Report on Everything an Entra ID Group Touches with Microsoft Graph
Before you rename, rescope or delete a group, find out what it's wired to. Members, owners, licenses, apps and Intune policies, in one report.
2 min readRead note
Across the notebook
Intune.
Entries sharing this tag, wherever they're filed.
Trigger Intune Automatic Enrollment on a Windows Device with PowerShell
For the Entra-joined PC that never showed up in Intune. Check it's ready, kick off enrollment, and see why it failed if it does.
Thread: Getting devices into Intune ↗2 min readRead note
Microsoft Intune, Before You Enroll Anything: What It Does and What to Plan
A plain-spoken tour of what Intune actually handles, where it stops, and the identity decisions you want settled before the first device shows up.
Thread: Getting devices into Intune ↗4 min readRead note
How to Enroll a Windows Device in Intune by Hand
The Settings app route into Intune, which of its three options to pick, and why the device might show up as personal when you didn't want it to.
Thread: Getting devices into Intune ↗4 min readRead note
Checklist: Moving a Device from MDE Security Settings Management to Intune
A practical checklist for taking a device that gets its security policy through Defender for Endpoint and enrolling it in Intune without leaving a gap.
4 min readRead note
Patching Without Fear: Rings, Risk and a Way Back
How I think about patch risk now. Sort updates by blast radius, roll them out in rings, decide what "bad" looks like up front, and know your way back before you need it.
4 min readRead note
WSUS, WUfB or Windows Update? Check (and Reset) Where a PC Gets Its Updates
One script that reads the WSUS, scan-source and Windows Update for Business settings on a device and tells you where it's really getting updates from, with a safe reset for leftovers.
2 min readRead note
Pushing Configuration Profiles to Devices That Are Already Deployed
How to build a configuration profile in Intune, roll it out to machines that are already in people's hands, and confirm it actually landed.
4 min readRead note
Defender for Endpoint vs. Intune: Who Actually Manages the Device?
Onboarding to Defender for Endpoint and enrolling in Intune are two different things, and you almost never have to offboard one to get the other.
3 min readRead note
What Get-WindowsAutopilotInfo Actually Does (and How to Use It Today)
The hardware hash script behind Windows Autopilot, explained. Upload straight to Intune with -Online, or export a CSV when the device can't reach the tenant.
Thread: Getting devices into Intune ↗4 min readRead note