Section
Casework
Casework holds the one-off pieces. Each article here answers a single question that came out of real work and stands entirely on its own: no reading order, no prerequisites, nothing to finish. That is what separates this section from Guides, where a series is built to be read end to end and tells you where you are in it. The subjects range as widely as the work does. If a problem was worth solving once and worth writing down properly, it lands here.
Every article, newest first
The Management Plane Is a Code Execution Path
Intune is a remote code execution service with a settings user interface in front of it. Whoever can create an assignment can run code as SYSTEM on every device in scope, and most tenants govern that permission like a helpdesk task.
August 10, 2026
The Device Already Told You: Build Sheet
Build the diagnostic kit: know which of the two check-ins you are waiting on, force the right one, read the one log that owns the failure, and collect a remote bundle only when the log does not settle it.
August 10, 2026
The Device Already Told You
The Intune admin center reports state, not cause. The reason a policy or an app did not land is already written down on the device, and knowing which check-in you are actually waiting for is most of the job.
August 10, 2026
The Graph Client Nobody Owns: Build Sheet
Register a Graph PowerShell client you own, gate it behind an assignment requirement, consent it at the audience you chose, and validate it end to end.
August 9, 2026
The Graph Client Nobody Owns
Most tenants administer their directory through a Microsoft-owned client nobody in the organisation owns, with a tenant-wide consent grant that has no holder. Here is why the client matters more than the scopes.
August 9, 2026
Stop Building Every Laptop by Hand: What Modern Windows Deployment Looks Like
The unbox-and-install checklist has been optional for years. Here is what Windows deployment looks like when Autopilot, Intune, and Entra do the repetitive work, and what has to be true in your tenant before it feels effortless.
July 27, 2026
Why Old WSUS Settings Can Block Windows 11 Upgrades in Intune
The device is compliant, the ring is green, and Windows 11 never arrives. Why tattooed WSUS policy still blocks feature updates, how to find it, and the remediation pair that clears it fleet-wide.
July 14, 2026
Migrating to Intune from Another MDM: Workspace ONE, Meraki, and the Apple Migration Problem
The most common reason organizations end up in an MDM migration isn't dissatisfaction with their current platform - it's the realization that they already…
April 15, 2026
Wipe, Retire, Delete, Fresh Start, Autopilot Reset: Which One Do You Actually Want
Intune gives you five different ways to remove or reset a device, and the names don't make the behavior obvious. Choosing the wrong one…
April 15, 2026
Disable BitLocker on Existing Devices with Intune
There is no decrypt button in Intune. The order of operations that actually decrypts a device, when to suspend instead, and why Windows 11 24H2 made this workflow common.
January 28, 2026
Deploying Visio and Project with Intune
Adding Visio or Project to devices that already run Microsoft 365 Apps: what the licenses actually include in 2026, the one-deployment limit, and the channel trap that fails silently.
January 23, 2026
