Earlier this year I sat down and took apart the published Conditional Access baselines the way I’d audit a customer tenant. Every policy definition at the JSON level, every group reference resolved, every grant control checked against what it actually…
Winget in Intune works, and for a lot of environments it is genuinely fine. I want to say that plainly up front, because the rest of this article is going to be honest about where it sits, and honesty can…
CIS Level 1 and Level 2 are profiles, not difficulty tiers. A practitioner's view of what the distinction means, what it takes to operationalize either in Intune, and how the available options - Microsoft baselines, build-your-own, and OpenIntuneBaseline - actually compare.
Deploying Microsoft 365 Apps through Intune is straightforward. The channel decision is not. It determines how often your users get new features, how long security updates are supported, and how much testing overhead your team carries. Get it right once…
The full Win32 lifecycle on one sheet: packaging, install context, detection, requirements, dependencies and supersedence, and assignment, with the traps named.
Compliance policies are the bridge between Intune configuration and Conditional Access enforcement. Before you build individual policies, two tenant-wide settings need to be set correctly – and most environments have them wrong by default. Tenant-wide compliance settings first In Intune,…
The architecture article made the case for Autopatch as the default update approach when licensing allows. This one covers what it actually takes to get it running – the prerequisites that matter, how Autopatch groups work, and where manual update…
ASR rules are one of the highest-value security controls available in a Microsoft Defender environment. They’re also one of the easiest ways to break legitimate applications if you deploy them without understanding what you’re doing. The staged approach – Audit,…
