The device is compliant, the ring is green, and Windows 11 never arrives. Why tattooed WSUS policy still blocks feature updates, how to find it, and the remediation pair that clears it fleet-wide.
Intune fails quietly: a lapsed certificate, a stale connector, an untested break-glass account. The quarterly review I run, ordered so the highest-consequence items come first.
There is no single Intune alert engine. The three mechanisms that actually exist, how to wire real alerts in Azure Monitor, and the signals worth watching versus the noise worth ignoring.
Supervision is the flag that separates a corporate iPhone from a personal one. What it unlocks, what it pointedly does not, and why the only clean path to it is Automated Device Enrollment.
Standing up an Android dedicated fleet: the enrollment profile and its token, the three lockdown modes, the Managed Home Screen, and why AOSP and userless devices change what compliance can see.
The build behind app protection: the three setting groups, the data protection level I start from, and the assignment filter that decides whether the policy actually reaches the devices you meant.
From a tenant with nothing to an enforced compliant network Conditional Access policy, with the client packaged, the co-requisite device settings deployed, every exclusion argued for, and an end-to-end test that proves the block instead of assuming it.
Two instruments make a Conditional Access change safe: What If for a single hypothetical, and report-only for the whole population. How to use both, read the four report-only results, and promote a policy to enforcement without locking anyone out.
