Most of a Conditional Access deployment is about people who already exist. The harder problem, and the one baselines almost never address, is the person who does not exist yet. A new hire on their first morning has no registered…
At the end of the build you have a tenant full of Conditional Access policies that do nothing. Every one of them is in report-only. That is the correct state, and it is also the most dangerous moment in the…
The design paper made the case. This is the part where you actually stand up the framework in a tenant, and it is where the gap between “imported the policies” and “operates the policies” stops being rhetorical. I built the…
Earlier this year I sat down and took apart the published Conditional Access baselines the way I’d audit a customer tenant. Every policy definition at the JSON level, every group reference resolved, every grant control checked against what it actually…
Winget in Intune works, and for a lot of environments it is genuinely fine. I want to say that plainly up front, because the rest of this article is going to be honest about where it sits, and honesty can…
CIS Level 1 and Level 2 are profiles, not difficulty tiers. A practitioner's view of what the distinction means, what it takes to operationalize either in Intune, and how the available options - Microsoft baselines, build-your-own, and OpenIntuneBaseline - actually compare.
Deploying Microsoft 365 Apps through Intune is straightforward. The channel decision is not. It determines how often your users get new features, how long security updates are supported, and how much testing overhead your team carries. Get it right once…
The full Win32 lifecycle on one sheet: packaging, install context, detection, requirements, dependencies and supersedence, and assignment, with the traps named.
