ASR rules are one of the highest-value security controls available in a Microsoft Defender environment. They’re also one of the easiest ways to break legitimate applications if you deploy them without understanding what you’re doing. The staged approach – Audit,…
BitLocker policy in Intune looks straightforward until you try to deploy it silently and it doesn’t work. The settings that control silent encryption are non-obvious, the policy type matters more than most people realize, and hybrid joined devices behave differently…
The architecture article explained why modular baselines are the right approach. This one covers how to actually deploy OIB – what you need before you start, how the import works, what to watch for, and how to roll it out…
Before Autopilot can provision a device, that device needs to be registered. Registration ties a specific piece of hardware to your tenant. Without it, the device powers on and goes through a standard Windows setup – Autopilot never triggers. There…
The Enrollment Status Page is the most visible part of the Autopilot experience and the most common source of Autopilot failures. Getting it right matters more than almost any other provisioning decision. The ESP holds the device at the setup…
The Autopilot profile is the first decision point in the provisioning flow. It determines the deployment mode, the out-of-box experience, and how much control the user has during setup. Most environments need one profile. Some need two. Almost nobody needs…
Mobile enrollment is where Intune’s flexibility becomes its complexity. Windows and Mac enrollment paths are relatively constrained. Mobile is not. iOS and Android each have multiple enrollment modes, each with different management capabilities, different user experiences, and different implications for…
Enrollment restrictions are the first line of control over what gets into your Intune environment. Most deployments leave them at default. That’s a mistake. The default enrollment restriction allows any device on any platform to enroll. That’s fine for a…
