Designing, deploying, and operating Microsoft Intune. Home of the Intune Deployment Guide.
Most Mac fleets arriving at Intune aren’t starting from zero. They’re either managed by Jamf and the organization is consolidating to Intune, or they’re unmanaged – devices that have accumulated years of local configuration, user-installed software, and no management footprint…
Intune gives you five different ways to remove or reset a device, and the names don’t make the behavior obvious. Choosing the wrong one is usually recoverable – but occasionally it isn’t, and understanding what each action actually does before…
This guide documents the architecture, configuration, and deployment of Privileged Identity Management across a Microsoft Entra tenant. It is an internal methodology document covering break glass account setup, authentication context design, Conditional Access policy construction, PIM group structure, and role…
Most Intune content starts in the wrong place. It starts with clicks – screenshots of the portal, numbered steps, “navigate to Devices and select New Profile.” It assumes the reader’s problem is not knowing where to find things. That’s rarely…
There is no decrypt button in Intune. The order of operations that actually decrypts a device, when to suspend instead, and why Windows 11 24H2 made this workflow common.
Adding Visio or Project to devices that already run Microsoft 365 Apps: what the licenses actually include in 2026, the one-deployment limit, and the channel trap that fails silently.
