Designing, deploying, and operating Microsoft Intune. Home of the Intune Deployment Guide.
Carrying a live OIB deployment from one version to the next without drifting away from upstream or from your own adjustments. The compare, the by-name matching, the fork rule, and working an update as a set of decisions.
The first deployment as a set of decisions rather than clicks: the identity the tool runs as, what to leave unselected, the Store setting that reaches into EPM, and why a freshly deployed baseline is correct but assigned to nothing.
A purpose-built way to ship OpenIntuneBaseline into a tenant. What makes its browser-only, no-backend architecture trustworthy, why it deploys unassigned by design, and when it beats the IntuneManagement module.
The join mechanics from SCP discovery to PRT, what Entra Connect must be doing, whether you need Seamless SSO or GPOs, the targeted rollout registry method, and how to read dsregcmd on a device that will not join.
The device is compliant, the ring is green, and Windows 11 never arrives. Why tattooed WSUS policy still blocks feature updates, how to find it, and the remediation pair that clears it fleet-wide.
Intune fails quietly: a lapsed certificate, a stale connector, an untested break-glass account. The quarterly review I run, ordered so the highest-consequence items come first.
There is no single Intune alert engine. The three mechanisms that actually exist, how to wire real alerts in Azure Monitor, and the signals worth watching versus the noise worth ignoring.
Supervision is the flag that separates a corporate iPhone from a personal one. What it unlocks, what it pointedly does not, and why the only clean path to it is Automated Device Enrollment.
