Designing, deploying, and operating Microsoft Intune. Home of the Intune Deployment Guide.
The first deployment as a set of decisions rather than clicks: the identity the tool runs as, what to leave unselected, the Store setting that reaches into EPM, and why a freshly deployed baseline is correct but assigned to nothing.
A purpose-built way to ship OpenIntuneBaseline into a tenant. What makes its browser-only, no-backend architecture trustworthy, why it deploys unassigned by design, and when it beats the IntuneManagement module.
The join mechanics from SCP discovery to PRT, what Entra Connect must be doing, whether you need Seamless SSO or GPOs, the targeted rollout registry method, and how to read dsregcmd on a device that will not join.
Intune fails quietly: a lapsed certificate, a stale connector, an untested break-glass account. The quarterly review I run, ordered so the highest-consequence items come first.
There is no single Intune alert engine. The three mechanisms that actually exist, how to wire real alerts in Azure Monitor, and the signals worth watching versus the noise worth ignoring.
Supervision is the flag that separates a corporate iPhone from a personal one. What it unlocks, what it pointedly does not, and why the only clean path to it is Automated Device Enrollment.
Standing up an Android dedicated fleet: the enrollment profile and its token, the three lockdown modes, the Managed Home Screen, and why AOSP and userless devices change what compliance can see.
The build behind app protection: the three setting groups, the data protection level I start from, and the assignment filter that decides whether the policy actually reaches the devices you meant.
