Category Intune

CIS Level 1 and Level 2 are profiles, not difficulty tiers. A practitioner's view of what the distinction means, what it takes to operationalize either in Intune, and how the available options - Microsoft baselines, build-your-own, and OpenIntuneBaseline - actually compare.

Deploying Microsoft 365 Apps through Intune is straightforward. The channel decision is not. It determines how often your users get new features, how long security updates are supported, and how much testing overhead your team carries. Get it right once…

The full Win32 lifecycle on one sheet: packaging, install context, detection, requirements, dependencies and supersedence, and assignment, with the traps named.

Compliance policies are the bridge between Intune configuration and Conditional Access enforcement. Before you build individual policies, two tenant-wide settings need to be set correctly – and most environments have them wrong by default. Tenant-wide compliance settings first In Intune,…

The architecture article made the case for Autopatch as the default update approach when licensing allows. This one covers what it actually takes to get it running – the prerequisites that matter, how Autopatch groups work, and where manual update…

ASR rules are one of the highest-value security controls available in a Microsoft Defender environment. They’re also one of the easiest ways to break legitimate applications if you deploy them without understanding what you’re doing. The staged approach – Audit,…

BitLocker policy in Intune looks straightforward until you try to deploy it silently and it doesn’t work. The settings that control silent encryption are non-obvious, the policy type matters more than most people realize, and hybrid joined devices behave differently…

The architecture article explained why modular baselines are the right approach. This one covers how to actually deploy OIB – what you need before you start, how the import works, what to watch for, and how to roll it out…