Nice to have additional Windows login MFA options beyond WHfB.

[Web sign-in] Web sign-in now works on Microsoft Entra hybrid joined devices. Before this update, it was only available on Microsoft Entra joined devices. You can sign in to Windows at the lock screen with a passwordless credential: a FIDO2 security key, a passkey on your phone, or a Temporary Access Pass (TAP). You don't need a password. Once you're signed in, Windows gets a Kerberos ticket, so on-premises file shares and internal sites keep working.

https://www.neowin.net/news/new-windows-11-build-improves-gaming-task-view-and-revamps-the-run-dialog/

We're deploying Yealink MP56 E2 and MP58 E2 Teams phones (Android AOSP 15) and running into an issue with Conditional Access during initial sign-in/enrollment.

Our phones use regular employee M365 accounts, not resource accounts. Some employees don't have MFA configured, which is fine for their normal workstation access, but we have a Conditional Access policy that requires MFA AND a compliant device for anyone accessing M365 from Android/iOS.

Obviously, the Yealink phones get caught by this policy since they're Android devices.

What I'm trying to accomplish:

• Allow employees to sign into new Yealink Teams phones using their M365 username/password without MFA.
• Keep MFA required for personal iOS/Android devices, even for those same employees.
• Keep the Yealink phones enrolled and compliant through Intune AOSP.
• Automatically identify and exempt Yealink phones without manually maintaining device IDs or excluding users every time we deploy one.
• Keep device code flow blocked. We're using direct sign-in on the phones.

The issue:

Once a phone is enrolled, this seems straightforward. Intune/Entra reports the manufacturer as Yealink, model as MP56 E2 or MP58 E2, and enrollment profile as AOSP - Teams Devices.

However, during the very first sign-in on a factory-new phone, none of those device attributes are available yet.

I tested this with a completely new M365 account that had never registered MFA. After entering the username/password on the phone, I immediately got the "Let's keep your account secure" prompt requiring Microsoft Authenticator.

The Entra sign-in logs show:

• Application: Microsoft Teams
• Resource: Device Management Service
• Authentication requirement: Multifactor authentication
• Error: 50079 (MFA registration required)
• Related event: 50097 (device authentication required)
• Device ID: Blank
• Device name: Blank
• Managed: No
• Compliant: No
• OS: Android

The sign-in user agent does identify the hardware:

Dalvik/2.1.0 (Linux; U; Android 15; MP56 E2 Build/AP4A.241205.013.C1) ;MP56 E2

But as far as I can tell, Conditional Access can't filter directly on the user agent.

Microsoft's Teams Android Conditional Access documentation mentions using device.displayName because manufacturer information is supposedly available early in the sign-in process, before Intune enrollment finishes.

However, the device display name is completely blank in my initial sign-in logs. After enrollment, the display name changes to something like Username_AndroidAOSP_Date, which doesn't contain Yealink either.

My questions:

1. How are you excluding Teams Android phones from MFA policies during their very first sign-in, before they have an Entra device identity?
2. Has anyone successfully used device.displayName filtering for initial enrollment on Yealink MP56 E2/MP58 E2 phones? If so, what exact filter are you using, and how did you verify the value?
3. Are you temporarily excluding users/groups from your mobile-device CA policies during enrollment, then removing the exclusions afterward?
4. Is there a better supported way to handle this without disabling MFA for personal mobile devices or enabling device code flow?

I understand I could temporarily exclude the user from the Android policy, enroll the phone, and then use manufacturer/model filters afterward. But I'd really prefer something scalable that doesn't require manual exceptions for every deployment.

Has anyone actually implemented this successfully with Yealink Teams phones and Intune AOSP? What does your Conditional Access configuration look like?

Curious to see if anyone is using the Edge management service to block other browsers. Initial deployment is being met with some intense pushback. Unreasonable as I've asked what Chrome can do that Edge can't and I get no logical responses.

We have on-prem AD synced to Entra ID, Microsoft 365 passkeys enabled, and Mac users accessing VPN and Windows SMB shares with AD credentials.
We’re planning to enroll Macs in Intune with Platform SSO and standard local accounts. The goal is fewer passwords and simple recovery.
For those with a similar setup:
Did you choose Password sync or Secure Enclave?
How do you handle VPN and SMB authentication?
How do users reset forgotten passwords, especially when locked out of the Mac?

I’m advovatimg or move file server to sharpoint still havmt. Convinced My Boss due to cost . I’m talking about 90Tera of data
I also old My network Guy to ensure vpn authenticates From extra instead of local AD. Pending more convincing.

Would appreciate hearing what works in practice.

Over the past few days, we identified an issue where some devices managed through Microsoft Intune and Windows Autopatch were unexpectedly upgraded to Windows 11 26H2, even though our Feature Update policies were explicitly configured to target Windows 11 25H2.

We opened a support case with Microsoft, and their official response confirmed that the issue originated from a service-side problem within Microsoft's infrastructure.

According to Microsoft:

• The issue has been identified and mitigated.
• The unexpected Windows 11 26H2 rollout has been stopped.
• Devices that had not yet restarted were removed from the 26H2 upgrade path.
• Microsoft has requested confirmation of the current upgrade status of affected devices.

Here's the important part:

The issue was not caused by an incorrect Intune or Autopatch configuration, but rather by a problem on Microsoft's service side.

However, Microsoft has not confirmed that devices which have already completed the upgrade to Windows 11 26H2 will automatically be rolled back to 25H2.

This incident highlights an important reality of cloud-managed update environments:

Even when Feature Update policies are correctly configured, the actual outcome may not always match the intended deployment configuration.

For organizations managing large Windows environments, continuously monitoring Feature Update policies, actual OS build versions, and unexpected upgrade activity is essential.

Has anyone else experienced unexpected Windows 11 26H2 upgrades in their Intune or Windows Autopatch environment?

I'm testing out administrator protection on my pc and I kinda like it, but I found a caveat:

I'm trying to deploy a shortcut in the start menu to the Papercut Hive client since it doesn't show when you look for it and you can bet your ass people will accidentally turn it off at startup or some shit. So I test it locally, works fine.

When I deploy it in Intune in User context, it uses the account that is used for Admin Protection (local account starting with ADMIN_userName). Not sure why since the script is set to not require admin:

    RequireAdmin                = $false

I'm not sure how to continue, to be honest. Anybody know how I can target my actual user appdata? Really don't want to do some heavy math just to find the fucking user.

Per MS doc: psso policy must be assigned to static user group and doesn’t work with device or dynamic groups.

Q: will it work with “All users”?

It’s mentioned that we should assign the psso, company portal and enrollment policy to this SAME user group as well otherwise “psso during enrollment fails”

So that makes me think “ all users” wouldn’t work.

Hi everyone,

We recently discovered an issue with our Intune Autopilot deployment.

We have Microsoft 365 E3 licenses, so our devices should be running Microsoft 365 Apps for Enterprise (O365ProPlusRetail).

Unfortunately, someone mistakenly configured our Autopilot deployment to install Microsoft 365 Apps for Business (O365BusinessRetail) instead.

As a result, we now have two scenarios across our environment:

• Devices with only O365BusinessRetail installed.
• Devices showing both O365BusinessRetail and O365ProPlusRetail in their Click-to-Run configuration.

I'm looking for advice and real-world experience on the best way to fix this.

1. Migrating from Business to Enterprise

Is there a supported way to switch from O365BusinessRetail to O365ProPlusRetail without completely uninstalling and reinstalling Office?

Could we simply deploy a new ODT configuration XML through Intune to change the product ID while keeping the existing installation?

Ideally, we'd like to make this change as silently and transparently as possible, without disrupting users or forcing them to close their Office applications.

2. Devices with both products installed

What's the safest way to remove O365BusinessRetail while keeping O365ProPlusRetail?

Has anyone successfully handled this using ODT or Intune Remediations?

3. Impact of running Business with E3 licenses

How problematic is it to have Microsoft 365 Apps for Business installed on devices where users have Microsoft 365 E3 licenses?

Apart from potentially missing Enterprise-specific features, are there any licensing, activation, security, or management implications?

Our main priority is to fix this across our existing devices with minimal user impact.

I'd really appreciate any recommendations, scripts, ODT XML examples, or lessons learned from anyone who has dealt with a similar situation.

Thanks!

Hey All,

We are currently having our IT techs use Intune Remote Help to assist users and to fix any issues on those workstations. I've noticed a couple of issues recently that I'm curious if anyone else is facing the same issues.

1. Connectivity issues with Attended Remote Help sessions. I've seen multiple reports, and witnessed a few of them myself, where the helper will start a session from the Intune Admin Center, the end user/sharer will click the Windows Notification, and start the session. However, both Remote Help clients will just sit there spinning for forever. At first, I was thinking it was a Hybrid Join issue, since that is how the vast majority of our devices are set up. But it also happens on our Entra Joined machines too.

2. Keyboard input on Unattended sessions sometimes does not type on remote workstation. On some remote machines, we've seen issues where trying to type on a remote workstation does not actually type anything on the remote machine. I think this is isolated to a couple applications, rather than a whole Remote Help service issue. At first, I was thinking if I turned off and on Advanced keyboard commands that it would start working, but it did not.

Also, I made sure that all clients for Remote Help, as well as the RD bootloader and RD infrastructure agents were on whatever the latest versions are (Thanks PatchMyPC, y'all are bros).

There also may be other weird issues that I'm not thinking of, but just curious if people are actually experiencing similar issues, or are actually happy with how the Remote Help features work as is.

I'm starting an effort to migrate local admin privileges to a managed tool. Since EPM is included, I'm obligated to try it out before saying CyberArk is the only way.

The environment is simple. You have you standard account and if you have local admin, you have an admin account.

So now that the audit policy has been running for a couple weeks, why do I have events like regular accounts running chrome.exe as an unmanaged elevation? Or cmd.exd having over 32k elevated events

And then I cant export the reports?

I feel like I have to be doing something wrong because this experience is just horrible.

My bios’s have a license key for pro education but I can’t see that as an edition for osd cloud. Anyone know a way of having it automatically use that key?

i was testing out Epm elevation rule for cmd, with filepath + certificate method, for few devices it worked, but few devices nothing, no report of policy processing, no reports of failure,sucess nothing, any idea? It's mostly like rule is not reaching devices. But default policy and other polices are working fine

I cross checked file path and certificate it's matching also.

Stop me if I'm reading this wrong, but it seems to me that in order to use any of the features in the new AutoPilot device association feature you would have to remove every single device from their box, power it on, and perform a registration and/or export of TPM data. That seems to defeat the whole point of AutoPilot, especially when you have hundreds of laptops to deploy.

Hi All,

We've recently moved to using Autopilot for all builds & are seeing some inconsistency with regional/language/keyboard settings.

I've had our service support team run through some builds specifically testing for following the same process & they are assuring me they are selecting the US, followed by Australia, which should give the intended result... However on 2 devices they tesed, one ended up correct & the other ended up giving them a En-GB keyboard layout (which throws out special character mapping on keyboard).

Is there a good guide out there for making sure we end up with correct settings for an Australian system? Would be good to make sure its correct during AUtopilot plus also enforcing it after the fact via Remediations.

Greetings Intune admins. I am setting up Autopilot and I was wondering if anyone has used the WriteToHkcuFromSystem.ps1 script with Autopilot with success.

I am still troubleshooting but it appears that it is failing.

SCCM has been my thing for years, this is new. Other apps install fine.

Thank you for your feedback.

Hey Reddit,

Several users have reported getting stuck in pending driver update loops, even after rebooting their PCs. I’m not sure how to fix this, since the usual solutions I’ve tried haven’t worked.

Background on our environment:

1. We have Autopatch set up and enabled, with recommended drivers approved automatically. This worked well until about a month ago. We’re not sure whether the drivers released through Intune are causing the issue.

2. I paused updates for HP drivers, which fixed the issue for those drivers, but the Intel drivers seem to cause the same problem, even after being paused.

3. I created a script to create a new SoftwareDistribution folder. It works, but I need a fix that doesn’t require deploying it to every user.

Has anyone else reported this in the community, or am I the only one? Should I turn off automatic approvals for recommended driver updates and approve them manually? I know drivers can be wonky, and a consultant recommended that we turn automatic approvals on.

Please let me know.

Cross-posting from the Defender subreddit as there’s a like-minded crowd here managing similar IT stacks.

This morning, a large number of our Intune-managed Windows 11 devices displayed a toast notification saying Defender signatures were out of date. However, the Defender portal shows those devices as up to date and healthy. We’re expecting some user concern given the conflicting information.

We had an issue in August, resolved in September, where Defender was incorrectly reported as disabled due to a Windows Security Center (WSC) signal issue. That also caused Intune compliance issues, as the check for whether Defender was active relied on those signals.This feels potentially similar.

Anyone else seeing these notifications today, or noticing any corresponding changes in device compliance?

I had a users laptop's SSD die yesterday and am trying to plan out the repair. Since the SSD died, I could not send a wipe command. What is the best way to replace the failed hardware and re-join the PC?

Since the SSD is the only thing that died (and replaced) the hardware hash should still be OK....correct? If that is the case, what is the recommended method to re-join? Just manually delete the device object in Intune and then replace the SSD and re-join via Autopilot? I think that this should work, but it almost seems too easy. Am I correct with the methodology? If not, please help bring me up to speed on best practices for handling this.

TIA

Regarding : https://techcommunity.microsoft.com/blog/microsoft-entra-blog/platform-sso-during-automated-device-enrollment-is-now-generally-available-for-m/4436813

I've introduced the setting RegistrationDuringSetup (Enabled). It's in a configuration profile that a mac is getting when enrolling thru Enrollment program tokens.

It doesn't work... I still have to use the Company Portal prompt to complete the Platform SSO.

I didn't find any other documentation beside that article.

Have you tried that setting ?

Who is using EPM in large enterprise environments? How was your experience through deployment? Any gotchas or roadblocks? Anyone tried to use it and found it so lacking that you didn’t go to prod?