Fix the iTunes Sign-In Prompt on Intune-Managed iPhones: iOS Store App vs VPP Device Licensing

Posted on May 11, 2026 by Thomas.Marcussen

You manage a fleet of corporate iPhones through Microsoft Intune. Enrollment is automated through Apple Business Manager (ABM), apps deploy silently through the Volume Purchase Program (VPP), and users never see an App Store login. Then one day, your service desk starts getting tickets:

“Sign in to iTunes Store. Sign in to allow Contoso A/S to manage and install apps.”

A handful of devices show the prompt at first. A few days later, dozens. Users tap Cancel, the dialog disappears, and a few hours later it reappears. Some users sign in with personal Apple IDs to make it go away, which is exactly what you do not want on a corporate device.

This is one of those issues that looks like an Apple ID, ABM, or enrollment problem – but almost never is. In every case I have worked, the root cause was the same: somewhere in the tenant, an app was added as an iOS Store App when it should have been added as an iOS Volume Purchase Program app. This post walks through why those two app types behave so differently, how to confirm which one is causing the prompt, and how to fix the issue across a large device estate without disrupting users.

Why iOS Devices Ask for an Apple ID in the First Place

Intune offers several iOS app types in the admin center. Two of them install the same app from the same App Store listing, but they have completely different licensing and installation behavior:

iOS Store App – A direct link to a public App Store listing. The app installs into the user’s iCloud account. The device must be signed in to the App Store with a personal or managed Apple ID for the install to complete. There is no concept of device-based licensing.
iOS Volume Purchase Program app (VPP) – An app license that your organization owns through Apple Business Manager. With Device licensing, the license is assigned to the device itself – no Apple ID is required on the device for the install. The app simply appears.

The two app types look almost identical in the admin center. Both can point to the same App Store URL. Both can be assigned as Required, Available, or Uninstall. The difference is invisible until a device tries to install the app and discovers it has no Apple ID signed in.

When an iOS Store App is assigned as Required to a supervised device with no Apple ID, iOS does what it is told – it prompts the user to sign in so the install can proceed. That is the prompt your users are seeing.

Why You May Not Have Seen This Before

A fresh ABM enrollment with VPP apps assigned through Device licensing never triggers an Apple ID prompt because no app on the device needs one. The issue surfaces when somebody adds the same app a second time – as an iOS Store App – usually because they pasted the App Store URL into the wrong “Add app” wizard. The VPP version may still be present, but the iOS Store App duplicate is now competing for the same slot on the device, and only one of them can win.

How to Confirm This Is Your Issue

Before you start changing assignments, confirm the diagnosis. Three quick checks usually settle it.

Check 1: List All iOS Apps with Required Assignments

In the Intune admin center, go to Apps > iOS/iPadOS and filter the list. Look at every app where the App type column shows iOS store app. For each one, open the app and check Properties > Assignments.

Any iOS Store App with a Required assignment is a candidate for the prompt. iOS Store Apps assigned only as Available or Uninstall do not trigger the prompt – they sit quietly in the company portal or only act when the user actively removes the app.

Check 2: Cross-Reference with VPP

For each suspect iOS Store App, search for a VPP version of the same app. The naming will be similar but not identical – the VPP version typically shows the publisher and a different icon variant. If both versions exist, the iOS Store App is almost certainly redundant.

Check 3: Look at the Audit Log

Intune’s audit log will tell you exactly when each app was added and by which admin account. Go to Tenant administration > Audit logs and filter on the Mobile App category. Search for the app name and check the Create entries. In one recent case, an admin had bulk-added a dozen iOS Store App duplicates within a 20-minute window – clearly someone working through a list using the wrong wizard.

If checks 1 and 2 confirm the duplication and check 3 confirms when it happened, you have your root cause.

Why You Cannot Just Delete the iOS Store App

The natural reaction is to delete the iOS Store App duplicate and be done with it. Resist that urge until you have a rollout plan, because three things can go wrong:

Users still see the prompt until iOS finishes its install queue. iOS does not automatically discard a pending install when its source is removed. The user has to Cancel the prompt at least once – sometimes more than once – before the MDM channel processes the change.
Required and available install intent on a managed device is sticky. If the VPP version is not already assigned and licensed at the device level, removing the iOS Store App leaves users with no app at all.
Filters and groups can overlap in non-obvious ways. If the iOS Store App is assigned to a broad group and the VPP version is assigned to a different broad group, deleting one may pull the app from devices that should still have it.

The safe sequence is: assign the VPP version with Device licensing first, validate on a single device, then remove the iOS Store App.

The Pilot Approach: Validate on One Device Using Assignment Filters

Before you touch a production assignment, prove the fix on one device. Intune’s Assignment Filters make this clean.

Step 1: Create a Single-Device Filter

In the Intune admin center, go to Tenant administration > Filters > Create.

Platform: iOS/iPadOS
Name: Something obvious like Pilot-iPhone-XYZ123-only
Rule syntax:

(device.deviceName -eq "XYZ123")

Replace XYZ123 with the actual device name from Devices > iOS/iPadOS devices. Use Edit in advanced mode if you prefer to write the rule directly.

Step 2: Exclude the Pilot Device from the iOS Store App Assignment

Open the problematic iOS Store App in Intune. Go to Properties > Assignments > Edit. On the existing Required assignment, click Filter and set:

Filter mode: Exclude
Filter: Pilot-iPhone-XYZ123-only

This tells Intune to apply the iOS Store App’s Required assignment to everyone except the pilot device. The pilot device is now isolated from the prompt – existing prompts may still need to be dismissed once, but no new ones will queue.

Step 3: Assign the VPP Version with Device Licensing to the Pilot Device

Open the VPP version of the same app. If it does not yet have a Required assignment to the same target group, create one:

Assignment type: Required
Group: The same group the iOS Store App was assigned to
License type: Device
Filter: Pilot-iPhone-XYZ123-only
Filter mode: Include

This is the inverse of Step 2 – the VPP assignment now applies only to the pilot device. The rest of your estate still gets the (about to be removed) iOS Store App version; the pilot device gets the VPP version with a device-bound license.

Step 4: Have the Pilot User Dismiss the Prompt and Sync

Walk the pilot user through these exact steps:

When the iTunes sign-in prompt appears, tap Cancel.
Open Settings > General > VPN & Device Management > the MDM profile.
Tap Sync to force a check-in.

Within a minute or two, the VPP version of the app installs silently. No Apple ID prompt. The app shows the small organisation marker indicating it was installed by MDM.

If the install fails or the prompt comes back, stop and investigate before going further – usually the cause is a missing VPP license assignment or an expired VPP token (more on tokens below).

Rolling Out the Fix to the Rest of the Estate

Once the pilot is green, the rollout is mechanical. For each affected app:

On the VPP version, remove the Pilot-XYZ123-only filter so the Required + Device-licensing assignment applies to the full target group.
On the iOS Store App version, remove the existing Required assignment entirely. Do this before deleting the app to avoid an Intune sync that might re-prompt users.
Delete the iOS Store App entirely once no devices reference it. This also makes sure nobody re-uses it accidentally later.

If you have several apps to fix, work through them one at a time. iOS handles MDM commands serially, so a batch change can produce more prompts than you would expect.

What Users Should Expect

Communicate clearly to end users before you flip the assignment. A short email along these lines works well:

Over the next 24 hours, you may see a sign-in prompt on your work iPhone asking you to log in to iTunes or the App Store. Please tap Cancel. Do not enter any Apple ID. The app you are missing will install automatically within a few minutes after you cancel the prompt.

The behaviour is non-obvious: iOS only processes the next MDM command after the current prompt is dismissed. Until the user taps Cancel, the device is effectively stuck waiting for the user.

Cleanup: Filters, Duplicates, and Audit Trail

After the rollout is complete, do not leave the scaffolding in place:

Delete the pilot assignment filter (Pilot-iPhone-XYZ123-only) so it does not get reused accidentally.
Confirm both iOS Store App duplicates are deleted – keeping them around “just in case” invites the same mistake again next quarter.
Document what happened in your change log so future admins know the difference between iOS Store App and VPP and which to use.
Run a tenant-wide review of remaining iOS Store Apps. Any iOS Store App with only Uninstall or Available (without enrollment) assignments is safe. Any iOS Store App with a Required assignment to a device group should be evaluated.

A Quick Reference: iOS Store App vs VPP at a Glance

Aspect	iOS Store App	iOS VPP App (Device licensing)
Source	Public App Store URL	Apple Business Manager (purchased)
Requires Apple ID on device	Yes	No
Required-install on supervised devices	Triggers iTunes sign-in prompt	Installs silently
License consumed	None tracked by MDM	One per device
Revoke license	Not possible	Yes, from Intune
Update behavior	Same as App Store	Same as App Store
Cost	Free apps only (in practice)	Free and paid apps
Recommended for managed iOS	No	Yes

The short version: on a corporate-owned iOS device managed through Apple Business Manager, VPP with Device licensing is the only app type that should appear as Required for first-party and approved third-party apps.

How to Prevent This from Happening Again

The root cause is almost always procedural – an admin selected the wrong app type from the Intune wizard. A few controls reduce the chance of recurrence:

Document the standard. Add a one-line rule to your Intune operations doc: “All Required iOS apps must be added as iOS Volume Purchase Program apps. iOS Store Apps may only be used for Available or Uninstall assignments.”
Restrict app creation with RBAC. Use scope tags and Intune’s role-based access control to limit app creation to a small group of admins who know the difference. The principle of least privilege applies to MDM tenants too.
Use audit log alerts. Microsoft Graph + a small Logic App can email you whenever a new iOS Store App is created. Quick to set up, quick to react.
Check the VPP token expiry. A frequent secondary cause is an expired VPP token. When a token expires, Intune cannot create or renew Device licenses, and admins reach for “iOS Store App” as a workaround that turns into a permanent footgun. Renew the token annually and set a calendar reminder a month in advance.

Healthy VPP Token Practices

A VPP token has a 12-month validity. When it is close to expiry, Intune shows a banner in the Tenant administration > Connectors and tokens > Apple VPP Tokens view. After expiry:

Existing licensed apps continue to function.
New licenses cannot be assigned.
Token renewal requires a new .vpptoken file from Apple Business Manager.

If your token has just been renewed and apps are stuck in Failed state, revoke and re-assign licenses one app at a time. Bulk re-assignment occasionally fails for individual apps, and the only way to clear the failed state is a manual revoke + reassign cycle.

Troubleshooting: When the Prompt Will Not Go Away

If you have applied the fix and a specific device is still prompting, work through these in order:

Has the user tapped Cancel at least once? iOS sometimes queues multiple install commands – the user may need to dismiss two or three prompts before the queue drains.
Force a sync. From the device: Settings > General > VPN & Device Management > MDM profile > Sync. From Intune: Devices > select device > Sync.
Confirm the device is licensed for the VPP version. Open the VPP app in Intune > Device install status. The device should be listed with Installed or Pending. If it is Not applicable, the assignment is not reaching the device – check group membership and filters.
Check the VPP token health. Tenant administration > Connectors and tokens > Apple VPP Tokens. If the token shows any warning, address that first.
Reboot the device. Last resort, but occasionally clears a stuck MDM channel.

If you have exhausted these, look at the device’s Managed Apps report. An app that should be VPP-licensed but appears under iOS Store App lineage indicates the old assignment is still active somewhere – usually a forgotten filter or a duplicate group assignment.

FAQ

Will users lose any data when I switch from iOS Store App to VPP?

No. The App Store install and the VPP install are the same app binary from the same listing. Local data and settings are preserved across the transition because iOS treats them as the same bundle ID.

Do I need a managed Apple ID for VPP with Device licensing?

No. Device licensing is the entire point – the license is bound to the device hardware identity, not to any Apple ID. The device can have no Apple ID signed in at all, and VPP apps will still install.

Can I keep using iOS Store Apps for some apps?

For apps you want to make optionally available to users through the Company Portal, yes – assign them as Available. For Required deployment to corporate-owned devices, no. Switch them to VPP.

What about iPadOS devices?

The same rules apply. iPadOS uses the same MDM commands and the same VPP licensing model as iOS. If you have iPads in the same affected group, they will exhibit the same prompt behaviour and be fixed by the same approach.

It can be. A token renewal sometimes leaves individual app licenses in a Failed state until they are re-assigned. This is a separate issue from the iOS Store App vs VPP problem, but you may encounter both at once if the same admin tried to “work around” the failed VPP state by adding iOS Store App versions. Treat the VPP licensing failures as a separate workstream once the prompt is gone.

Summary

If iOS devices managed by Microsoft Intune are showing an iTunes or App Store sign-in prompt, do not start with Apple ID configuration, ABM enrollment, or DEP profiles. Start with your app inventory. Look for iOS Store Apps with Required assignments that overlap with VPP versions of the same app. Fix one device first using assignment filters, then roll the change out to the rest of the estate, and finish by deleting the iOS Store App duplicates entirely.

The technical fix is simple. The harder part is preventing the next admin from making the same selection in the same wizard – so document the standard, restrict who can add apps, and keep your VPP token healthy. Your users will never see another iTunes prompt, and your service desk will get its mornings back.

References

How to Remove Classic Microsoft Teams with PowerShell and Intune Proactive Remediations

Posted on April 18, 2026 by Thomas.Marcussen

Microsoft officially retired Classic Teams on July 1, 2025, and the client is no longer functional. Despite this, many organizations still have remnants of Classic Teams scattered across their Windows device estate. This is not just a cosmetic issue. Classic Teams no longer receives security updates, the per-user installation model wastes disk space, leftover shortcuts confuse users, and end-of-life software can put you out of compliance. If you have been putting off the cleanup, now is the time to remove Classic Teams from your environment.

In this post I am sharing three PowerShell scripts that handle different scenarios, from a one-off standalone removal to a fully automated Intune Proactive Remediations approach.

Why You Need to Remove Classic Teams

Even though Classic Teams stopped working months ago, there are real reasons to actively remove it rather than just leaving it behind:

Security – Classic Teams no longer receives security updates, leaving a potential attack surface on your endpoints
Disk space – The per-user installation model means Classic Teams can consume hundreds of megabytes per user profile on a device
User confusion – Leftover shortcuts and autorun entries can confuse users, especially when New Teams is already deployed
Compliance – Many organizations have policies requiring the removal of end-of-life software from managed devices
Clean device state – Leftover registry entries and autorun configurations can interfere with New Teams or cause unexpected behavior

What Gets Removed

All three scripts target the same Classic Teams components:

Teams Machine-Wide Installer – The MSI-based installer typically deployed via SCCM, GPO, or during OS deployment
Per-user Teams installations – Classic Teams installed itself per-user under %LocalAppData%\Microsoft\Teams for each profile on the device
Autorun registry entries – Both HKLM and per-user Run keys that launch Classic Teams at logon
Desktop and Start Menu shortcuts – Leftover .lnk files pointing to the old Teams client
Teams Installer folder – The C:\Program Files (x86)\Teams Installer directory

Option 1: Remove Classic Teams with a Standalone Script

If you need to remove Classic Teams from a smaller number of devices, or want to run the cleanup through SCCM, ConfigMgr, GPO, or manually, use the standalone removal script. It handles the complete removal process in a single run: stops Teams processes, uninstalls the Machine-Wide Installer via msiexec, iterates through all user profiles to remove per-user installations, cleans up registry entries and shortcuts, and validates the result.

Script: Remove-ClassicTeams.ps1

Usage

Run the script as SYSTEM or with local administrator privileges:

powershell.exe -ExecutionPolicy Bypass -File Remove-ClassicTeams.ps1

The script creates a log file at C:\Windows\Logs\Remove-ClassicTeams.log for troubleshooting.

Option 2: Remove Classic Teams with Intune Proactive Remediations

For organizations managing devices through Microsoft Intune, the preferred approach is to use Proactive Remediations (now called Remediations in the Intune admin center). This gives you a detection script that identifies non-compliant devices and a remediation script that automatically cleans them up.

Detection Script

The detection script checks whether you still need to remove Classic Teams by scanning all common locations. If any remnant is found, it exits with code 1 (non-compliant), which triggers the remediation script. If the device is clean, it exits with code 0 (compliant).

Script: Detect-ClassicTeams.ps1

The detection checks include:

Teams Machine-Wide Installer in both 32-bit and 64-bit uninstall registry keys
Classic Teams folder, Teams.exe, and Update.exe in each user profile
Teams desktop shortcuts across all profiles
HKLM Run entry for Teams

Remediation Script

When the detection script flags a device as non-compliant, the remediation script will remove Classic Teams and perform the full cleanup. It goes further than the standalone script by also cleaning Start Menu and Startup folder shortcuts, loading offline user registry hives to remove per-user Run entries, and removing the Teams Installer folder from Program Files.

Script: Remediate-ClassicTeams.ps1

After remediation, the script runs its own validation. If all remnants are successfully removed, it exits with code 0. If anything remains, it exits with code 1, which Intune will flag for review.

Setting Up the Proactive Remediation in Intune

In the Intune admin center, navigate to Devices > Remediations
Click Create script package
Give it a name, for example: Remove Classic Microsoft Teams
Upload Detect-ClassicTeams.ps1 as the detection script
Upload Remediate-ClassicTeams.ps1 as the remediation script
Set Run this script using the logged-on credentials to No (runs as SYSTEM)
Set Run script in 64-bit PowerShell to Yes
Assign the remediation to a device group – start with a pilot group before targeting all devices
Set the schedule – daily is recommended until the bulk of devices are cleaned up, then reduce to weekly

Logging

All three scripts write detailed logs to C:\Windows\Logs:

Remove-ClassicTeams.log
Detect-ClassicTeams.log
Remediate-ClassicTeams.log

Each log entry includes a timestamp, severity level (INFO, WARN, ERROR), and a descriptive message, making it easy to verify that the scripts successfully remove Classic Teams. This makes it straightforward to troubleshoot any issues through Intune device diagnostics or by reviewing the log files directly.

Summary: Remove Classic Teams the Right Way

Cleaning up Classic Microsoft Teams is a necessary task for any organization that has migrated to New Teams. Whether you run the standalone script through your existing deployment tools or leverage Intune Proactive Remediations for automated, ongoing compliance, these scripts give you a reliable way to get it done.

All scripts are available on my GitHub:

Remove-ClassicTeams.ps1 – Standalone removal script
Detect-ClassicTeams.ps1 – Intune Proactive Remediations detection script
Remediate-ClassicTeams.ps1 – Intune Proactive Remediations remediation script

If you have questions or run into issues, feel free to reach out.

Fix Microsoft Teams Dial Pad Not Working

Posted on February 19, 2026 by Thomas.Marcussen

If you’ve ever had a user say:

“The dial pad is there, but I can’t click it.”
“Join meeting does nothing.”
“Teams opens, but it’s just broken.”

You already know what’s coming.

And no – it’s usually not licensing.

In many cases, it’s a corrupted local Teams client.

In this article, I’ll show you:

Why Microsoft Teams breaks like this
Which common error codes this reset resolves
When the issue is client-side vs policy-side
And a full PowerShell script to fix it properly

The Real Problem: Teams Is a Web App in Disguise

Microsoft Teams (especially New Teams) is essentially:

WebView2
Cached profile data
AAD token storage
Local state
MSIX container

When something corrupts:

WebView2 rendering
Authentication tokens
Local Teams cache
SSO credentials
Proxy configuration

The result is classic:

Dial pad visible but not clickable
Join meeting button does nothing
Blank white screen
Endless loading spinner
Random sign-in prompts

Common Microsoft Teams Error Codes This Script Fixes

This reset script resolves a large number of client-side errors, including:

Authentication Errors

CAA50021
CAA50024
CAA20002
0xCAA70004
0xCAA82EE2
0x80048823
0x800704CF

Meeting Join / UI Errors

Join button unresponsive
Dial pad not clickable
Blank calendar view
“We couldn’t connect you” error
“Something went wrong” generic UI errors

WebView2 / Rendering Issues

White screen on launch
UI elements missing
Buttons visible but not interactive

0x80072EFD
0x80072EE7
0x801901F7

If Teams Web works but the desktop client does not -> this script is almost always the fix.

When This Script Will NOT Help

If the dial pad is greyed out, the problem is not the client.

It’s usually:

No Teams Phone license
No OnlineVoiceRoutingPolicy
No Calling Policy
Enterprise Voice not enabled

Client reset won’t fix licensing.

Clickable but broken = client
Greyed out = policy

Important distinction.

What the Script Actually Does

This is not just a “delete cache” script.

It performs a full user-context reset:

Stops all Teams-related processes
Removes Classic Teams folders
Removes New Teams MSIX profile folders
Clears WebView2 cache
Optionally removes stored AAD/Office credentials
Optionally resets WinHTTP proxy
Relaunches Teams cleanly

It does NOT:

Uninstall Teams
Change licensing
Affect other users
Modify tenant configuration

Safe for enterprise usage.

Reset-TeamsClient.ps1 – https://github.com/ThomasMarcussen/assortedScripts/blob/master/Reset-TeamsClient.ps1

Microsoft Intune Connector for Active Directory – Updated and Improved

Posted on December 16, 2025 by Thomas.Marcussen

The Intune Connector for Active Directory, also referred to as the Offline Domain Join (ODJ) Connector, is responsible for joining computers to an on-premises domain during the Windows Autopilot process.

This Intune Connector for Active Directory will create computer objects in a specified Organizational Unit (OU) in Active Directory during the domain join process. Unfortunately for Microsoft, it appears as though there have been some issues with setting up the connector with build 6.2501.2000.5.

Common Issues with the Intune Connector for AD version 6.2501.2000.5

According to the feedback that Microsoft received, here are some of the more common challenges that customers run into.

Issue	Details
Error “MSA account <accountName> is not valid” when signing in.	This happens when the connector successfully creates the MSA but fails to retrieve the data from the domain controller. Several things could cause this, including replication delays between domain controllers in a single domain, or when the user account exists in a different domain to the connector machine. Fortunately, this issue is resolved in build 6.2504.2001.8.
Error “Failed to create a managed service account – Element not found.”
Error “Cannot start service ODJConnectorSvc on computer ‘.’. —> System.ComponentModel.Win32Exception: The service did not start due to a logon failure” after the MSA is created.	This has been observed when the service can’t run as the MSA. Several issues can cause the service to not be able to run as the MSA, including group or local policy restricting Log on as a service privileges.
Error “System.DirectoryServices.DirectoryServicesCOMException (0x8007202F): A constraint violation occurred.”

New and Improved Build

In light of everything, Microsoft released an update and build that intends to address the recent challenges. This update specifically resolves come of the client feedback and it also improves overall functionality. Users can download this new build 6.2504.2001.8 from Microsoft Intune. From this improved version, you can expect:

A new sign in page in the wizard that now uses WebView2, lives on Microsoft Edge, instead of the previously used WebBrowser.
There is resolution to the error “MSA account <accountName> is not valid” that some clients were seeing.
The error “Cannot start service ODJConnectorSvc on computer” is available for mitigation.
The error “System.DirectoryServices.DirectoryServicesCOMException (0x8007202F): A constraint violation occurred” is also available for troubleshooting and mitigation.

Updated Intune Connector

Windows Autopilot continues to use the Intune Connector for Active Directory to deploy hybrid joined Microsoft Entra devices. Going forward, Intune is looking to enhance security. It does so by updating the connector to use a Managed Service Account (MSA) instead of a SYSTEM account.

Customers will find the updated Connector available for download from within Intune. And although the legacy connector may still be available for download, it will no longer have support in late June 2025. So, before that happens, you need to plan to update the connector because this won’t happen automatically.

Updated Troubleshooting Guide

Problem	Solution
Why is the Intune Connector for Active Directory not logging in Event Viewer even though logging is enabled?	The connector originally logged in the Event Viewer directly under Applications and Services Logs in a log called ODJ Connector Service. But, going forward, logging for the connector has been moved to the path Applications and Services Logs > Microsoft > Intune > ODJConnectorService. This means that users who find the ODJ Connector Service log at the original location empty or not updating should check the new path location.
Why does uninstalling the Intune Connector for Active Directory through the Settings app not fully remove the application?	Uninstalling the connector requires you to use both the Settings app and the Intune Connector for Active Directory installed executable ODJConnectorBoostrapper.exe. To uninstall the connector, run ODJConnectorBoostrapper.exe and select the Uninstall option. Make sure that the ODJConnectorBoostrapper.exe installer version matches the version of the connector you’re uninstalling.
Why is the error “The MSA account couldn’t be granted permission to create computer objects in the following OUs” occurring when installing the Intune Connector for Active Directory?	Different types of failures can cause this error including: The admin installing and configuring the connector not having the required permissions. The OU specified in the Intune Connector for Active Directory ODJConnectorEnrollmentWiazard.exe.config XML configuration file doesn’t exist. To view more information on the error and what caused it, see the ODJConnectorUI.log normally located in the following folder: C:\Program Files\Microsoft Intune\ODJConnector\ODJConnectorEnrollmentWizard
Why is the error “Cannot start service ODJConnectorSvc on computer ‘.'” occurring when setting up the Intune Connector for Active Directory?	A few reasons could cause this error including the following: The domain has more than one domain controller with a replication latency policy. The MSA was created in one of the domain controllers but the search happened against another domain controller. Wait until replication completes in accordance with your policy or manually sync. Once the replication is complete, then open the connector and choose Configure MSA.A group policy is configured that doesn’t allow services to start as a non-privileged account. Check that the MSA account has Log on as a service privileges granted.
Why is the error “Microsoft Edge can’t read and write to its data directory” occurring?	This error shows that the user needs read/write permissions to the listed directory.
Why did enrollments start failing when using the Intune Connector for Active Directory?	Verify that the Intune Connector for Active Directory is updated to version 6.2501.2000.5 or later and that the legacy version isn’t still being used.
Why are the errors “Navigation to the webpage was canceled” or “Can’t connect securely to this page” occurring while setting up the Intune Connector for Active Directory?	Different types of issues can cause this error including: The server where the admin has chosen to install and configure the Intune Connector for Active Directory lacks the required internet access or required Intune URLs aren’t allowed. The server is sending network requests via TLS 1.0 or 1.1 because PKCS Cryptography is disabled. You can fix this on the server hosting the Intune Connector for Active Directory by deleting the registry key value specified in the following command by running the command from an elevated command prompt: reg.exe delete “HKLM\System\CurrentControlSet\Control\SecurityProviders\SCHANNEL\KeyExchangeAlgorithms\PKCS” /v Enabled /f

Pre-installation Requirements for Intune Connector

Before carrying out the installation, you need to verify that you meet all the requirements for the Intune Connector for Active Directory:

The connector will work best when installed on a computer running Windows Server 2016 or later with .NET Framework version 4.7.2 or later.
The server hosting the Intune Connector for Active Directory must have access to the Internet and Active Directory.
Multiple connectors can install in a domain, as this will increase scale and availability. Each connector must be able to create computer objects in the domain that it supports.
The administrator carrying out the installation must be a local administrator on the server where the Intune Connector for Active Directory is installing.
For the updated Connector, installation will require an account with the following domain rights:
Required – Create msDs-ManagedServiceAccount objects in the Managed Service Accounts container
Optional – Modify permissions in OUs in Active Directory – if the administrator installing the updated Intune Connector for Active Directory doesn’t have this right, additional configuration steps by an administrator who has these rights may be essential.

Installation Process

Internet Explorer Enhanced Security Configuration

The change to using WebView2 that comes with build 6.2504.2001.8 means that turning off the Internet Explorer Enhanced Security Configuration setting in Windows Server is no longer necessary. So, as long as you have version 6.2504.2001.8 or later of the connector installed, you should not run into problems with the Internet Explorer Enhanced Security Configuration setting.

DOWNLOADING THE CONNECTOR

To install the new connector in your environment, you can download it from the Intune admin center as follows:

Sign into the Intune admin center on the server where you want to install the connector.
Select Devices in the Home screen.
Select Windows in the Devices | Overview screen, under By platform.
Select Enrollment in the Windows | Windows devices screen, under Device onboarding.
Select Intune Connector for Active Directory in the Windows | Windows enrollment screen, under Windows Autopilot.
Select Add in the Intune Connector for Active Directory screen.
In the Add connector window that opens, under Configuring the Intune Connector for Active Directory, select Download the on-premises Intune Connector for Active Directory. The link downloads a file called “ODJConnectorBootstrapper.exe.”

INSTALLING THE CONNECTOR ON THE SERVER

Sign into the the server where you want to install the connector using an account that has local administrator rights.
Before you can install the updated Intune Connector for Active Directory, you need to first uninstall the legacy connector.
Open the downloaded “ODJConnectorBootstrapper.exe.” file to launch the Intune Connector for Active Directory Setup install.
Go through the Intune Connector for Active Directory Setup install.
When installation is complete, tick the checkbox Launch Intune Connector for Active Directory.

SIGNING IN With Intune Connector

Select Sign In in the Intune Connector for Active Directory window, under the Enrollment tab.
Sign in with the Microsoft Entra ID credentials of an Intune admin role under the Sign In tab. Also note that the user account needs to have an assigned Intune license.
With the sign in process done:
A “The Intune Connector for Active Directory successfully enrolled” confirmation window appears. Click OK to close the window.
An “A Managed Service Account with name “<MSA_name>” was successfully set up” confirmation window appears. The name of the MSA has the format “msaODJ#####” with the ##### representing 5 random characters. Notate the name of the MSA created, and then click OK to close the window.
The Enrollment tab shows Intune Connector for Active Directory as officially “enrolled.” The Sign In button will also be gray and Configure Managed Service Account will show as enabled.
Close the Intune Connector for Active Directory window.

VERIFICATION

Once authentication finishes, the Intune Connector for Active Directory will finish installation. After the completion of installation, you can verify that the connector is active by following the steps below:

Head over to the Microsoft Intune admin center if it’s still open. From there, close the Add connector window if it’s still there. Alternatively, if the Microsoft Intune admin center isn’t still open:
Sign into the Intune admin center.
Select Devices in the Home screen.
Select Windows in the Devices | Overview screen, under By platform.
Select Enrollment in the Windows | Windows devices screen, under Device onboarding.
Select Intune Connector for Active Directory in the Windows | Windows enrollment screen, under Windows Autopilot.
In the Intune Connector for Active Directory page:
Confirm that the server displays under Connector name and shows as Active under Status.
Don’t forget to verify that the version is greater than or equal to 6.2501.2000.5 for the updated Connector.

If you don’t see the server displayed, select Refresh or head away from the page before going back to the Intune Connector for Active Directory page. Once the connector installs, it will start logging in the Event Viewer under the path Applications and Services Logs > Microsoft > Intune > ODJConnectorService.

Wrap Up

The previous version of the Microsoft Intune Connector for Active Directory presented several issues for many customers. And as one would expect, these issues reduced the efficiency of the connector and negatively impacted functionality.

Fortunately, with build 6.2504.2001.8, Microsoft is taking heed of the feedback from its clients to make the necessary adjustments. Going forward, clients can look forward to leveraging a connector with better functionality and significantly less issues. And if you do run into any problems, Microsoft provides updates the troubleshooting guide.

How to Deploy Applications to Microsoft Teams Rooms (MTR) with Intune Using Remediation Scripts

Posted on July 23, 2025 by Thomas.Marcussen

Introduction: The Challenge of Managing Microsoft Teams Rooms

Microsoft Teams Rooms (MTR) are purpose-built devices that bring seamless Teams meetings into physical conference rooms. However, if you’re an IT admin or consultant trying to manage these devices with Microsoft Intune, you may have already hit a major wall: you can’t deploy standard applications like Win32 or MSI packages.

In this post, I’ll walk you through:

Why app deployment fails on MTRs
How to use Intune Proactive Remediation Scripts to install apps anyway
A real-world script-based workaround you can implement today

This article is especially useful for IT administrators, Microsoft 365 consultants, and organizations managing MTR on Windows devices using Microsoft Intune.

What Are Microsoft Teams Rooms (MTR) Devices?

Microsoft Teams Rooms are specialized endpoints running Windows or Android, designed to facilitate video conferencing in meeting spaces.

This article focuses on MTR on Windows, which:

Boots into a kiosk-like shell
Uses a locked-down local user account (usually “Skype”)
Automatically launches the Teams Rooms app
Is managed differently from typical Windows endpoints

Why Are MTRs So Locked Down?

Because they’re designed to do one thing very well: run meetings reliably and securely. That means:

Minimal background processes
No user distractions
Reduced vulnerability footprint

Unfortunately, this also means limited support for app deployment using traditional Microsoft Intune methods.

Why Standard App Deployment Doesn’t Work on MTR

Let’s quickly review how app deployment in Intune normally works:

You upload a Win32 or MSI app
Intune pushes it to the device
The app installs silently in the background

But MTRs are a special case:

Issue	Description
Kiosk Shell	MTR devices run a locked-down shell that prevents user interaction.
Limited Admin Access	The logged-in “Skype” user doesn’t have full local admin rights.
Silent Installs Often Fail	Even SYSTEM-context installs can hang or fail silently.
Win32 App Deployment Not Supported	MTRs are excluded from full app deployment via Intune.

TL;DR: Intune treats MTRs like they’re manageable—but for apps, they’re basically off-limits.

What Can You Manage on MTR with Intune?

Feature	MTR Support?
Enroll in Intune	✅ Yes
Configuration Profiles (Wi-Fi, Certificates)	✅ Yes
Compliance Policies	✅ Yes
PowerShell Scripts	⚠️ Limited
Win32/MSI App Deployment	❌ Not Supported
Store App Deployment	❌ Not Supported
Remediation Scripts	✅ Yes — this is our workaround!

The Workaround: Use Proactive Remediation Scripts

What Are Proactive Remediations in Intune?

Proactive Remediations are part of Endpoint Analytics in Microsoft Intune. They allow you to:

Detect issues on endpoints (e.g., missing apps or settings)
Run scripts in the SYSTEM context to remediate them

And because these scripts run as SYSTEM, they can bypass the user restrictions imposed by the MTR shell. That’s the secret sauce here.

Step-by-Step: Deploy Apps to MTR Devices Using Remediation Scripts

Step 1: Choose an Application

Pick an application with a silent installer. Examples include:

Zoom Rooms Plugin
Custom certificate tools
Remote support agents

Pro tip: Avoid apps that require UI interaction or restart the system.

Step 2: Host the Installer

Since you can’t upload Win32 apps, host the installer externally:

Azure Blob Storage with SAS token
SharePoint Online
A secure HTTPS server

Step 3: Write the Detection Script

This script checks whether the app is already installed.

powershellCopyEdit# Detect-Zoom.ps1
$app = Get-WmiObject -Class Win32_Product | Where-Object { $_.Name -like "*Zoom*" }
if ($app) {
    exit 0  # App is installed
} else {
    exit 1  # App is missing
}

Exit code 1 tells Intune that remediation is needed.

Step 4: Write the Remediation Script

This script installs the application silently.

powershellCopyEdit# Remediate-Zoom.ps1
$installerUrl = "https://yourstorage.blob.core.windows.net/apps/ZoomRoomsInstaller.msi"
$tempPath = "$env:TEMP\ZoomInstall.msi"
$logPath = "C:\ProgramData\ZoomInstall.log"

Invoke-WebRequest -Uri $installerUrl -OutFile $tempPath -UseBasicParsing

Start-Process "msiexec.exe" -ArgumentList "/i `"$tempPath`" /quiet /norestart /log `"$logPath`"" -Wait

Remove-Item $tempPath -Force

Store logs in C:\ProgramData\ for later troubleshooting.

Step 5: Deploy via Intune

Go to Endpoint Security > Endpoint Analytics > Proactive Remediations
Click + Create Script Package
Upload both scripts (Detect and Remediate)
Assign the policy to a dynamic group of MTR devices
Set the schedule (e.g., once a day)

Tip: Filter devices by naming convention like MTR-*.

Real-World Example: Install Chocolatey on MTR

Let’s say you want to deploy Chocolatey to MTR devices to enable future package management.

Detection Script

powershellCopyEditif (Get-Command "choco" -ErrorAction SilentlyContinue) {
    exit 0
} else {
    exit 1
}

Remediation Script

powershellCopyEditSet-ExecutionPolicy Bypass -Scope Process -Force
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
iex ((New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1'))

This installs Chocolatey silently using PowerShell.

Security Tips for Remediation Scripts on MTR

Best practices to stay secure:

Use SAS tokens for Azure Blob Storage to avoid public links.
Avoid complex UIs or restarts in your install logic.
Sign your scripts with a trusted certificate if possible.
Log everything: install logs, errors, success flags.

How to Maintain This Workaround

Treat remediation scripts like code:

Version control with GitHub or Azure Repos
Store application versions and update logic
Schedule re-checks weekly or monthly
Rotate download URLs periodically if they expire

When Should You Use This Workaround?

Use Case	Good Candidate?
Small hotfix	✅ Yes
Lightweight plugin	✅ Yes
Large apps with UI	❌ No
Mission-critical installs	⚠️ Use caution

For complex applications, consider a manual install window, or coordinate with the OEM.

Alternatives to Intune Remediation Scripts

Method	Notes
Manual Deployment	Good for one-off fixes
OEM Management Tools	Logitech Sync, Poly Lens, etc.
Group Policy	Works for Hybrid AAD Join MTRs
Teams Pro Management	Useful for Teams config, not apps

Conclusion: MTR App Deployment is Possible—With the Right Tools

Deploying applications to Microsoft Teams Rooms using Intune isn’t supported natively—but that doesn’t mean it’s impossible. With a bit of scripting and smart use of Proactive Remediation, you can achieve automated, scalable, and relatively safe application installs.

This method:

Uses supported Intune features (Endpoint Analytics)
Works in the locked-down MTR environment
Scales across multiple devices and locations

Understanding Device Enrollment and Visibility in Microsoft Intune and Entra ID

Posted on June 17, 2025 by Thomas.Marcussen

Troubleshooting Errors Like 0x80180014 and Navigating Device Records in the Admin Portals

Introduction

Managing devices in a modern enterprise requires a clear understanding of how devices enroll into your organization’s management ecosystem, particularly in Microsoft Intune and Microsoft Entra ID (formerly Azure Active Directory). With the increasing adoption of mobile device management (MDM) and the demand for secure cloud identity integration, IT administrators frequently encounter various behaviors—and sometimes, errors—that can be confusing.

One of the more common challenges occurs when a device fails to enroll correctly, presenting cryptic error codes such as 0x80180014. This blog post provides a deep dive into how device registration and visibility work across Microsoft Intune and Entra ID. We’ll also unpack typical issues, explain where devices appear in each admin center, and how to cleanly troubleshoot enrollment errors.

This issue was thoroughly explored during a troubleshooting session with Carsten Lund Meilbak, the go-to expert for everything Microsoft Teams and Teams Meeting Room environments, where we investigated problems with a Microsoft Teams Room (MTR) device. During the session, we discovered how certain Autopilot scenarios could result in orphaned device records in Entra ID, preventing re-enrollment.

What Is Microsoft Intune?

Microsoft Intune is a cloud-based endpoint management solution that helps organizations manage user access, enforce compliance, and deploy apps and configurations to devices. Whether the devices are Windows, Android, iOS, or macOS, Intune serves as the command center for policy enforcement and inventory tracking.

What Is Microsoft Entra ID?

Microsoft Entra ID (previously known as Azure Active Directory) is Microsoft’s cloud-based identity and access management service. Devices can be registered, joined, or hybrid joined to Entra ID, and the identity status of these devices is critical for secure access, Conditional Access policies, and MDM enrollment flows.

Section 1: Device Lifecycle – From Registration to Management

Step 1: Device Registration in Entra ID

When a device first connects with a corporate identity, it can take one of several paths:

Azure AD Registered (Workplace Join):
- Typical for BYOD (Bring Your Own Device).
- Appears under the user’s profile in Entra ID.
- Usually paired with manual or conditional enrollment in Intune.
Azure AD Joined:
- Common for corporate-owned devices.
- Full control over the device by the organization.
- Required for Autopilot provisioning and device-based Conditional Access.
Hybrid Azure AD Joined:
- Devices are joined to on-prem Active Directory and then synced to Entra ID via Azure AD Connect.
- Offers compatibility for legacy environments still using GPOs or SCCM.

Step 2: Device Enrollment in Intune

After a device is registered in Entra ID, it may also become enrolled in Intune:

Automatic Enrollment via group policies or Autopilot.
Manual Enrollment by end-users through “Access Work or School” in Windows settings.
Co-management Scenarios where both Intune and ConfigMgr (SCCM) share responsibilities.

This enrollment is what allows policies, apps, and configurations to be deployed to the device.

Section 2: How Devices Appear in Admin Portals

2.1 Microsoft Entra Admin Center

Link: https://entra.microsoft.com

Navigate to:

Microsoft Entra Admin Center → Devices → All Devices

Here, you’ll see all devices that are registered or joined to your Entra tenant.

Each record provides the following key information:

Device Name
Join Type (Azure AD Registered, Azure AD Joined, or Hybrid)
OS Type and Version
MDM Enrolled (Yes/No)
Compliant (Yes/No)
Owner (User Principal Name)

If a device shows up here but not in Intune, it might not be enrolled in MDM. You can confirm this via the MDM Enrolled column or by selecting the device and checking details.

2.2 Microsoft Intune Admin Center

Link: https://intune.microsoft.com

Navigate to:

Devices → All Devices

This view shows all devices that are successfully enrolled in Intune, either through automatic enrollment or manual addition.

Important fields include:

Compliance Status
Enrollment Type (Corporate, BYOD, Autopilot)
Primary User
Managed By
Last Check-In
Device Category

If a device is listed here but shows a warning or non-compliance, the issue often relates to Conditional Access, configuration profiles, or missing required apps.

Cross-Referencing Between Portals

It’s not uncommon for admins to find a device in one portal and not the other. Here’s what it typically means:

Found in Entra Only	Found in Intune Only	Found in Both
Device is only registered, not MDM-enrolled.	Rare; usually due to stale objects or migration.	Device is properly joined and managed.

A properly managed device should show up in both portals, and any inconsistency is a sign of an enrollment issue.

Section 3: Common Error – `0x80180014`

What Does 0x80180014 Mean?

This error appears most often during the enrollment phase of a Windows 10/11 device. It typically means:

“The device is already enrolled.”

In other words, Windows believes the device is already managed, either because of a previous enrollment or residual data from a prior configuration.

Resolution Steps

Check Admin Portals: Remove the device from both Intune and Entra if it still exists.
Remove MDM Profile: Disconnect the work or school account in Settings.
Use PowerShell: Run dsregcmd /leave to unjoin from Entra ID.
Retry Enrollment: After cleanup, re-enroll the device manually or through Autopilot.

Section 4: Unable to Delete Device from Entra ID

If the device does not appear in Intune but is still stuck in Entra ID and can’t be deleted, follow these steps:

Step 1: Confirm Your Permissions

Ensure your account has one of the following roles:

Global Administrator
Cloud Device Administrator

You can verify your roles here: https://entra.microsoft.com → My Roles

Step 2: Check the Join Type

In the Entra Admin Center → Devices → All Devices, look at the device’s join type:

Join Type	Description	Deletion Method
Azure AD Joined	Cloud-joined device	Can be deleted directly if permissions allow
Azure AD Registered	BYOD registration	Can be deleted directly
Hybrid Azure AD Joined	Synced from AD	Must be deleted from on-prem AD first

If the device is Hybrid Azure AD Joined, delete it from Active Directory Users and Computers on-prem, then let Azure AD Connect sync the deletion.

Step 3: Graph PowerShell Method (Cloud-only Devices)

A. Install Microsoft Graph PowerShell SDK

Install-Module Microsoft.Graph -Scope CurrentUser -AllowClobber -Force

B. Connect to Microsoft Graph

Connect-MgGraph -Scopes "Device.ReadWrite.All"

C. Find and Remove Device

# Replace 'DEVICE-NAME' with the actual name
$device = Get-MgDevice -Filter "displayName eq 'DEVICE-NAME'"
Remove-MgDevice -DeviceId $device.Id

If you already have the Object ID, skip the lookup and run:

Remove-MgDevice -DeviceId "&lt;device-object-id>"

Note on Autopilot Devices

In some scenarios, Autopilot devices can lose their connection to the Entra device object, especially if the device has been reset outside of Autopilot flows (e.g., manually or using third-party imaging). This causes:

The Autopilot object to remain in the Autopilot portal
The Entra ID device to become orphaned
Intune showing no matching device

This was exactly the case during a troubleshooting session with Carsten Lund Meilbak, where we were diagnosing an enrollment failure on a Microsoft Teams Room (MTR) device. The Entra ID device had become orphaned, preventing the MTR from successfully enrolling. Manual deletion of the Entra device object was required to resolve the issue.

In these cases, the orphaned Entra ID device must be deleted manually as described above.

Conclusion

Understanding how devices register and appear in Microsoft Intune and Entra ID is crucial for device management. Cross-portal visibility, proper cleanup, and the ability to handle errors like 0x80180014 efficiently ensure a secure and manageable environment for both users and administrators.

If device records are left stale or orphaned, they can interfere with future enrollment attempts, Autopilot deployments, and compliance policies. Always keep your portals clean and verify device join and MDM status regularly.

Mastering Indicators in Microsoft Defender for Endpoint

Posted on June 11, 2025 by Thomas.Marcussen

As hackers get more daring and attacks more sophisticated, organizations need to continuously look at how they can enhance their security protocols. Concerning statistics show that the cost of cybercrime, already well into the trillions, could surpass $23 trillion by 2027.

Faced with the reality that cybercrime is unquestionably on the rise, a proactive approach is now necessary to lessen the risk of attack. One of the best ways to achieve that is by utilizing the indicators that Microsoft Defender for Endpoint has.

By using these, IT admins can preemptively block malicious entities and prevent them from accessing the organization’s resources. With this in mind, the focus for this blog will be to provide you with detailed information concerning indicators.

Explaining Microsoft Defender for Endpoint Indicators

Indicators provide IT administrators with certain data that can help identify individuals with nefarious intentions. This data can enable organizations to pinpoint malicious IP addresses, untrusted certificates, suspicious URLs, and more. Moreover, an organization can then set up its indicators accordingly thereby enabling a proactive approach to dealing with threats.

In Microsoft Defender for Endpoint, the indicators operate by applying specific rules to endpoint devices. These rules will use predetermined criteria to govern whether or not devices allow or block certain types of activity. A good example of this would be blocking all traffic to and from IP addresses that have been determined to be carrying out malicious activities.

Importance of Indicators

Indicators play a major role in improving organizational security by enabling businesses to take a proactive approach and block malicious actors before they can do any damage. And if an incident does occur, indicators will help you to quickly identify threats and implement a swift response. Additionally, using indicators allows you to customize your security to effectively meet the specific needs of your organization.

These tools are invaluable for intercepting attacks. Once it has been determined that an attack is ongoing, the malicious entities can be immediately blocked therefore limiting the impact from affecting the entire organization.

Types of Indicators with Microsoft Defender for Endpoint

In this section, we’re going to look at four types of indicators that Microsoft Defender for Endpoint supports. These indicators are essential for responding to different threats.

IP ADDRESS INDICATORS

This type is used for preventing access to IP addresses suspected of malicious activities. Once a specific IP address has been determined, an action is implemented that blocks all devices within an organization from connecting to that IP address. To do this, you need to navigate to Microsoft 365 Defender portal > Settings > Indicators. Next, you’ll need to add a new indicator and then select IP Address. With this done, you can now set up the action as Block and specify devices affected.

URL AND DOMAIN INDICATORS

These indicators are used to block access to malicious domains and phishing sites. After you’ve specified the URL concerned, you can then implement an action blocking all devices within your organization from connecting to that particular URL. Microsoft Defender for DNS is recommended if you want to have DNS-level protection.

FILE HASH INDICATORS

These will enable you to block access to known malicious files based on their hash (MD5, SHA-1, or SHA-256). You can use Advanced Hunting in Microsoft Defender or third-party threat intelligence sources to get the necessary file hashes.

CERTIFICATE INDICATORS

With this fourth type, you can block executables signed by untrusted certificates.

How to Set Up Microsoft Defender for Endpoint Indicators

The process of setting up indicators is not an overly complicated one. You start by navigating to the Microsoft 365 Defender portal where you need to sign in with your administrator account. Following this, you can then begin creating an indicator.

CREATION PROCESS

Head over to Settings > Indicators.
Click on Add Indicator.
Select the type of indicator required.
Provide the necessary information:
Indicator Type: IP Address, URL, File Hash, or Certificate.
Action: Block or Allow
Scope: Specify which devices/groups will be affected by the action to be performed.
Expiration Date: Provide an expiration date for temporary indicators (this is optional).
Description: For documentation purposes, a description will be required.

COMPLETING THE PROCESS

After you’ve completed the creation process, you can click Create to save the indicator. You’ll also have the capability to monitor the indicator’s impact by taking advantage of Reports and Advanced Hunting. Advanced Hunting offers a powerful, query-based tool that helps you track threats and evaluate how effectively the indicators are working. Hunting works best if you use filters to get more specific results, as well as if you save and reuse queries during the monitoring processes.

Using Indicators Effectively

Like most other apps and services, you can’t set up indicators once and forget about them. You need to constantly review them and update them when necessary so your security remains strong.

As already mentioned, some indicators are temporary and so you need to remember to set expiration dates for these so that you avoid cluttering your environment. Not only that, but you should ensure that indicators are targeting the specific devices or groups they are created for.

Furthermore, IT admins should continuously evaluate the information obtained from Advanced Hunting and reports so that they are always aware of whether or not the indicators are performing to expectations. And then to enhance your security posture even more, you can combine indicators with Conditional Access policies for better results.

Wrap up

The staggering figures that we hear being thrown around when discussing cybercrime are almost beyond belief. But, the reports about cybercrime provide a lot of insights that enable organizations to take the necessary steps to improve their security. Leveraging the indicators available in Microsoft Defender for Endpoint goes a long way in securing your network and reducing the risk of attack. If applied correctly and used as recommended, indicators can be some of the best tools in an organization’s cybersecurity arsenal.

Windows Autopilot Device Preparation – Overcoming the Win32 App Deployment Challenge

Posted on April 8, 2025 by Thomas.Marcussen

Windows Autopilot is a set of technologies that is built to simplify the process of deploying, setting up, and configuring new devices. By using this technology, users can avoid going through the traditional imaging process and save countless productive hours.

However, Autopilot is not without its faults. One of the more common instances of running into problems occurs when using Managed Installer policies with Win32 app deployment during the Autopilot device preparation phase. As an issue that can cause quite a headache, this blog will help you better understand this problem as well as provide you with solutions for addressing it.

Windows Autopilot Explained

Windows Autopilot gives organizations a solution that eliminates the challenges that come with building, maintaining, and generally applying custom images. IT admins can use this service to set up new desktops to join pre-existing configuration groups and apply profiles to the desktops. What this does is give users the opportunity to access fully functional desktops from their first login.

Importance of Managed Installer Policies

Managed Installer policies are useful for dictating which applications can be installed on your organization’s devices. Once enabled, Managed Installer uses a special rule collection in AppLocker to designate binaries. These are trusted by your organization as an authorized source for application installation.

The problem IT admins will run into is that currently Windows Autopilot device preparation doesn’t guarantee the delivery of the Managed Installer policy before trying to install Win32 apps. Because of this, you may end up with deployment failures during the App Installation phase of Autopilot.

INVESTIGATING THE PROBLEM

A regular deployment scenario follows a series of steps that begins with the launch of the Autopilot Device Preparation process. Following this, Win32 apps are then scheduled for installation as part of the device preparation policy.

At this point, the Managed Installer policy won’t yet have been installed. The reason why you may see the Win32 app installations failing is because the policy is set up to block apps from unverified sources.

WHAT TO EXPECT With Windows Autopilot

One of the things you can expect to see because of this issue is the Autopilot deployment process stopping at the app installation phase. You will also get error messages showing application deployment failures. Another thing to expect is that deployment reports will show failed Win32 app installations. Lastly, end-users may receive incomplete or improperly configured devices.

How has Microsoft addressed the issue?

Microsoft is fully aware of the issue at hand and has offered some recommendations that provide a temporary solution. IT admins can start by removing Win32 apps from all Autopilot device preparation policies.

Also, devices should be left to complete Autopilot and reach the desktop. Furthermore, Win32 apps and Managed Installer policies need to be applied after the user gets to the desktop.

In October 2024, Microsoft announced service release 2410 that introduced some new changes that will see Win32 and Microsoft Store apps being automatically skipped during device preparation and instead continuing to the desktop. To implement these solutions, you’ll need to follow the steps below:

AUDIT YOUR EXISTING Windows AUTOPILOT DEVICE PREPARATION POLICIES

For this process, organizations need to identify all device preparation policies configured in Intune. You’ll also need to verify any Win32 apps included in these policies. With all this done, make sure to document these apps as well as their purpose.

REMOVE WIN32 APPS FROM DEVICE PREPARATION POLICIES

Navigate to Microsoft Intune and edit your existing device preparation policies. Then, proceed to remove all Win32 apps from these policies. Once these tasks are complete, save and apply the updated policies.

MONITOR DEPLOYMENT STATUS

Use the updated policies to deploy your devices. You can track the progress of this process using the Autopilot Deployment Report. Make sure that you check that devices reach the desktop without app installation failures.

DEPLOY WIN32 APPS POST-ENROLLMENT

Once a device has reached the desktop, you can reassign your Win32 apps to deploy. You’ll need to use Required or Available for enrolled devices deployment settings in Intune. The success of app installation can be monitored using Intune’s reporting tools.

Alternative Options

In addition to the recommendations by Microsoft, there are other options that organizations can consider to address the above-mentioned issue. These include:

PRE-STAGE CRITICAL APPLICATIONS

One thing that organizations can consider doing is pre-staging key apps that are required to be on the device at deployment. This can be done using offline methods such as:

Injecting apps into the Windows image using tools like OSDCloud or Configuration Manager.
App deployment using PowerShell scripts post-Autopilot.

CONDITIONAL ACCESS AND APP PROTECTION POLICIES

If your organization is worried about security, then using Conditional Access policies will help block access to corporate resources until the necessary apps have been installed. An example of this would be enforcing Conditional Access policies to ensure that non-compliant devices are prevented from accessing the organization’s resources.

Optimize Enrollment Status Page (ESP) Configuration

The Enrollment Status Page plays a key role in controlling app deployment during Windows Autopilot. This is done by dividing the deployment into several stages, thus allowing you to prioritize the apps you consider more important.

USER VS DEVICE ASSIGNMENTS

With device-based deployments, there is a greater likelihood of encountering problems with Managed Installer policies. Because of this, it’s worth considering changing your app deployment from device-based to user-based assignments.

PILOT AND TEST NEW CONFIGURATIONS

Before rolling out new deployment configurations to the entire organization, it’s always wise to test them on a small pilot group. Doing it this way gives you the opportunity to identify problems and address them early.

Monitoring and Troubleshooting

The availability of Autopilot Deployment Reports in Microsoft will provide organizations with key information concerning the deployment process. This allows them to evaluate skipped apps, failed deployments, and device readiness status.

Additionally, organizations should also use Intune Diagnostics and Event Viewer to analyze deployment logs. By evaluating these logs, IT admins can pinpoint specific app failures and then determine whether they’re related to the Managed Installer policy.

If all else fails and your deployment issues are still yet to be resolved, you’ll have the option of reaching out to Microsoft Support for any help you need. Alternatively, engaging with the Intune community on X may yield assistance from those who have dealt with the issues you may be confronting.

Wrap Up

Windows Autopilot offers organizations a powerful tool to help simplify the process of deploying and setting up devices. Processes are made simpler and faster, thus helping businesses operate more efficiently. And although there may be issues with Wind32 app deployment during device preparation, there are ways to deal with it.

But, in addition to the workaround, we can look forward to Microsoft developing a more permanent solution to this challenge. Updates are sure to be forthcoming and we will be keeping an eye on what Autopilot will bring us next.

Latest Updates for Microsoft Intune and Windows 365

Posted on January 16, 2025 by Thomas.Marcussen

New features and updates are paramount to improving the functionality of the various devices and applications that businesses use. This is necessary, especially if companies expect high levels of performance. It’s also essential as the tasks that we deal with grow more complex.

Not only do companies want to maintain performance but they also need tech companies to address any existing issues. As a result, organizations like Microsoft will offer many new features. These updates are for services like Microsoft Intune and Windows 365.

Because of the updates, released in 2024, overall user experiences will greatly improve. Let’s discuss the recent additions and explore how they might help elevate, simplify, and improve your business operations.

Improvements to Microsoft Intune

2024 has been a year with a lot of innovation from Microsoft across its various products and services. Plenty of this effort prioritizes Microsoft Intune improvements, bringing us features such as:

New capabilities for Windows Autopilot

Windows Autopilot is a service that makes the device deployment process faster and less complex. Companies benefit immensely from Autopilot’s ability to do away with the labor-intensive process previously necessary to provision new devices. And, Microsoft has additional service improvements to share.

Earlier this year, an announcement introduced an exciting new release – device preparation. This brilliant new innovation will enable the accommodation of more devices and delivery of more efficient results. Moreover, it will allow for the provisioning of cloud instances such as Windows 365.

Still, Microsoft ensures customers that the original, existing Windows Autopilot architecture is still in place. Because of this, you still have access to all your favorite features. IT admins can now enjoy a faster and simpler addition of groups to devices. This is due to enrollment time grouping, which replaces dynamic grouping. This creates a process that assigns app policies and scripts to devices more efficiently.

NEW SECURITY BASELINE

A key reason for updating devices and applications is to strengthen security and address vulnerabilities. Companies want to make sure that their security measures can stay ahead of the methods being employed by cybercriminals.

Hence the introduction of an update to the Microsoft Defender for Endpoint security baseline. These one-click collections of policies can be applied to devices (and device groups) in Intune. They also provide you with a way to configure all your organization’s devices with the same security policies.

Setting up your security measures in this way makes it’s easier to maintain the same security levels across the entire enterprise. This particular update offers a much better way of implementing the configuration recommendations made by the Microsoft Defender for Endpoint team. Furthermore, because it’s based on the Windows unified settings platform, you also get:

Quicker turnaround for updates.
Improved reporting, including per-setting status reports.
Assignment filter support.
Improved UI.
Consistent names across Intune.

Platform single sign-on (SSO) has arrived for macOS device enrollment

Signing in to multiple applications and websites using different credentials can be a tedious task. It can also be difficult for many people to keep up with all their sign-in information and passwords. This is why Platform Single Sign On (SSO) is a wonderful solution for streamlining the authentication process.

Because of how local account credentials synchronize with an individual’s IdP, one will only need to log in once. Platform SSO can help your company improve its security posture and enhance productivity.

Owing to the integration of SSI with Apple’s Secure Enclave technology, your organization can enable phishing-resistant, hardware-bound, passwordless authentication on Mac through Intune. In addition to better security, end-users can enjoy a less complex and faster out-of-the-box experience. This is possible because all they’ll need to set up their devices are their Entra ID passwords.

End-users also get to work more efficiently. This SSO experience, unique to Intune, enables them to sign in to their Outlook, Teams, and other Microsoft 365 apps simultaneously.

Installation of macOS apps on demand via Intune

Microsoft has done plenty of work to develop systems that can provide more capable Mac management. Intune has made providing IT admins and end-users a better, more efficient platform one of its key objectives. And one of the main reasons they’ve been able to achieve that is by leveraging feedback from customers.

Of note among the latest developments, are options that admins can provide to users for downloading unmanaged applications. These specifically apply in PKG and DMG format via the Intune Company Portal app.

Furthermore, to reduce the reliance on line-of-business app workflow or third-party tools to deploy optional applications, Intune added the “available” assignment type to the well-known “required” type. As one of the most requested features by Mac device administrators, this should be a well-received development as it will help both end-users and admins save time.

Expanded support for Microsoft Managed Home Screen

Microsoft Managed Home Screen (MHS) is an enterprise launcher application that enables IT admins to customize their devices and restrict the capabilities that a user can access. If you configure in multi-kiosk mode in Intune, MHS launches automatically as the default home screen on the device. This customizable launcher serves as a key tool for IT admins to better manage devices. It also ensures that users are performing at the expected levels.

As organizations provide users with increasingly more powerful devices, they need to make sure that business operations improve accordingly. The availability of Managed Home Screen is expanding from just user-less kiosks or shared devices to corporate-owned, fully managed devices associated with a specific user as well. As a result, this means capabilities are will extend to a wider range of use cases and applications.

BitLocker RECOVERY KEY

Having access to a BitLocker recovery key allows you to unlock an Intune-enrolled PC if you have the misfortune of forgetting your sign-in password and getting locked out. The stored recovery key is accessible from the Intune Company Portal website. It’s also accessible in the Intune Company Portal app.

Without this key, users would typically need to contact the Help Desk for assistance. As one can imagine, it’s easy to see why this option is better. It offers greater support to users while lightening the load on IT professionals.

Going forward, this update will enable end-users to access their BitLocker recovery key directly from the Company Portal website. Because of this, your organization can expect to benefit from a more intuitive and streamlined path to recovery.

This should also help improve productivity because end-users won’t need to wait for the delays that sometimes occur while waiting for IT support to assist them. And with IT having this task taken care of for them, they will have more time to dedicate to more productive endeavors.

CORPORATE IDENTIFIERS

This feature aims to verify that corporate devices are labeled as corporate-owned as soon as they enroll. It does so by adding their corporate identifiers ahead of time in the Microsoft Intune admin center.

For businesses, corporate device management provides you with more capabilities than that for personal devices. This new change will help organizations restrict the application of the corporate-owned devices label only to authorized devices.

Adding corporate identifiers to Intune requires you to upload a file of corporate identifiers in the admin center or enter each identifier separately. Also important to note is the fact that you don’t need to add corporate identifiers for all deployments. During enrollment, Intune automatically assigns corporate-owned status to devices that join to Microsoft Entra via:

Device enrollment manager account (all platforms)
An Apple device enrollment program such as Apple School Manager, Apple Business Manager, or Apple Configurator (iOS/iPadOS only)
Windows Autopilot
Co-management with Microsoft Intune and group policy (GPO)
Azure Virtual Desktop
Automatic mobile device management (MDM) enrollment via provisioning package
Knox Mobile Enrollment
Android Enterprise management:
Corporate-owned devices with work profile.
Fully managed devices.
Dedicated devices.
Android Open Source Project (AOSP) management:
Corporate-owned user-associated devices
Corporate-owned userless devices
Google Zero Touch

Windows 365 Cloud PC security baseline updates

From the new, additional features and updates to Microsoft Intune, it’s clear to see that increasing efficiency matters. Strengthening security is also of utmost importance. And the same applies here.

Configuring security settings can often be a complex, time-consuming task that few will enjoy especially if you are still a novice. These deployed policy templates with Intune aim to establish Microsoft Security–recommended settings are central to the security strategies employed by Intune.

To ensure that you get the most from these measures, Intune has set it up such that these baselines can be tailored to your unique needs. Additionally, this particular update requires you to manually update your customizations, if any, from the previous baseline. This baseline, which comes highly recommended, will also give you:

Faster deployment of baseline version updates
Improved user interface and reporting experience (such as per-setting status reports)
More consistent naming across the Intune portal
Elimination of setting “tattooing”
Ability to use assignment filters for profiles

New updates and features for Windows 365

Similar to Microsoft Intune, Windows 365 has also introduced several updates to the Cloud PC service. Some of these include:

ADDITIONS TO DEVICE MANAGEMENT CAPABILITIES

Update	What it offers
Windows 11 Cloud PCs now support EN-NZ	As of September 2024, Windows 11 Cloud PCs now support EN-NZ.
Support for symmetric NAT with RDP Shortpath	The goal is to develop an RDP Short path in Windows 365 such that it can support setting up an indirect UDP connection using Traversal Using Relays around NAT (TURN) for symmetric NAT. Most are probably aware that TURN is a widely accepted standard for device-to-device networking for low latency, high-throughput data transmission.
Uni-directional clipboard support is now generally available	With service release 2407 in July 2024, came the release of uni-directional clipboard support into general availability.
Closing port 3389 by default for newly provisioned and reprovisioned Cloud PCs	Going forward, expect to find the inbound port 3389 closed by default. This update has come about as a means to further safeguard your Windows 365 environment.
Chroma subsampling default change to 4:2:0	This change has been made to help reduce monitor support issues. The Windows 365 service will now default to the chroma subsampling at 4:2:0. instead of the previous 4:4:4.
Windows 365 Boot and Windows 365 Switch now support battery status redirection	In a move that should be welcomed by users, Windows 365 Boot and Windows 365 Switch will now offer support for battery status redirection. Therefore, you can now view your local PCs battery status on a Cloud PC.
Upgrade Windows 365 licenses in Microsoft admin center	All clients with Modern Microsoft Cloud Agreements can now upgrade their existing Windows 365 licenses in the Microsoft Admin Center.
New Windows 365 Cloud PC images available in the gallery	As of May 2024, you can now access new Cloud PC gallery images for Windows 10 and Windows 11. These improved images have harmonized optimizations with Windows 365 apps images for better policy management: Win 10 Enterprise Cloud PC: 21H2, 22H2,Win 11 Enterprise Cloud PC: 21H2, 22H2, 23H2
Manage redirections for Cloud PCs on iOS/iPadOS devices	The Intune admin center can now be used to handle redirections for iOS/iPadOS users who access their Cloud PCs using Microsoft Remote Desktop and Windows App.

DEVICE SECURITY UPDATES

Update	What it offers
Session lock experience configuration for single sign-on	This new update offers clients the ability to configure the remote session lock experience when single sign-on (SSO) is enabled between the default disconnect behavior and showing the remote lock screen. Enabling SSO allows you to use passwordless authentication and third-party Identity Providers that federate with Microsoft Entra ID to sign in to your Cloud PC. This tool offers an SSO experience when authenticating to the Cloud PC and inside the session when accessing Microsoft Entra ID-based apps and websites.
Windows 365 support for Microsoft Purview Customer Key	Windows 365 clients are also being given a feature that supports the encryption of Cloud PCs by setting up Microsoft Purview Customer Key.
Customer Lockbox	With service release 2407 is new Windows 365 Government support for Microsoft Purview Customer Lockbox. The Customer Lockbox prevents Microsoft from accessing your content without explicit approval. This feature gets you integrated into the approval workflow process that Microsoft uses thereby restricting access to your content only to authorized requests.
Single sign-on Windows 365 clients authentication change	Single sign-on for Windows 365 is switching to the use of the Windows Cloud Login Entra ID cloud app for Windows authentication. This change will begin with the Windows and Web clients.
FQDNs removed from requirement list	Several of the required FQDNs have in the past been moved to the *.infra.windows365.microsoft.com wildcard FQDN. This move reduces the initial configuration requirements and the change rate of connectivity requirements. As of May 2024, the old FQDNs have been removed from the requirement list.
Microsoft Purview Data Loss Prevention	In March 2024 (service release 2403), it was announced that Microsoft Purview Data Loss Prevention (DLP) will now support Windows 365 Enterprise. Getting access to DLP means that you can now monitor the actions that are being taken on items you’ve determined to be sensitive. Moreover, this also helps you block unintentional sharing of these items. As soon as you onboard devices into the Microsoft Purview solutions, data concerning what users are doing with sensitive items becomes available in activity explorer.
Windows 365 Boot shared mode supports FIDO	This change can help your business strengthen the security of your Windows 365 environment. Because Windows 365 Boot shared mode now supports FIDO, enterprises can leverage hardened authentication measures that minimize the risk of successful attacks.

MONITOR AND TROUBLESHOOT

Update	What it offers
New Intune report and device action for Windows enrollment attestation (public preview)	The device status attestation report gives you information about devices that have either Completed, Failed, or Not started enrollment attestation. With the new device attestation status report in Microsoft Intune, you can find out if a device has attested and enrolled securely while being hardware-backed.
Cloud PC utilization report for Windows 365 Government	The Cloud PC utilization report offers you a useful tool for monitoring and optimizing Cloud PC usage in your organization. You can glean from it information such as how much time users are spending on their Cloud PCs or when they last connected. As of June 2024, support for this feature is now available to Windows 365 Government.
Cloud PC size recommendations report	This Cloud PC recommendations report is now out of preview and generally available. The report is an AI-powered feature that enables administrators to determine the correct size for Cloud PCs. By assessing data such as end-user Cloud PC usage patterns, platform level resource utilization data, and performance needs, you can work out the best Cloud PC configuration for your users.
Cloud PCs that aren’t available report	Generally available as of May 2024 (service release 2404). Simplifies the task for admins by helping them identify Cloud PCs that may be currently unavailable. The report will give you information concerning conditions up to 5 to 15 minutes ago. As a result, you could potentially find Cloud PCs in the report that have already recovered.
Improvements to Cloud PC connection quality report	Several upgrades to the Cloud PC connection quality report became generally available in March. The improvements that you can look forward to include: A more comprehensive view of the overall performance of your Cloud PCs.A more detailed view of devices when they are in a state of poor performance due to high round trip times.Tenant level visibility to most recent/current for:Round Trip Time.Bandwidth.Connection Time.UDP Utilization.Connection specific detail on client IP and associated CPC Gateway.Filters for all columns.
Alerts for Windows 365 Frontline maximum concurrent Cloud PCs	Windows 365 administrators will be getting even more information to help them better manage their Cloud PC environments. With this update, admins receive alerts notifying them when the maximum concurrent Cloud PCs are active for Windows 365 Frontline subscriptions.
Device action data kept for 90 days	You get to view actions performed within the last 90 days. To access this information, navigate to the Overview page for individual Cloud PCs.

UPDATES TO WINDOWS 365 BOOT

Update	What it offers
Shared and dedicated Windows 365 Boot device	Using Windows 365 Boot, admins can configure Windows 11 physical devices so that users can: Avoid signing in to their physical device.Sign in directly to their Windows 365 Cloud PC on their physical device. To add to the flexibility, Windows 365 Boot now supports both dedicated and shared PC scenarios.
Windows 365 Boot sign-in page customization	Another update for Windows 365 Boot is the availability of sign-in page customization. Previously in preview, this feature became generally available in February.
Windows 365 Boot fail fast notifications	Adding to the previous new updates is fail fast notifications. Beginning in February as well, Windows 365 Boot detection and notification of network or application setup issues transitioned to general availability.
Management of local PC settings	The last update for February allowed for changes regarding the management of local PC settings. Going forward, users will be able to manage local PC settings through their Windows 365 Boot Cloud PC.

Wrap up

Ensuring that your IT environment is operating at peak efficiency is a goal that every company should have. Optimizing the functions of applications and devices is integral to maintaining elevated productivity levels. This is why one cannot overstate the importance of the new features and updates. It’s why we regularly see them from Microsoft Intune and Windows 365.

Not only do they keep your business running smoothly. They constantly address any issues that may arise. As a business, your needs change as the operating environment evolves. Therefore, there is a need for services like Intune and the Cloud PC that can keep up with those changes.

Microsoft Intune and Windows 365 in 2025: What to Expect

Posted on December 30, 2024 by Thomas.Marcussen

As 2024 is drawing to a close, we can start to look back at the features that have been added to Microsoft Intune and Windows 365. These upgrades have enhanced the user experience, strengthened security measures, and enabled users to operate more efficiently.

As such, it will be exciting to look at what Microsoft could potentially add to these platforms in 2025. Businesses will be interested in seeing what Microsoft has on the horizon. They will also be eager to see what will improve these platforms even further while simultaneously addressing some common concerns they may have.

With this in mind, in this article, we’ll be going over the information Microsoft has released concerning features scheduled to be released in 2025.

What does 2025 hold for Intune?

Microsoft Intune: Managed device attestation for iOS/iPadOS and macOS device enrollment and ADE

When we consider the threat landscape that organizations constantly have to deal with, it’s easy to see why there is a great need for continually improving security measures. Hence why bringing ACME and managed device attestation support for eligible Apple devices to GA is a great move on Intune’s part. It should enable you to have better control over the verification processes of various devices.

Included in this update are device enrollment and ADE enrollments, notably AC2. Admins should note that this will apply to new enrollments with device enrollment (BYOD) and new enrollments with ADE or Apple Configurator tool. We can expect to see the rollout of this feature beginning in April 2025.

Microsoft Intune: Windows enrollment attestation

Staying with the same theme of enhancing security measures, businesses will also be getting this feature beginning in March 2025. You can expect to have physical devices attested at enrollment and enrollment credentials storage in the hardware of the device.

This can provide administrators with an extra bit of convenience. It will allow them to view device attestations in the new Device attestation status report. Additionally, they can force attestation from that report when necessary.

Microsoft Intune: Enhanced device inventory for Windows devices

Few things can increase work efficiency the way that easily having access to all the information you need when you need it can. This is what businesses will be getting when this service is rolled out in February 2025 enabling them to obtain more inventory information about their Windows devices. You get to specify which device properties you need to collect as well as from which devices. With this, you can view that information for your devices.

Microsoft Intune: Hardware-backed attestation – enhanced for Windows 11

This feature, which will be coming to you in January 2025, seeks to improve the Windows compliance policy. You should expect an improvement in device health due to the addition of five additional hardware attestation settings. These settings are specific to Windows 11 using advanced platform security features. The latter will include features such as firmware protection, virtualization-based security, Memory Integrity and Access Protection, and Early Launch Antimalware protection.

Microsoft Intune: macOS Platform SSO Support

Intune is constantly looking for ways to enhance the user experience for customers that use the macOS platform. To this end, features like this one in particular will give you better security and increase convenience. With the release planned for January 2025, customers should soon be able to log in on a managed Mac using their Entra ID password.

Microsoft Intune: Multiple managed accounts

Adding to the convenience that the upcoming Intune features will bring is this feature. As of January 2025, Microsoft plans on enabling users to use a single device with multiple company accounts to access company information through specific managed applications.

Microsoft Intune: Enrollment time grouping for Android Enterprise Corporate devices

Enrollment time grouping (ETG) for Android Enterprise Corporate devices is a feature that will help targeted apps and policies reach devices faster thus minimizing delays common with device setup. The rollout is slated for January 2025.

AI to boost the capabilities of the Cloud PC

Businesses cannot deny the immense potential that AI can offer them. This technology has vast applications that can positively impact business operations at just about every level. It’s therefore no surprise that Windows 365 is working on taking advantage of AI to improve the user experience for Cloud PC users. Already, Windows 365 can use AI to provide you with Cloud PC resizing recommendations that can help minimize costs and increase efficiency.

Windows 365 does this and more by leveraging AI to evaluate Cloud PC deployment and utilization. With this information in hand, companies can better plan their Cloud PC environments thus maximizing the value of their investment. These tailored, AI-powered insights will help you avoid several issues including:

Complex purchase discussions – when you lack specific information, your organization could spend vast amounts of time bogged down in discussions with vendors trying to figure out what’s most suitable for your needs.
Low productivity levels – if your environment operates with incorrect configurations, employees cannot perform at optimum levels and their output will be lower than it should be.
Fluctuations in usage and license churn – any discrepancies between your purchased licenses and actual use may cause irregular usage patterns which in turn negatively impacts cost management.

Wrap up

The various development teams at Microsoft appreciate the need to keep expanding the capabilities of the products and services they offer. As the modern work environment evolves, so too should the tools available to us. Companies need technologies that empower their employees, strengthen their security, and inspire business innovation.

Fortunately, the new features and capabilities that Microsoft Intune and Windows 365 are working on promise to deliver. Customers can plan excitedly for the future knowing that their platforms of choice will keep them ahead of the curve.

Why iOS Devices Ask for an Apple ID in the First Place

Why You May Not Have Seen This Before

How to Confirm This Is Your Issue

Check 1: List All iOS Apps with Required Assignments

Check 2: Cross-Reference with VPP

Check 3: Look at the Audit Log

Why You Cannot Just Delete the iOS Store App

The Pilot Approach: Validate on One Device Using Assignment Filters

Step 1: Create a Single-Device Filter

Step 2: Exclude the Pilot Device from the iOS Store App Assignment

Step 3: Assign the VPP Version with Device Licensing to the Pilot Device

Step 4: Have the Pilot User Dismiss the Prompt and Sync

Rolling Out the Fix to the Rest of the Estate

What Users Should Expect

Cleanup: Filters, Duplicates, and Audit Trail

A Quick Reference: iOS Store App vs VPP at a Glance

How to Prevent This from Happening Again

Healthy VPP Token Practices

Troubleshooting: When the Prompt Will Not Go Away

FAQ

Will users lose any data when I switch from iOS Store App to VPP?

Do I need a managed Apple ID for VPP with Device licensing?

Can I keep using iOS Store Apps for some apps?

What about iPadOS devices?

My VPP token was renewed by someone else and now apps are failing – is this related?

Summary

References

Why You Need to Remove Classic Teams

What Gets Removed

Option 1: Remove Classic Teams with a Standalone Script

Usage

Option 2: Remove Classic Teams with Intune Proactive Remediations

Detection Script

Remediation Script

Setting Up the Proactive Remediation in Intune

Logging

Summary: Remove Classic Teams the Right Way

The Real Problem: Teams Is a Web App in Disguise

Common Microsoft Teams Error Codes This Script Fixes

Authentication Errors

Meeting Join / UI Errors

WebView2 / Rendering Issues

Network / Proxy Related

When This Script Will NOT Help

What the Script Actually Does

Common Issues with the Intune Connector for AD version 6.2501.2000.5

New and Improved Build

Updated Intune Connector

Updated Troubleshooting Guide

Pre-installation Requirements for Intune Connector

Installation Process

DOWNLOADING THE CONNECTOR

INSTALLING THE CONNECTOR ON THE SERVER

SIGNING IN With Intune Connector

VERIFICATION

Wrap Up

Introduction: The Challenge of Managing Microsoft Teams Rooms

What Are Microsoft Teams Rooms (MTR) Devices?

Why Are MTRs So Locked Down?

Why Standard App Deployment Doesn’t Work on MTR

What Can You Manage on MTR with Intune?

The Workaround: Use Proactive Remediation Scripts

What Are Proactive Remediations in Intune?

Step-by-Step: Deploy Apps to MTR Devices Using Remediation Scripts

Step 1: Choose an Application

Step 2: Host the Installer

Step 3: Write the Detection Script

Step 4: Write the Remediation Script

Step 5: Deploy via Intune

Real-World Example: Install Chocolatey on MTR

Detection Script

Remediation Script

Security Tips for Remediation Scripts on MTR

How to Maintain This Workaround

When Should You Use This Workaround?

Alternatives to Intune Remediation Scripts

Conclusion: MTR App Deployment is Possible—With the Right Tools

Troubleshooting Errors Like 0x80180014 and Navigating Device Records in the Admin Portals

Introduction

What Is Microsoft Intune?

Section 3: Common Error – `0x80180014`