Microsoft 365 & Intune

Windows Hello for Business (WHfB) lets people sign in with a PIN or biometric tied to the device's TPM instead of a password. In a hybrid environment, the hard part has always been getting on-premises resources like file shares, printers and Kerberos apps to accept that Hello sign-in. Get it wrong and the user signs in with a PIN, then gets a password prompt the moment they open a share. The older key trust and certificate trust models needed either a PKI with certificates on your domain controllers, or a wait while public keys synced back to AD. Cloud Kerberos Trust removes both. Entra ID issues a partial Kerberos ticket that your DCs trust. It's now Microsoft's recommen…

Every environment has little problems that keep coming back, like a service that keeps getting disabled or a registry setting an app keeps resetting. Each time, somebody calls the help desk and a tech fixes it by hand. Intune Remediations (previously Proactive Remediations) are how we stop doing that. You give Intune a pair of PowerShell scripts that run on a schedule, one to detect the problem and one to fix it. Below is how we write them, how we schedule and check them, and the Graph gotcha that left one of ours detecting problems for weeks without fixing a single one. Licensing and setup Licensing that includes Remediations, which means Windows Enterprise E3/E5 or E…

Most real software gets into Intune as a Win32 app. That covers EXE installers, MSIs with transforms, and anything that needs a script to do some work before or after setup. Building the package is the easy part. What actually breaks deployments is detection rules, install context and return codes, and usually you find out when someone opens a ticket saying the app they were promised never showed up. This is the process we follow, including the testing step that saves us the most time. Tools to grab first The Microsoft Win32 Content Prep Tool (IntuneWinAppUtil.exe) from Microsoft's GitHub. The installer and its silent install and uninstall switches. Check the vendor's …

If your domain-joined PCs are already hybrid-joined to Entra ID, one Group Policy setting will get them into Intune. The PC enrolls itself in the background with the signed-in user's Entra credentials, and nobody has to click anything. That's the theory. In practice we spent a long time on a handful of machines that refused to enroll, and every one of them was used by someone in IT. It turned out to be a Conditional Access policy. Below is the setup we use, how to check it, and how we tracked that problem down. Confirm these before you start Entra Connect (or Cloud Sync) configured for hybrid Entra join, with the computer OUs in sync scope. Users licensed for Intune, d…