Intune Cheat Sheet: Advanced Edition

Your comprehensive guide to managing devices with Microsoft Intune.

Intune Roles and Responsibilities

Define core responsibilities and expertise areas for managing Microsoft Intune. This section outlines advanced tasks in device management, policy enforcement, and troubleshooting for professionals with 5.7 years of experience.

Key Concepts

Responsibility Description Advanced Troubleshooting Expertise
Device Enrollment & Lifecycle Management • Manage and oversee the full lifecycle of devices – enrollment, provisioning, and retirement.
• Implement and manage Windows Autopilot and Apple Business Manager (ABM) integration.
• Ensure successful enrollment across multiple platforms (Windows, macOS, Android, iOS). 		1. Diagnose enrollment failures (e.g., hardware hash upload, MDM authority errors).
2. Use dsregcmd /status to validate Azure AD Join and MDM registration.
3. Analyze device logs (C:\Windows\Temp\MDMDiagnostics for Windows issues).
Policy Management & Compliance Enforcement • Design, deploy, and monitor compliance policies (e.g., password complexity, encryption).
• Implement and maintain device configuration profiles (Wi-Fi, VPN, BitLocker, Firewall).
• Automate compliance checks and remediate non-compliant devices via Intune. 		1. Investigate non-compliant devices by analyzing logs in Intune Management Extension.
2. Resolve policy conflicts (Intune vs. Group Policy) using the gpresult /h report.
3. Troubleshoot Conditional Access enforcement issues by inspecting Azure Sign-in Logs.
OS Deployment & Autopilot Management • Oversee Windows OS deployment using Windows Autopilot and feature updates.
• Configure Autopilot profiles (User-Driven, Self-Deploying, Hybrid Azure AD Join).
• Ensure devices receive and apply required OS updates and feature releases. 		1. Collect and verify hardware hashes using Get-WindowsAutoPilotInfo.ps1.
2. Resolve Autopilot errors by inspecting C:\Windows\Logs\ModernDeployment.
3. Validate network endpoints to ensure connectivity with Windows Update services.
Application Deployment & Win32 Management • Package and deploy applications (Win32, Microsoft Store, LOB, VPP, and Managed Google Play).
• Configure detection rules and install commands for custom Win32 applications.
• Manage application lifecycles (assignment, update, retire). 		1. Repackage apps using IntuneWinAppUtil.exe for Win32 deployment.
2. Diagnose failures using IntuneManagementExtension.log.
3. Resolve application installation issues by validating detection rules and dependencies.
Security & Conditional Access Implementation • Design and enforce Conditional Access policies for secure corporate resource access.
• Implement Zero Trust strategies and advanced security protocols (BitLocker, Defender ATP).
• Integrate security baselines and ensure endpoint compliance across hybrid environments. 		1. Troubleshoot Conditional Access failures using Microsoft Entra ID Sign-In Logs.
2. Identify compliance mismatches using Intune compliance and policy reports.
3. Analyze endpoint protection errors via C:\ProgramData\Microsoft\Windows Defender logs.
Monitoring, Reporting & Automation • Monitor device status, policy compliance, and application success rates using Intune reports.
• Automate repetitive tasks using PowerShell and Graph API scripts.
• Maintain comprehensive documentation for audits and troubleshooting processes. 		1. Use Device Compliance Reports to identify and resolve policy gaps.
2. Develop PowerShell scripts to automate device reporting and app packaging.
3. Troubleshoot automation failures by reviewing Graph API logs and PowerShell outputs.

Enroll Devices

Enroll devices into Microsoft Intune for centralized management, security policies, and compliance enforcement. Learn the different enrollment methods available for various device types.

Key Concepts

Task Steps Explanation Details
Enroll Windows Devices (AutoPilot) 1. Navigate to Microsoft Intune Admin Center → Devices > Windows > Windows Enrollment.
2. Set up AutoPilot Profiles (User-Driven, Self-Deploying, Hybrid Azure AD Join).
3. Register devices via hardware hash, OEM, or JSON import.
4. Assign profiles to device groups and verify the sync status.
5. Enable Enrollment Status Page for user experience tracking.
6. Validate policies using Intune Troubleshooting Blade. 		Automates Windows device enrollment with minimal user interaction. Troubleshooting Tools & Log Paths – Windows Enrollment:
- Enrollment Status Page (ESP) Logs: Key for monitoring device enrollment progress.
  C:\Windows\Provisioning\Status\EnrollmentStatusPage.log
- MDM Diagnostic Report: Comprehensive device management and enrollment diagnostics.
  Run MDMDiagReport.exe to generate detailed logs in ZIP format
- Device Management-Enterprise-Diagnostics-Provider Logs: Logs related to MDM enrollment and policy application.
  Event Viewer → Applications and Services Logs → Microsoft → Windows → DeviceManagement-Enterprise-Diagnostics-Provider
- Registry Keys for Enrollment: Check enrollment status and configuration:
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Enrollments
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\MDM
- Services Related to Enrollment: Confirm these services are running:
  dmwappushservice (Device Management Wireless Application Protocol Push Service)
  EnterpriseMgmt (Enterprise Management Service)
- Task Scheduler: Verify scheduled enrollment and management tasks:
  Task Scheduler → Microsoft → Windows → EnterpriseMgmt
- Company Portal App: Used for manual enrollment and compliance status checks.
  Available in Start Menu or via Microsoft Store
- Command Line Enrollment Status: Use dsregcmd /status to check device registration status.
  Also try dsregcmd /debug for verbose logs.
- Event Logs for Enrollment Failures: Check System and Security logs as well for errors.
  Event Viewer → Windows Logs → System and Security
Enroll Android Devices (Fully Managed) 1. Go to Devices > Android > Android Enrollment in Intune.
2. Configure Android Enterprise by linking to Google Play.
3. Create a Corporate-Owned Fully Managed Profile.
4. Enable Zero-Touch Enrollment in the Google admin console.
5. Factory reset the device and scan the generated QR code.
6. Ensure Compliance Policies are applied to enforce security. 		Provides full control over corporate-owned Android devices. Troubleshooting Tools & Log Paths – Android Enrollment:
• Company Portal Logs: Key logs for device enrollment and policy application.
  /data/data/com.microsoft.windowsintune.companyportal/files/
• MDM Diagnostic Logs: Contains detailed enrollment and compliance logs.
  /sdcard/Android/data/com.microsoft.intune.companyportal/files/logs/
• Device Policy Logs: Tracks policies applied via Intune.
  Logcat filtered with “DevicePolicyManager” tag
• Android Settings - Device Management: To verify enrolled device status and sync.
  Settings > Accounts > Work Profile or Device Management
• Google Play Services Logs: Important for device compliance and policy enforcement.
  Logcat filtered for “com.google.android.gms”
• Intune App SDK Logs: For troubleshooting app configurations via Intune SDK.
  Application’s internal logs, usually accessed via adb or app UI
• ADB Commands for Enrollment Debugging: Run:
  adb logcat -s DevicePolicyManager or adb shell dumpsys device_policy
• System Event Logs: Check system events related to enrollment.
  adb shell logcat and filter errors/warnings related to device management
• Service Status Check: Ensure Device Policy Controller and related services are running.
  adb shell dumpsys device_policy to view status
Enroll iOS/macOS Devices (ADE) 1. Set up Apple Business Manager (ABM) or Apple School Manager (ASM).
2. Navigate to Devices > iOS/iPadOS/macOS Enrollment in Intune.
3. Sync devices from ABM/ASM and create enrollment profiles.
4. Configure Device Enrollment Program (DEP) profiles.
5. Assign profiles to device groups and push to synced devices.
6. Enable Company Portal app for user self-service and policy enforcement. 		Automates enrollment and configuration for Apple devices. Troubleshooting Tools & Log Paths – iOS Enrollment:
• Company Portal App Logs: Collect logs directly from the Company Portal app on iOS.
  Settings > Privacy > Analytics & Improvements > Analytics Data (Look for logs related to Company Portal)
• Apple Configurator: Use Apple Configurator to monitor device enrollment and configuration status.
  Connect device and review profiles and logs during enrollment.
• MDM Server Logs: Check your Intune MDM server logs for enrollment requests and status.
  Typically accessed via the Azure portal > Intune > Device enrollment troubleshooting logs.
• Device Console Logs: View iOS device logs using macOS Console app or Xcode.
  Connect device to Mac > open Console.app > select device > filter for MDM or enrollment errors.
• Profile and Certificate Validation: Check installed profiles and certificates on iOS device.
  Settings > General > Profiles & Device Management
• Network Connectivity Check: Ensure device can reach Intune and Apple MDM endpoints:
  https://login.microsoftonline.com, https://applemdm.apple.com, https://enterpriseregistration.windows.net
• Apple Push Notification Service (APNS): Confirm valid APNS certificate in Intune portal.
  Check under Devices > Enroll devices > Apple Enrollment > Apple MDM Push certificate
• Event Logs in Azure Portal: Review enrollment event logs:
  Intune > Devices > Monitor > Device Enrollment
• Company Portal Reinstallation: Remove and reinstall Company Portal app to reset enrollment state.
  Sometimes resolves stuck or incomplete enrollments.
• Reset Network Settings: On device, Settings > General > Reset > Reset Network Settings to fix connectivity problems during enrollment.
Enroll Hybrid Azure AD Joined Devices 1. Configure Azure AD Connect for Hybrid Join.
2. Enable device registration via Group Policy (GPO) or Intune policy.
3. Go to Devices > Windows > Windows Enrollment in Intune.
4. Create and assign a Hybrid Join AutoPilot profile.
5. Validate registration in the Azure AD Devices portal.
6. Use dsregcmd /status to verify device state. 		Supports both on-premises and cloud management via Azure AD. Requirements: Azure AD P1 or P2, Azure AD Connect.
Advanced: Set up Device Writeback for conditional access.
Monitoring: Check device join status in Azure AD logs.

Windows Device Enrollment

Enroll Windows devices into Microsoft Intune for centralized management, security policies, and compliance enforcement. Learn different enrollment methods, including AutoPilot, Hybrid Azure AD Join, and Group Policy enrollment.

Key Concepts

Enroll Windows Devices Using AutoPilot

Windows Autopilot simplifies the process of setting up and pre-configuring new Windows devices, providing a streamlined experience for both IT and end-users.

Task Steps Explanation Details
Prepare Devices for Autopilot 1. Gather the hardware hash of the devices.
2. Use the Get-WindowsAutopilotInfo PowerShell script or the Microsoft Endpoint Manager admin center.
3. Import the hardware hash into Microsoft Intune.
4. Create a device group in Azure AD and add the Autopilot devices.
 Collect device-specific information and import it into Intune. Hardware Hash: A unique identifier for each device.
Get-WindowsAutopilotInfo: A PowerShell script to retrieve device information.
Intune: Used to manage and configure Autopilot devices.
Create an Autopilot Profile 1. Sign in to the Microsoft Endpoint Manager admin center.
2. Go to Devices > Windows > Enrollment > Deployment Profiles.
3. Click Create Profile and provide a name and description.
4. Configure the Out-of-Box Experience (OOBE) settings:
  • Deployment mode: User-Driven or Self-Deploying.
  • Join to Azure AD: Yes or No.
  • Microsoft Software License Terms: Accept or Hide.
  • Hide privacy settings: Yes or No.
  • User account type: Standard or Administrator (Self-Deploying mode).
5. Assign the profile to the Azure AD group containing the Autopilot devices.
6. Click Create to save the profile. 		Define the OOBE settings and apply them to devices. OOBE: The initial setup process that users go through.
User-Driven: Requires user interaction during setup.
Self-Deploying: Automated setup, no user interaction (for kiosks, etc.).
Enroll Devices with Autopilot 1. Ensure devices have internet access.
2. For new devices: Start the device and go through the OOBE.
3. For existing devices: Reset the device to start the OOBE process.
4. The Autopilot profile will be applied during the OOBE.
5. The device will join Azure AD (if configured).
6. Intune will enroll the device and apply policies.
 The device automatically enrolls and configures itself. Internet Access: Required for Autopilot to function.
OOBE Process: The user experience when setting up a new Windows device.
Intune Policies: Configurations applied to the device after enrollment.
Manage Autopilot Devices 1. Monitor device enrollment status in the Microsoft Endpoint Manager admin center.
2. Reassign profiles if needed.
3. Delete devices from Autopilot if necessary.
4. Troubleshoot enrollment issues using Intune.
 Monitor, reconfigure, and troubleshoot Autopilot deployments. Endpoint Manager: A central console to manage devices and policies.
Troubleshooting: Diagnose and resolve any enrollment problems.
Hybrid Azure AD Join 1. Configure Azure AD Connect to synchronize devices.
2. Create and assign a Domain Join profile in Intune.
3. Ensure devices have network connectivity to the domain controller.
4. The device will join the on-premises domain and register with Azure AD. 		Join devices to both on-premises Active Directory and Azure AD. Azure AD Connect: Tool for synchronizing on-premises AD with Azure AD.
Domain Join Profile: Intune configuration for hybrid join.
Autopilot for existing devices 1. Use the Get-WindowsAutopilotInfo.ps1 script to gather hardware hash.
2. Import the hardware hash into Microsoft Intune.
3. Create an Autopilot deployment profile.
4. Reset the Windows device. 		Enroll devices that are already in use. Hardware Hash: Unique identifier of the Windows device.
Get-WindowsAutopilotInfo.ps1: PowerShell script.
Delete a device from Autopilot 1. In the Microsoft Endpoint Manager admin center, go to Devices > Windows > Windows enrollment > Devices.
2. Select the device you want to delete, and then click Delete.
 Remove a device from Autopilot management. Microsoft Endpoint Manager admin center: Web portal to manage devices.
Enroll Devices via Hybrid Azure AD Join 1. Ensure Azure AD Connect is configured and syncing devices:
 • Enable "Device Writeback" for Hybrid Join.
2. In the Intune console, navigate to Devices > Windows > Windows Enrollment.
3. Set up a Configuration Profile for Hybrid Azure AD Join:
 • Go to Device Configuration > Profiles > Create Profile.
 • Select "Windows 10 and later" and "Domain Join".
4. Deploy the profile to the appropriate Device Group.
5. Apply Group Policy (GPO) for automatic enrollment:
 • Enable "Enable automatic MDM enrollment using Azure AD credentials".
 • Target required Organizational Units (OUs).
6. Restart the devices and confirm Hybrid Join via:
 • dsregcmd /status on the client machine.
 • Azure AD → Devices > All Devices for registration status. 		Allows Windows devices to be managed both on-premises and in the cloud. Requirements: Windows 10/11 Enterprise, Azure AD Connect.
Advanced: Use GPO with security filtering for precise targeting.
Monitoring: Audit logs in Azure AD for join operations.
Enroll via Group Policy 1. Verify MDM auto-enrollment settings are enabled in Intune:
 • Navigate to Devices > Windows Enrollment > Automatic Enrollment.
2. Set up Group Policy for automatic enrollment:
 • Open Group Policy Management Console (GPMC).
 • Navigate to Computer Configuration > Administrative Templates > Windows Components > MDM.
 • Enable "Enable automatic MDM enrollment using Azure AD credentials".
3. Assign the GPO to the appropriate Organizational Units (OUs).
4. Restart devices to trigger auto-enrollment.
5. Verify device enrollment in Intune:
 • Go to Devices > Windows > Monitor > Enrollment.
 • Check Enrollment Failures for troubleshooting. 		Mass enrolls domain-joined Windows devices without manual intervention. Requirements: Windows 10/11 Pro, Enterprise, or Education edition.
Advanced: Use Security Filtering to target specific groups.
Monitoring: Review GPO results with gpresult /h on client devices.
Enroll Devices via Azure AD Join 1. Enable Azure AD Join in the Intune portal:
 • Go to Devices > Windows > Windows Enrollment.
 • Configure Enrollment Restrictions for Azure AD Join.
2. Set up user permissions in Azure AD:
 • Navigate to Azure Active Directory > Devices > Device Settings.
 • Enable "Users may join devices to Azure AD".
3. On the Windows device:
 • Navigate to Settings > Accounts > Access work or school.
 • Click "Join this device to Azure Active Directory".
4. Validate device registration in Intune and Azure AD. 		Directly registers devices to Azure AD for cloud-based management. Requirements: Azure AD P1 or P2 licensing.
Advanced: Automate Azure AD Join using Autopilot.
Monitoring: Use Azure AD Device Blade for real-time monitoring.

Android Device Enrollment

Enroll and manage Android devices in Microsoft Intune using various methods, including Fully Managed, Work Profile, and Dedicated Device modes. Choose the best enrollment method based on your organization's needs.

Key Concepts

Task Steps Explanation Details
Enroll Android Devices with Work Profile (BYOD) 1. Navigate to Microsoft Intune Admin Center → Devices > Android > Android Enrollment.
2. Select Android Enterprise and click Set up Work Profile.
3. Approve Intune’s integration with Google Play (requires Google Admin access).
4. Create an Enrollment Profile for Work Profile:
 • Go to Devices > Android > Android Enrollment > Corporate-Owned Personally Enabled (COPE).
 • Configure profile settings (e.g., app permissions, data sharing).
5. Share instructions with end users:
 • Instruct users to install the Microsoft Intune Company Portal app.
 • Users sign in with corporate credentials and complete registration.
6. Monitor enrollment status via Devices > Monitor > Enrollment Status. 		Enroll Android Devices with Work Profile (BYOD) – Step-by-Step

1. Navigate to Microsoft Intune Admin Center:
 • Open a web browser and go to https://intune.microsoft.com
 • Sign in using your Intune Admin credentials.
 • Go to Devices > Android > Android Enrollment

2. Set up Android Enterprise Work Profile:
 • Under the Android Enrollment section, select Android Enterprise.
 • Click on Set up Work Profile.

3. Connect Intune to Managed Google Play:
 • You will be redirected to Google to sign in with a Google Admin Account.
 • Accept the Terms and complete the binding process.
 • This links Intune with your organization's Managed Google Play account.

4. Create an Enrollment Profile for Work Profile:
 • Navigate to Devices > Android > Android Enrollment > Work profile
 • Click on Create Profile.
 • Provide a meaningful Name and Description.
 • Configure settings like:
  – Data sharing between work and personal profiles
  – System app permissions
  – Password and encryption requirements
 • Assign the profile to the required Azure AD groups.
 • Save and publish the profile.

5. End-User Instructions:
 • Ask users to install the Microsoft Intune Company Portal app from the Play Store.
 • Open the app and sign in with their corporate credentials.
 • Follow the on-screen steps to enroll their device:
  – Setup of a Work Profile on the device.
  – Accept necessary permissions.
  – Device compliance checks.
 • After successful enrollment, apps assigned via Intune will install in the Work Profile.

6. Monitor Enrollment Status:
 • Go to Devices > Monitor > Enrollment failures / Enrollment status.
 • You can filter by platform (Android), user, or group.
 • This helps ensure all targeted devices are enrolled successfully and compliant.
 Ideal for: BYOD users who need corporate apps without full device control.
Advanced: Apply Conditional Access for app-level protection.
Monitoring: Use the Device Compliance blade to track and remediate issues.
Enroll Android Devices as Fully Managed (Corporate-Owned) 1. Ensure Android Enterprise is configured in Intune:
 • Go to Devices > Android > Android Enrollment and confirm setup.
2. Create a Fully Managed Enrollment Profile:
 • Select Corporate-Owned Fully Managed profile type.
 • Customize policy settings (e.g., password requirements, app restrictions).
3. Enroll devices using one of the following methods:
 • QR Code: Factory reset the device, tap the screen multiple times, and scan the QR code.
 • Enrollment Token: Enter the token during the setup wizard.
 • Zero-Touch Enrollment: Integrate with the Android Zero-Touch Portal for bulk enrollment.
4. Validate enrollment by checking device status under Monitor > Device Enrollment.
5. Apply policies and confirm compliance via the Device Blade. 		Enroll Android Devices as Fully Managed (Corporate-Owned) – Step-by-Step

1. Open Microsoft Intune Admin Center:
 • Visit https://intune.microsoft.com
 • Sign in using your Microsoft 365 admin credentials.
 • Navigate to Devices > Android > Android Enrollment

2. Set up Android Enterprise:
 • Under Android Enrollment, select Android Enterprise.
 • If not yet configured, click Connect to Managed Google Play.
 • Sign in with a Google account (Gmail) and approve Intune’s integration.
 • This creates a Managed Google Play account linked to your Intune tenant.

3. Create Enrollment Token/Profile for Fully Managed Devices:
 • Navigate to:
  Devices > Android > Android Enrollment > Corporate-Owned, Fully Managed user devices
 • Click on + Create profile.
 • Enter a unique Name and Description.
 • Configure the following:
  – Token Expiration Date (max 90 days)
  – Device Group Assignment (Azure AD group)
  – Device naming format (optional)
 • Click Create.
 • After creation, copy the Enrollment Token (string of characters).

4. Provision Android Devices Using Enrollment Token:
 • Factory reset the device (if not already new).
 • At the first screen (Welcome screen), enter the special code to trigger provisioning:
  Tap the screen 6 times or use the afw#setup method:
  – When prompted for Google account, enter: afw#intune
  – This installs the Microsoft Intune app.
 • Continue setup and scan the QR code/token from Intune (optional method).
  – You can generate QR code from the Enrollment Profile page.

5. Device Automatically Configures:
 • Microsoft Intune installs and initiates management.
 • Device becomes fully managed (no personal profile).
 • Apps and policies assigned via Intune are pushed during provisioning.
 • User signs in with corporate Azure AD credentials.

6. Post-Provisioning:
 • Device appears in Intune under:
  Devices > All devices or Devices > Android.
 • Use filters like device name, serial number, or user.

7. Monitor and Troubleshoot:
 • Check device compliance under:
  Devices > Monitor > Device compliance / Enrollment failures
 • Use logs on the device:
  – Company Portal logs
  – DeviceManagement-Enterprise-Diagnostics-Provider
 • Use MDM Diagnostics Report if needed:
  Settings > Accounts > Access work or school > Export report
 Methods: QR Code, NFC Bump, Zero-Touch, or Token-based enrollment.
Advanced: Implement App Configuration Policies for advanced controls.
Monitoring: Use Endpoint Analytics for performance and health insights.
Enroll Android Devices as Dedicated Devices (Kiosk Mode) 1. Set up Android Enterprise if not already configured.
2. Create a Dedicated Device Enrollment Profile:
 • Go to Devices > Android > Android Enrollment and select Corporate-Owned Dedicated Devices.
 • Choose kiosk mode (single app, multi-app, or fully locked) and define allowed applications.
3. Enroll the device:
 • Factory reset the device.
 • Scan the QR code or enter the enrollment token during setup.
4. Configure kiosk behavior:
 • Restrict hardware buttons (e.g., disable back or home buttons).
 • Set device reboot schedules and auto-update settings.
5. Verify enrollment via the Intune dashboard under Devices > Android > Monitor. 		Enroll Android Devices as Dedicated Devices (Kiosk Mode) – Step-by-Step

1. Open Microsoft Intune Admin Center:
 • Visit https://intune.microsoft.com
 • Sign in with Microsoft 365 Admin credentials.
 • Navigate to Devices > Android > Android Enrollment

2. Set up Android Enterprise:
 • Under Android Enrollment, select Android Enterprise.
 • If not already done, click Connect to Managed Google Play.
 • Sign in with a Google Account (admin@gmail.com) and accept the permissions.
 • This links your tenant with Managed Google Play for kiosk deployments.

3. Create Enrollment Profile for Dedicated Devices:
 • Go to Devices > Android > Android Enrollment > Corporate-owned dedicated devices
 • Click + Create Profile.
 • Enter a profile Name and Description.
 • Configure options like:
  – Token expiration (max 90 days)
  – Device group assignment
  – Device name template (optional)
 • Click Create.
 • Save the generated Enrollment Token and QR Code.

4. Create a Device Configuration Profile for Kiosk Mode:
 • Go to Devices > Configuration profiles
 • Click + Create Profile
 • Platform: Android Enterprise
 • Profile type: Device restrictions
 • Under Kiosk section:
  – Select Single App or Multi-app Kiosk mode.
  – Enter app details (package name, class name).
  – Example (for Microsoft Edge):
   com.microsoft.emmx – App package
   com.microsoft.emmx.Main – Class name
 • Assign the profile to device group linked to the Enrollment Token.

5. Provision Device Using QR Code (Dedicated Mode):
 • Factory reset the Android device (or use new device).
 • At the Welcome screen, tap 6 times on the same spot (anywhere).
 • QR code scanner opens. Scan the QR code from the Intune Enrollment Profile.
 • Device auto-installs Intune app and begins kiosk enrollment.

6. Post-Enrollment Device Behavior:
 • Device will launch directly into Kiosk Mode.
 • Users cannot exit or use other apps (in Single-App mode).
 • In Multi-App Kiosk, users will only see whitelisted apps.

7. Monitor & Support:
 • Go to Devices > All devices or use Monitor > Device compliance
 • View deployment logs, status, and device sync info.
 • Use MDM diagnostics report:
  Settings > Accounts > Access Work or School > Export report

 Use Case: Digital signage, point-of-sale (POS), or single-use devices.
Advanced: Enable Managed Home Screen for multi-app kiosk mode.
Monitoring: Use the Device Diagnostics tool for in-depth troubleshooting.
Enroll Android Devices Using Zero-Touch Enrollment 1. Set up Zero-Touch Enrollment in the Android Enterprise portal:
 • Contact your device reseller to register devices in the Zero-Touch Portal.
2. Link Zero-Touch Portal with Intune:
 • In Intune, go to Devices > Android Enrollment > Corporate-Owned.
 • Select Zero-Touch Enrollment and follow the integration steps.
3. Create a Zero-Touch enrollment profile and assign policies.
4. Ensure devices are factory reset and power on for automatic provisioning.
5. Confirm device enrollment status in Intune under Monitor > Enrollment. 		Enroll Android Devices Using Zero-Touch Enrollment – Step-by-Step

1. Prerequisites:
 • Devices must support Zero-Touch Enrollment (ZTE).
 • Devices must be purchased from a Zero-Touch reseller (e.g., Samsung Knox, Google ZTE partner).
 • You need access to the Zero-Touch Portal with admin credentials.
 • Intune must be bound to Managed Google Play.

2. Link Intune to Managed Google Play:
 • Go to Intune Admin Center → Devices → Android → Android Enrollment
 • Click Managed Google Play → Sign in and approve the binding.
 • This step enables Android Enterprise enrollment via Intune.

3. Create an Intune Enrollment Profile (Fully Managed):
 • Navigate to Devices > Android > Android Enrollment > Corporate-owned, fully managed user devices
 • Click + Create Profile
 • Define:
  – Profile Name and Description
  – Token expiration (up to 90 days)
  – Assign to appropriate device group
 • Click Create and copy the enrollment token.

4. Configure Zero-Touch Portal:
 • Visit zerotouch.google.com
 • Log in with your organization’s ZTE admin account.
 • Select the device(s) using IMEI or Serial Number (usually auto-populated by reseller).
 • Click + Configuration → Create a new configuration:
  – Configuration name: e.g., "Intune Fully Managed"
  – EMM DPC: Select com.microsoft.intune.dpc
  – DPC Extras:
  
{
  "android.app.extra.PROVISIONING_DEVICE_ADMIN_COMPONENT_NAME":
  "com.microsoft.intune.dpc/.IntuneAndroidDeviceAdminReceiver",
  "android.app.extra.PROVISIONING_EMAIL": "user@yourdomain.com",
  "android.app.extra.PROVISIONING_TOKEN": "YourEnrollmentToken"
}

  – Company name: Displayed during device provisioning
  – Support info: Contact number/email for IT support
 • Save and assign this configuration to the required device(s).

5. Power On the Android Device:
 • Turn on the factory-reset device (or new out-of-box).
 • Device auto-detects Zero-Touch enrollment and shows your company’s branding.
 • Device auto-installs Intune Company Portal silently.
 • Device is enrolled as a Fully Managed device.

6. Post-Enrollment Actions:
 • Device is assigned apps and policies from Intune.
 • Appears in Devices > Android > All Devices.
 • User signs in with corporate credentials if required (user-affinity).

7. Monitor Enrollment:
 • Go to Devices > Monitor > Enrollment failures or All devices
 • Use filters for platform, profile, or group
 • Export logs or sync devices as needed

 Ideal for: Enterprises requiring automated device deployment.
Advanced: Use dynamic groups to automate policy assignment.
Monitoring: Validate Zero-Touch status in the Android Enterprise Admin Console.
Enroll Android Devices Using Samsung Knox (Without Reseller) 1. Register for Samsung Knox Mobile Enrollment (KME):
 • Go to kms.samsungknox.com and sign up as an IT Admin.
2. Install and use the Knox Deployment Tool (KDT) to manually add devices:
 • Connect Samsung device via USB and enable USB Debugging.
 • Use KDT to register device to KME without a reseller.
3. Create a Knox profile in the KME portal:
 • Assign the Intune DPC (com.microsoft.intune.dpc) with your Intune token.
4. Factory reset device and power on:
 • Device auto-installs Intune Company Portal and enrolls silently.
5. Confirm device enrollment status in Intune:
 • Go to Devices > Monitor > Enrollment for verification. 		Enroll Samsung Android Devices Using Samsung Knox Mobile Enrollment (KME) without OEM/Reseller – Step-by-Step

1. Prerequisites:
 • Devices must be Samsung Knox-enabled (typically Android 8.0+).
 • You must create a free account at https://kms.samsungknox.com
 • Devices must be factory reset (or new).
 • You need access to a Windows PC and Samsung Knox Deployment Tool.

2. Register for Samsung Knox Mobile Enrollment:
 • Visit https://kms.samsungknox.com
 • Sign up as an IT Admin.
 • After login, go to Customer Portal > Devices

3. Download and Install Knox Deployment Tool (KDT):
 • Go to Samsung Knox Deployment Tool
 • Download and install on a Windows PC.
 • Launch KDT and sign in using your Knox account credentials.

4. Connect Samsung Device via USB to PC:
 • Enable Developer Options > USB Debugging on the device.
 • Connect the device via USB cable.
 • In KDT, device will appear under Available devices.

5. Add Device to Knox Portal using KDT:
 • Select the device in KDT and click Add to KME.
 • Choose a profile (or create one).
 • Device will be registered to the Knox KME portal manually.

6. Create a Knox Profile for Intune:
 • In the Knox KME portal, go to Profiles > + Create Profile
 • Enter profile name: Intune Fully Managed
 • Under MDM Agent APK:
  – Select: Use Google Play EMM
  – EMM: com.microsoft.intune.dpc
  – MDM URL (optional): leave blank or use token

7. Enter DPC Extras (Token-based Enrollment):
 • Go to Intune → Devices > Android > Android Enrollment > Fully Managed
 • Create a profile, copy the Enrollment Token
 • In Knox, under DPC Extras, paste:
  
{
  "android.app.extra.PROVISIONING_DEVICE_ADMIN_COMPONENT_NAME":
  "com.microsoft.intune.dpc/.IntuneAndroidDeviceAdminReceiver",
  "android.app.extra.PROVISIONING_TOKEN": "YourEnrollmentToken"
}

 • Click Save and assign this profile to the device(s).

8. Factory Reset and Enroll the Device:
 • Perform a factory reset or turn on a new device.
 • Device will auto-launch Samsung Knox Enrollment flow.
 • Intune Company Portal will be installed silently.
 • Device will enroll into Intune as a Fully Managed Device.

9. Post-Enrollment Monitoring:
 • Go to Intune Admin Center > Devices > Android > All Devices
 • Check sync status, compliance, and device assignment.
 • Use Monitor > Enrollment failures for troubleshooting.

 Ideal for: Organizations using Samsung devices outside official OEM channels.
Advanced: Customize DPC extras for token-based userless or user-driven setup.
Monitoring: Track device status in both Knox Portal and Intune Admin Center.

iOS/macOS Device Enrollment

Enroll and manage Apple devices in Microsoft Intune using Automated Device Enrollment (ADE), Apple Business Manager (ABM), and User Enrollment. Choose the best enrollment method based on your organization's needs.

Key Concepts

Task Steps Explanation Details
Enroll iOS/macOS Devices with Automated Device Enrollment (ADE) 1. Sign in to Apple Business Manager (ABM) and register devices:
 • Ensure all corporate-owned devices are added to ABM.
2. In Intune, go to Devices > iOS/iPadOS or macOS > Enrollment Program Tokens:
 • Download the public key and upload it to ABM.
 • Sync devices from ABM to Intune.
3. Create an Automated Device Enrollment Profile:
 • Select user affinity (with or without user).
 • Enable Supervised Mode for advanced management.
 • Customize device setup screens (e.g., skip Apple ID, Siri setup).
4. Assign the profile to synced devices and confirm enrollment.
5. Factory reset devices or ship new ones – they will enroll automatically. 		Automates enrollment for corporate-owned Apple devices. Requirements: Apple Business Manager (ABM) integration.
Advanced: Use enrollment profiles for different device types.
Monitoring: Verify enrollment under Devices > Monitor > Enrollment.
Enroll iOS Devices Using User Enrollment (BYOD) 1. In Intune, go to Devices > iOS/iPadOS > Enrollment > Enrollment Types:
 • Enable User Enrollment for personal devices.
2. Share enrollment steps with users:
 • Download the Intune Company Portal app from the App Store.
 • Sign in using corporate credentials and follow prompts.
3. Apply App Protection Policies (APP) for additional data protection. 		Provides limited control over personal (BYOD) devices. Use Case: Employees accessing work resources on personal devices.
Advanced: Apply Conditional Access to enforce policy compliance.
Monitoring: Track user enrollment under Devices > Monitor.
Manually Enroll macOS Devices (Non-ABM) 1. Navigate to Devices > macOS > macOS Enrollment in Intune.
2. Create a Device Enrollment Profile:
 • Configure MDM profile with required policies.
3. On the Mac device:
 • Download and install the Intune Company Portal.
 • Authenticate using corporate credentials.
4. Validate successful enrollment in the Intune dashboard. 		Allows individual macOS devices to be enrolled without ABM. Best for: Small businesses or environments without ABM.
Advanced: Configure security baselines for macOS devices.
Monitoring: Check macOS device compliance in Device Blade.

Deploy Applications

Deploy and manage applications on Windows, macOS, iOS, and Android devices using Microsoft Intune. Choose the appropriate deployment method based on platform and app type.

Key Concepts

Task Steps Explanation Details
Deploy an Android App via Managed Google Play 1. Connect Intune to Managed Google Play:
 • Navigate to Devices > Android > Android Enrollment.
2. Approve apps in the Google Play console.
3. Sync approved apps to Intune.
4. Assign apps to user or device groups. 		Deploy Android Apps via Intune – Step-by-Step

1. Prerequisites:
 • Android device must be enrolled via Intune (Work Profile / Fully Managed / Dedicated).
 • Intune must be connected to Managed Google Play.
 • Admin must have permissions to add and assign apps.

2. Open Microsoft Intune Admin Center:
 • Go to https://intune.microsoft.com
 • Sign in with your Microsoft 365 admin account.
 • Navigate to Apps > Android > Android apps

3. Add a Managed Google Play App:
 • Click + Add and choose platform: Android Enterprise.
 • Choose Managed Google Play app and click Select.
 • In the Play Store window that opens:
  – Search for the app (e.g., Microsoft Teams, Edge).
  – Click Approve → Choose app permission behavior → Save.
 • After approval, click Sync to bring the app into Intune.

4. Configure App Assignment:
 • Once the app is listed under Apps > All apps, click on the app name.
 • Go to Assignments tab → Click Add group.
 • Select target Azure AD groups (e.g., “All Android Fully Managed”).
 • Choose Install intent:
  – Required: Installs automatically
  – Available: Shows in Company Portal for optional install
  – Uninstall: Removes from targeted devices
 • Save the assignment.

5. Add and Deploy LOB or Custom Apps (.APK/.AAB):
 • Go to Apps > Android > Add → Choose Android Line-of-business app.
 • Upload the signed .apk or .aab package.
 • Provide app details (Name, Description, Publisher, Logo).
 • Assign the app to groups using the Assignments tab.
 • Save and monitor deployment status.

6. Monitor Deployment:
 • Go to Apps > Monitor > App install status
 • Filter by:
  – App name
  – Platform (Android)
  – Install status (Installed / Failed / Pending)
 • Use device-specific logs if needed:
  – Company Portal logs
  – MDM Diagnostics Report
  Settings > Accounts > Access work or school > Export report

 Advanced: Configure App Configuration and App Protection Policies.
Monitoring: Use Monitor > App Install Status for deployment tracking.
Deploy an iOS App via Apple VPP 1. Connect Intune to Apple Volume Purchase Program (VPP):
 • Navigate to Tenant Administration > Connectors and Tokens.
2. Upload VPP token downloaded from Apple School/Business Manager.
3. Sync purchased apps to Intune.
4. Assign apps to user or device groups. 		Deploy iOS Apps Using Microsoft Intune – Step-by-Step

1. Open Microsoft Intune Admin Center:
 • Go to https://intune.microsoft.com
 • Sign in with Microsoft 365 Admin credentials.
 • Navigate to Apps > iOS/iPadOS > iOS/iPadOS apps

2. Choose the App Type to Deploy:
 • Click + Add to begin app deployment.
 • Select from the following app types:
  – Store App: App available on Apple App Store
  – Line-of-Business (LOB) App: Internal IPA file
  – Web link: URL shortcut to a web app
  – Built-in Apple apps: (e.g., Safari, Notes)
  – VPP App: Apple Volume Purchase Program integration

3. Add an App from App Store:
 • Choose iOS Store App and click Select
 • Search for the app by name (e.g., Microsoft Teams)
 • Select the app and click Next
 • Review metadata and click Next

4. Configure App Information:
 • App Name and Description are pre-filled from App Store.
 • Optionally, customize:
  – Publisher
  – Category
  – Logo (optional)
 • Click Next.

5. Assign the App to Groups:
 • Under Assignments, choose how the app is deployed:
  – Required: App auto-installs silently
  – Available for enrolled devices: User can install from Company Portal
  – Uninstall: Remove app from targeted devices
 • Add Azure AD device/user groups accordingly.
 • Click Next.

6. Review + Create:
 • Review all configuration details.
 • Click Create to deploy the app.

7. Monitor Deployment Status:
 • Navigate to Apps > Monitor > App install status
 • Select the app to see:
  – Installed devices
  – Pending installations
  – Failed deployments
 • Export logs for troubleshooting if needed.

8. Optional – Add VPP Apps (Apple Volume Purchase Program):
 • Go to Tenant Administration > Connectors and tokens > Apple VPP Tokens
 • Upload the VPP token file from Apple Business Manager
 • Sync purchased apps to Intune
 • Assign VPP apps as required (no Apple ID needed on devices)

 Advanced: Enable device-based licensing to avoid Apple ID requirements.
Monitoring: Check App Install Status and Device Install Status.
Deploy a Win32 Application 1. Convert the app to .intunewin format using the IntuneWin tool.
2. Upload the package to Intune.
3. Configure detection rules, install commands, and dependencies.
4. Assign the app to specific devices or user groups. 		Deploy Win32 Applications using Microsoft Intune – Step-by-Step

1. Prerequisites:
 • Supported app types: .exe, .msi, .bat, .ps1 (must be packaged into .intunewin format).
 • Device must be enrolled and Intune-managed.
 • Microsoft Win32 Content Prep Tool is required to create .intunewin files.

2. Prepare the Application Package:
 • Download the Win32 Content Prep Tool:
   https://github.com/Microsoft/Microsoft-Win32-Content-Prep-Tool
 • Place the installer (e.g., setup.exe) and any support files in a folder (e.g., C:\Source\App).
 • Run the tool:
  IntuneWinAppUtil.exe -c C:\Source\App -s setup.exe -o C:\Output
 • This creates a .intunewin file in the Output folder.

3. Upload and Configure in Intune:
 • Go to Intune Admin Center → Apps → Windows → Add
 • App type: Select Windows app (Win32)
 • Upload the .intunewin package.
 • Click Next and configure the following:

4. App Information:
 • Name, Publisher, Description, etc.
 • Upload logo/icon (optional).

5. Program Settings:
 • Install command: (e.g., setup.exe /silent or msiexec /i app.msi /qn)
 • Uninstall command: (e.g., msiexec /x {ProductCode} /qn)
 • Install behavior: Select System or User context

6. Requirements:
 • Define system requirements:
  – OS Architecture (x64/x86)
  – Minimum Windows version (e.g., 10 1909)
  – Disk space or custom PowerShell rules

7. Detection Rules:
 • Used to detect if the app is already installed.
 • Choose from:
  – File detection (e.g., C:\Program Files\App\app.exe)
  – MSI product code
  – Registry detection (e.g., HKLM\SOFTWARE\
App\Version)
  – Custom PowerShell script

8. Dependencies (Optional):
 • Add apps that must be installed before this one.
 • Specify install order and conditions.

9. Supersedence (Optional):
 • Used to replace older versions of the app.
 • Define uninstall behavior of previous version.

10. Assignments:
 • Assign app to Azure AD device or user groups.
 • Choose installation intent:
  – Required: Silent install
  – Available: User installs from Company Portal
  – Uninstall: Removes app

11. Review + Create:
 • Review all configurations.
 • Click Create to start uploading and distributing the app.

12. Monitoring and Logs:
 • Go to Apps > Monitor > App Install Status
 • Use the following log paths on the client device:

Troubleshooting Tools & Log Paths:
 • Intune Management Extension Log:
  C:\ProgramData\Microsoft\IntuneManagementExtension\Logs\IntuneManagementExtension.log
 • App Intent Eval Log:
  C:\ProgramData\Microsoft\IntuneManagementExtension\Logs\AppIntentEval.log
 • Detection Scripts:
  Logged in AppIntentEval.log and Intune logs
 • Content Folder (Staging area):
  C:\Program Files (x86)\Microsoft Intune Management Extension\Content
 • IME Cache Folder:
  C:\ProgramData\Microsoft\IntuneManagementExtension\Cache
 • Service: IntuneManagementExtension
 Advanced: Use PowerShell scripts for pre/post-install actions.
Monitoring: Track deployment via the App Deployment Monitor.

application-repackaging-msi-creation

Application Re-Packaging & MSI Creation

Step-by-step guide to create MSI packages by repackaging existing applications using InstallShield AdminStudio. Covers snapshot capturing, MSI editing, loose-file packaging, and EXE to MSI conversion.

Key Concepts

Task Steps
Overall Packaging Flow 1. Collect business requirements.
2. Perform technical review to identify installer type (.exe, .msi, loose files).
3. Choose appropriate packaging method.
4. Package the application.
5. Test the package with pilot users.
6. Make fixes if needed.
7. Deploy widely (mass deployment).
Repackaging with AdminStudio A. Build a clean virtual machine (VM) with only AdminStudio installed.
B. Clean temp folders, Recycle Bin, and disable Windows auto-updates.
C. Launch AdminStudio Repackager, start “Capture Installation Using Repackager Wizard”.
D. Choose Snapshot method and perform Pre-Snapshot capture.
E. Run source application installer (e.g., VLC.exe), complete install but do not launch app.
F. Observe Windows Installer activity to verify if MSI is wrapped in EXE installer.
G. Return to AdminStudio Repackager and run Post-Snapshot to detect system changes.
H. Review detected changes: files added/removed, registry keys created/removed, shortcuts made.
I. Clean the captured data by removing temp files, caches, logs unrelated to the application.
J. Click Build to generate the MSI package.
K. Save the MSI to default or chosen path (e.g., C:\Packages\MSI$$.
L. (Optional) Edit MSI within InstallShield:
  • Modify files and folders.
  • Set properties: LICENSE=YES, ALLUSERS=1/2, REBOOT=ReallySuppress.
  • Disable Change/Remove buttons if needed.
M. Save edited MSI project.
N. Convert MSI to Intune Win32 format (.intunewin) with Microsoft Win32 Content Prep Tool if deploying via Intune.
Loose-File (Portable) App Packaging 1. Create new InstallShield project.
2. Drag and drop unzipped application folder into “Destination Computer” view.
3. Add shortcuts manually if required.
4. Build the project to generate MSI or EXE wrapper.
5. Test portability on clean machines.
EXE-to-MSI Wrapper Creation 1. Create InstallShield Big Installation project.
2. Build installer, locate generated setup.exe in release folder.
3. Open command prompt, run recording:
  setup.exe /r /f1"<path-to-iss-file>"
4. Run silent build command:
  setup.exe /s /f1"<path-to-iss-file>" /f2"<path-to-log-file>"
5. Open %TEMP% folder during installation.
6. Locate and copy MSI cached by InstallShield (before cleanup).
7. Validate MSI package works as expected.
8. Repeat if installer changes or updates.
Save and Convert for Intune 1. Save the AdminStudio or InstallShield MSI project.
2. Download and install Microsoft Win32 Content Prep Tool.
3. Run command:
  IntuneWinAppUtil.exe -c <source_folder> -s <setup.msi> -o <output_folder>
4. Verify creation of .intunewin package.
5. Upload .intunewin package to Intune portal.
6. Configure install/uninstall commands, detection rules, and assignments as required.
7. Test deployment on pilot device groups.

Win32 App Deployment

Deploy and manage legacy Win32 applications on Windows devices using Microsoft Intune. Convert traditional EXE and MSI applications into the IntuneWin format for deployment. This section includes standard procedures and advanced scenarios to help troubleshoot real-world issues and interview questions.

Key Concepts

Task Steps Explanation Troubleshooting
Prepare a Win32 App for Deployment 1. Download IntuneWinAppUtil.exe
2. Run:
IntuneWinAppUtil.exe -c <source_folder> -o <output_folder> -s <setup.exe> -q
3. Verify the .intunewin package.
4. Document install/uninstall commands:
Install: setup.exe /silent
Uninstall: setup.exe /uninstall 		How it works (Advanced Backend Flow):
• Step 1: Intune Admin configures the Win32 app deployment.
• Step 2: IME (Intune Management Extension) checks for new policies from Intune.
• Step 3: IME downloads app content to cache:
 • Location: C:\Program Files (x86)\Microsoft Intune Management Extension\Content
 • Incoming: Encrypted content initially lands here.
 • Staging: Content is extracted/unzipped here.
 • Staged: Final prepared state before installation.
• Step 4: App Action Processor executes the install command silently.
 • Logs: AppActionProcessor.log tracks this step.
 • Location: C:\ProgramData\Microsoft\IntuneManagementExtension\Logs
• Step 5: IME evaluates Detection Logic to confirm success.
• Step 6: Status (Success/Failure) is sent back to Intune Portal.
• Step 7: Optional retry occurs if install fails based on retry schedule.
 Troubleshooting Tools & Log Paths – Win32 App Deployment:
• IntuneManagementExtension (IME) Logs: Primary logs for Win32 app deployment.
  C:\ProgramData\Microsoft\IntuneManagementExtension\Logs\IntuneManagementExtension.log
• Win32App.log: Contains detailed app installation process logs.
  C:\ProgramData\Microsoft\IntuneManagementExtension\Logs\Win32App.log
• Detection Rules & Requirements Logs: Tracks detection logic evaluations.
  DetectionRules.log under the same IME logs path.
• Registry Editor: Check deployment tracking and status:
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IntuneManagementExtension\Win32Apps
• Event Viewer: Logs under:
  Applications and Services Logs > Microsoft > Windows > DeviceManagement-Enterprise-Diagnostics-Provider
• Task Scheduler: Confirms scheduled execution of IME tasks.
  Task Scheduler → Microsoft > IntuneManagementExtension
• Company Portal: Helps in manual app install testing and visibility.
  Available apps can be triggered manually via the Company Portal
• Command Line Testing: Use IntuneWinAppUtil and test install commands locally.
  Also test return codes for troubleshooting deployment results.
• Service Validation: Ensure the following service is running:
  Intune Management Extension via services.msc
Deploy a Win32 App in Intune 1. Go to Apps > Windows > Add > Windows app (Win32)
2. Upload the .intunewin file
3. Configure name, publisher, and commands
4. Set Install Behavior: System or User
5. Configure Requirements: OS architecture, version
6. Assign app to groups: Required, Available, or Uninstall
7. Review and submit 		Ensures the app is properly configured for deployment. Assignment Types: Available, Required, Uninstall
Advanced: Version Targeting 📌 Scenario: Deploy v2.0 only if v1.0 exists.
💡 Fix: Add requirement rule checking registry key "Version = 1.0".
🔍 Filters: Use filters to exclude ARM or non-compliant devices.
Configure Detection Rules 1. Choose detection type:
• File exists
• Registry key
• MSI Product Code
• Custom Script (PowerShell)
2. Example:
Path: C:\Program Files\AppFolder
File: app.exe 		Ensures Intune verifies if the app is installed correctly. Best Practice: Use PowerShell for complex logic
Advanced: Smart Detection 🛠️ Script:
if ((Get-ItemProperty 'HKLM:\Software\App' -Name 'Version').Version -eq '2.0') { exit 0 } else { exit 1 }
⚠️ Scenario: App keeps reinstalling → Fix the detection to include version check.
Set Up App Dependencies 1. Identify required apps
2. Ensure all are packaged as Win32
3. Add dependencies in the deployment wizard
4. Validate order and rules 		Ensures apps install in proper sequence. Example: Install .NET before target app
Advanced: Nested Dependencies 📌 Scenario: App fails without Visual C++ Redist.
💡 Solution: Add VC++ as dependency; confirm via detection script.
🧾 Log: IntuneManagementExtension.log for sequence check
Monitor and Troubleshoot Deployment 1. Monitor from Apps > Monitor > App install status
2. Check logs on endpoint:
C:\ProgramData\Microsoft\IntuneManagementExtension\Logs
3. Use Company Portal for self-service installs
4. Use Troubleshooting Blade in Intune portal 		Provides insight into deployment success or errors. Log File: IntuneManagementExtension.log
Advanced: Common Issues & Fixes ⚠️ Scenario: Status "Waiting for user logon"
💡 Fix: Change context to "System" install
📊 Analytics: Leverage Endpoint Analytics & Log Analytics for historical trends
``` ---

Configure Compliance Policies

Define and enforce compliance policies in Microsoft Intune to ensure devices meet security and organizational standards. Devices that fail to comply can be restricted from accessing corporate resources.

Key Concepts

Task Steps Explanation Troubleshooting
Create a Compliance Policy 1. Sign in to the Microsoft Intune Admin Center:
 • Go to Devices > Compliance policies > Create policy.
2. Select the target platform (Windows, iOS, Android, macOS).
3. Configure policy settings:
 • Device Health: Require encryption, prevent jailbroken devices.
 • Device Security: Enforce password policies, biometrics.
 • OS Version: Set minimum and maximum OS versions.
 • Custom Scripts (Windows Only): Run PowerShell scripts for advanced compliance checks.
4. Define Actions for Non-Compliance:
 • Send a compliance notification to the user.
 • Mark device non-compliant or retire device after a grace period.
5. Assign the policy to specific Users, Devices, or Groups.
6. Review and create the policy. 		How it works (Advanced Backend Flow):
• Step 1: Admin creates and assigns the compliance policy via Intune.
• Step 2: The device syncs with Intune MDM using the OMADM channel (Open Mobile Alliance Device Management).
• Step 3: PolicyManager receives the compliance rules and hands them off to respective CSPs.
 • Example: ./Vendor/MSFT/Policy/Config/DeviceLock/PasswordRequired
• Step 4: Device evaluates compliance using various components:
 • BitLocker CSP – Checks encryption status
 • HealthAttestation CSP – Validates Secure Boot, Code Integrity, etc.
 • Password CSP – Ensures complexity and length requirements
• Step 5: Compliance report is generated and sent back to Intune.
• Step 6: Based on the result:
 • Device is marked Compliant or Noncompliant
 • Configured actions (notifications, block access) are triggered.

Important Logs for Troubleshooting:
• DeviceManagement-Enterprise-Diagnostics-Provider (Event Viewer)
• PolicyEvaluator.log – Evaluates rules locally
• CompliancePolicyProcessor.log – Tracks compliance rule execution
• HealthAttestationState – WMI or registry path to check attestation values
 Troubleshooting Tools & Log Paths – Compliance Policies:
• DeviceComplianceHandler.log: Logs compliance evaluation results.
  C:\ProgramData\Microsoft\IntuneManagementExtension\Logs\DeviceComplianceHandler.log
• IntuneManagementExtension.log: Tracks overall MDM tasks including compliance check initiation.
  C:\ProgramData\Microsoft\IntuneManagementExtension\Logs\IntuneManagementExtension.log
• Registry Editor: Verifies compliance policy settings and status:
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\current\device\CompliancePolicy
• Event Viewer: Track compliance policy application and issues:
  Applications and Services Logs > Microsoft > Windows > DeviceManagement-Enterprise-Diagnostics-Provider
• Company Portal App: Shows compliance state and alerts for end-users.
  Helpful in identifying non-compliance reasons like BitLocker, password, or OS version.
• MDM Diagnostic Report: Lists applied compliance policies and current state.
  Generate using:
  mdmdiagnosticstool.exe -area DeviceCompliance;Policy
• Sync Process Trigger: Force policy evaluation:
  Settings > Accounts > Access work or school > Info > Sync
• Device Status in Intune Portal: Check compliance status and last check-in:
  Intune Admin Center > Devices > [Device Name] > Device compliance
• Windows Health Attestation: Affects certain compliance rules (e.g., BitLocker, Secure Boot):
  TPM must be active and reporting; check with TPM.msc
Monitor Device Compliance 1. Navigate to Reports > Device Compliance in Intune.
2. Review compliance status by platform, policy, or user.
3. Use the following monitoring tools:
 • Non-Compliant Devices: Shows devices not meeting policy.
 • Policy Compliance: View compliance status for each policy.
 • Device Status: Check individual device compliance.
4. Investigate non-compliance reasons:
 • OS Out of Date: Verify device OS version.
 • Encryption Disabled: Ensure BitLocker/FileVault is active.
5. Take actions on non-compliant devices:
 • Send compliance reminder notifications.
 • Mark devices as non-compliant or initiate remote wipe. 		Allows IT to track and manage compliance violations. Action: Notify users or block access via Conditional Access.
Tip: Use the Device Compliance Report for audit reviews.
Advanced: Set up alert policies to receive real-time compliance violations.
Enforce Compliance with Conditional Access 1. Open the Microsoft Entra ID (Azure AD) portal.
2. Go to Security > Conditional Access and click New policy.
3. Configure policy settings:
 • Users: Select specific users, groups, or devices.
 • Cloud Apps: Apply to Office 365, Exchange, or custom apps.
 • Conditions: Filter by device platform, location, or risk level.
4. Under "Access controls," select Require device to be marked as compliant.
5. Enable policy and select "On" for enforcement.
6. Review and create the Conditional Access policy. 		Prevents non-compliant devices from accessing corporate resources. Example: Block non-compliant devices from Microsoft 365.
Advanced: Use Sign-in Logs to troubleshoot blocked access.
Tip: Use the What If tool to simulate policy effects.
Use Custom Compliance Scripts (Windows Only) 1. Prepare your PowerShell compliance script (e.g., check installed apps).
2. In Intune, go to Devices > Compliance Policies > Create Policy.
3. Choose "Windows 10 and later" and add Custom Compliance:
 • Upload your PowerShell script.
 • Define JSON rules to interpret script results.
4. Assign the policy to Windows devices.
5. Monitor compliance results under the "Device Status" blade. 		Allows advanced compliance checks using PowerShell scripts. Example: Verify app versions or check Windows services.
Advanced: Use JSON outputs for complex rule validation.
Tip: Test scripts on a local machine before uploading.
Automate Remediation for Non-Compliance 1. In Intune, go to Devices > Compliance Policies.
2. Select a compliance policy and configure Actions for Non-Compliance:
 • Send email notifications (customize email templates).
 • Mark devices non-compliant after a grace period.
 • Remotely lock or wipe non-compliant devices.
3. Monitor actions under the "Device Compliance" dashboard. 		Automates responses to enforce security compliance. Example: Notify users after 7 days of non-compliance.
Advanced: Create dynamic user groups for automated targeting.
Tip: Use action logs to track remediation execution.

Configure Conditional Access

Use Conditional Access policies in Microsoft Entra ID (Azure AD) to secure corporate resources by restricting access based on device compliance, location, risk level, and other conditions.

Key Concepts

Task Steps Explanation Details
Create a Conditional Access Policy 1. Open the Microsoft Entra Admin Center (Azure AD):
 • Navigate to Security > Conditional Access.
2. Click New Policy and provide a descriptive name.
3. Under "Assignments," configure:
 • Users: Include or exclude specific users/groups.
 • Cloud Apps: Select apps (e.g., Microsoft 365, Exchange).
 • Conditions: Configure sign-in risk, location, or platform.
4. Under "Access Controls," select:
 • Grant Access: Require conditions like MFA, compliant devices, or app protection.
 • Block Access: Restrict access if conditions are not met.
5. Set "Session Controls" (optional):
 • Enforce app restrictions (e.g., limit data download).
 • Control session persistence and sign-in frequency.
6. Enable "Report-Only" for testing or "On" to enforce immediately.
7. Click Create to finalize the policy. 		Ensures access control based on security conditions. Example: Block access for non-compliant devices.
Advanced: Use "Report-Only" mode to analyze impact before enforcing.
Tip: Assign policies gradually to avoid accidental lockouts.
Require MFA for High-Risk Sign-Ins 1. Open the Conditional Access page in Microsoft Entra Admin Center.
2. Click New Policy and give it a clear name (e.g., "MFA for High-Risk Users").
3. Configure "Assignments":
 • Users: Include all users or select high-risk groups.
 • Cloud Apps: Choose critical apps (e.g., Microsoft 365).
4. Set "Conditions":
 • Sign-in Risk: Enable and select "High".
5. Under "Access Controls," choose:
 • Grant: Require Multi-Factor Authentication (MFA).
6. Review, enable, and save the policy.
7. Validate policy activity using the Sign-in Logs. 		Protects against compromised accounts by requiring additional verification. Requirement: Microsoft Entra ID P2 for risk-based access policies.
Advanced: Use Identity Protection to customize risk levels.
Tip: Use "What If" to simulate policy impacts before enabling.
Block Access from Untrusted Locations 1. Go to Security > Conditional Access and click New Policy.
2. Define "Assignments":
 • Users: Select all users or specific groups.
 • Cloud Apps: Apply to all apps or critical apps.
3. Set "Conditions":
 • Enable Locations and select "Any location".
 • Exclude trusted IPs (e.g., corporate networks).
4. Under "Access Controls," select:
 • Block Access to prevent sign-ins from untrusted locations.
5. Enable and save the policy.
6. Verify policy enforcement in the sign-in logs. 		Prevents sign-ins from untrusted or high-risk locations. Use Case: Block logins from outside corporate networks.
Advanced: Define geo-specific locations for precision.
Tip: Regularly update trusted IP ranges.
Implement Session Controls 1. Open Conditional Access and create/edit a policy.
2. Go to "Access Controls" and click Session:
 • Use "Sign-in Frequency" to define re-authentication times.
 • Enable "Persistent Browser Session" to control session lifetimes.
3. For app-based controls, select Use App Enforced Restrictions:
 • Restrict downloads and clipboard access in Microsoft 365.
4. Enable and save the policy.
 Manages session length and enforces stricter data controls. Example: Force re-authentication every 12 hours.
Advanced: Use "App Enforced Restrictions" for advanced session policies.
Tip: Test session settings with a small user group before wider deployment.

Manage Windows Update Policies

Use Microsoft Intune to configure and enforce Windows update policies, ensuring devices receive security patches and feature updates on a controlled schedule.

Key Concepts

Task Steps Explanation troubleshooting
Create a Windows Update Ring 1. Sign in to the Microsoft Intune Admin Center:
 • Navigate to Devices > Windows > Update Rings for Windows 10 and later.
2. Click Create Profile and enter a descriptive name.
3. Configure the following update settings:
 • Update Deferrals: Delay feature and quality updates.
 • Automatic Update Behavior: Set to auto-install, notify, or schedule.
 • Restart Controls: Manage grace periods, deadlines, and active hours.
4. Choose "User Experience" options:
 • Allow end-users to pause or postpone updates.
 • Configure auto-restart notifications and deadlines.
5. Assign the policy to device groups (e.g., Pilot, Production).
6. Review and click Create to deploy the update ring.
• 1️⃣ Intune Admin creates or updates the Windows Update Ring policy.
• 2️⃣ Policy is delivered to the device via the MDM channel.
• 3️⃣ Configuration Service Provider (CSP) processes and writes to the registry.
• 4️⃣ Device applies settings using Windows Update engine.
• 5️⃣ Device connects to Windows Update to retrieve updates.
Troubleshooting Tools & Log Paths:
• SyncML Viewer: Tracks received MDM policies.
  C:\Windows\System32\DMClient\ (logs depend on tool output)
• MDM Policy Sync Trace: GitHub tool by Oliver – parses policy sync ETLs.
  C:\Windows\Logs\DeviceManagement\
• MDM Diagnostic Report: Captures full device-side MDM policy state.
  Generate with: mdmdiagnosticstool.exe -area DeviceEnrollment;DeviceProvisioning;Autopilot;Policy;Wufb
• Registry Editor: Verifies policy application under:
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\current\device
• Event Viewer: View logs under:
  Applications and Services Logs > Microsoft > Windows > DeviceManagement-Enterprise-Diagnostics-Provider
• Windows Update Logs: Generate readable logs:
  Get-WindowsUpdateLog
• PerfView Tool: Open ETL logs:
  C:\Windows\Logs\WindowsUpdate\
• Services Console: Check required services:
  services.msc → Validate Windows Update, Update Orchestrator
Configure Feature Update Deployment 1. In Intune, go to Devices > Feature Updates for Windows 10 and later.
2. Click Create Profile and name the profile.
3. Select the Windows version to deploy (e.g., Windows 11 23H2).
4. Choose Feature Update Deployment settings:
 • Freeze devices on a specific version (until you change the policy).
 • Configure deferrals to delay rollout for testing.
5. Assign the policy to appropriate device groups.
6. Review and click Create to deploy the feature update.
• Step 1: Admin creates Feature Update policy via Intune.
• Step 2: Policy is synced to DSS (Delivery and Servicing Stack).
• Step 3: DSS evaluates what updates are applicable.
• Step 4: Device contacts DSS using Azure AD Device ID.
• Step 5: DSS confirms eligibility and provides update plan.
 Troubleshooting Tools & Log Paths:
• SyncML Viewer: Tracks received MDM policies.
  C:\Windows\System32\DMClient\ (logs depend on tool output)
• MDM Policy Sync Trace: GitHub tool by Oliver – parses policy sync ETLs.
  C:\Windows\Logs\DeviceManagement\
• MDM Diagnostic Report: Captures full device-side MDM policy state.
  Generate with: mdmdiagnosticstool.exe -area DeviceEnrollment;DeviceProvisioning;Autopilot;Policy;Wufb
• Registry Editor: Verifies policy application under:
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\current\device
• Event Viewer: View logs under:
  Applications and Services Logs > Microsoft > Windows > DeviceManagement-Enterprise-Diagnostics-Provider
• Windows Update Logs: Generate readable logs:
  Get-WindowsUpdateLog
• PerfView Tool: Open ETL logs:
  C:\Windows\Logs\WindowsUpdate\
• Services Console: Check required services:
  services.msc → Validate Windows Update, Update Orchestrator
Manage Update Rollbacks (Feature & Quality Updates) 1. Navigate to Devices > Windows > Update Rings in Intune.
2. Select an existing Update Ring and click Properties.
3. Enable Rollback settings:
 • Feature Update Rollback: Allow users to rollback within 10 days.
 • Quality Update Rollback: Configure auto-rollback for faulty updates.
4. Assign the updated policy to affected devices.
5. Monitor rollback requests and adjust policies if needed. 		Allows devices to revert to a previous update version if issues arise. Use Case: Revert failed updates or problematic builds.
Advanced: Automate rollbacks based on compliance failures.
Tip: Set a 10-day rollback window to catch post-update issues.
Monitor Windows Update Compliance 1. In Intune, navigate to Reports > Windows Update (Preview).
2. Use the following reports for monitoring:
 • Update Compliance: View update status across devices.
 • Feature Update Report: Check Windows version adoption.
 • Quality Update Report: Identify devices missing security patches.
3. Identify non-compliant devices and initiate remediation:
 • Send compliance notifications.
 • Force policy refresh or device restart.
4. Export compliance data for auditing purposes. 		Tracks update deployment and identifies non-compliant devices. Reports: Use compliance dashboards to track update health.
Advanced: Filter reports by device group, OS version, or update type.
Tip: Schedule periodic compliance audits for security assurance.
Enforce Update Deadlines 1. Open the existing Windows Update Ring policy in Intune.
2. Configure the following under "User Experience":
 • Grace Period: Set days before enforced installation (e.g., 7 days).
 • Deadline: Force install quality and feature updates.
 • Auto-Restart: Configure auto-restart during off-hours.
3. Save changes and ensure the policy is assigned to target devices.
4. Monitor compliance and verify deadline enforcement. 		Ensures devices install updates within a specified timeframe. Use Case: Ensure critical patches apply within 7 days.
Advanced: Stagger deadlines for different departments.
Tip: Combine with Feature Updates for full update lifecycle control.

Deploy Configuration Profiles

Use Microsoft Intune to deploy configuration profiles that enforce security settings, device restrictions, and network configurations on Windows, macOS, iOS, and Android devices.

Key Concepts

Task Steps Explanation Details
Create a Device Configuration Profile 1. Open the Microsoft Intune Admin Center:
 • Go to Devices > Configuration Profiles > Create Profile.
2. Select a platform (Windows, macOS, iOS/iPadOS, Android).
3. Choose a profile type:
 • Configuration Profiles: Apply standard policies (e.g., Wi-Fi, VPN, restrictions).
 • Templates: Use predefined templates like BitLocker or Windows Defender.
4. Configure the profile:
 • Input required settings (e.g., password complexity, encryption).
 • Set user experience options (e.g., allow or block features).
5. Assign the profile to target user/device groups:
 • Use Dynamic Groups for automated assignment.
6. Set Scope Tags to limit admin visibility (optional).
7. Review and click Create to deploy the profile. 		Applies security and configuration policies to managed devices. Example: Enforce BitLocker encryption on Windows devices.
Advanced: Use filters to apply policies to specific OS versions.
Tip: Separate profiles by platform for easier troubleshooting.
Deploy a Custom Configuration Profile (ADMX Template) 1. In Intune, go to Devices > Configuration Profiles > Create Profile.
2. Select the platform and choose Templates:
 • Administrative Templates: Access built-in ADMX settings.
3. Configure ADMX settings:
 • Customize policies like Windows Update, OneDrive, and Microsoft Edge.
4. Assign the policy to appropriate device groups.
5. Review and deploy the policy.
6. Monitor deployment status under Device Configuration Status. 		Uses ADMX templates to enforce advanced system configurations. Use Case: Configure Windows Update settings or enforce USB restrictions.
Advanced: Import custom ADMX files for third-party apps.
Tip: Use "Administrative Templates" for granular Windows management.
Create a Custom OMA-URI Configuration Profile 1. Go to Devices > Configuration Profiles > Create Profile.
2. Select platform and choose Custom profile type.
3. Configure OMA-URI settings:
 • Add unique settings using OMA-URI paths.
 • Example: Configure advanced Windows Defender exclusions.
4. Assign the profile to specific device groups.
5. Validate deployment through device reporting. 		Enforces advanced configurations using OMA-URI for fine-tuned control. Use Case: Set device telemetry or advanced firewall rules.
Advanced: Reference Microsoft documentation for OMA-URI paths.
Tip: Test OMA-URI settings in a lab environment before production.
Deploy PowerShell Scripts for Windows Devices 1. Navigate to Devices > Scripts > Add in Intune.
2. Choose Windows and upload your PowerShell script (.ps1).
3. Configure script options:
 • Run script in user or system context.
 • Allow script to restart devices (if required).
4. Assign the script to device or user groups.
5. Monitor deployment success via script reports. 		Executes PowerShell scripts for complex configurations. Use Case: Install software, change registry settings, or execute tasks.
Advanced: Use logging within the script for better troubleshooting.
Tip: Validate scripts on test devices before deploying widely.
Monitor Configuration Profile Deployment 1. In Intune, go to Reports > Device Configuration.
2. View deployment status:
 • Success: Devices applied the profile successfully.
 • Error: Policy failed—click on "Error" for diagnostics.
 • Pending: Device has not yet received the policy.
3. Export logs for auditing and troubleshooting.
4. Resolve failures by reviewing logs (MDM Diagnostic Tool on Windows). 		Tracks deployment progress and identifies non-compliant devices. Reports: Analyze detailed logs of applied profiles.
Advanced: Use "Intune Management Extension" logs for script failures.
Tip: Schedule periodic reviews of compliance for critical profiles.

Device Enrollment Issues

Troubleshoot common and advanced device enrollment failures in Microsoft Intune. This section guides you on *exactly what to look for* in logs, diagnostic outputs, and tools for successful root-cause analysis.

Key Concepts

Issue Possible Causes Advanced Resolution
Device Enrollment Fails • Incorrect user permissions or missing Intune license.
• Enrollment restrictions block device type or OS.
• Device is already enrolled with another MDM.
• MDM authority is not set to Intune.
• Corrupted local enrollment state or device provisioning errors. 		1. Verify Intune license and user permissions:
 • Check if user is assigned a valid Intune license.
 • Use PowerShell: Get-MsolUser -UserPrincipalName user@domain.com | Select Licenses.

2. Review enrollment restrictions:
 • Confirm allowed platform, OS version in Devices > Enrollment Restrictions.

3. Confirm MDM authority:
 • Devices > Enrollment > MDM Authority — must be set to Intune.

4. Remove device from previous MDM or reset provisioning:
 • Windows: Settings > Accounts > Access work or school > Disconnect.
 • iOS/Android: Factory reset if previously enrolled elsewhere.

5. Check device logs for enrollment errors:
 • Event Viewer → Applications and Services Logs → Microsoft → Windows → DeviceManagement-Enterprise-Diagnostics-Provider (DMEDP):
  • Look for events with Event ID 201, 301, 404, or 4045
  • Check error messages mentioning "Failed to enroll", "MDM Registration", or specific error codes like 0x80180014 or 0x80180026 (often indicates permission or authority issues)
  • Search for details about network errors, authentication failures, or device already managed
 • Intune Management Extension logs (C:\ProgramData\Microsoft\IntuneManagementExtension\Logs):
  • Open IntuneManagementExtension.log
  • Filter for keywords: “Enrollment”, “Failed”, “Error”
  • Check timestamps matching your enrollment attempt
  • Look for connectivity errors, authentication errors, or messages about conflicting MDM

6. Use dsregcmd /status on Windows:
  • Under Device State: "AzureAdJoined : YES" means successful registration; "DomainJoined : YES" for hybrid
  • Check "DeviceID" and "TenantID" align with expected values
  • Errors in “Diagnostic Data“ or lines mentioning "Error code" show registration failures
  • For failed registration, you may see "Join Type: None" or codes like 0x801c03f2

7. Perform network trace during enrollment:
  • Run Netsh trace start capture=yes and analyze results for failed or blocked HTTP/S requests to Microsoft endpoints
  • Check for firewalls or proxies blocking required domain names

8. Reattempt enrollment after resolving the above issues; monitor log files in real time to catch new errors and codes as they appear
Company Portal App Enrollment Error • Authentication or MFA failures.
• User permissions issues.
• Corrupted Company Portal installation.
• Cached credentials or token expiration.
• Overlapping device management. 		1. Check sign-in logs:
  • Go to Microsoft Entra Admin Center > Sign-In Logs
  • Filter by user and app, check for error details under "Conditional Access", "Failure reason", and if MFA or expired password is mentioned
2. Ensure user has proper enrollment permission and within device limit:
  • In Devices > Enrollment Restrictions > User Device Limits, as well as any CA policies or assigned roles
3. Clear cached credentials:
  • Windows: Delete contents of %localappdata%\Packages\Microsoft.CompanyPortal_8wekyb3d8bbwe\LocalCache
  • Mobile: Fully uninstall and reinstall Company Portal, then try enrolling again
4. Reset MDM enrollment (Windows):
  • Settings > Accounts > Access work or school > Disconnect, then reboot
5. Review Company Portal and DMEDP logs for clues:
  • In Event Viewer → DMEDP, look for errors with "MDM application management", "Token validation", "AADSTS" errors, or device compliance failures
  • Any Event ID 404 or 4045 with message "Exception" indicates a registration or token-related problem
  • Company Portal itself on Windows: Go to "Feedback" in the app → enable logging, and then check CompanyPortal.log under "%ProgramData%" if available
6. If stuck, run SaRA tool ("Microsoft Support and Recovery Assistant") for Company Portal issues — note all errors and remediation suggestions it gives 7. Perform enrollment and watch logs for new error codes or failed plugin messages
Windows AutoPilot Enrollment Fails • Hardware hash issues.
• Profile assignment error.
• Wrong Azure AD group.
• TPM or Secure Boot issues.
• Blocked endpoints. 		1. Confirm hardware hash upload status:
  • Check Devices > Windows > Windows Enrollment > Devices
  • In Windows: Open C:\Windows\Panther\UnattendGC\setupact.log and C:\Windows\Panther\AutoPilot\ logs
  • If you see "Hash not found" or "Device not assigned", re-upload the hardware hash using Get-WindowsAutoPilotInfo.ps1
2. Validate AutoPilot profile assignment:
  • In deployment profile, ensure "Assigned" device matches your test machine's serial number and hash
  • Look for error lines in AutoPilot logs about "Profile GUID mismatch", "DeviceProfileAssignmentFailed", or unassigned profiles
3. Check Azure AD group membership:
  • Verify device or user is in correct group in Azure AD portal. Remove from/ re-add if group assignment sync seems delayed
4. Check TPM and Secure Boot status:
  • Get-Tpm: Status MUST be "Ready" and "TpmPresent = True"
  • Secure Boot: Enter UEFI and confirm it's enabled
5. Connectivity:
  • Fiddler or Wireshark: Look for connection attempts to *.windows.net and failure codes
  • If you see "Could not connect to server" or certificate errors, validate firewall and proxy
6. dsregcmd /status:
  • Check device joined status "AzureAdJoined : YES"
  • If not, review "Error code" in Diagnostic Data (0x801c03f2 = AAD sync issues)
iOS/macOS Enrollment Stuck • Apple MDM push cert invalid or expired.
• Improper Apple Business Manager association or DEP token.
• Device MDM conflict.
• Blocked push notification/MDM endpoints. 		1. Check MDM push certificate:
  • Intune portal: Validity, "about to expire", or "expired" states. If expired, logs show failed to communicate with Apple APNs.
2. Apple Business Manager assignment:
  • ABM: Ensure "MDM Server" assignment is listed for your organization
  • If device "disappears" from ABM or not showing in Intune, check sync and identifier matches
3. DEP token renewal:
  • If expired, Intune portal > iOS enrollment notifications show token expiry
4. Firewall troubleshooting:
  • From affected device, Confirm 17.0.0.0/8 and *.apple.com traffic succeeds (use Apple diagnostics app or network utility on Mac)
  • Check for "Could not connect to server" on screen at activation
5. Console log (macOS):
  • Search for "mdmclient", "MDM error", "Profile installation failed" — note error/warning lines
6. Apple Configurator (if stuck):
  • Try "Prepare" mode and observe for errors about device preparation or enrollment rejection
Android Enrollment Blocked • Device incompatible or unsupported for Android Enterprise.
• Managed Google Play link broken.
• Enrollment restriction policy blocks device.
• Outdated Company Portal App.
• Already enrolled on another MDM. 		1. Check device compatibility:
  • Settings > About; confirm OS version and manufacturer on Android Enterprise list
2. Validate Managed Google Play integration:
  • Intune portal > Android enrollment: Status = Linked
  • If "Unlinked", re-authorize with Google
3. Review enrollment restrictions:
  • Ensure Android is enabled in restriction policy
4. Company Portal version:
  • Go to Play Store; update if version is >6 months old
5. Remove existing MDM profile:
  • Settings > “Accounts” and “Device admin apps” → Remove any conflicting apps
  • If issues persist, factory reset and retry
6. Collect device logs:
  • Use adb logcat, search for "Intune", "Company Portal", or "enrollment_failed" events
  • Look for Google Play errors about account provisioning
Network and Firewall Issues • Critical endpoints (Intune, Microsoft, Apple) blocked.
• Proxy or SSL inspection issues.
• Port restrictions.
• Inconsistent connectivity. 		1. Verify endpoints and ports allowed:
  • Use Test-NetConnection -ComputerName manage.microsoft.com -Port 443
  • If failed, check with networking/firewall admins for allow list updates
2. Check proxy configuration:
  • Run netsh winhttp show proxy. If proxy is in use, ensure Microsoft endpoints bypass proxy authentication or SSL inspection
  • SSL inspection may require importing the proxy/root cert on the device
3. Network trace:
  • Run Wireshark during enrollment; look for failed TLS handshakes, "connection refused", or HTTP status codes like 403, 407, 502
  • In logs, find phrases like "Timeout", "Cannot connect", or "handshake failed"
4. In Intune Management Extension log or DMEDP Event Log:
  • Look for error codes 0x80180018 (connectivity), 0x801c0003 (registration fail), or detailed "Exception" stack traces
Maximum Device Limit Reached • User has hit enrollment cap.
• Enrollment restriction or DEM account device max quota.
• Stale/inactive devices using up slots. 		1. Review device enrollment count:
  • In Intune portal, go to Devices > All devices and filter by username
  • If at limit, prompt user to remove devices in portal
2. Remove old/inactive devices:
  • Click on unused devices and choose "Delete"
  • Use Intune Powershell: Remove-IntuneManagedDevice -DeviceId 'device_id'
3. If DEM or bulk provisioned devices:
  • Review DEM account properties for current count and licensing
4. Communicate to user or DEM admin about removal and re-enrollment best practices
Enrollment Status Page (ESP) Advanced Failures • ESP app deployment failures.
• Conditional Access policy conflict during ESP.
• Network or device timeouts, compliance check failures.
• ESP config mismatch. 		1. Inspect ESP logs (Windows):
  • Navigate to C:\Windows\Provisioning\Diagnostics\EnrollmentStatus
  • Open XML/CSV logs and search for "failed", "error", or "timeout" tags
  • Identify which app or script deployment is holding up the status bar
2. Validate network/firewall:
  • Confirm all ESP and Intune endpoints are allowed. In the logs, "Could not download..." or "HTTP status 4xx/5xx" entries point to firewall or proxy issues
3. ESP config:
  • In Intune portal, verify ESP profile’s list of blocking apps and "App installation timeout" setting
  • Untick "Block device use until required apps are installed" to test for progress
4. dsregcmd /status, Get-MDMEnrollmentStatus (if available):
  • Look for failing compliance states or “Not compliant” in returned output
5. If running Win32 app or PowerShell scripts at ESP:
  • Check in logs for exit code details and any "failed to run script" errors
  • Confirm script pre-requisites as listed in Intune app assignment are satisfied
6. After adjustment, Win+R > shutdown /r /t 0 to reboot and retry enrollment

Compliance Policy Failures

Troubleshoot common compliance policy failures in Microsoft Intune. Identify issues preventing devices from meeting compliance requirements and ensure enforcement through Conditional Access.

Key Concepts

Issue Possible Causes Resolution
Device Marked as Non-Compliant • OS version out of date.
• Encryption not enabled (e.g., BitLocker, FileVault).
• Password policy not met (e.g., complexity, length).
• Device did not complete a recent check-in with Intune. 		1. Confirm compliance status:
 • Go to Microsoft Intune Admin Center > Devices > Monitor > Device Compliance.
2. Verify the device meets policy criteria:
 • Check OS version, encryption, and password settings.
3. Force a device sync:
 • Windows: Settings > Accounts > Access Work or School > Sync.
 • Android/iOS: Use the Intune Company Portal app.
4. Resolve issues and monitor compliance status updates.
Compliance Policy Not Applying • Policy not assigned to the correct group.
• Incorrect policy configuration.
• Policy conflicts with other applied profiles.
• Device did not sync with Intune. 		1. Verify policy assignment:
 • Ensure the policy targets the correct users/groups.
 • Go to Intune > Devices > Compliance Policies > Assignments.
2. Identify conflicts or duplicate policies:
 • Cross-check overlapping policies under "Device Status".
3. Force a policy sync:
 • Windows: dsregcmd /status to check Azure AD Join.
 • Android/iOS: Sync via the Company Portal.
4. Validate the policy logs:
 • Windows: C:\ProgramData\Microsoft\IntuneManagementExtension\Logs.
Conditional Access Blocking Access • Device marked as non-compliant.
• Policy requires compliance before granting access.
• Device status has not updated in Intune. 		1. Identify the failure reason:
 • Go to Microsoft Entra Admin Center > Sign-In Logs.
2. Check device compliance:
 • Review compliance under Devices > Monitor > Device Compliance.
3. Allow time for sync:
 • Wait for up to 15 minutes for updated compliance status.
4. Reattempt access after compliance is restored.
iOS/macOS Compliance Policy Not Evaluating • Apple MDM Push Certificate expired.
• Device check-in failure.
• Incorrect compliance policy targeting macOS/iOS. 		1. Check Apple MDM certificate validity:
 • Go to Devices > macOS/iOS Enrollment > Apple MDM Push Certificate.
2. Force device check-in:
 • Reboot the device and manually trigger a sync.
3. Verify policy settings:
 • Ensure the policy targets the correct platform and groups.
4. Remove and re-enroll the device if necessary.
Android Work Profile Device Non-Compliant • Compliance policy not applied to Work Profile.
• Device check-in failed.
• Security settings (e.g., encryption) not enforced. 		1. Validate Android Enterprise enrollment:
 • Confirm Work Profile enrollment under Devices > Android > Monitor.
2. Verify policy assignment:
 • Ensure the compliance policy applies to Work Profile devices.
3. Force a compliance check:
 • Use the Intune Company Portal app to sync manually.
4. If issues persist, reset the Work Profile and re-enroll.
Device Stuck in "Not Evaluated" Status • Device has not checked in recently.
• Policy not correctly applied.
• Enrollment incomplete or corrupted. 		1. Confirm check-in status:
 • Verify the last check-in time under Devices > Monitor.
2. Force a device sync:
 • Windows: dsregcmd /status.
 • Android/iOS: Sync via the Company Portal.
3. Check logs:
 • Windows: Review MDM Diagnostics Tool output.
 • macOS: Check /Library/Logs for MDM logs.
4. If unresolved, remove the device from Intune and re-enroll.
Custom Compliance Script Fails • PowerShell script errors.
• Incorrect JSON output structure.
• Permissions issues during script execution. 		1. Validate PowerShell script syntax:
 • Ensure output meets required JSON format.
2. Run the script locally for debugging.
3. Check Intune Management logs:
 • C:\ProgramData\Microsoft\IntuneManagementExtension\Logs.
4. Update the script or reassign the compliance policy.

Configuration Profile Not Applying

Troubleshoot issues preventing configuration profiles from applying to devices in Microsoft Intune. Identify policy conflicts, missing assignments, and connectivity issues that may cause deployment failures.

Key Concepts

Issue Possible Causes Resolution
Configuration Profile Not Deploying • Profile not assigned to correct users or devices.
• Device not syncing with Intune.
• Policy is configured incorrectly or has invalid settings.
• Device exceeds the Intune device limit. 		1. Verify the profile assignment:
 • Go to Devices > Configuration Profiles and check assignments.
 • Ensure the profile targets the correct user/device groups.
2. Check deployment status:
 • Monitor under Devices > Monitor > Configuration Status.
3. Force a device sync:
 • Windows: Settings > Accounts > Access work or school > Sync.
 • Android/iOS/macOS: Use the Company Portal app.
4. Confirm the user has not exceeded the Intune enrollment limit:
 • Go to Devices > Enrollment Restrictions > User Device Limits.
Profile Applied But Settings Not Changing • Conflicts with other Intune profiles.
• Local Group Policy Objects (GPOs) overriding Intune settings.
• Profile misconfiguration (incorrect settings or values).
• Device not synced after profile update. 		1. Identify conflicting profiles:
 • Check overlapping settings under Devices > Monitor > Policy Conflicts.
2. Inspect local Group Policy conflicts (Windows only):
 • Run gpresult /h report.html on the target device.
 • Ensure "MDM Wins Over GPO" is enabled in Intune.
3. Validate profile settings:
 • Ensure correct input (e.g., valid Wi-Fi SSID, VPN settings).
4. Force a policy refresh:
 • Windows: Run IntuneManagementExtension.log for logs.
 • Android/iOS: Sync via the Company Portal app.
Windows Device Not Receiving Configuration Profile • Device not enrolled properly in Intune.
• Sync errors or network connectivity issues.
• MDM enrollment conflicts with local GPO settings.
• Intune Management Extension (IME) malfunction. 		1. Confirm device enrollment:
 • Ensure the device appears under Devices > Windows.
2. Check for sync errors:
 • Run dsregcmd /status to verify Azure AD registration.
3. Validate the Intune Management Extension:
 • Check logs in C:\ProgramData\Microsoft\IntuneManagementExtension\Logs.
4. Re-enroll the device if required:
 • Remove and rejoin the device under Access Work or School.
iOS/macOS Device Not Applying Configuration • Expired Apple MDM Push Certificate.
• Device not checking in with Intune.
• Incorrect profile targeting macOS/iOS devices.
• Device pending user action (e.g., accept management profile). 		1. Validate the Apple MDM Certificate:
 • Go to Devices > iOS/macOS Enrollment > Apple MDM Push Certificate.
2. Force device sync:
 • Restart the device and open the Intune Company Portal.
3. Confirm correct profile targeting:
 • Ensure the profile is assigned to the proper platform.
4. Re-enroll the device if needed:
 • Remove and re-enroll via Apple Business Manager or manual steps.
Android Device Not Receiving Profile • Incorrect profile targeting (e.g., Work Profile vs. Fully Managed).
• Device not syncing with Intune.
• Enrollment restrictions blocking the profile. 		1. Validate enrollment type:
 • Ensure the correct assignment (Work Profile, Fully Managed, etc.).
2. Force a sync:
 • Open the Intune Company Portal app and sync manually.
3. Confirm the device meets compliance:
 • Go to Devices > Android > Monitor and verify compliance.
4. Re-enroll the device if necessary:
 • Factory reset and re-enroll under the correct profile type.
Configuration Profile Stuck in Pending Status • Device not checking in with Intune.
• Profile applied before device enrollment was complete.
• Device is offline or has limited connectivity. 		1. Check the device's last check-in:
 • Go to Devices > Monitor > Device Status.
2. Force a manual sync:
 • Windows: Settings > Accounts > Sync.
 • Android/iOS/macOS: Open the Company Portal app.
3. Review device logs:
 • Windows: MDM Diagnostic Tool.
 • Android/iOS: Use Device Diagnostics in the portal.

Application Deployment Issues

Troubleshoot detailed application deployment failures in Microsoft Intune, including advanced log analysis and resolution for packaging, assignment, installation errors, detection failures, and compliance or configuration issues. Use this comprehensive guide to pinpoint root causes and remediate persistent or complex deployment blocks across all platforms.

Key Concepts

Issue Possible Causes Detailed Troubleshooting & Resolution
Application Not Deploying • Incorrect or missing app assignment.
• Insufficient app licenses (VPP, Store, ABM).
• Device not syncing with Intune.
• Targeting wrong OS/platform.
• Device not registered or marked as non-compliant. 		1. Verify Assignment:
  • Intune Admin Center: Apps → Select app → Assignments — check if user/device appears and if assignment matches scope (required/available/uninstall).
  • Assignment filters: Ensure device/user isn’t filtered out because of unsupported OS, exclusions, or targeting mistypes.
2. Check License Allocation:
  • Apple VPP/ABM: Devices > iOS/macOS > Enrollment Program Tokens and VPP tokens → confirm enough licenses remain. Address warning banners about exhausted or expired tokens.
  • Microsoft Store: Monitor available licenses, app presence under Store for Business.
3. Device Sync Status:
  • Windows: Settings > Accounts > Access Work or School > Sync.
  • Mobile: Open Company Portal → tap device details → "Check Status" to initiate sync.
  • If sync fails, device cannot receive new assignments. Check Company Portal or Intune app for last contact timestamp.
4. Deployment/Install Failure Logs:
  • Intune Admin Center → Apps → Monitor → App Install Status: Red X for failed, hover for error code. Click to see targeted devices/users.
  • Windows: C:\ProgramData\Microsoft\IntuneManagementExtension\Logs → IntuneManagementExtension.log.
    - Search for "App install failed", "Assignment missing", or error codes: 0x87D300C9 (assignment), 0x87D13B66 (rule mismatch). - Check for the correct AppID showing up during assignment phase. - Confirm device is listed as “Active” in Intune.
  • Event Viewer: Application & Service Logs → Microsoft → Intune → Management Extension or AppXDeployment-Server: - Search for Event IDs 301, 404, 499, 10000, 10005. - "No applicable assignments found" indicates scope/assignment issue.
5. Remediate:
  • Reassign app, adjust assignment filters, or re-license VPP/Microsoft Store apps as needed. Force device sync, validate assignment and retry deployment.
Win32 App Deployment Fails • Invalid install/uninstall command-line.
• Bad packaging or .intunewin corruption.
• Detection logic mismatches.
• Dependencies not fulfilled or failed.
• App exits with non-zero code, permission denial, or file lock. 		1. Check Install/Uninstall Commands:
  • On test device, run install/uninstall command as SYSTEM using PsExec (psexec -i -s cmd.exe).
  • Common install failures: ERROR_FILE_NOT_FOUND, Access Denied, Return code 1603 (see MSI logs).
2. Review .intunewin Package:
  • Use IntuneWinAppUtil.exe to re-create app package. Inspect for incorrect folder, missing files, improper nesting.
  • Corruption is shown in logs as “Hash mismatch” or “Unable to expand package”.
3. Detection Rules:
  • Check rule logic (file exists, MSI, registry key/value, custom PowerShell). Failure to detect after install reports as 0x87D1041C (detection failed).
  • Review Detection.xml in logs for expected values. For MSI, ensure ProductCode matches installed product.
4. Dependency Handling:
  • Apps with prerequisites must be targeted and installed before parent app.
  • Intune logs show "Dependency failed" or "Dependency not installed".
5. Log Review & Detailed Clues:
  • IntuneManagementExtension.log: - Search for "AppInstallManager", "Starting install", "Detection logic", "Failed with error code". - “Exit code 1603”, “Exit code 1”, or “Invalid command line” mean script/installer failed. - Look for AppID, tracking across install, detection, and retry attempts.
  • MSIExec Log (if MSI): Add /l*v C:\Temp\app_install.log to your installer for verbose output.
  • Event Viewer: Application → Event ID 11708 or 11706 for MSI installer failures.
6. Fix and Remediate:
  • Correct install/uninstall code, rebuild .intunewin, adjust detection, ensure dependency order. Reset status by reassigning or updating detection logic.
iOS/macOS App Not Installing • App not synced between ABM and Intune.
• Insufficient/expired VPP licenses.
• App assignment errors.
• Device not checked in or with pending removal.
• Platform version incompatibility. 		1. Sync and License Review:
  • In Intune portal, Devices > iOS/macOS > Enrollment Program Tokens → confirm ABM/VPP tokens are valid and synced recently.
  • Check license count in Intune & ABM and user/device assignment.
2. Check Device Sync & Assignment:
  • Restart device, open Company Portal app for forced check-in.
  • Intune Admin Center → Apps → Monitor → App Installation Status: Look for failures marked with “License not available”, “Device not found”, or “Not supported on this device”.
3. Check for Platform Version:
  • App may require higher iOS/macOS version. “Incompatible” or “not supported” in portal/app logs.
4. Device Logs:
  • iOS: Device log via Apple Configurator & System Log, search for “install request failed”, “license not found”, or “Error Domain=PKInstallErrorDomain”.
  • macOS: Console.app: “mdmclient” log for “Profile installation failed”, “MDMAppInstallRequest”, “license exhausted”, “timeout”.
5. Remediate:
  • Correct assignment, purchase more licenses, or remove/re-target if device archived. Upgrade device OS and retry assignment.
Android App Deployment Blocked • Intune not linked to Managed Google Play.
• Enrollment type not compatible (Work Profile vs. Fully Managed).
• Platform restrictions.
• Play Store/Google sync delays.
• Device is not connected to network. 		1. Validate Managed Google Play Link:
  • Intune Admin Center: Devices > Android > Android Enrollment; status must show “Linked”.
  • If “Not Linked”, reauthorize and confirm tenant connection.
2. Check Enrollment Type:
  • Assign app only to matching enrollment mode (Work Profile, Fully Managed, Dedicated).
  • Device company portal: Settings → Check device management mode.
3. Deployment/Restriction Review:
  • Intune Admin Center → Devices → Enrollment Restrictions. Confirm Android approvals and group assignment.
4. Check App/Device Sync:
  • In Company Portal app: Tap "Check status" to sync. Watch for “App not available” or “Awaiting approval” errors.
  • Restart device and retry.
5. Android Logs:
  • Use adb logcat, search for “GooglePlay”, “install_failed”, or “Intune” entries at time of install attempt.
  • Common failure logs: “INSTALL_FAILED_BY_DEVICE_POLICY”, “LICENSE_NOT_FOUND”, “NOT_SUPPORTED”.
6. Remediate:
  • Re-link Managed Google Play, update assignments, or clear device cache. Confirm enrollment type and re-sync.
Microsoft Store App Not Deploying • App removed from Microsoft Store.
• Incorrect license type assigned.
• OS version or device not compatible.
• Device check-in/sync failures.
• Offline package not uploaded for offline deployment. 		1. Validate App Existence & License:
  • Intune Admin Center → Apps → Windows, check if app remains available (removed apps won’t redeploy).
  • For offline licenses, ensure package (with .appx/.msix and license files) is current and uploaded.
2. Device Sync & Registration:
  • Windows: dsregcmd /status. Under Device State: AzureAdJoined = YES, Intune = YES.
  • If not, remove device and re-enroll.
3. Logs & Failure Evidence:
  • C:\ProgramData\Microsoft\IntuneManagementExtension\Logs\IntuneManagementExtension.log
  • Look for "Microsoft Store for Business app failed", "App not found" or error codes like 0x87D300C9 (likely store withdrawal) or 0x87D13B64 (offline package issue).
  • Event Viewer → Apps → AppXDeployment-Server — Event IDs 5961, 5973, “Deployment failed” with HRESULT.
4. Remediate:
  • If app is deprecated, replace with new version or use Win32/LOB. Re-upload or update offline packages as required. Ensure licenses in Intune portal align with deployment scenario.
Application Stuck in Pending Status • Device has not checked in recently.
• OS/hardware not compatible.
• App assignment conflicting or duplicated.
• Detection rules unresolved (app unsure if installed/uninstalled). 		1. Check Device Status & Last Activity:
  • Intune → Devices → Monitor → Device Status: “Last check-in” time should be recent; if not, troubleshoot device connectivity (network, battery, user logoff).
2. Assignment Logic:
  • Review app assignment for scope conflicts or multiple overlapping rules targeting the same device.
3. Device Logs (Windows):
  • IntuneManagementExtension.log: Search for “Pending” status, check for repeated retries without error/failure code.
  • Times where log cycles between “waiting for check-in” or “waiting to retry” indicate sync problems or device-side blocking (AV, group policy, etc).
  • Event Viewer: Application logs → filter for application install attempts, timeouts, conflicts.
4. Device Sync:
  • Manual sync: Windows: Settings > Accounts > Access work or school > Sync. Mobile: Open Company Portal → “Check status”.
5. Remediate:
  • If device is inactive or deleted, re-enroll. Otherwise, update assignment, reboot, or remove and re-add user/device group from the assignment.
Dependency App Deployment Fails • Required dependency not assigned or failing.
• Wrong install order.
• App dependency removed or missing.
• Device out of compliance. 		1. Verify Dependency Chain:
  • Intune Admin Center → Apps → Win32 → Dependencies: App shows all listed prerequisites; all must complete install for main app to proceed.
  • Failure log: “Dependency installation failed” or “Prerequisite app not installed” in IntuneManagementExtension.log.
2. Install Order:
  • Ensure all dependencies are assigned as “required”/“available” to correct group/device and are not stuck in pending/failed status.
3. Dependency and Compliance Logs:
  • IntuneManagementExtension.log: Search for AppID, look for "dependency" errors, failed install code, or looped attempts on main app when dependency missing.
  • Intune portal: App Install Status/Monitor → view dependency status alongside primary app install status; red X or pending indicates block.
4. Remediate:
  • Assign/fix missing pre-req, confirm compliance status (device not out of policy), and retry install. Update detection rules or repair dependency package if deployment is broken.
Detection Logic Failure • Detection rule incorrect, too strict/broad.
• Installed app path/value not matching rule.
• Detection timeout.
• Custom script returns error/unexpected output. 		1. Check Detection Settings:
  • Intune portal → App properties: Review file/registry/MSI detection logic for typos, path errors, or case sensitivity mismatches.
  • “Failed to detect” or “Detection logic not satisfied” in IntuneManagementExtension.log immediately after attempted app install.
2. Testing:
  • Manually run detection method (PowerShell or check path) as SYSTEM on endpoint. Validate presence of file/registry as expected.
  • For MSI: Get-WmiObject -Query "SELECT * FROM Win32_Product WHERE IdentifyingNumber='Your-ProductCode'".
3. Custom Detection Script:
  • Script must exit cleanly with 0 for success. Log or output any errors during test run; non-zero codes or stderr content cause detection fail.
4. Remediate:
  • Edit detection rules or fix install path/product code. Update deployment and force re-evaluation by the Intune client. Use logs to confirm new logic is detected as intended.

OS Deployment Issues

Troubleshoot advanced operating system deployment issues in Microsoft Intune and Windows Autopilot. This guide covers device registration, assignment issues, TPM or hardware failures, DNS/Azure AD join errors, and post-deployment Windows Update issues. Deep-dive log paths, Event Viewer IDs, diagnostics scripts, and recovery workflows help ensure successful deployment.

Key Concepts

Issue Possible Causes Advanced Resolution
Autopilot Deployment Stuck at "Preparing Device" • Unstable or blocked internet access during OOBE.
• No Autopilot profile applied.
• Hardware hash missing or mismatched.
• DNS or certificate resolution issues during Azure AD Join. 		1. Validate Internet Access at OOBE:
 • Confirm access to update, enrollment, and login endpoints (e.g., *.microsoft.com / *.windows.net)
 • Test via Shift+F10 > ping, nslookup, or tracert.

2. Verify Profile Assignment:
 • Go to Devices > Windows Enrollment > Deployment Profiles
 • Check device status in Windows Autopilot Devices: Ensure status = Assigned

3. Check Device Registration:
 • Open PowerShell and run Get-WindowsAutoPilotInfo.ps1
 • Confirm serial number/mac address matches known device

4. Review Logs:
 • Event Viewer > Applications and Services Logs > Microsoft > Windows > Provisioning-Diagnostics-Provider
   — Key events: 200, 201, 401 for profile application.
 • C:\Windows\Panther\UnattendGC\setupact.log ← Check for join or profile staging errors

5. Retry & Remediate:
 • Reset device & retry Autopilot.
 • Optionally test using AutopilotDiagnostics.ps1 from Shift+F10 console
OS Deployment Fails During OOBE • Incorrect Autopilot profile behavior (user-driven vs self-deploying).
• Device not joined to domain properly.
• TPM/UEFI misconfigured.
• Dual join (AAD + Hybrid) not synchronizing. 		1. Check TPM Status:
 • Run tpm.msc: Ensure "TPM is ready for use".
 • Run Get-Tpm for PowerShell status.
 • Look for issues with TPM 2.0 requirement if Self-Deploying mode is used.

2. Correct Profile Settings:
 • Go to Windows Enrollment > Deployment Profiles
 • Make sure deployment mode fits use case: User-Driven (AAD join), or Self-Deploying (Kiosk/Dedicated)

3. Check Logs for Failures at OOBE:
 • C:\Windows\Panther\setuperr.log
 • C:\Windows\Panther\UnattendGC\setupact.log: Look for Online Services errors or objectID conflicts
 • Event Viewer → Microsoft\Windows\Provisioning-Diagnostics-Provider: Event ID 360, 410 signal blocking error

4. Reimage if necessary: Reset device to factory and reattempt profile sync
Device Not Enrolling After OS Deployment • Intune license not assigned or expired.
• Enrollment restrictions by platform, limit, or OS version.
• Device not linked correctly in Azure AD.
• Hybrid devices not completing join/sync. 		1. Check Intune License:
 • Go to Microsoft Entra Admin Center > Users > Licenses
 • User must have Microsoft Intune AND Enterprise Mobility + Security (EMS)

2. Review Enrollment Restrictions:
 • Intune Admin Center → Devices > Enrollment Restrictions
 • Confirm platform/OS assignment is allowed

3. Collect MDM Logs:
 • C:\Windows\Temp\MDM, MDMDiagnosticstool.exe -area Autopilot;DeviceEnrollment -cab C:\autopilotlogs.cab

4. Validate Join Status:
 • Run dsregcmd /status
    Check: AzureADJoined: YES, MDM Enrollment: YES
 • Errors like 0x801c03f2 indicate sync or join failure due to SCP, user mismatch, or network block
Windows Update Fails After OS Deployment • Network or proxy blocking endpoints.
• Update ring not applied yet.
• Corrupted SoftwareDistribution folder.
• Device not scanned since deployment. 		1. Review Update Policies:
 • Navigate to Devices > Windows > Update rings
 • Confirm target group has correct assignment

2. Test Update Connectivity:
 • Open PowerShell and test these endpoints:
    Test-NetConnection www.windowsupdate.com -Port 443
    nslookup download.windowsupdate.com

3. Reset Update Services:
 • Run:
    net stop wuauserv
    del /s /q %windir%\SoftwareDistribution\*.*
    net start wuauserv

4. Trigger Scan:
 • Run usoclient StartScan or wuauclt /detectnow
5. Logs: C:\Windows\Logs\WindowsUpdate → Examine windowsupdate.log for error codes like:
 • 0x8024401c: proxy issue
 • 0x80070005: permissions issue
OS Deployment for macOS Fails • Apple Business Manager not linked.
• Invalid or unassigned MDM profile.
• Device not synced across ABM & Intune.
• Certificate or connectivity issue. 		1. Verify ABM Integration:
 • Go to Devices > iOS/macOS Enrollment > Enrollment Program Tokens
 • Check that ABM sync completed – no token expiry

2. Ensure MDM Profile Assignment:
 • In Intune, under macOS devices, confirm profile assigned based on serial/UDID

3. Re-Enroll Device:
 • Remove existing MDM profile: System Preferences → Profiles, then re-trigger setup

4. Collect Logs:
 • Open Console.app → Output filtered for "nsurlsession", "MDM", or "Apple Configurator"
 • Look for “Enrollment Error 403” or “Missing profile”
Device Not Appearing in Autopilot • Hardware hash upload failed or invalid format.
• Device not uploaded to correct tenant ID.
• Sync delay or failure between Autopilot, Intune, or Graph API. 		1. Hardware Hash Upload:
 • From device: Run Get-WindowsAutoPilotInfo.ps1 -OutputFile C:\hash.csv
 • Upload to Intune at: Devices > Windows > Windows enrollment > Devices

2. Use CSV Validator:
 • Open hash file in Excel — verify expected columns (Device Serial Number, Product ID, etc.)

3. Force Sync:
 • Go to Autopilot > Sync and trigger portal refresh. Status may take up to 15 minutes

4. Validation:
 • If not appearing, use Graph API: Check /deviceManagement/windowsAutopilotDeviceIdentities via Microsoft Graph Explorer

BitLocker Device Encryption

BitLocker provides full disk encryption to protect sensitive data on Windows devices. Integrated with Intune, it ensures compliance and data security across managed endpoints.

Key Concepts

Task Steps Explanation Details
Enable BitLocker via Intune 1. Go to Intune Admin Center → Endpoint security > Disk encryption.
2. Click Create Policy:
 • Platform: Windows 10 and later
 • Profile: BitLocker
3. Configure encryption settings (OS drive, fixed data drives, etc.).
4. Enable Silent Encryption for seamless deployment.
5. Assign the policy to a Device Group.
6. Monitor compliance under Reports > Encryption Report. 		Enables BitLocker on devices automatically without user input. Requirements: TPM 1.2 or 2.0, Windows Pro/Enterprise.
Advanced: Use PowerShell manage-bde for manual configuration.
Monitoring: View recovery keys in Azure AD > Devices.
Store Recovery Keys in Azure AD 1. Ensure device is Azure AD joined or Hybrid joined.
2. Enable Group Policy:
 • Computer Configuration > Administrative Templates > Windows Components > BitLocker Drive Encryption > Operating System Drives.
 • Enable "Store BitLocker recovery information in Azure AD".
3. Encrypt the drive using BitLocker.
4. Verify recovery key in Azure AD device details. 		Secures recovery keys in the cloud for easy retrieval. Tools: Group Policy, Intune, PowerShell.
Check: Azure AD > Devices > Select device > BitLocker keys.

BitLocker Issue Troubleshooting

BitLocker provides drive encryption for enhanced security on Windows devices. However, deployment or policy-based management may run into issues related to compliance, recovery key backup, TPM, or encryption failures. This section covers both common steps and advanced scenarios to address BitLocker problems.

Key Concepts

Issue Possible Causes Resolution Steps Advanced Scenarios
TPM Not Ready or Missing • TPM not initialized
• TPM ownership issues
• Virtual TPM not enabled (VMs) 		1. Run tpm.msc and check status
2. Enable TPM in BIOS/UEFI
3. Use PowerShell:
Get-WmiObject -Namespace "Root\CIMV2\Security\MicrosoftTpm" -Class Win32_Tpm
Advanced: Interview/Real-World Fix 🔄 Scenario: TPM is present but "Not Ready"
💡 Fix: Reset TPM via BIOS + Clear-Tpm
🧪 Pro Tip: Check if device is in UEFI and Secure Boot is ON
Encryption Not Triggering • User context requirement
• Encryption method mismatch
• Policy conflict or WMI filters 		1. Validate BitLocker policy settings in Intune:
Endpoint Security > Disk Encryption
2. Check Event Viewer:
Applications and Services Logs > Microsoft > Windows > BitLocker-API
3. Force policy sync:
dsregcmd /status & intune sync
Advanced: Policy & MDM Conflict 🛠️ Scenario: GPO conflicts with Intune encryption
💡 Fix: Use MDMDiagReport.html to compare CSP vs GPO
⚠️ Note: Silent enablement requires device to be AAD joined + UEFI
Recovery Key Not Backing Up • Device not Azure AD Joined
• Sync failures
• User turned off backup 		1. Confirm device is Azure AD Joined
2. Check backup via PowerShell:
manage-bde -protectors -get C:
3. Verify recovery key in Azure:
Devices > Select device > BitLocker Keys
Advanced: Force Backup 📌 Fix: Manually back up with:
Backup-BitLockerKeyProtector -MountPoint "C:"
🧠 Interview Tip: Highlight how Intune handles recovery key escrow
BitLocker Not Reporting Compliance • Incorrect compliance policy
• WMI returns incorrect status
• Encryption paused or not full 		1. Review Intune compliance policy settings
2. Check status using PowerShell:
Get-BitLockerVolume | Select-Object MountPoint, VolumeStatus, ProtectionStatus
3. Restart MDM PolicyManager service
Advanced: WMI Inconsistency 🔄 Fix: Trigger full encryption with:
manage-bde -on C:
🧪 Check: EncryptionMethod must not be “None”
📌 Scenario: Only OS drive encrypted but compliance policy expects all drives
Autopilot + BitLocker Conflict • Encryption blocked until ESP completes
• Device not AAD joined during provisioning 		1. Review ESP timeout logs in:
C:\ProgramData\Microsoft\IntuneManagementExtension\Logs\ESP
2. Delay BitLocker via policy:
ConfigureDelayEncryption = 1
3. Validate Enable BitLocker after sign-in setting
Advanced: Delayed Encryption Handling 🔁 Fix: Use OMA-URI ./Device/Vendor/MSFT/BitLocker/ConfigureEncryptionMethod
💬 Interview Use Case: Secure provisioning using staging account + post-login encryption

Microsoft Defender for Endpoint

Microsoft Defender provides real-time protection against malware, ransomware, and advanced threats. Integrated with Intune and Microsoft 365 Defender, it enables endpoint protection and advanced threat hunting capabilities.

Key Concepts

Task Steps Explanation Details
Configure Defender Antivirus Policy 1. Navigate to Endpoint security > Antivirus in Intune.
2. Click Create Policy:
 • Platform: Windows 10 and later
 • Profile: Microsoft Defender Antivirus
3. Define settings:
 • Real-time protection
 • Scheduled scans
 • Cloud protection level
4. Assign to device groups.
5. Monitor policy deployment in Reports > Antivirus Status. 		Create and Assign Microsoft Defender Antivirus Policy in Intune – Step-by-Step

1. Open Microsoft Intune Admin Center:
 • Go to https://intune.microsoft.com
 • Sign in with your Microsoft 365 Global Admin or Intune Admin credentials.
 • Navigate to Endpoint Security > Antivirus

2. Create a New Antivirus Policy:
 • Click + Create Policy
 • Platform: Windows 10 and later
 • Profile: Microsoft Defender Antivirus
 • Click Create

3. Configure Defender Antivirus Settings:
 • Provide a Name and Description for the policy.
 • In the Configuration settings section, configure important options like:
  – Real-time protection: Enable
  – Cloud-delivered protection: Enabled
  – Automatic sample submission: Send all samples
  – Scan archive files: Yes
  – Schedule full scan: Weekly
  – Scan removable drives: Yes
  – Signature update interval: Every 4 hours
  – Idle-time scan: Enabled
  – Potentially unwanted applications (PUA) protection: Block
 • Customize based on compliance and security requirements.
 • Click Next.

4. Assign the Policy to Devices or Users:
 • Under Assignments, click Add groups.
 • Select an Azure AD group (e.g., All Windows 10 Devices).
 • Use filters if needed to target only corporate devices.
 • Click Next.

5. Review and Create:
 • Review your configurations.
 • Click Create to deploy the Defender Antivirus policy.

6. Monitor Policy Deployment and Compliance:
 • Go to Endpoint Security > Antivirus
 • Select the policy and view the Device and User check-in status.
 • Check for Errors, Conflicts, or Not Applicable states.
 • Use Device > Monitor > Security Baselines > Antivirus to check compliance.

7. Verify from the Client Side (Optional):
 • Open PowerShell on the client system and run:
  Get-MpPreference
  Get-MpComputerStatus
 • Confirm real-time protection, scan schedules, and policy status.

 Advanced: ASR rules, exclusions, scan schedules.
Monitoring: Microsoft 365 Defender portal for security alerts.
Onboard Devices to Defender for Endpoint 1. Go to Microsoft 365 Defender portal > Settings > Endpoints > Onboarding.
2. Select "Microsoft Intune" as deployment method.
3. Download onboarding package.
4. In Intune, create a Device Configuration Profile:
 • Platform: Windows 10 and later
 • Profile type: Custom
5. Add onboarding script and settings.
6. Assign to appropriate devices.
7. Verify onboarding status in Defender portal. 		Onboard Android Devices to Microsoft Defender for Endpoint – Step-by-Step

1. Prerequisites:
 • Microsoft Defender for Endpoint (MDE) Plan 1 or Plan 2 license.
 • Microsoft Intune licenses assigned to users/devices.
 • Android devices must be enrolled in Intune via Android Enterprise (Fully Managed, Work Profile, or Dedicated).
 • Microsoft Defender for Endpoint app must be available via Managed Google Play.

2. Connect Intune and Defender for Endpoint:
 • Go to Microsoft 365 Defender Portal
 • Navigate to Settings > Endpoints > Advanced features
 • Ensure Microsoft Intune Connection is turned ON.
 • Also enable:
  – Microsoft Defender Antivirus
  – Mobile Threat Defense (MTD)

3. Sync Defender with Intune:
 • In the Intune Admin Center, go to:
  Endpoint security > Microsoft Defender for Endpoint
 • Click Open Connector Page → Ensure the toggle is ON.
 • Save settings if modified.

4. Approve Microsoft Defender App in Managed Google Play:
 • In Intune Admin Center, navigate to:
  Apps > Android > Android apps > + Add
 • Select Managed Google Play → Search for Microsoft Defender
 • Approve the app → Sync it to Intune.

5. Assign Microsoft Defender App to Android Devices:
 • After syncing, go to Apps > All apps → Select Microsoft Defender
 • Click Assignments → Add Required or Available assignment group.
 • Save the configuration. Defender will be pushed to enrolled devices.

6. Create App Configuration Policy for Defender:
 • Navigate to Apps > App configuration policies > + Add
 • Platform: Android Enterprise
 • Profile type: Work Profile or Fully Managed (based on enrollment)
 • Targeted app: com.microsoft.scmx
 • Add these JSON values under Configuration settings format: JSON
  
{
  "allowWebProtection": true,
  "enableNetworkProtection": true,
  "reportThreatsToMTP": true,
  "allowOnboarding": true
}
 • Assign to targeted groups.

7. (Optional) Create Compliance Policy Based on Threat Level:
 • Go to Devices > Compliance Policies > + Create Policy
 • Platform: Android
 • In conditions, set:
  – Threat level: Secured / Low / Medium / High
 • Assign to device group.

8. Monitoring Defender Status:
 • Open https://security.microsoft.com
 • Go to Endpoints > Device Inventory
 • Filter by platform (Android) → View threat status, alerts, compliance.
 • In Intune, go to Devices > Monitor > Threat agent status

 Tools: Microsoft 365 Defender, Intune, PowerShell.
Check: Device inventory > Onboarding status.

SCCM and Intune Migration

Migrate from System Center Configuration Manager (SCCM) to Microsoft Intune or configure co-management to leverage both platforms for centralized device management, security policies, and compliance enforcement in a mixed-device environment (Windows, Android, iOS). Learn the key steps for enabling co-management, transitioning workloads, and managing hybrid environments.

Key Concepts

Task Steps Explanation Details
Enable Co-Management 1. In Configuration Manager console, navigate to Administration > Cloud Services > Co-management.
2. Select Configure Co-management and sign in with a Microsoft 365 global admin account.
3. Enable Co-management and select a pilot collection (e.g., “Pilot Windows Devices”).
4. Configure workloads to manage via SCCM or Intune (e.g., Client Apps, Compliance Policies).
5. Verify Azure AD integration in Azure Portal > Azure AD > Mobility (MDM and MAM).
6. Monitor co-management status in Monitoring > Co-management. 		Enables hybrid management, allowing SCCM and Intune to coexist for Windows devices. Requirements: SCCM 1806+, Azure AD Connect, Intune subscription.
Advanced: Use PowerShell to automate collection creation for pilot groups.
Monitor: Check CoMgmtSettingsProd.log in SCCM client logs.
Configure Cloud Management Gateway (CMG) 1. In Configuration Manager console, go to Administration > Cloud Services > Cloud Management Gateway.
2. Create a CMG instance and deploy it to Azure.
3. Configure a server authentication certificate (e.g., from a public CA or internal PKI).
4. Enable clients to use CMG in Client Settings > Cloud Services.
5. Assign CMG to a boundary group in Administration > Hierarchy Configuration > Boundary Groups.
6. Verify client connectivity in Monitoring > Cloud Management Gateway. 		Allows SCCM to manage internet-based clients via Intune’s cloud infrastructure. Requirements: Azure subscription, SCCM 1810+, valid certificate.
Advanced: Configure CMG for content distribution (apps, updates).
Monitoring: Review CMGService.log for connection issues.
Transition Workloads to Intune 1. In Configuration Manager console, navigate to Administration > Cloud Services > Co-management.
2. Select Workload Slider to move workloads (e.g., Compliance Policies, Device Configuration) to Intune.
3. Create equivalent Intune policies in Intune Admin Center > Devices > Configuration Profiles.
4. Test policies on a pilot collection before full rollout.
5. Gradually shift workloads (e.g., Apps, Windows Updates) to Intune.
6. Monitor policy application in Intune > Devices > Monitor. 		Gradually migrates management tasks from SCCM to Intune for cloud-based management. Workloads: Compliance, Device Configuration, Endpoint Protection, Apps, Updates.
Advanced: Use Intune’s Security Baselines for standardized policies.
Monitoring: Check Intune reports for policy compliance.
Migrate Mobile Device Management to Intune 1. In Intune Admin Center, go to Devices > Android/iOS > Enrollment.
2. Set up Android Enterprise and Apple Business Manager (ABM) for mobile devices.
3. Create enrollment profiles for Android (Fully Managed/Work Profile) and iOS (ADE/User Enrollment).
4. Migrate SCCM-managed mobile devices to Intune via Intune Connector.
5. Assign MAM policies for BYOD devices in Intune > Apps > App Protection Policies.
6. Verify enrollment in Intune > Devices > All Devices. 		Transitions Android and iOS device management from SCCM to Intune for cloud-native capabilities. Requirements: Intune subscription, ABM for iOS, Google Play for Android.
Advanced: Use Intune’s App Configuration Policies for app settings.
Monitoring: Track enrollment status in Intune’s Device Diagnostics.

Microsoft 365 Admin Center

The Microsoft 365 Admin Center is the centralized portal for managing users, groups, licenses, services, and security across Microsoft 365 workloads like Exchange, SharePoint, Teams, and Intune. This section outlines core administrative functions, user and license management, and integration with Azure Active Directory.

Key Concepts

Task Steps Explanation Details
Add a New User 1. Go to Microsoft 365 Admin Center > Users > Active Users.
2. Click + Add a user.
3. Fill in name, username, and domain (e.g., user@domain.com).
4. Assign product licenses (e.g., Microsoft 365 E3, Business Premium).
5. Set location and roles (e.g., User, Global Admin).
6. Review and finish adding the user. 		Creates a new Microsoft 365 user with required licenses and permissions. Advanced: Use PowerShell New-MsolUser or New-AzureADUser.
Monitor: View audit logs in Microsoft Purview > Audit.
Assign/Remove Licenses 1. Navigate to Users > Active Users.
2. Select the user and go to Licenses and Apps tab.
3. Check/uncheck required service plans (e.g., Exchange, SharePoint, Teams).
4. Save changes. 		Grants or revokes service access based on user role or business need. Automation: Use PowerShell: Set-MsolUserLicense.
Bulk: Use CSV import for license assignment.
Reset User Password 1. In Users > Active Users, select a user.
2. Click Reset Password from the top menu.
3. Choose auto-generated or manually set password.
4. Send password to email or copy manually.
5. Ensure Require password change at next sign-in is enabled. 		Helps secure user accounts and recover access for locked-out users. Security: Enable MFA and Conditional Access in Entra ID (Azure AD).
Log: Password reset events tracked in Audit Logs.
Manage Roles and Admin Delegation 1. Go to Roles > Admin roles in M365 Admin Center.
2. Select a role (e.g., Exchange Admin, Compliance Admin).
3. Click Assigned Admins and add users or groups.
4. Use role groups in Microsoft Entra ID for dynamic assignment.
5. Review role activity using Microsoft Purview > Audit. 		Ensures secure and controlled administrative access. Best Practice: Use least privilege principle.
Advanced: Assign PIM (Privileged Identity Management) in Azure AD.
Service Health and Incident Monitoring 1. In M365 Admin Center, go to Health > Service Health.
2. View real-time incidents and advisories.
3. Subscribe to service health email alerts.
4. Click on incidents for root cause and resolution timeline.
5. Export reports for stakeholder updates. 		Helps IT teams track outages and proactively address issues. Advanced: Use Microsoft 365 Admin App for mobile alerts.
Integration: Connect to SIEM tools for automated ticketing.
```