Forum Widgets
Latest Discussions
Problems installing ADD Connect on Server 2022
I have set up a Windows Server 2022 (Hyper-V). I have an M365 DEV tenant from Microsoft. When I install ADD Connect, I am first asked for the local user, which works with the login. Then I am supposed to log in to the DEV tenant with a user. To do this, I made a user a global administrator with Microsoft authentication. I log in and am asked to enter the number displayed on my cell phone. Immediately after that, I see this message and cannot continue. I have installed only Microsoft Edge, last version, all updates are installed. In the Serevr Manager -> Local Server I Disable IE Enhanced Security Configuration. I Login in Edge with this Global admin and have still open this Edge Window. But If I Login again, the same error message. What can I do to fix this problem?Hybrid to Entra ID WiFi Certificate Authentication NPS via WHfB Cloud Trust & Cloud PKI-Replace ADCS
Hello Team, We are working in moving our devices Hybrid Entra ID Joined to Intune autopilot Entra ID Joined Current scenario: Hybrid Entra ID Joined devices (joined to both on-prem AD and Entra ID) Active Directory with Entra ID Connect for object synchronization AD Certificate Services (ADCS) issuing user and device certificates via GPO auto-enrollment Group Policies to push Wi-Fi configuration (EAP-TLS using device certificate) NPS RADIUS server using EAP-TLS ("Smart Card or Other Certificate") for secure 802.1X authentication On-prem SSO enabled through standard Kerberos authentication Now, I am testing Autopilot Win11 Entra ID Joined with WHfB using Cloud trust to SSO to on-prem resources. The autopilot is working, however, the WIFI is not working as the autopilot device doesn't have any certificate from the on-prem ADCS. What is the best practice to try be as much cloud and begin to decommision on-prem services. I have 2 options to push the User and computer certificate to the AUtopilot device: Option 1: Intune Certificate Connector that will bridge on-prem ADCS and Intune, In Intune a PKCS profile to install the certificate to the autopilot device. Option 2: Intune Cloud PKI and configuration profile PKCS profile to install the certificate to the autopilot device. on-prem install the root CA from the Intune cloud PKI. https://learn.microsoft.com/en-us/intune/intune-service/protect/microsoft-cloud-pki-deployment For the on-prem SSO I will contine using Cloud Trust. Component Target Device Identity Autopilot + Entra ID Joined only (no domain join) User Sign-In Windows Hello for Business (WHfB) with Cloud Kerberos Trust Certificate Issuance Replace ADCS/GPO with Microsoft Cloud PKI and Intune PKCS Wi-Fi Authentication Retain existing NPS RADIUS using EAP-TLS, but trust both ADCS and Cloud PKI root CAs On-prem SSO Enabled by AzureADKerberos on domain controllers Hybrid Devices Continue current operation during the transition — no immediate impact The 2 network environment needs to coexist: the on-prem and the cloud. Device Type Certificate Issuer Wi-Fi Auth SSO Hybrid AD-joined ADCS via GPO EAP-TLS (device cert) Native Kerberos Autopilot Entra ID Joined Cloud PKI via Intune EAP-TLS (device cert) WHfB + Cloud Trust (AzureADKerberos) How the New Wi-Fi Auth Works: Autopilot devices receive: A device certificate from Cloud PKI via Intune A Wi-Fi profile using EAP-TLS authentication NPS RADIUS server: Validates the device cert Issues access to Wi-Fi WHfB Cloud Trust provides a Kerberos ticket from AzureADKerberos, enabling seamless access to file shares, print servers, etc. This allows Autopilot Entra ID Joined devices to: Connect to Wi-Fi without GPO Access on-prem resources without passwords High-Level Implementation Steps Deploy Microsoft Cloud PKI in Intune Configure PKCS profiles for user and device certificates Deploy WHfB Cloud Trust via Intune + Entra ID (no AD join needed) Configure AzureADKerberos on domain controllers Install Cloud PKI Root CA in NPS server trust store Update NPS policy to accept certificates from both ADCS and Cloud PKI Deploy Wi-Fi profiles to Autopilot devices via Intune (EAP-TLS using device cert) Based on it, what is the best practice to move the device to the cloud as much possible.Web-based device enrollment vs Company Portal
Hi everyone, Microsoft recommended the web based device registration for IOS, especially bring your own device. I went through the whole process. The main difference is that the user doesn't need to install the company portal and you need to configure the JIT (Just in time registration). The enterprise portal should be delivered as a web application. The user experience: The user goes to the URL https://portal.manage.microsoft.com/enrollment/webenrollment/ios. The profile is loaded, then the user has to go to the settings application and install the profile. The user has access to the company portal with the web application. Microsoft recommends JIT (just in time registration) for web-based device registration. I see the advantage of less logins for the user (thanks to JIT) and no Company Portal app on the device. What is the advantage of web-based device enrolment? Why did Microsoft recommend this method of registration?
Enable Developer Mode at supervised iPad
We've just started introducing Microsoft InTune. We've managed to get our iPads registered an the onboarding seems to work. Now i've the challenge, that one of our users needs for testing and developing iOS Apps with apple xcode to have the developer mode enabled at his iPad device. XCode is not able to connect to the iPad and i think thats why the swith in Data Security and Privacy Settings doesn't even show up (and can not be enabled cause of this). I worked through all the settings regarding USB connections ("Limitiation") in InTune. No success so far. Is there any setting i can check to enable the user / the device to connect via USB to a Mac ? Any ideas appreciated Regards
Yealink AOSP Phones and Intune Scep certificate configutation Profile
Hi, Im looking for guidance if Yealink Teams phones can have scep certificates deployed via Intune to be used for 802.1x authentication. We can push root certificates to the devices, but even though the scep certificate configuration shows that a certificate has been created it never gets onto the phone.Android 15 - CredentialProviderPolicy not surfaced by Intune
I have been having an issue with Android 15 devices. We use Authenticator as our password autofill provider. As soon as a device is updated from Android 14 to Android 15, the password autofill provider is no longer set and the setting to change it is 'blocked by work policy.' I have already tried removing all policies that apply to the devices (device config and device compliance policies) and factory resetting them. Simply having them enrolled as corporate owned fully managed devices causes this to happen. I raised the issue in the Android Enterprise community blog. A link to that is included below. Someone on that thread found that there is a policy in Android 14/15 called the credentialproviderpolicy. When that policy is blocked or unconfigured, this behavior happens. I cannot find anywhere in Intune where I can set this policy. It seems that it is allowed by default when managing Android 14 with Intune, but not set or blocked when the device switches to Android 15. Is there any way to specifically set a policy that is not reflected in the Intune UI? This is a blocker for being able to move more phones to Android 15. Link to Android Enterprise thread: Re: Android 15 - Cannot set default password app - Android Enterprise Customer Community - 8708 Thanks, Tom
We’re running into an Intune issue where a Win32 app with a dependency sits at "Download Pending"
Setup: Main App: Installs in User Context Dependency: Installs in System Context Dependency Detection: Hosts file modification detection script Direct file detection does NOT work either When the hosts file modification is present (detection is met), detection works, and everything installs fine manually The Problem: If detection passes (exit 0) → Everything installs fine. If detection fails (exit 1) → Intune never moves forward, just stays at "Download Pending" indefinitely. Happens with both file-based detection and script-based detection. Dependency app as well at parent app install fine via Intune on their own as well as manual testing. What We Need to Know: Does Intune get stuck in "Download Pending" instead of moving forward when dependency detection fails? Could the install context mismatch (dependency in SYSTEM, main app in USER) be causing this? Myth or fact? Does Intune break the install process if a dependency app is in system context and the parent app is in user context? Again, both apps work fine independent of each other. Thanks for any help!
