Forum Widgets
Latest Discussions
Autopatch for quality updates and WUFB for feature updates
We have switched to Autopatch for quality updates in our environment, but now is the time for feature update deployments. In the past we had used Windows Updates for Business for feature update without any problem. We would like to deploy the feature updates and retain the control of the target groups through the process, which are different ones from the quality updates. As the content is much bigger, we would like to test to specific users, after communicating to them for the procedure, and also be sure that the availability and the bandwidth will be adequate specially now during summer holidays. Could we still use WUfB only for the feature deployment along with Autopatch, without intervening to the normal monthly update cycle?SolveddemionJul 09, 2026Copper Contributor101Views0likes4Comments
Intune Platform Scripts never target devices (0 targeted devices) despite healthy Intune environment
Hi everyone, I'm hoping someone has seen this before because I've exhausted most of the obvious troubleshooting. Environment Microsoft 365 Business Premium Windows 11 Pro Microsoft Intune Microsoft Entra ID Joined devices Intune Management Extension (IME) installed and healthy The Issue Platform Scripts never target any devices. Regardless of the script, assignment or device, the script always remains at: 0 Devices 0 Succeeded 0 Errors The device never appears under Device Status. What works The Intune environment is otherwise functioning normally. Configuration Profiles deploy successfully. Settings Catalog policies apply successfully. BitLocker policies apply. Windows Firewall policies apply. Windows LAPS is working. Win32 applications deploy successfully Devices are Entra Joined and managed by Intune. What I've tested To eliminate variables I created: Created a brand new PowerShell script that simply creates a text file. Created a brand new assigned Security Group containing a single Windows 11 device. Assigned only that Security Group to the Platform Script. The result is still: 0 Devices 0 Succeeded 0 Errors Device checks completed On the client: dsregcmd /status shows AzureAdJoined = YES. Intune Management Extension service is running. Win32 apps are deploying correctly. Intune Management Extension logs appear healthy. AgentExecutor.log contains WinGet application activity but no evidence of any Platform Script ever being downloaded or executed. The IntuneManagementExtension registry contains SideCarPolicies but there is no evidence of any PowerShell script policy being received. Additional observations I reproduced the issue on two separate Windows 11 devices. I reproduced the issue using both dynamic and assigned device groups. I reproduced the issue using different PowerShell scripts. This makes me believe the issue is not device specific. Question Has anyone seen Platform Scripts remain permanently at 0 targeted devices despite Intune otherwise functioning normally? Is there a known tenant-side issue, prerequisite or licensing requirement that would prevent Platform Scripts from ever targeting devices while Win32 apps and Configuration Profiles continue to work? Any suggestions would be appreciated.SolvedHRZookJun 28, 2026Tin Contributor191Views0likes5Comments
Is monthly BIOS updates via Intune overkill for enterprise Windows 11
Hey all, Looking for some opinions from others managing BIOS and Drivers on enterprise environments. We’re considering pushing BIOS/firmware updates monthly across our Windows 11 fleet using Intune, but it feels a bit too aggressive. Is anyone actually doing BIOS updates this frequently? Do you see real risk in not updating BIOS regularly? Or do you treat BIOS updates more as “only when needed” (security issue / vendor recommendation)? Any issues you’ve run into pushing BIOS updates at scale via Intune? My concern is stability risk vs actual security benefit — feels like monthly might be overkill unless there’s a critical vulnerability. Keen to hear how others are handling this in production environments.Solved
MS InTune - packaging Amazon DCV client
Hi, I used the InTune prep tool to bundle the Amazon DCV client. Everything seems to work correctly, bundle created and it uploads well. When I use the company portal to install, it looks like it pushes\installs properly but the DCV client does not run on the laptop after install. This is a .msi package so all the settings are in place when i create the InTune APP in the portal. Has anyone succesfully bundled DCV in InTune? Am I missing anything? or anything to try? Thank you,Solvedlearnazure_adMay 13, 2026Brass Contributor171Views0likes5Comments
Intune Device Reset Issue After Recent Update
Hi everyone, We’re currently running into an issue with device reset scenarios in our environment and wanted to check if others are seeing something similar or have identified a reliable workaround. Environment: • Windows 11 25H2 • Windows Autopatch enabled • Devices managed via Intune Issue: When initiating any of the following actions from the Intune portal: • Autopilot Reset • Fresh Start • Wipe …the process consistently fails at around 38–40%. Observations: • Event Viewer logs Event ID 4502 during the failure. • This behavior started after applying a recent update. Troubleshooting performed: • We attempted to repair/rebuild the WinRE partition using the WinRE.wim from the latest Windows 11 ISO. • After this repair, the reset process completes successfully. However: • Post-reset, during re-enrollment, the device fails at the Account Setup (ESP) stage. Support status: • We had a case opened with Microsoft but they said that Reset was triggered from intune and reset process started on device so they cannot check anything further from their end and they have not received any similar cases or not aware of any known issue Has anyone else encountered: • Reset failures around 40% with Event ID 4502? • Issues tied to WinRE after recent updates? • Enrollment failures post-reset (ESP Account Setup stage)? If so, have you found: • A root cause? • A stable remediation or workaround? Appreciate any insights or shared experiences. Thanks!SolvedParth49Apr 08, 2026Tin Contributor1.2KViews0likes2Comments- lilbopeepsMar 31, 2026Tin Contributor82Views0likes1Comment
IOS - Embedded Webkit - Not Reporting Correct Device info
It appears that with the latest iOS versions (26.3.1 through 26.4), applications that rely on an embedded WebKit for sign-in are no longer reporting accurate device details within Device Info. Users have company-issued phones that are successfully enrolled in Intune, but when they attempt to sign in to Apple Mail, Conditional Access is denying the login. After reviewing the logs, iOS is reporting the OS version as 18.7.0 to Intune, even though the device is actually running iOS 26.4. Additionally, the device information is coming through as blank, so attributes are not being evaluated. When looking at other logins via the outlook app on that device it all appears normal and works. Has anyone else observed this behavior where WebKit is sending incorrect data to Intune? Does anyone know of a workaround other than relaxing Conditional Access policies?SolvedNexusEgoMar 30, 2026Tin Contributor2.6KViews1like7CommentsHow to configure Intune to not allow remote wiping of personal devices
I’m a journalist seeking to do a story around best practices for configuring Intune, in the wake of last week’s destructive attack against Michigan-based medical device maker Stryker. It looks like attackers gained admin-level access to Intune and used it to wipe employees’ personal devices that were enrolled in Intune. I was speaking with someone who has recent Intune administration experience, and his take is that like other UEM/BYOD/endpoint management tools, none of this software should be configured with the ability to fully wipe a personal device. Instead, it should be only placing sandboxed apps or directories onto a device. Only this sandboxed stuff should be remotely nuke-able. His supposition is that if personal data can be wiped, then either the Intune admins set it up incorrectly, or their documentation for employees who self-configure didn’t specify how to add their device but not give Intune full wiping capabilities. My questions: 1) Is it possible to configure Intune so that it doesn’t have overly broad permission to wipe an entire, personally owned device? 2) How exactly would one do that (on either Android or iOS)? There’s lots of “ditch Intune” chatter on Reddit now, supposedly tied to CISOs/executives reacting to the Stryker attack. So I’m seeking clarity around whether the tool can be configured to not remotely wipe personal data, even if other defenses that should be in place (such as requiring multiple admins’ approval before wiping devices, setting alerts if more than a few devices get remotely wiped at once, and so on) aren’t there.SolvedMathew1Mar 17, 2026Copper Contributor718Views0likes3Comments
Unable to deploy out of band update 26200.7628
Hello, I need to deploy OOB 26200.7628 on our computers. We use deployment rings. The 2026.1 OOB update appeared in Releases on January 24. I created an expedite policy with a group of users I want to target with this update (with a restart within 0 days). But nothing has happened since Monday, everyone is still on 26200.7623. Where am I going wrong? Thank you.Solved1.2KViews1like6Comments
Tags
- intune4,362 Topics
- mobile device management (mdm)2,323 Topics
- Mobile Application Management (MAM)851 Topics
- Software Management476 Topics
- Conditional Access463 Topics
- Graph API255 Topics
- Azure Friday166 Topics
- Autopilot118 Topics
- android75 Topics
- ios62 Topics