Our organization is trying out the passwordless capability as part of the Authentication Policy CSP, but we are struggling with the some of the functionality as currently designed and documented: https://learn.microsoft.com/en-us/windows/security/identity-protection/passwordless-experience/#in-session-authentication-experiences To keep this short: What is the reasoning behind forcing in-session authentication to the built-in local Administrator account and not allowing the opportunity to provide another account with local administrator access to authenticate? LAPS is great and it works but is hard to track down to who actually performed that action, aka retrieved the LAPS password from Entra, and EPM requires additional configuration, doesn't currently check all of the boxes, and most importantly, comes at an additional cost.

Is there a plan to add an executable to make integration to Intune easier? Currently with the current procedures: GPO, work, /school login. It would simplify the experience to have an MSI to install Intune.

Education customer- we want to deploy EID-Joined, Intune managed devices for shared teaching spaces with a high turnover of users. We are finding issues with some Intune policies not re-applying for every user who signs in. For example we remove the Shutdown/Restart/Sleep options from the start menu- when the first user signs in, the policy seems to work. For subsequent users it doesn't work, then intermittently it will work for another user. The policies where this happens are all marked as 'User-scoped'. We assign these to device groups, but this is supposed to be a supported scenario - whereby they are applied to all users. In reality they don't seem to be applied immediately upon login, which makes them pretty useless in this scenario. Is there anything we can do/should be doing?

one more if I may, I see remote Antivirus scans, remote wipe, etc. I do not see remote backup. Is this not a feature, such as have the user plug in a USB external drive and click backup to remotely back them up or backup to an azure storage blob perhaps, before doing all kinds of maintenance or wiping/fresh starting a device? Perhaps powershell to the rescue but where to start on that?

How are folks managing with Intune the remote workers and their devices when a remote worker is not a local admin yet needs to add a device at home such as a local printer/scanner etc for their job? That would require elevation, and as a local user, they do not have rights to do so? Is IT having to constantly add devices to remote worker systems in support calls (sounds inefficient) or are people leaving users as admins?

Have yet to be able to find a successful process/script/etc for removing local admin privileges from aad joined or hybrid devices for the corporate users. Examples: Bob is a new employee, we ship him a laptop new in the box. No autopilot, just a new one off the shelf with Win 11 pro. Bob has the necessary 365 licenses, he goes thru the OOBE with his 365 credentials, It makes him an administrator, seems to be no easy way to remove that from him. Dave, on the other hand, Dave has been around a bit, his laptop is 2 years old, we are only starting to roll out intune, Dave logs into his laptop with a local account, it was upgraded from win10 to win 11 pro but he uses a local account, then accesses work/school via the usual apps and browsers, but, Dave is the only administrator account and his system is AAD Registered. How do we easily make Dave a local user and not an admin anymore? There is a catch, Neither Dave nor Bob are in the office, they work from home (remote employees).

We have just started moving away from an On-Prem Server to a AAD Joined (not using Hybrid). One of the features I miss already is the ability to lock out an account from signing in to their laptop. Blocking Sign In to their AAD/email account and Revoking Access to their signed in sessions doesn't prevent the user from signing in to Windows. On top of that, changing the users password for their AAD/email account doesn't stop them using their old password to sign in UNTIL the new password is used. It also doesn't prompt for a password change on signing in to windows after setting their account to "change on next sign in". Am I missing something? can we disable the caching of credentials? Thank you!