Event details
44 Comments
Following recent updates from Windows 11 KB5124010 / Windows 10 KB5120249 through Windows 11 KB5127648 / Windows 10 KB5126657, File History can locate and run on target drive D:, but the "Last copied date and time" in Control Panel fails to update to the actual latest save time after clicking "Run now"; additionally, while D: read/write functions normally, modified file versions/timestamps do not update, newly created files show "No previous versions available," duplicate physical versions of unmodified files are created, attempting to "Clean up versions" triggers an "Element not found" error, and despite successful backup execution, newly added or updated files and images are missing or retaining prior timestamps, which I suspect stems from unresolved regression since KB5101684 compounded by recently renaming D:\FileHistory to filehistory.old, clicking "Run now", and renaming it back, causing a mismatch between displayed backup times and actual D: drive backup contents; as similar issues post-KB5124010/KB5120249 have been reported by users on Feedback Hub and Microsoft Community Hub as well as Japanese media and repair shops, please refer to my prior support history with representative Vensky—who escalated my issue to the engineering team for review—and provide an official status update on the engineering investigation.
What would be the recommended best-practice approach for designing and implementing Microsoft Intune as the centralized management platform for corporate Windows 11 laptops for users licensed with Microsoft 365 Business Premium?
We are looking to establish a secure, standardized, scalable, and maintainable endpoint management model that covers the entire device lifecycle, from provisioning and enrollment through ongoing management and eventual retirement.
Specifically, we would like guidance on the recommended architecture and policy baseline for Windows Autopilot, Microsoft Entra ID, Intune configuration and compliance policies, Conditional Access, Microsoft Defender, BitLocker, Windows Update, application deployment, and Windows LAPS.
One of our key requirements is to follow the principle of least privilege: end users should normally operate as standard users and should not be able to create unauthorized local accounts or add users to the local Administrators group. At the same time, IT needs a secure and manageable mechanism to perform administrative and support tasks when elevated privileges are required.
From Microsoft’s perspective, what would be the recommended Intune architecture, security baseline, and policy strategy for this scenario? Which policies should be considered essential, which should be optional, and are there any configurations or common mistakes you would recommend avoiding to prevent unnecessary operational complexity or user disruption?
We would also appreciate recommendations on how to structure device and user groups, policy assignments, pilot deployments, and phased rollout so that the environment remains secure but also practical for IT to operate and maintain over time.
for business premium i'd do a user-driven entra join autopilot profile with User account type set to Standard, so whoever signs in at oobe doesn't end up in local admins. pair that with a windows LAPS policy so you've still got a managed local admin password for support.
- Jason_Sandys
Microsoft
Hi Chriistian. There isn’t necessarily a single “best” Intune architecture or policy set for every organization. The right approach depends heavily on your environment, security requirements, operational priorities, application portfolio, support model, and organizational standards.
A good starting point is Microsoft’s Zero Trust and Cloud-Native Windows guidance. It describes the broader approach of using cloud-native Windows management with Zero Trust principles, including continuous verification and least-privilege access.
For Windows 11 configuration specifically, I recommend starting with the built-in Intune security baselines rather than attempting to define every security setting independently. They provide a Microsoft-recommended starting point that you can validate and adjust to meet your organization’s requirements.
From there, build around a few core principles:
- Use Windows Autopilot and Microsoft Entra join where they fit your provisioning and identity requirements.
- Keep users as standard users by default. Use Windows LAPS to secure and rotate managed local administrator credentials for appropriate support and recovery scenarios.
- Where controlled elevation is required, consider Intune Endpoint Privilege Management to allow specific tasks to run elevated without making the user a local administrator.
- Establish the security, compliance, Conditional Access, Defender, BitLocker, update, and application-management policies your organization requires, but avoid configuring the same settings through multiple policies where possible.
- Keep assignments and group structures as simple as practical. Use exceptions deliberately rather than creating many slightly different versions of your core policies.
- Pilot first and expand in phases. Validate security settings, applications, updates, provisioning, and the support experience with representative devices and users before broad deployment.
Most importantly, treat Microsoft’s guidance and baselines as a starting point, not a universal finished configuration. Test and adapt them to your organization’s security standards, operational needs, and risk tolerance. Configuring settings simply because they are available can add complexity, create policy conflicts, and cause user disruption without necessarily improving your security posture.
- Heather_Poulsen
Community Manager
Thanks for joining today. We'll be back next month - visit this link to save the date: Windows Office Hours: November 19, 2026 - Windows Tech Community
Is there a roadmap available for App Control for Business features? I am in the early planning stages of deployment, and I want to know what features may be upcoming that I might be able to use.
- Heather_Poulsen
mrb_pc - Thanks for the question. We’re following up with the product team. In the meantime, I’d encourage you to join the Management Advisors Program, which provides opportunities to preview upcoming experiences and provide feedback directly to the teams building them.
Hey guys 👋, hope you're well. We were just wondering if this roadmap is still in use please as doesn't seem to have been updated since June? If not, has it been replaced with something else?
- AriaUpdated
Hey, thank you for the flag. This is supposed to still be up to date, but I see your point. I'm flagging this for the team and we will get updated ASAP.
Thank you Aria 😊
I would like to know If Microsoft is coming out with a Copilot CLI For its business customers without the requirement for the business customers to subscribe to a separate Microsoft Azure subscription to gain access and the ability to utilize a Copilot CLI.
- EricMoe
EugeneHaroldJohnson are you referring to the Github Copilot CLI? If so, that is available with all Copilot plans and does not state an Azure subscription is required (Installing GitHub Copilot CLI - GitHub Docs). If you are referring to a different CLI please let me know which one you are asking about. Thanks!
"The CLI for Microsoft is included in two plans that I know of: like you mentioned, the GitHub Copilot CLI plan and the Microsoft Azure subscription CLI plan. There is no native CLI for Windows 11 or the Windows command prompt by default. Nor is there a CLI offered within the Windows Business Premium subscription. As far as that goes, I am unsure if we can even utilize a CLI with the local LLM models that Microsoft recently released. So I am asking: will there ever be an out-of-the-box CLI locally—running as an out-of-the-box experience or natively on Windows—for common command-line execution use cases within the Windows command prompt? Or a CLI that can be added to the Microsoft Business Premium subscription plan and utilized with the Windows 11 architecture and operating system?"
- Heather_Poulsen
Welcome to Office Hours! We're working on your early questions, but keep them coming. Our Windows, Intune, and Windows 365 experts will be here for the next hour.
What do you recommend we do to close the gap about software metering when we move to cloud native and lose this functionality from sccm?
thks- Jason_Sandys
Hi lalanc01,
If software metering is critical to your business or IT operations, we recommend keeping Co-management in place for the time being. There are no other services in the Microsoft ecosystem, to my knowledge, that provide any sort of equivalent capability. Keeping co-management in place in no way precludes you from moving to cloud-native Windows as you can still fully perform all other management from Intune, Entra join the devices and use Autopilot to provision them.
I understand but using autopilot v2 makes it incredibly hard to install the client. Is there any good docs on all to install the sccm client with Ap v2 or with Intune apps on cloud native devices?
Thks
With the new ability to create groups from multi device query. Is there or will there ever be a way to automate this so we can create groups from inventory data so that we can scope devices kinda in the same way that we do with collections?
thks- Jason_Sandys
Hi lalanc01,
Thank you for the question. We've discussed this openly before and even hinted at having these capabilities in the pipeline. We recognize that this is major source of feedback but don't have anything concrete to share on exactly what this will look like or what/if there are timelines. It continues to be an area for deep investigation in the service but because of the scale and complexity it's not something we are taking lightly and are handling with great care.
Any news on getting the GPO applocker UI added in Intune so not to have to export applocker policies from a GPO into Intune's setting catalog?
This would help to move out of GPOs- Jason_Sandys
Hi lalanc01,
Are you looking to manage AppLocker or Application Control for Business (fka WDAC)? If AppLocker, then the recommendation is to move to Application Control for Business as we have no plans to enable direct AppLocker configuration in Intune at this time.
