I'm trying to deploy SCEP certs for Okta device trust, but around 1/4 of my devices fail getting the profile. I just enrolled a new device and it still failed. I had Okta and MS support look at the profile and it looks correct but for some reason the profile fails to deploy. This is a user cert but the cert doesn't ever appear. The root/int cert does get deployed successfully though.

I checked Event viewer for any SCEP attempts and there are none.

Also any recommendations for how to handle this for Windows? We have both shared devices and single user devices. Can we just deploy a device cert for everyone? 

We are starting to use Intune Remote Help as part of our transition away from MECM Remote Takeover. Feedback that we've had from our support teams is that most failed connections are caused by the user missing the connection prompt that appears above the taskbar.

The behaviour of the Notifications Area is controlled within 'Settings \ Accessibility \ Visual Effects \ Dismiss notifications after this amount of time' - currently defaults to 5 seconds. This can be configured by a Config Profile through Intune, but would affect all notifications such as MS Outlook (new emails) and Windows Security Centre (Defender). Luckily wouldn't affects Teams notifications, the Teams clients handles its own notification duration.

Question: are there any plans to have the setting configurable independently for Remote Help? Something in 'Tenant Admin \ Remote Help \ Settings' within Intune perhaps? Not sure how you'd get that to win over the Windows default, but MS Teams seems to manage it.

Maybe late to ask but about Autopatch and Edge. Deciphering what Autopatch really does for Edge is that it only sets the releasechannel and nothing more.

What I would expect and really wish for Autopatch is to manage more update settings for Edge like Autopatch does for MS365 Apps, both with device config policies. For example increase the check for updates and force install them and nudge the user to restart Edge.

So my wish is that Autopatch does more for Edge then just setting the release channel.

Are there any plans to build software usage/metering reports into Intune? We are currently utilising Software Metering through MECM as our end user devices are co-managed, however we are looking to go Intune managed for our EUD's and as such need an alternative.

I can see a request for it in Community Feedback from a year ago, but nothing published on the roadmap that I can find. 

If not, are there any MS alternatives you can recommend? I have heard that 'Defender for Endpoint Advanced Hunting' can query execution events for apps?

For Driver Updates in Windows Autopatch, is Microsoft looking at giving us a way to get easier reporting on Applicable Devices?

I'm sure a lot of us would like to see the list of devices before we approve any drivers but it seems that we can only get reporting on those after the fact starting from when the driver is in an "Offer Ready" state for the device

Why doesn't MS update all their apps in Windows Update?

It just takes adding a command like this: 

 winget upgrade --all

Though it's a bit more complex with Server OS - I'm putting together some instructions, including rolling it out through Intune or Group Policy, here https://blog.glcomputing.com.au/2026/10/winget-upgrade.html

It would make sense for MS to make this a default maintenance procedure, rather than a secret.

Unanswered question from September 17th:

We are seeing an increasing number of vulnerability findings in Microsoft applications where the application itself appears current, but a bundled third-party security library remains vulnerable.

As a specific example, Microsoft Defender Vulnerability Management is reporting that Microsoft OneDrive version 26.153.0809.0004 contains OpenSSL 3.4.5. At the time of assessment, OpenSSL 3.4.6 had been available since 9 June 2026 and OpenSSL 3.4.7 since 25 August 2026, meaning OneDrive appears to have missed at least one complete OpenSSL security release cycle and remained on a vulnerable OpenSSL version for more than three months after a fixed upstream release became available.

From an enterprise vulnerability management perspective, this raises several questions:

• What is Microsoft's expected servicing timeframe for critical third-party components embedded within Microsoft applications such as OneDrive?
• When a current Microsoft application is flagged by Microsoft Defender Vulnerability Management due to a vulnerable bundled library, should customers treat that vulnerability as a remediation requirement, or as a risk that must be accepted until Microsoft republishes the application?
• Is there a documented service level objective, target timeframe, or best-practice guidance for how quickly Microsoft applications should incorporate upstream security fixes for bundled libraries such as OpenSSL?
• What is Microsoft's recommended course of action when no newer Microsoft-published version is available but vulnerability scanners continue to report critical or high-severity findings within Microsoft-managed software?

We are looking for guidance on how enterprise security teams should assess, report, and respond to these findings, particularly when the vulnerable component is embedded within a Microsoft application and remediation is wholly dependent on Microsoft's release process.