Secure Enterprise Onboarding and Domain Join Method - Concept
Hey Microsoft Hub community — Rodrigo here. After nearly two decades working in enterprise Windows environments, I’ve seen the same onboarding problem repeat everywhere: trust is granted too early, too inconsistently, and across too many disconnected systems. To address this, I created APilot — a Microsoft‑aligned concept for secure Windows onboarding and domain join. We’ve modernized identity. We’ve modernized device management. We’ve modernized compliance. But onboarding — the moment trust is established — remains fragmented. APilot — A Unified, Microsoft‑Aligned Trust Orchestration Lifecycle APilot reframes onboarding as a governed trust event, not just a technical step. It brings together Microsoft Entra ID, AD DS, Intune, Windows Autopilot, Conditional Access, PKI, and CMDB governance into a single zero‑trust onboarding lifecycle. The core principle: A device should not be considered trusted or productive until identity, asset ownership, posture, and certificate state are validated together. Why This Matters Enterprise onboarding is often split across identity, device management, compliance, PKI, and asset lifecycle systems. This fragmentation leads to: failed joins and poor first‑time success rates partially trusted devices entering production stale or orphaned device records certificate drift and expired trust artifacts inconsistent onboarding experiences across teams increased helpdesk and support burden higher risk from lost, stolen, or decommissioned devices APilot addresses these issues through a governed lifecycle that includes: identity validation device identity collection CMDB verification compliance gating temporary trust windowing join authorization quarantine and rollback wipe and decommission controls Microsoft Ecosystem Alignment APilot aligns directly with: Entra ID identity governance Intune compliance & Autopilot provisioning AD DS domain join PKI certificate trust Conditional Access CMDB / ITSM asset governance ZTNA segmentation The result: a device becomes trusted only when identity, posture, certificate state, and asset ownership converge. Who This Concept Is For APilot is intended for: Microsoft ecosystem stakeholders identity & endpoint engineering teams Zero Trust and security architects enterprise IT operations leaders CMDB / ITSM governance teams If this resonates with Microsoft PMs or architects, I’d be happy to collaborate on deeper exploration or refinement. Full technical concept: https://github.com/RodrigoACriscuolo/criscra/blob/main/Domain-Join_Knowledge.is.Power.md?utm_source=copilot.com This is my first contribution, and I invite fellow engineers and architects to contribute their perspectives. Today, many enterprises still rely on custom scripts or adopt tools like NinjaOne simply because they lack a unified Microsoft‑aligned approach. My hope is that APilot helps us elevate our Microsoft environment and improve the operational reality we face every day.
co-managed Working flow
Hi SCCM Expert, I would like to understand how co-management works in a multi-tenant scenario. Currently, my SCCM environment manages devices from two different domains: abc.com → Integrated with ABC Intune Tenant xyz.com → Integrated with XYZ Intune Tenant To enable co-management, we configured the Cloud Attach/Co-Management settings in SCCM using a Global Administrator account from the abc.com tenant. We then created a pilot collection and added devices from both abc.com and xyz.com domains. My questions are: Since co-management was configured using credentials from the abc.com tenant, how can devices belonging to the xyz.com tenant successfully become co-managed and receive Intune workloads from their respective tenant? During the co-management enrollment process, what determines which Intune tenant a device enrolls into? Is the SCCM co-management configuration tied to the tenant used during setup, or does the device use its own Azure AD/Entra ID registration information to identify the target tenant? What is the actual trigger point for the transition from SCCM management to co-management/Intune enrollment? If devices from multiple tenants exist in the same SCCM hierarchy, how does SCCM ensure that each device is enrolled into the correct Intune tenant? Could you please help clarify the architecture and enrollment flow in this scenario?
New MD-102 : Weird departure from course traditional design
The first slide deck is tremendously long. It takes me 5 hours of lecture to get students into the first lab. The slide decks are very repetitive and could often be replaced with Instructor Demonstration slides. The topics are far-ranging: it mixes identity administration, Intune RBAC, Android enrollment, LAPS, Windows enrollment, and Autopilot before students have a stable mental model of the fundamentals of: Device enrollment > Policy/app creation > Targeting assignment. The first lab is disjointed, with many configurations, such as Creating Administrative units, Assigning Scope tags, and Custom Intune Roles, not implemented until later in the week in Exercise 5. The delegation model, administrative-unit work, and Android restrictions obscure the basics students should understand first. The course design seems to be a big departure from most, if not all, Microsoft courses I have ever taught. No Entra Connect Lab and no real Autopilot lab are a disappointment to some students as wellWindows Autopilot ESP App Failures: My Troubleshooting Approach
Hi everyone, I’ve been working with Windows Autopilot and Microsoft Intune deployments and wanted to share a troubleshooting approach I use when a device fails during the Enrollment Status Page (ESP) Apps phase. When I see an Apps-stage failure, I normally start by checking: Which application failed in Intune. Whether the application is actually required during ESP. Win32 detection rules and installation commands. Application dependencies and assignment targeting. Autopilot/MDM diagnostic logs. Whether too many applications are being installed during ESP. One thing I’ve found particularly useful is separating applications that truly need to block provisioning from applications that can be installed after Autopilot has completed. I also try to avoid immediately resetting the device. Finding the failing application and understanding why it failed gives us a much better chance of preventing the same problem on future deployments. My basic workflow is: ESP failure → Identify failed app → Check assignment → Check install/detection → Review logs → Test with a controlled app set → Re-test Autopilot I'm interested in hearing how other Intune admins approach this. What logs or checks have helped you the most when troubleshooting ESP application failures? Thanks, Jayesh KedarCall for perspectives: Endpoint Management Experiences of IT Professionals Survey
Hi Endpoint management community, we’d love to hear from you! How do you manage employee devices today? Where do you turn for guidance and support? And how are you thinking about AI-enabled ways of working? 🔗 Share your perspective in our 15-minute survey: https://lnkd.in/gmjkFx8P We’re especially interested in hearing from people in their first five years in the field, but all experience levels are welcome. If someone in your network comes to mind who has relevant experience, feel free to pass the survey along!
Microsoft Edge plans to retire its legacy direct-WAM - version 157
Hello, I’m not sure if you are already aware of the above. Do you know of any way I could create a detection mechanism in Intune for the recommendation below? Thank you Action recommended for administrators: Check edge://signin-internals under Edge Auth Library Information → Library to see if any managed profiles still show WAM. Organizations wishing to validate early or test profiles that previously disabled the transition can test with --enable-features=msForceOneAuthWAM. Report any sign-in issues to Microsoft Support prior to the Microsoft Edge 157 release.
Managed Google Play apps not syncing completely to Intune
Nimm diesen Text für den Beitrag: Hi, we are using Microsoft Intune with Android Enterprise Fully Managed devices and Managed Google Play. The Managed Google Play connection itself is working. Apps can be approved successfully and are visible in our Managed Google Play enterprise store. The problem is the synchronization from Managed Google Play to Intune. Several apps were approved and saved, for example: Adobe Acrobat Reader Microsoft OneNote ScanSnap Home Brother Mobile Connect HP Canon PRINT Canon PRINT Business A manual Managed Google Play sync in Intune completes, but the apps are not imported reliably into the Intune Android app list. We have had this issue repeatedly for several days. Sometimes only one app appears after synchronization while the other approved apps remain missing. Example from today: All seven apps are visible and approved in Managed Google Play, but after synchronization only Brother Mobile Connect appeared in Intune. We also tried removing the affected apps from Managed Google Play and approving them again individually. After each approval we saved the app, started another synchronization and refreshed the Intune Admin Center. The result was still incomplete. The Android Enterprise connection is otherwise working and existing apps are already managed successfully. Has anyone seen the same behavior? Is there currently a known synchronization issue between Managed Google Play and Microsoft Intune, or is there another way to force a complete re-import of the approved apps? Thanks.
WHFB - Intune - Only PIN works and it causes print issues
Hello, I have personally attempted to deploy this for my environment and so has a colleague. We deploy windows hello specifically to a single machine or user, the PIN ends up being the only option which can be used, the device will say every other option is not available. It will constantly pop up at the bottom right that the password needs to be put in again to authenticate the user and printing will not work at all. The devices are fully capable of using facial recognition. Has anyone encountered any of these issues in a similar fashion with an AD > Entra environment ? Thank you, Jamie.
