Microsoft Technical Takeoff 2026: Windows + Intune
Mondays in March. Deep dives. AMAs. Windows, Intune, Windows 365, and Azure Virtual Desktop. Join us for Microsoft Technical Takeoff 2026 for Windows + Intune! This virtual technical skilling event takes you deep inside the latest features, capabilities, and scenarios for commercial organizations and the IT professionals that support them. Skill up and get answers to your questions from the engineering and product teams behind the features. How do I participate? Create your own agenda. Select “Add to Calendar” on a session page to save the date, then click the “Attend” button to save your spot, receive event reminders, and participate in the Q&A. If you can’t make the live session, don’t worry. You can post your questions in advance and catch up on the answers and insights later in the week. All sessions for Tech Takeoff will be recorded and available on demand immediately after airing. Don't see the "Attend" button or the ability to post Comments? Make sure to first sign in on the Tech Community! MONDAY MARCH 2 MONDAY MARCH 9 MONDAY MARCH 16 MONDAY MARCH 23 7:00 AM Let's talk Windows and Intune: 2026 edition 7:00 AM The latest in security for Windows 365 and Azure Virtual Desktop 7:00 AM Why smarter Windows management starts with Intune 7:00 AM AMA: The latest in Windows hardware security 7:30 AM The latest in Windows 11 security 7:30 AM Secure Boot certificate updates explained 7:30 AM Reporting at scale with Windows Autopatch update readiness 7:30 AM Zero Trust DNS: Securing Windows one connection at a time 8:00 AM Uplevel business continuity with Windows 365 Reserve 8:00 AM Feedback wanted: App management in the enterprise 8:00 AM User experience updates: Windows 365 Boot and more 8:00 AM AMA: Secure and manage AI and agentic capabilities in Windows 8:30 AM Hotpatch updates demystified: answers to real-world questions 8:30 AM Ready day one: how to get Windows users up and running fast 8:30 AM AI roundup: Intune agents for outcome-oriented innovation 8:30 AM Deploy and manage Windows 365 with Microsoft Intune 9:00 AM Zero Trust in action: securing endpoints with Intune 9:00 AM Making the most of your Intune data 9:00 AM AMA: Getting the most from Security Copilot in Intune 9:00 AM Unpacking Endpoint Management: Live from Tech Takeoff 2026 9:30 AM AMA: Windows Autopilot 9:30 AM Windows 365 reporting and monitoring updates 9:30 AM Manage Apple devices at scale: Intune security best practices 9:30 AM Azure Virtual Desktop for hybrid environments 10:00 AM The AI‑powered admin: emerging trends in endpoint management 10:00 AM Least privilege on Windows with Endpoint Privilege Management 10:00 AM Click less, manage more: simplify app deployment with Intune 10:00 AM Protect users, stop attacks: Passkeys on Windows 10:30 AM Eliminating NTLM in Windows 10:30 AM Windows 365 Frontline expands with Cloud Apps and more 10:30 AM App Control for Business: same roots, new playbook 10:30 AM AMA: AI and agentic features for Windows 365 11:00 AM One platform, many industries: smart Android management with Intune 11:00 AM From panic to productive: point-in-time restore in Windows 11:00 AM Intune timing demystified: what really happens behind the scenes 11:00 AM Transitioning to post-quantum cryptography 11:30 AM Resiliency with Windows 365 and Azure Virtual Desktop 11:30 AM The Intune playbook for iOS management at scale 11:30 AM Migrating from VDI to Windows 365 11:30 AM Resilience for the modern era: Windows quick machine recovery This event will feature AI-generated captions during the live broadcast. Human-generated captions will be available by the end of the week.How to exclude specific machines from Intune compliance policy?
Hi, I need a few virtual machines to be excluded from the Intune compliance policy, I thought that the following setup would be sufficient to accomplish this and be able to access corporate data without the need to make these virtual machines compliant (they all have fixed IPs): Unfortunately this isn't working and I'm wondering how could I exclude this machines from enrolment. Thank you, Ion
Intune does not sync Owner/Compliant state to Entra (iOS)
Dear All, We have the following problem in our environment. Initial situation Company Owned iOS Devices are joined / autoenrollt with Apple Business Manager into our Intune MDM and are fully managed. The devices have all configuration and compliance policies applied. The devices have an primary user and are compliant. During the enrollment the Entra device has been successful created. Problem The Entra device has no owner, no compliant state, no "MDM" value. Thereforce our conditional access policies which refer to the "Compliant"-state are not applied. Analysis Created a Microsoft case. We checked several things: - Intune seems correct configured - Compliance Policies are applied in Intune (as mentioned above) - irrelevant, when device has been enrolled or what models they are Microsoft support confirmed that they received similar feedbacks from other customers. It is indicated as "known issue" Workaround We found out, that when an end user opens the "Company Portal" app on the device and syncs, all Entra device attributes are updated. Then the owner, compliance state, MDM state, etc. is updated and now valid. But this seems to be not the correct behaviour. As far as I understood the Microsoft documentation, it should not require this step (Intune should sync the status to Entra in the backgroud, from service to service) Our objective should be, that it is not necessary to start Company portal. All entra devices should always have the current values from Intune synced. Thanks for your help, ChrisCompany portal says rooted device but it's not - Android
Hi everyone, We came across a situation where one of our Android user is not able to access Outlook and Teams due to rooted device. We configured only App protection (MAM) policy in Intune and blocked access from Jailbroken/rooted devices. Only the MAM policy as been applied on the device and the device is not enrolled with Intune. So far, we have followed below troubleshooting, Rejoined the device again, however after sometime, the error will be appeared again. Check whether the device is rooted or not (Go to Settings > About phone > Status Information > Phone Status). Phone status says official. I believe this means not a rooted device. Below is the error message from the company portal Device Status in Azure AD (Not enroll with Intune) I would appreciate if anyone can help me whether I have anything else try out before I create a support case with Microsoft. Thanks, DilanIssue with creating an issuing CA in Cloud PKI
I have activated an trial license for Cloud PKI a couple of days ago. I follow this guide to create a Root and Issuing CA https://oliverkieselbach.com/2024/03/04/how-to-configure-cloud-pki-certificate-based-wifi-with-intune/ I could create a root certificate successfully, but when i want create an issuing certificate i'm getting this error 'CA failed to be created' I have waited to a couple of hours to try it again but still no luck. What can cause this issue and how to solve this?
We’re running into an Intune issue where a Win32 app with a dependency sits at "Download Pending"
Setup: Main App: Installs in User Context Dependency: Installs in System Context Dependency Detection: Hosts file modification detection script Direct file detection does NOT work either When the hosts file modification is present (detection is met), detection works, and everything installs fine manually The Problem: If detection passes (exit 0) → Everything installs fine. If detection fails (exit 1) → Intune never moves forward, just stays at "Download Pending" indefinitely. Happens with both file-based detection and script-based detection. Dependency app as well at parent app install fine via Intune on their own as well as manual testing. What We Need to Know: Does Intune get stuck in "Download Pending" instead of moving forward when dependency detection fails? Could the install context mismatch (dependency in SYSTEM, main app in USER) be causing this? Myth or fact? Does Intune break the install process if a dependency app is in system context and the parent app is in user context? Again, both apps work fine independent of each other. Thanks for any help!
Android 15 - CredentialProviderPolicy not surfaced by Intune
I have been having an issue with Android 15 devices. We use Authenticator as our password autofill provider. As soon as a device is updated from Android 14 to Android 15, the password autofill provider is no longer set and the setting to change it is 'blocked by work policy.' I have already tried removing all policies that apply to the devices (device config and device compliance policies) and factory resetting them. Simply having them enrolled as corporate owned fully managed devices causes this to happen. I raised the issue in the Android Enterprise community blog. A link to that is included below. Someone on that thread found that there is a policy in Android 14/15 called the credentialproviderpolicy. When that policy is blocked or unconfigured, this behavior happens. I cannot find anywhere in Intune where I can set this policy. It seems that it is allowed by default when managing Android 14 with Intune, but not set or blocked when the device switches to Android 15. Is there any way to specifically set a policy that is not reflected in the Intune UI? This is a blocker for being able to move more phones to Android 15. Link to Android Enterprise thread: https://www.androidenterprise.community/t5/admin-discussions/android-15-cannot-set-default-password-app/m-p/8827#M2105 Thanks, Tom
Windows Hello - optional
Hello community, I'm trying to set Windows Hello as optional (not forced) for users in our org. Currently we have security group for people who asked for Windows Hello to be enabled for them. All devices are Windows 11 fully managed by Intune. Current Win Hello solution is provided by Intune policy - identity protection - "Configure Windows Hello for Business". It works, but as mentioned I would like to make it optional for everyone in our org so users can decide whether use it or not. Is it possible?Intune Graph API deviceStatuses missing device shown in portal
Hello, I am retrieving device status for an Intune configuration profile using Microsoft Graph API. API request: GET https://graph.microsoft.com/beta/deviceManagement/deviceConfigurations/{policyId}/deviceStatuses Issue: In the Intune portal, a device shows Success status for the configuration profile under: Devices → Configuration profiles → Device status However, when retrieving the same data using the Graph API endpoint above, that device does not appear in the API response. Observations: In the Intune portal, the policy shows one device with Success status. But the Graph API response returns different devices and does not include the device visible in the portal. Example response (sanitized): deviceDisplayName: Device-A status: unknown deviceDisplayName: Device-B status: unknown Questions: Why would a device appear in the Intune portal device status but not in the Graph API deviceStatuses response? Is there a delay in data synchronization between the Intune portal and Graph API? Is there another Graph endpoint recommended for retrieving all device configuration status results? Additional details: Graph API version: beta Permission used: DeviceManagementConfiguration.Read.All Tested using Graph Explorer Any insights would be appreciated.
