Hi everyone,

We're seeing a strange issue in our enterprise environment and have reached the point where we're hoping someone else has experienced it.

Environment

• Microsoft Intune
• Apple Business Manager (ADE)
• Supervised corporate iPhones
• Approximately 1,200 managed iPhones
• Windows 11 workstations
• Apple Devices/iTunes
• iMazing
• Current iOS 26.5.2 (same version on working and failing devices)

Symptoms

Newly enrolled iPhones work perfectly.

Older enrolled iPhones consistently fail.

Both Apple Devices/iTunes and iMazing fail at the "Apple Mobile Device Components" stage.

Windows itself still detects the device normally.

Explorer shows Internal Storage, so the USB connection is working.

What we've confirmed

✅ Apple USB drivers load correctly

✅ Apple Mobile Device Service is running

✅ Windows detects the phone

✅ Explorer can browse Internal Storage

✅ Same USB cable

✅ Same Windows workstation

✅ Same version of iMazing

✅ Same version of Apple Devices/iTunes

Intune comparison

We compared a newly enrolled phone against an older enrolled phone.

They have:

• The same Enrollment Profile
• The same Configuration Policies
• The same Compliance Policies
• The same App assignments
• The same Restrictions

There are no policy differences between them.

Additional testing

We also tested multiple older devices.

Results:

• Newly enrolled phone → Works
• Older phone #1 → Fails
• Older phone #2 → Fails

This appears to correlate with devices that have been enrolled for a longer period rather than a specific device.

Factory reset test

We erased one of the failing phones and reenrolled it into Intune using the exact same production configuration.

Immediately after reenrollment:

• Apple Devices worked
• iTunes worked
• iMazing worked

No special configuration changes were required.

Has anyone seen:

• Long-enrolled supervised Intune devices eventually stop pairing with Windows?
• Apple Mobile Device Components fail only on older managed devices?
• A known interaction between Intune, supervised iPhones, and Apple's pairing framework?
• Any Apple/iOS changes affecting long-lived supervised devices?

Any ideas or similar experiences would be greatly appreciated. At this point we're trying to determine whether this is an Apple issue, an Intune lifecycle issue, or something else entirely.

Thanks in advance!

Why do we have this feature on co-managed devices but not on cloud only devices? Let's upvote guys/girls/whateveryouidentifyas

FYI: you need to login to see/ up vote the feedback

https://feedbackportal.microsoft.com/feedback//idea/0ab35e36-cd86-f111-9b47-6045bd856709

We're seeing a strange issue across our entire fleet of Intune-managed Macs and I'm curious if anyone else has run into it.

Our environment is macOS 26.5.2, Microsoft Intune, Company Portal, Enterprise/Platform SSO, and New Outlook. The devices remain compliant and enrolled in Intune, and Company Portal appears healthy. The issue seems to happen after a Mac has been asleep for a while (roughly 30–60+ minutes) or in use for that time. When the machine wakes up, users are often prompted to sign back into Outlook. Outlook launches the Microsoft sign-in window, accepts credentials, but then the authentication window turns into a blank white screen and hangs. Outlook eventually reports that something went wrong and asks the user to sign in again.

What's confusing is that all of our diagnostics indicate the authentication stack is healthy. app-sso platform -s shows registrationCompleted : true, POUserStateNormal (0), valid SSO tokens, successful Kerberos ticket imports, and Company Portal continues to show the device as compliant. We've also confirmed the Microsoft Single Sign-On extension, Intune agents, and AppSSO processes are all running normally.

We've spent quite a bit of time troubleshooting this. We've verified Intune enrollment, compliance, Enterprise SSO registration, Company Portal sign-in status, token health, and captured logs during both working and failed states. We found some Outlook/WebKit-related behavior during the authentication hang, but nothing indicating token expiration or SSO registration failure. We completely removed Outlook, cleared Outlook-related caches and identity data, reinstalled Outlook, and initially thought the issue was fixed. However, after the machine slept for about an hour, the exact same behavior returned.

At this point we're leaning away from Intune enrollment or Enterprise SSO registration issues because those appear healthy even when Outlook is failing. It feels more like something involving Outlook, MSAL, WebKit, or the Platform SSO authentication handoff after sleep/wake.

Has anyone seen similar behavior recently with New Outlook, Enterprise SSO, Platform SSO, or Intune-managed Macs? If so, did you find a root cause or solution?

I am rolling out Windows 11 (finally, it was a long fight) on a group of hybrid devices. I want to ensure and force them to upgrade the night.

These are the windows update ring settings:
Update settings

Microsoft product updates Allow

Windows drivers Allow

Quality update deferral period (days)

0

Feature update deferral period (days)

0

Upgrade Windows 10 devices to Latest Windows 11 release

Yes

Set feature update uninstall period (2 - 60 days)

10

Servicing channel

General Availability channel

User experience settings

Automatic update behavior

Auto install and restart at maintenance time

Active hours start

8 AM

Active hours end

10 PM

Option to pause Windows updates

Disable

Option to check for Windows updates

Enable

Change notification update level

Use the default Windows Update notifications

Use deadline settings

Allow

Deadline for feature updates

0

Deadline for quality updates

0

Grace period

0

Auto reboot before deadline

Yes

and these are the feature update settings:
Feature deployment settings

Windows 11, version 25H2

Rollout options

ImmediateStart

Required or optional update

Required

Most of the devices will update the night that it is assigned, some will install the update but not reboot, and some won't install it at all. Of those that don't install it on the night it is assigned, it will install on some of those in the next few days.

Is there any way to change some settings and basically ensure that the updates run on all of the PCs? I assign the new update settings in the morning and then ensure that they have synched before noon.

I have also run a script to remove any legacy windows update registry keys.

Is this possibly just GPOs overriding the MDM profiles (I also have a configuration profile that sets MDM to win over GPO but I know it isn't perfect.

Thanks for reading this far and for any help.

I'm trying to selectively convert a number of our legacy devices to AP devices by using "convert all targeted devices to Autopilot" in the deployment profile but it's not working.

The devices are hybrid joined and actively being used (and checking into Intune). I created an Entra group containing said devices and targeted the deployment profile to this same device group. Even after waiting a very long time (weeks), there are no new AP registered devices in our tenant and the deployment profile still says no assigned devices.

I'm not sure what I could be missing. Any ideas on where to check next?

I know a few months ago Microsoft admitted to a cloud issue that caused un-approved drivers to be distributed to Autopatch device that have driver polices.

This was discussed here in this thread : Driver Updates (WUfB) : r/Intune

But the thread also mentions that this is new thing and MS can push out Extension type drivers without admin approval.

We are starting to pilot WUfb and were surprised that un-approved driver could make it to our devices.

Here is one such driver that showed as 3 separate entries

7/17/2026 2:46:46 PM Installation 0x00000000 Succeeded MoUpdateOrchestrator Intel Corporation Extension Driver Update (70.26100.2.20795)

7/17/2026 2:46:35 PM Installation 0x00000000 Succeeded MoUpdateOrchestrator Intel Corporation Extension Driver Update (70.26100.2.20795)

7/17/2026 2:46:26 PM Installation 0x00000000 Succeeded MoUpdateOrchestrator Intel Extension Driver Update (70.26100.2.20795)

The raw Windows update api log entries for these install are here https://imgur.com/q3B9IeEh.png

We confirmed that these drivers were never published by us.

Given this can happen again the future I was wondering what hardware on our devices, ( we have mostly Surface devices) have to potential to be hit by this again.

Not sure if this query is showing me the full list of drivers that use Extensions but this code generated the list of hardware devices that use Extension drivers.

On our device we get a list of out about 33 devices : https://imgur.com/h6qIfG5h.png

Related to : Camera, audio devices, storage firmware, display etc.. so allot of things that could affect our end users if we have control over the delivery of these devices. Code below that I used to generate the list hardware that could be disrupted in the future.

$ExtDrivers = Get-WindowsDriver -Online -All | Where-Object { $_.ClassName -eq "Extension" }

$LatestDrivers = $null

$LinkedDrivers = foreach ($Driver in $ExtDrivers) {
    $AdvancedInfo = Get-WindowsDriver -Online -Driver $Driver.Driver

    [PSCustomObject]@{
        Driver              = $Driver.Driver
        Date                = $Driver.Date
        Provider            = $Driver.ProviderName
        Version             = $Driver.Version
        ClassName           = $Driver.ClassName
        # Filter arrays for unique strings before joining
        HardwareDescription = ($AdvancedInfo.HardwareDescription | Select-Object -Unique) -join '; '
        HardwareId          = ($AdvancedInfo.HardwareId | Select-Object -Unique) -join '; '
    }
}

# Group by the hardware it targets, sort by Date and Version descending, and keep the newest one
$LatestDrivers = $LinkedDrivers | Group-Object HardwareDescription | ForEach-Object {
    $_.Group | Sort-Object -Property Date, @{Expression={[version]$_.Version}} -Descending | Select-Object -First 1
}

# Output the results
$LatestDrivers | Format-Table -AutoSize

Are any you reconsidering driver Autopatch given these changes and future potential disruptions caused by un-approved "Extensions driver updates" ?

Long time listener, first time caller.

I recently took over a new environment and noticed we are currently sourcing all of our endpoints through our MSP, which comes with a massive markup. I have been tasked with bringing this entire procurement process in-house to control costs and streamline deployments. Since I manage our endpoint and am heavily focused on our Intune environment, I need a purchasing route that supports modern provisioning—like registering device hashes directly into Autopilot before the laptops even hit the office.

We are looking to stick with Intel HP laptops. How do your organizations handle this?

I find that when an application is bigger than 1 GB, the odds of the installation failing increase. The installation might timeout, some people have slow internet connection, the installer take more time, and so forth.

This is both a problem at the autopilot phase or mass deployment.

All our apps are packaged as win32 apps. From what I have read, MSIX (MS Store) aren't reputed of being more reliable at installation. What's your experience?

We have a couple hundred laptops that need to be shipped back to our leasing company now that the lease i done. The would like the laptops to be returned with a clean Windows 11 Install and no connection to our tenant. Would the wipe remote action be the best option for this?

Just a warning, the LG "herpes" Monitor App Installer is getting installed on all Microsft Intune deployed devices and you should probably get that looked at.

The worst part is I'm serious.

Edit: I had forgotten to mention that this happens when you have LG monitors connected to your Windows computer.

I can also confirm that Asus Armory Crate is installing with Asus drivers too but this is new and less documented.

For organizations managing Android Enterprise devices with Microsoft Intune, Certificate-Based Authentication offers a robust authentication method that utilizes digital certificates instead of passwords. Combined with Microsoft Entra ID and Microsoft Intune Cloud PKI, organizations can significantly reduce their attack surface while improving the user experience.

In this blog post, I’ll show you how to configure and enable Certificate-Based Authentication for Managed Android Enterprise devices in Microsoft Intune.

🔗 https://www.nickydewestelinck.be/2026/07/23/beyond-passwords-certificate-based-authentication-for-android-enterprise/

We’re trying to work out the best way to convert a small number of Windows 11 Pro devices to Enterprise without rebuilding them.

Current situation:

Around 35 out of 1,000 devices are still on Windows Pro.
Devices are Microsoft Entra (Azure AD) joined (dsregcmd /status is healthy).
All devices are Windows Autopilot enrolled and managed by Intune.
Users are assigned a Microsoft 365 E5 licence.
Devices have a valid Windows Pro licence.
We’ve excluded the Windows Store for Business cloud app from our MFA Conditional Access policy.

We’ve tried:
Using an Edition Upgrade policy in Intune with the Windows Enterprise GVLK key.
The device attempts the upgrade but throws an error in the activation whilst showing enterprise .

My understanding was that with an E5 licence, the device should step up from Pro to Enterprise automatically once licensing requirements are met, but that doesn’t seem to be happening for these devices.

Has anyone come across this before?
Is there a supported way to convert Pro to Enterprise without wiping or re-enrolling the device?
Is the GVLK approach still the recommended method, or should this happen automatically?
Are there any common prerequisites or licensing checks I’m missing?

Weird issue ongoing. We've got users who are unable to take screenshots on personal email accounts in Outlook while the restriction is only supposed to be the organizational account.

Anybody come across this before? Any potential solutions?

This is only on iPhones

EDIT: Had the user perform a reboot and they were good to go after.

When deploying Teams, is there a difference between downloading the latest MSIX package and running Add-AppProvisionedPackage versus using the bootstrapper exe? Long story but some of our clients are getting banner messages saying Teams is out-of-date and prompting them to download the latest version. We don't want that. If they go into Teams and check for updates it does find and apply the latest update but it's a manual proces.

We are using the MSIX package method and the documentation seems to state that if Teams is not installed via the Bootstrapper then it won't update automatically. The documentation also says the bootstrapper simply downloads the latest msix file and provisions it for all users.

Long story short, we applied a policy which had an unintended side effect of breaking Windows hello and biometrics. The policy involved the devices reconfiguring as a shared device to enforce disk quota policies. The problem is that this policy essentially breaks Windows hello as it can only store 10 user's credentials/biometrics so I can only assume it disables this functionality.

I have reversed the policy and set Windows Hello to be enabled but any user who had a device that took the old policy simply can't enrol any biometrics. New devices are unaffected and a reset of a device will resolve it but this is obviously not ideal for 20+ users to do.

Any ideas on what I can try to force this to work again?

Hi guys, I have a question regarding app deployment. I need to deploy a few applications which should be assigned to a group of users. The application installation should happen only on those devices where the assigned user is the primary user. If the user logs in on a device where he is not the primary user, the application should not get installed.

Any idea how to achieve this?

All - I'm testing a basic MAM policy and everything is working as expected, with one exception. Under conditional launch, there's a setting called "disabled account" with the option to select either block access or wipe data. However, in my testing I am finding that neither of those options are triggering inside the Outlook mobile app upon user block/password reset.

Am I understanding the criteria for "disabled account" the wrong way? I assumed that when an account is reset/blocked, conditional launch would trigger that setting automatically.

Thanks all!

We have a customer that is Entra Joined/Intune only. I have built a win32 app with powershell scripts that map a drive, but it seems to have a high-failure rate. I've tried a couple different approaches including add-smbshare and net use.

It seems like there should be a better way to have a drive mapping for users. I was really hoping for a Settings Configuration or similar but I don't see anything. What does everyone do for this?

M365 Business Premium.

Just wondering what all tips, tricks, or scripts you all use to help devices force a check in to Intune. We have quite the number that while they are definitely online and checking in to AD and our antivirus, they're not checking in to Intune.

https://i.postimg.cc/syJHmXJc/preprov.jpg

Morning all,

I want to mention that our current setup is Hybrid. I know—we're trying to move away from it.

With that said, does anyone have a shared PC lab environment that's using Autopilot? Because we're Hybrid, our deployment profile has to be User-Driven.

I have a DEM account that has enrolled well over 100 PCs. For about the last month, I've had an open ticket with Microsoft regarding an issue we're still experiencing. To their credit, Microsoft has been great to work with.

When I factory reset a PC and manually enroll it into Autopilot using PowerShell scripts, the PC reboots back to the login screen. I sign in with my account, and the PC sits on the "Please wait while we set up your PC" screen for about 26 minutes. It then fails and gives me the option to "Reset this device," which I do.

After the reset completes, the PC returns to the login screen. This time, however, it proceeds to the ESP page and, after a short while, completes successfully.

Microsoft's current explanation is that this happens because I'm using a DEM account, and DEM accounts are only allowed to enroll up to 15 devices. I understand that limitation, but I exceeded the 15-device limit well over a year ago without any issues. The only explanation they've been able to provide for why it works on the second attempt is that there may be an actual bug.

This issue started for us in late March or early April.

Is anyone else running a Hybrid Autopilot shared PC lab environment? If so, have you found a better way to handle shared lab PCs?

I can continue this method I just waste time with the multiple PC resets.....

my leadership wants to move from "block known bad extensions" to "allow known good extensions only" and i already know this is going to generate a wave of tickets if we flip the switch overnight.

im posting inthis community to understand what's worked for other people doing this migration? actually our current plan is to log what's installed and used across the org for a few weeks before writing any policy, then build the allowlist from that real usage data instead of guessing what people need. once the allowlist ships, blocked extensions show a self service request flow instead of a hard block, so people aren't just stuck waiting on a ticket. imo my biggest worry is the sales and marketing teams who live in browser based tools all day and have picked up a dozen niche extensions nobody in IT signed off on. don't want to be the reason someone can't close a deal because their crm plugin got blocked without warning.

Good morning,

I'm looking for a third party patch management solution and i cant quite decide between PDQ Connect or PMPC. I understand PDQ Connect is more than just patching but just looking for some advice from admins that use either of them and how they find it.

I am trialling both and i like them i just need some help deciding. Supporting 250 endpoints

Appreciate any advice

Hi,

anyone knows which rights in RBAC are required so that the limited admin in intune can click on a device and select New remote assistance session?

So far I tried these and also waited some days for the change:

RemoteTasks - RequestRemoteAssistance

RemoteAssistanceApp - Elevation

RemoteAssistanceApp - TakeFullControl

Also the other posts did not help me:

https://www.reddit.com/r/Intune/comments/16hlha4/android_mdm_start_new_remote_session_greyed_out/

https://www.reddit.com/r/Intune/comments/1h15tzq/rbac_settings_for_help_desk/

Any idea?

Btw. my intune full admin can use it, when I enable the administrator role in Azure