Windows Autopilot, app deployment, compliance, BitLocker, Windows LAPS, updates, and Apple and Android enrollment — the heart of this blog.
Trace a stuck Wi-Fi or VPN profile back through the certificate chain: trusted root, SCEP/PKCS profile, Certificate Connector and NDES, using the logs and event IDs Microsoft documents.
Configure single-app and multi-app kiosks with the Intune Kiosk template or Assigned Access XML, set up Shared PC mode, pair with Autopilot self-deploying mode, and fix kiosks that won't launch.
Run KQL in Intune against one Windows device in real time or across your fleet's inventory: licensing, permissions, the properties catalog policy and queries you can reuse.
Fix Windows Hello for Business PIN setup failures on Intune PCs: the 0x801C and 0x8009 codes, Event ID 360 prerequisite lines, conflicting policy sources and dsregcmd checks.
Set up Windows LAPS end to end: enable it in Microsoft Entra ID, build the Intune account protection profile, retrieve and rotate passwords, and check the LAPS event log.
Fix Android zero-touch devices that skip Intune: reseller registration, linking the zero-touch account, DPC extras JSON and tokens, and the checksum and Conditional Access errors.
Set Autopilot up from nothing, then work through the errors that stop a deployment: the Enrollment Status Page, redeployments and enrollment blocks.
Start the series 6 partsPackage an app, understand how the IME installs and detects it, read its logs, and move on to scripts and remediations.
Start the series 6 partsChoose the right policy type, then roll out BitLocker, Windows LAPS and Defender settings without conflicts.
Start the series 9 partsThe problems Microsoft has documented this year — what they look like on a device, how to confirm you're hitting them, and the fix or workaround.
Start the series 5 partsWhy devices go noncompliant for reasons that have nothing to do with the user — risk scores, missing Sense clients and attestation endpoints — and how to fix each.
Start the series 7 partsSecure Boot certificates, EWS retirement, Azure Attestation, Windows 11 26H2 and mandatory MFA — what changes, when, and what to do before the date.
Start the seriesWindows enrollment, Company Portal, device check-in and enrollment restrictions
Autopilot profiles, the Enrollment Status Page, hybrid join, pre-provisioning and device preparation
Win32 apps and the IME, Store apps, app protection, PowerShell scripts and remediations
Configuration profiles, settings catalog, compliance, certificates, VPN and Conditional Access
BitLocker, Windows LAPS, Defender, Windows Hello for Business, EPM and Secure Boot
Update rings, feature, quality and driver updates, and Windows Autopatch
iPhone, iPad and Mac: ADE, VPP, enrollment, Platform SSO, FileVault, apps and software updates
Android Enterprise work profile, fully managed and dedicated devices, and Linux
Jamf Pro, Jamf Connect and their integrations with Intune and Microsoft Entra ID
Third-party connectors: threat defense, certificate authorities, ServiceNow, Samsung, Zebra, VPN and SIEM
RBAC, Graph automation, reporting, device actions, Remote Help, Windows 365 and service health
Tell me which error or task you'd like covered next — new guides come from readers' questions.
