Knowledge library
39 hands-on write-ups from real Intune automation projects.
Foundry Local: from local inference to useful file organization · Part 3
Download and prepare the approved model and execution provider before scanning files. A startup probe helps, but the parser and real workflow need their own checks.
Foundry Local: from local inference to useful file organization · Part 2
When a filename tells us little, an opt-in local excerpt can help suggest a folder. Here is the code that checks the document, the answer and the allowed categories.
Foundry Local: from local inference to useful file organization · Part 1
What runs on the device with Foundry Local, how models get there, and where local folder suggestions end and OneDrive synchronization begins.
Office365Versions.com: release facts for people, scripts and assistants · Part 3
Connect an assistant to release lookups, discover the reviewed backend's four tools and check errors, supported scope and the public gateway contract.
Office365Versions.com: release facts for people, scripts and assistants · Part 2
Choose REST endpoints for Office and Windows release lookups, preserve download and servicing context, and handle gateway errors and stale cached data.
Office365Versions.com: release facts for people, scripts and assistants · Part 1
How Office365Versions.com collects release histories, Office download estimates, SafeOS packages and Hotpatch updates, with checks before replacing stored data.
NimbusLedger: from inventory evidence to controlled operations · Part 1
How NimbusLedger matches AD, Entra ID, Intune and optional ConfigMgr records, and what to check before trusting the inventory.
NimbusLedger: from inventory evidence to controlled operations · Part 2
What NimbusLedger checks before deleting device records, how dry-run and budgets work, and why failed operations can still need investigation.
NimbusLedger: from inventory evidence to controlled operations · Part 3
Set up NimbusLedger's worker, snapshot storage and dashboard access, then check freshness, audit retention and recovery in a staged pilot.
Chrome Policy Manager: from intent to verified policy · Part 2
Follow settings from group lookup to registry read-back, and see why an unchanged server hash or cached success can still leave a device needing attention.
Chrome Policy Manager: from intent to verified policy · Part 3
Check user-session tasks, temporary permissions and API identity controls, then follow queued Graph actions without mistaking a dispatch result for applied browser policy.
BitLocker startup PIN without ServiceUI · Part 1
See how SYSTEM launches a user-session PIN dialog and receives an encrypted response, then check the session, memory, timeout and recovery assumptions before rollout.
BitLocker startup PIN without ServiceUI · Part 2
Deploy the helper through Intune, choose a retry route, and verify the laptop's actual boot behavior. Installation success and a present PIN protector each tell only part of the story.
Find out why an encrypted device can fail compliance, what the repair script can fix, and where local escrow clues, policy differences and truncated reports can mislead.
Collect Delivery Optimization job data from Intune-managed devices and use an Azure pipeline, workbook and alerts to see where download bytes come from.
Choose consistent SVG and PNG symbols for technical diagrams, check their catalog hashes and keep the editable artwork for later changes.
Device Operations Bridge: accountable support for cloud-managed Windows devices · Part 2
Follow a support request through the clients, API, Graph services and optional gateway, with a separate look at what the audit pipeline retains.
Device Operations Bridge: accountable support for cloud-managed Windows devices · Part 1
How device lookup, operator access, LAPS sessions and an optional gateway fit together, and what they do not guarantee about reachability or audit records.
Device Operations Bridge: accountable support for cloud-managed Windows devices · Part 3
Where a LAPS password goes during support, why closing a session does not always rotate it, and how one-time vault links differ from credential-returning tools.
FleetKeeper: operational automation for Intune-managed Windows fleets · Part 3
The Azure services behind FleetKeeper, how device certificates and managed identities are checked, and where script hashes and webhook checks still need other controls.
FleetKeeper: operational automation for Intune-managed Windows fleets · Part 2
How FleetKeeper stages remediation, rechecks exclusions at plan time and stops a feature after too many reported failures, including the limits of on-demand actions.
FleetKeeper: operational automation for Intune-managed Windows fleets · Part 1
A walkthrough of device plans, detection outcomes and stored state, showing how cooldowns and a five-failure stop keep repairs from retrying forever.
LogCollector: authenticated telemetry for Intune devices · Part 3
How enterprise PKI and Intune MDM certificates pass separate trust checks, resolve to an Entra device ID and face device-binding and Graph authorization checks.
A new Chrome template brings all the old policies too. ADMxSqueezer extracts the additions and their dependencies into a smaller package to test in Intune.
Chrome Policy Manager: from intent to verified policy · Part 1
Work through templates, drafts and activation, including the assignment references you must update before a newly active policy reaches devices.
Keep selected Entra device attributes in sync with AD and Intune, with explicit mappings and a worker that knows when Graph is asking it to slow down.
See useful Intune details in a hover card instead of opening another blade, and understand what the extension does with your signed-in session.
Follow bulk scope-tag work as a background job, including Graph throttling, partial results and the limits of an in-memory queue.
Intune Assignment Viewer: from feature gap to implementation · Part 1
Find a group's Intune assignments on one screen, inspect policy targets and understand what the results can tell you about device targeting.
Intune Assignment Viewer: from feature gap to implementation · Part 2
How Intune Assignment Viewer separates sign-in from Graph access and uses caching, batching and retries to collect assignments across policy families.
An overview of certificate-authenticated telemetry, offline delivery and Azure ingestion, with the hosting and packaging constraints worth checking before deployment.
LogCollector: authenticated telemetry for Intune devices · Part 2
How the client keeps unsent telemetry in a bounded spool, retries with fresh signatures and ships through Intune with detection generated from the installed configuration.
LogCollector: authenticated telemetry for Intune devices · Part 1
Why the retired Data Collector API needed more than a new URL, and how device certificates, signed requests, replay checks and managed identity replace shared workspace keys.
BitLocker Key Monitor: proving recovery keys exist · Part 3
Part 3 of 3. Encrypt recovery values before SQL storage, bind them to their rows, and understand what still depends on key handling, migration and operator controls.
BitLocker Key Monitor: proving recovery keys exist · Part 2
Part 2 of 3. Follow an encrypted scan batch from the domain agent to Azure, including size checks, storage verification, retries and the permissions that keep intake out of decryption.
BitLocker Key Monitor: proving recovery keys exist · Part 1
Part 1 of 3. Check where recovery keys are available, resolve device identities carefully, and compare passwords when explicitly enabled rather than relying on presence alone.
Check inventory matches and proposed names or Group Tags in dry-run, then allow a small pilot to write. The checks matter more than the Graph call.
Stage the Secure Boot 2023 certificate update, follow the reboot-dependent result, and check the error paths before assigning these scripts widely.
Start with one condition, useful output and a remediation that is safe to run again. A small service check shows the basic approach.