Using update status as part of the compliance of Windows devices

This week is focused on the update status of Windows devices. More specifically, this week is focused on making sure that Windows devices can only be compliant when running the latest cumulative update. Within a device compliance policy, it was already possible to specify a specific Windows version. That, however, is a manual action. Over and over again. That can be achieved easier nowadays. A few months ago I wrote about working with custom compliance settings. That enables the ability to add custom scripting to device compliance policies. Custom scripting basically means that anything is possible. Including the check on the update status. This post will show how to leverage that functionality with a small custom script to check for the update status of the …

Read more

Simplifying repetitive administrative tasks by using low-code solutions: An overview

This week my post is a few days later, as my post is an extension of the session of me and Pim Jacobs at the Nordic Virtual Summit Third Edition. At the virtual summit we did a session about Simplifying repetitive administrative tasks by using low-code solutions​. During that session we shared information around the basics of low-code solutions and we provided some nice examples around Microsoft Intune and Azure AD. This post will provide a quick summary of that session. The slides (PDF) of that session are available for download here. Closing notes and summary It might sound a bit weird to start with the closing notes and summary. That, however, is the best summary of our session, as the biggest part of the session was demo. Besides the difference in what classifies …

Read more

Translating Windows Defender Application Control Policy Wizard sliders to Windows Defender Application Control policy options

This week is a short post focussed on Windows Defender Application Control (WDAC). More specifically, this short post is focussed on the different policy rules that can be configured by using the Windows Defender Application Control Policy Wizard. That policy wizard is an an open-source Windows desktop application written in C# and bundled as an MSIX package. It provides IT administrators with a user-friendly method for creating, edditing and merging WDAC policies. The WDAC policy wizard relies on the ConfigCI PowerShell cmdlets and that makes sure that the output of the policy wizard is identical to using the cmdlets manually. WDAC is genarally used to control what runs on Windows 10 and Windows 11 devices. That is achieved by setting policies that specify whether a …

Read more

Using the Microsoft Defender for Endpoint app for connecting to Microsoft Tunnel Gateway

This week is something completely different, compared to the last couple of weeks. This week is back to Microsoft Tunnel. Microsoft Tunnel is the VPN gateway solution for Microsoft Intune that fully integrates with Azure AD (and Conditional Access) for providing access to on-premises resources on iOS and Android devices. In the early stages of Microsoft Tunnel, there used to be a separate Microsoft Tunnel app for iOS and Android devices. One of the challenges with those devices is that there can only be one active VPN at the same time. That’s especially challenging when using it in combination with Microsoft Defender for Endpoint. That makes the combination of both products into a single app, a logic move. That’s been the case for Android already …

Read more

Getting familiar with the Windows Update for Business deployment service

This week is a follow-up on last week. Last week the focus was on getting started with the Windows Update for Business deployment service and this week is about getting more familiar with the Windows Update for Business deployment service. Last week the focus was on getting information and this week the focus is on adding information. More specifically, this week is about enrolling devices, creating groups, adding devices to groups, creating feature update deployments and assigning groups to feature update deployments. In other words, this week is about creating custom feature update deployments. For the basics of the Windows Update for Business deployment service have a look at last weeks post, this post will continue on that information. This post will go through the …

Read more

Getting started with the Windows Update for Business deployment service

This week is about the Windows Update for Business deployment service. That subject has been touched recently when discussing the different options for upgrading devices to Windows 11, but that subject never got the attention that it deserves. The deployment service provides control over the approval, scheduling, and safeguarding of updates delivered from Windows Update. And the often still unknown part is that it’s actually actively used already within Microsoft Intune. The Feature updates for Windows 10 and later profile and the Quality updates for Windows 10 and later profile, both rely on that deployment service. This post will start with a quick introduction of the Windows Update for Business deployment service, followed with the basics of the deployment service APIs. Introduction to the Windows …

Read more

Even easier managing local administrators

This week is back in the Windows platform. This week is another time about managing local administrators on Windows 10 devices and later. That subject has been discussed multiple times before – either by using custom device configuration profiles or by using proactive remediations – and this time it’s about a new configuration option within Microsoft Intune that provides a friendly configuration experience for the IT administrator around the custom device configuration profile option. That configuration relies on the LocalUsersAndGroups policy that is available with Windows 10 20H2 or later, or Windows 11. This blog post will provide an introduction to a new profile type and will show how to use that new profile type to easily manage local administrators. This blog post will end by …

Read more

Retiring non-compliant devices with Azure Logic Apps and Adaptive Cards for Teams

This week is another follow-up on the first few weeks of this year. Those weeks the focus was on monitoring the status of the different connectors, certificates, tokens and deployments, while this week the focus is on more than just monitoring. This week will be about non-compliant devices marked to retire. That means querying information and actually performing an action. When looking at device compliance policies, the IT administrator can configure the actions for non-compliance. One of those actions is to configure Retire the noncompliant device. That action, however, won’t actually retire the device and will only add the device to the Retire Noncompliant Devices view. Once added to that view, there is still a manual action required by the IT administrator to actually retire …

Read more

Getting started with filtering and selecting Microsoft Intune data via Microsoft Graph

This week is another week focussed on retrieving data of Microsoft Intune via Microsoft Graph. This week, however, is not focussed on creating a solution, but on providing some guidance on getting started with filtering and selecting specific data. It’s relativly simple to retrieve a bulk of data, but in many cases it might be more efficient and better performing to immediately filter the data and only select specific objects and properties. This post will provide a closer look at the basics of the main query parameters and show how to use them to filter data immediately in the request. The examples provided in this post are using the managedDevice objects as example and are all tested by using Microsoft Graph Explorer. Important: The Microsoft …

Read more

Windows Insider MVP 2022!

Not at the beginning of the year anymore, but that doesn’t make it any less special and that still makes an awesome start of the year! I just received that great email stating that I’m re-awarded as a Windows Insider MVP! Still a great feeling! I feel really proud, honored and privileged to be awarded with my fourth Windows Insider MVP award and to already been holding the Microsoft MVP (Enterprise Mobility) award for seven years! Just awesome! No other words. Of course none of this would be possible without the support of my great family! I love them and couldn’t do this without their support! With their support, I’m ready for another awesome year!