#Modern Workplace

  While working on a customer's Azure tenant, I came across an issue that I hadn't seen before. I was configuring the Intune tenant to provision Windows 11 devices using Autopilot. As part of the configuration, OneDrive for Business was also included to manage and secure user data. However, after provisioning a device, I soon started seeing issues with OneDrive failing to sync. I will only see a pop-up window displaying the message ' Sorry, OneDrive can't add your folder right now. Please contact support .'. Not really helpful. There was nothing in the Entra sign-in logs, so ruled out conditional access policies as the root cause. I also had the relevant licenses assigned so I ruled that out as well. Then I recalled that there was something similar in relation to Outlook mailbox device management setting which could interfere with Intune device management policies. Something that I also blogged about which you can check out over here . Not really like for like, but ...

When I blogged last week about whether it is possible to enrol a device in Intune without ever having to authenticate on the device itself , I wanted to follow it up with additional security measures that organizations may need to consider if they use device code flow for device registration purposes. While Microsoft Entra ID supports a wide range of authentication and authorization flows to provide a seamless experience across all application and device types, device code flow can be misused and exploited to carry out phishing attacks and therefore is considered high-risk. In general, Microsoft recommends blocking it altogether, but that may not always be an option as indicated in the my earlier post . In this post I will cover how to block authentication flow and how device registration can be allowed in certain scenarios. Authentication flows in a nutshell To provide more control over your security posture, Microsoft has provided the ability to control certain authentication flows t...

  If you work with Microsoft Intune to manage devices, be it corporate or personal, then most likely you would have dealt with monitoring the health of different Intune connectors. Admins can check their Intune tenant’s connector health using the Tenant Status page in the Microsoft Intune admin center. However, as of writing this article, there is no option available natively within Intune to proactively notify administrators on the health of the Intune connectors like Apple's Push Notification service (aka APNs). APN is a critical service which uses an Apple MDM Push certificate to manage iOS/iPadOS and macOS devices in Microsoft Intune. This certificate is required to be renewed annually and in failing to do so, you can end up re-enrolling all your Apple devices. In fact, Apple sends an automated email to the registered Apple ID configured for MDM Push Certificate, advising to renew the certificate before it expires. It looks something like this - The reminder frequency is 30, 1...