#Modern Workplace

If you provision devices using Autopilot, then you may have dealt with situations like delaying installation of certain applications to address provisioning requirements or simply get the process over the line. I recently had to deal with a something similar involving Zscaler in a customer's tenant. Installation of the application would halt the provisioning process, regardless of whether it installed in device or account setup phase. This is because the way Zscaler policy was configured in the customer's tenant which required user credentials before allowing access to internet.  Back in the day, if you were using ConfigMgr, then this could be addressed by creating a dynamic collection that would populate with the devices based on the completion status of an imaging task sequence. You would then target the same collection with such apps or scripts as post installation tasks. With Intune, the same isn't really possible using the native functionality and one has to come up wi...

Replacing a third party AV solution like Sophos with Microsoft Defender for Endpoint on Windows endpoints can be a harrowing experience. However, if you know the ins & outs of the process, then it can make things a little easier. I recently dealt with the task of removal of Sophos AV as part of an implementation project for Defender for Endpoint and thought of writing a blog post on it. Hope it helps. Let's look at some of the key steps first 1. Ensure that the devices are checking into Sophos Central and are healthy. 2. Turn off Tamper Protection on the endpoints. Just like other third party AV products in the market, Sophos does support removal of their products by running the relevant product uninstallers, however, in my experience this is a hit or miss and therefore, I resorted to using Sophoszap utility which gave me consistent results. It is important to note that you should use the latest Sophoszap utility, so always check the Sophos official vendor's website for lat...

On Feburary 10 2022, a new Microsoft Endpoint Manager permission was added which allows creating and editing of Win32 app supersedence and dependency relationships with other apps. If you are using RBAC within Intune, then this new permission becomes relevant to you. If you are not using RBAC, then my recommendation is to implement it, keeping in line with Microsoft's security principle of least previlege model. So what happens if you don't have the new permission enabled in RBAC? In such a case, the dependency and supesedence settings will not be available for setup or editing against Win32 apps. See below for reference. Therefore, starting in the 2202 service release, you will need to enable the 'Relate' permission against your RBAC role. This is how you can do it. 1. Navigate to Microsoft Endpoint Manager admin center . 2. Choose Tenant administration > Roles > All roles . 3. Edit your existing relevant RBAC role or create a new one if not in place. 4. Under Mo...