Conference season is in full swing judging by my LinkedIn feed (I’m enjoying October at home before travelling to Switzerland and San Francisco in November). It’s also school half-term holidays here starting next week and some much needed family time.
Community Content
We start this week with a guide on how to migrate to DDM for your Apple Updates including a useful analysis tool from James Vincent
Stopping users from doing things they shouldn’t be doing seems like a constant battle. The apps which run within cmd are especially tricky because they are signed by Microsoft. If you want to start with blocking ssh (always a risk to leave open), follow this guide from Jörgen Nilsson
A lot of companies want to implement a Bitlocker startup PIN, but as we all know, it ruins autopilot so we rely on getting the users to configure it after building. If you want to make this a bit easier for them, grab this script from Jorge Suarez
https://www.jorgeasaur.us/bitlocker-startup-pin-after-autopilot
This post from Michael Meier runs through the end to end configuration and use of Autopilot Device Prep Device Association
If you are having problems getting the Cloud Sync Provisioning agent to start, check out this guide from Jan Bakker
https://janbakker.tech/cloud-sync-provisioning-agent-fails-to-start-with-a-gmsa/
We’ve all heard of the horrible security baselines in Intune, but did you know there are also baselines for the rest of M365 which actually work quite well? If you haven’t implemented anything yet, this post from David McWee is worth a look
https://davidmcwee.com/2026/10/12/baseline-security-mode-deployment/
Sysmon is finally included in Windows 11 by default, but you do need to enable it. Learn how here from Peter van der Woude
Learn about the new way of enrolling Apple devices into Intune and enrollment time grouping in this post from Lisa Berenberg
Intune Device Enrollment Part 1: Apple Enrollment Profiles vs Policies, What changed?
For those of you using PEAP, this Windows update is worth watching for as it may break your WiFi authentication. Learn all about it here from Thomas Marcussen
KB5127648 breaks 802.1X PEAP Wi-Fi authentication on Windows 11: cause and workarounds
Video Content
Now for this weeks video content starting with a PowerShell metering dashboard from Chander Mani Pandey
Chander also runs through how to create an RBAC role just for remote help users here
Microsoft Content
It’s time for another certificate rotation, this one for Windows updates. Get prepared now in this post from Andrew Brown
If you are currently using custom CNAME for MDM auto discovery, make sure you read this article from the Intune Support Team (it’s a breaking change)
That’s all for this week, have a tremendous weekend!