Tech Trends and Insights

Introduction Microsoft recently introduced the ability to collect Windows Registry data using Device Inventory and the Properties Catalog in Intune. While most examples focus on application inventory and configuration validation, I wanted to explore a different use case. Many security-related events leave traces in the Windows registry. For example, enabling Remote Desktop, configuring a proxy server, or installing remote access software often results in registry changes that can be monitored. Traditionally, identifying these changes required PowerShell scripts, remote access tools, or dedicated security products. With Registry Inventory, administrators can collect selected security-related registry values directly from managed devices and review them centrally in Intune. This provides an additional layer of visibility without connecting to the endpoint. Why This Matters Security teams are often asked questions such as: Has Remote Desktop been enabled on any devices? Are users configur...

Introduction Microsoft recently introduced the ability to collect Windows Registry data using Device Inventory and the Properties Catalog in Intune. While most examples focus on application-specific registry data, I wanted to explore a practical use case for Windows kiosk devices. In environments such as libraries, schools, and public-access workstations, kiosk devices often rely on specific registry settings for automatic sign-in and user experience configuration. When these settings change unexpectedly, troubleshooting can become time-consuming and often requires remote access, PowerShell scripts, or manual registry inspections. With Registry Inventory, administrators can now verify these settings directly from Intune and gain visibility into device configurations without connecting to the endpoint. Why This Matters One of the most common support issues for kiosk devices is that: Automatic sign-in stops working The wrong local account is configured A device is rebuilt incorrectly Reg...

With recent changes introduced for users in the European Economic Area (EEA), Windows 11 users may see an additional consent prompt when Microsoft apps attempt to use the account already signed in to Windows. For managed environments, this extra prompt can create unnecessary user interaction. Microsoft has introduced a new policy that allows administrators to automatically approve this permission on supported devices. In this post, I'll show you how to deploy this configuration using Microsoft Intune Remediations. 📌 Prerequisites Before you begin, make sure the following requirements are met: Windows 11 version 24H2 or later July 2026 security update installed (KB5101650 or later) Device enrolled and managed by Microsoft Intune User signed in with a Microsoft Entra ID account Microsoft Intune Remediations license 📦 Deployment Options There are several ways to deploy this configuration across Windows devices: Group Policy (GPO) – Suitable f...

If you’re still using Quick Assist in enterprise environments, it’s time to move forward. With Remote Help in Intune , you get: ✅ Entra ID integration ✅ Role-based access control (RBAC) ✅ Elevation support ✅ Auditing and logging 🔔 Important: Starting June 2026, Remote Help is included in Microsoft 365 E3 and E5 licenses — removing the need for separate licensing and making it the natural choice for enterprise remote support. 🔐 Step 1 – Assign Required Roles (Important!) Before anything else, you must assign the correct roles. Navigate to: Intune admin center → Tenant administration → Roles ✅ Recommended roles: Help Desk Operator Remote Help Operator (if available in your tenant) Required permissions: Remote Help usage Device interaction User support capabilities 👉 Without proper role assignment, Remote Help will either fail or run in limited mode. Step 2 – Enable and Configure Remote Help Go to: Intune admin center → Tenant administration → Remote Help Enable the following: ✅ En...

🆕 What’s New in the Report ✅ Confidence Level A new column indicates how safe it is to deploy Secure Boot certificate updates. High confidence → Safe to auto-deploy Under observation → Test before rollout No data observed → Manual validation required Temporarily paused → Known issues — take no action Not supported → Cannot be updated automatically 👉 This significantly reduces the guesswork when planning updates. 🔑 Secure Boot Trust Configuration Shows how the device validates boot components: Microsoft only Microsoft + OEM 👉 This helps explain why some devices appear “Up to date” even when certain certificates are missing. 🔍 Interactive Certificate Status The Certificate status field is now clickable. 👉 You can now drill down and see: Which certificates are missing Which certificates are applicable Previously, only a generic status was shown — now you get full visibility. 🚨 Alerts A new column highlights issues per device. 👉 This helps you quickly identify: Devices that ...

BitLocker Recovery Loop Guide 🛠️ BitLocker Recovery Loop – Enterprise Troubleshooting Guide This guide explains how to troubleshoot repeated BitLocker recovery prompts after BIOS, TPM, Secure Boot or hardware changes in enterprise environments. 💡 Root cause: TPM PCR mismatch (especially PCR7 related to Secure Boot) after firmware or boot configuration changes. 🧠 Root Cause Explained (Important) BitLocker uses TPM PCR measurements to verify boot integrity. When firmware, Secure Boot or boot configuration changes, the TPM measurements no longer match → BitLocker triggers recovery mode. BIOS/UEFI update changes firmware measurements Secure Boot keys or DB/DBX changes TPM firmware update or reset Boot order / UEFI configuration changes Docking station affecting hardware hash 🌲 Decision Tree 1. Does BitLocker ask for recovery every boot? → Yes: TPM integrity issue (PCR mismatch) 2. Did it start after BIOS/firmware update? → Yes: Suspend ...