Knowledge library
25 hands-on write-ups from real Intune automation projects.
How an Intune Proactive Remediation, a certificate-gated Function App, Service Bus and Log Analytics turn per-job Delivery Optimization data into workbooks and alerts.
How an Affinity Studio icon collection turns editable vector artwork into organized, integrity-checked SVG and PNG assets for technical diagrams, documentation and interfaces.
Device Operations Bridge: accountable support for cloud-managed Windows devices · Part 2
A detailed architecture map of the clients, API, Core and Graph services, optional SignalR-to-WinRM gateway, and audit pipeline.
Device Operations Bridge: accountable support for cloud-managed Windows devices · Part 1
A practical support workflow for cloud-only Windows devices, with detailed LAPS session boundaries, optional gateway execution, and audit limitations.
Device Operations Bridge: accountable support for cloud-managed Windows devices · Part 3
How LAPS values travel through clients, process-local sessions, gateway execution, and route-specific stop and rotation paths.
FleetKeeper: operational automation for Intune-managed Windows fleets · Part 3
The infrastructure and trust model behind FleetKeeper: mutual TLS with explicit roots, per-workload managed identities, Service Bus isolation of privileged work, verified scripts and an SSRF-guarded webhook runner.
FleetKeeper: operational automation for Intune-managed Windows fleets · Part 2
How FleetKeeper limits the blast radius of fleet remediations: server-resolved rings and waves, plan-time gates, exclusions that protect late additions, and an automatic halt on error rate.
FleetKeeper: operational automation for Intune-managed Windows fleets · Part 1
Why static Intune Remediations are not enough for fleet operations, and how FleetKeeper adds server-driven plans, per-device state, cooldowns and give-up rules on Azure.
LogCollector: authenticated telemetry for Intune devices · Part 3
Part 3 of 3. How LogCollector accepts both enterprise PKI certificates and the Intune MDM device certificate, verifies each against its own chain of trust, and binds them to the Microsoft Entra device ID carried in OID 1.2.840.113556.5.25.
Why ADMxSqueezer compares Chrome policy templates, how it keeps only newly introduced policies and their dependencies, and why its versioned output is a community workaround that must be tested before production use.
A walkthrough of the feature gap behind Chrome Policy Manager, its versioned PolicySets and priority resolver, and the Intune remediation flow that applies resolved settings to managed devices.
Why Extension Attributes Automation unifies Active Directory and Intune mappings, how it validates collisions and processes devices concurrently, and how its Graph retry policy handles throttling.
How Intune Lens closes the repeated-navigation gap with browser hover cards, content scripts and a service-worker Graph proxy, together with the security boundaries that come with reusing the signed-in portal session.
How Intune Tag Manager turns scope-tag assignments into background jobs, reports progress through SignalR, and uses Microsoft Graph batching and retry handling to make bulk operations easier to operate.
Intune Assignment Viewer: from feature gap to implementation · Part 1
Why Intune Assignment Viewer was built to answer a group-centric question scattered across the Intune admin center, what it brings together, and what the focused read-only view does not claim to do.
Intune Assignment Viewer: from feature gap to implementation · Part 2
A technical walkthrough of the Blazor Server architecture, separated sign-in and Graph identities, category-specific Graph collection, caching, batching, throttling controls, and deployment trade-offs.
How a certificate-authenticated, spool-backed pipeline moves Intune device telemetry into Log Analytics without workspace keys, and the architecture choices and scars behind it.
LogCollector: authenticated telemetry for Intune devices · Part 2
Part 2 of 3. Why replacing the HTTP Data Collector API (retired in September 2026) requires a resilient device client, and how offline spooling, re-signed retries and matching Intune packages keep collection reliable.
LogCollector: authenticated telemetry for Intune devices · Part 1
Part 1 of 3. Why we built LogCollector after the HTTP Data Collector API was retired in September 2026, why workspace keys were unsafe on endpoints, and how client certificates, signed bodies and anti-replay let telemetry reach Log Analytics without shared keys.
BitLocker Key Monitor: proving recovery keys exist · Part 3
Part 3 of 3. How recovery keys are protected at rest with per-row authenticated encryption and wrapped data keys, what that does and does not defend against, and the lessons we would pass on.
BitLocker Key Monitor: proving recovery keys exist · Part 2
Part 2 of 3. How a domain-joined agent ships Active Directory data to Azure using envelope encryption, an intake function that cannot read what it stores, and verify-before-decrypt processing.
BitLocker Key Monitor: proving recovery keys exist · Part 1
Part 1 of 3. Why we built a hybrid monitor that proves BitLocker recovery keys exist in AD and Entra with matching values, and how its scanner and consistency model work.
A practical look at dry-run defaults, inventory eligibility, exact serial matching, and controlled Microsoft Graph writes in a scheduled Autopilot workflow.
How an Intune detection-and-remediation pair stages the Secure Boot 2023 certificate update, and which error paths need review before a broad rollout.
Design detection and remediation scripts that are observable, idempotent, and careful with device state.