Category: IT Pro tips

  • Setting up Android Enterprise enrolment in Intune.

    I recently sat down to enrol a fleet of brand new corporate Android tablets into Microsoft Intune.

    Everything was cruising along nicely until Intune stopped me in my tracks with a bizarre error message. What should have been a five minute job turned into a stubborn puzzle that cost me half my morning.

    Picking the Right Enrolment Path

    Before you hand out tablets to a team, you have to tell Intune how they will be used. Android gives you three basic flavours:

    • Corporate-owned, fully managed: The company owns the hardware, one user logs in, and IT has full control. This was what I needed.
    • Dedicated devices: Great for a front desk sign-in screen locked to one app, but useless for mobile staff.
    • Work profile: Best for personal phones where you only want a tiny, secure work bubble.

    I picked fully managed, set up my enrolment profile, and decided to do things properly. For a more detailed explanation of these please visit Android Management Options

    A Quick Win: Naming Your Devices

    Before touching the hardware, I always set up an automatic naming template. Leaving default device names makes your admin portal look like a junk drawer.

    I used this handy format in the enrolment profile:

    TAB-{{DEVICETYPE}}-{{SERIAL}}

    This tags every tablet with its hardware type and unique serial number right out of the box. It makes finding a specific device later ridiculously simple.

    Down the Rabbit Hole

    Next, I wanted every new tablet to drop into a dedicated Entra ID security group automatically as soon as it enrolled. That way, all the apps and security policies apply without me lifting a finger.

    I tried to save the profile, but Intune threw a giant warning at me:

    “Before you configure device groups, make sure that the Intune Provisioning Client or Intune ClientConfidential app has been added as an owner.”

    Fair enough, I thought. I jumped over to Entra ID, opened my tablet security group, clicked Owners, and searched for both names.

    Nothing. The search box stared back at me, completely blank.

    I figured the app was just hiding in the tenant. I opened Enterprise applications and searched for “Intune”, but the only thing that popped up was a PowerShell tool. Neither of the apps Microsoft explicitly told me to add actually existed under those names.

    Cracking the Code

    After twenty minutes of digging through documentation and banging my head against the desk, I realised Microsoft played a naming trick. The service principal is in your tenant, but its display name changes depending on how the tenant was set up.

    The name is a red herring. The secret is finding it by its permanent Application ID:

    f1346770-5b25-470b-88bd-d5744ab7952c

    Once I stopped searching for names, fixing it took sixty seconds:

    1. Open Entra ID and head to Enterprise applications.
    2. Change the search filter to Application ID starts with and paste in f1346770-5b25-470b-88bd-d5744ab7952c.
    3. Check the name that appears. In my tenant, it was disguised as Intune Autopilot ConfidentialClient.
    4. Go back to your device group, click Owners, choose Add owners, and paste that exact name in.

    As soon as that hidden app became an owner, Intune happily accepted the group and the tablets enrolled smoothly.

    Save that Application ID in your notes. The next time Intune sends you on a wild goose chase, you can skip the headache and get right back to work.

    Give it a spin on your next rollout and see what you think.

  • Adding Your First MacBook to Intune: A Step-by-Step Guide

    One of our customers had purchased a few MacBook Air laptops last week and were keen to get them up and running. I suggested that we at least get them enrolled in Intune with a very basic config before they go out in the field. Here are the steps I took to get them out the door.

    Mac enrolment in Intune isn’t complicated once you’ve done it once. The tricky part is knowing which route to take before you start, because Apple gives you two very different paths depending on how the device was bought.

    This guide covers both: Automated Device Enrolment (ADE) for a corporate-owned Mac bought through Apple Business Manager, and Company Portal enrolment for anything else. If you followed my earlier post on connecting Apple Business Manager to Intune for iOS, the ABM/MDM server link-up is already done. This is the same server, just adding Macs to it.

    Which route do you need?

    ADE (zero-touch) — the Mac was purchased through Apple Business Manager, or added to ABM via Apple Configurator. It shows up in Devices in ABM already. This is the route for corporate-owned kit and gives you a fully managed device from first boot.

    Company Portal (user-driven) — the Mac wasn’t bought through ABM, or it’s a personal/BYOD device. The user installs Company Portal themselves and enrols manually. Less control (no Setup Assistant automation, user can technically unenrol), but it works on any Mac.

    If you’re not sure which one you need, check Apple Business Manager under Devices first. If it’s listed there, use ADE.

    Prerequisites

    Before you start, confirm:

     Apple Business Manager is linked to your Intune tenant (Devices > Enrollment devices > Enrollment Program Tokens in Intune)

     The Mac is assigned to your MDM server in ABM, if you’re using ADE

     You have a macOS enrolment profile configured in Intune (Devices > macOS > Enrollment > Enrollment profiles)

     The user has an Intune licence assigned

    Skip any of these and enrolment will either fail outright or leave the device half-configured.

    Route 1: Automated Device Enrolment (ADE)

    1. Assign the device to your MDM server in Apple Business Manager

    Log into ABM, go to Devices, find the Mac by serial number, and assign it to the Intune MDM server. If it was bought directly through Apple with your ABM account linked, this happens automatically. If it came from a reseller, you may need to do this manually or ask the reseller to push it through.

    2. Create or check your enrolment profile in Intune

    Go to Devices > macOS > Enrollment > Enrollment Program Tokens, select your token, and open Profiles. Create a profile if you don’t have one:

     Set authentication method (usually Setup Assistant with modern authentication)

     Decide which Setup Assistant screens to skip (Location Services, Siri, and Apple ID are common ones to hide for corporate builds)

     Enable “Await final configuration” if you want the device to stay locked to a Configuration screen until all app and profile pushes finish. Worth turning on if first-boot policy delivery has ever been patchy in your tenant.

    3. Assign the profile to the device

    Back in the device list under your token, select the Mac and assign the profile you just built. This can take a few minutes to sync from Apple’s side, so don’t panic if it’s not instant.

    4. Boot the Mac

    Power it on (or factory reset if it’s been used before — ADE only triggers on a clean Setup Assistant run). The device will check in with Apple, pull down the MDM enrolment, and the user will be guided through Setup Assistant with your configured screens. No Apple ID sign-in prompt, no manual profile installation.

    5. Confirm enrolment in Intune

    Once through Setup Assistant, the device should appear in Devices > All devices within a few minutes, with compliance and configuration policies starting to apply. Check Managed Apps and Compliance status to confirm policies are actually landing, not just that the device shows up.

    Route 2: Company Portal (user-driven)

    1. Install Company Portal

    Download the ⁠.pkg⁠ installer directly from Microsoft by navigating to ⁠aka.ms/EnrollMyMac⁠ or by logging into the Intune Company Portal website. The macOS Company Portal app is not distributed through the Mac App Store.

    2. Sign in

    Open Company Portal and sign in with the user’s work account. It’ll prompt to enrol the device — accept.

    3. Download and install the management profile

    Company Portal generates a management profile the user needs to download and install manually through System Settings > Profiles. This is the one extra step ADE skips, and the one most users get stuck on, so it’s worth walking them through it the first time.

    4. Confirm enrolment

    Once the profile installs, Company Portal shows the device as enrolled, and it’ll appear in Intune within a few minutes same as the ADE route.

    A few things that catch people out

     ADE only fires on Setup Assistant. If the Mac has already been through first-time setup, you need to wipe it (or use Apple Configurator to force a factory-style reset) before ADE will apply. You can’t “convert” a live device to ADE enrolment after the fact.

     Token expiry. ABM enrolment tokens expire annually. If devices stop showing up under your token in Intune with no obvious cause, check the token hasn’t lapsed first.

     Await final configuration can backfire if your policies aren’t fully sorted, because the device sits on the lock screen until everything’s pushed. Test with one device before rolling it out to a batch.

     Company Portal enrolment isn’t as sticky. A user can remove the management profile from System Settings unless you’ve layered in additional restrictions. Fine for BYOD, not something I’d rely on for a fully corporate-managed Mac.

    Once you’ve got one Mac through either route, the rest of the fleet follows the same pattern. The main thing worth getting right early is deciding ADE vs Company Portal per device before it lands on a desk, since switching from one to the other later means a rebuild.

  • Which Android Management Mode Do You Actually Need?

    I spent way too much time testing different Android enterprise setups before realizing one simple truth: you cannot manage every device the same way.

    Pick the wrong mode, and you either end up with angry staff or a massive security headache.

    Here is how I break down the three main flavors of Android device management, so you can pick the right tool for the job.

    Corporate-Owned, Fully Managed

    The company buys the phone, hands it to an employee, and IT keeps full control.

    This was exactly what I needed for my fleet. You can push updates, wipe the hardware remotely if it gets lost, and lock down security settings without asking permission.

    • Best for: Company-owned phones issued to individual staff members.
    • Why it works: You get complete visibility and protection without compromise.

    Dedicated Devices

    Think of these as digital kiosks. They are locked down tight, usually running just a single app or a tiny set of approved tools.

    They are fantastic for a front-desk visitor sign-in screen, a warehouse barcode scanner, or an interactive shop display. But try giving one to a mobile worker who needs email, maps, and a browser, and it quickly becomes useless.

    • Best for: Kiosks, shared inventory scanners, and point-of-sale tablets.
    • Why it works: Nobody can tamper with the settings or wander off into YouTube.

    Work Profile

    This is the sweet spot for Bring Your Own Device (BYOD) setups.

    Instead of taking over the entire phone, you create a secure, encrypted sandbox just for company apps like email and Slack. The user keeps total privacy on their side of the phone, and IT gets full control inside the work container. If that person leaves the company, you can wipe the work data in one click without touching their personal family photos.

    • Best for: Personal phones used for light day-to-day work tasks.
    • Why it works: Total privacy for the employee, solid security for the company.

    Match the management mode to the actual daily job, and your deployment will run a whole lot smoother. Give these setups a test run in your lab and see which one fits your team best.

  • Demystifying the Intune Remove Data Menu

    I used to stare at the device actions menu in Intune and panic. I was always terrified of clicking the wrong button and accidentally deleting a user’s personal photos. Microsoft recently updated the admin center interface to tidily group all these reset options into one neat “Remove data” menu. It looks a lot cleaner now. If you are still a bit confused by the four different choices, you are definitely not alone.

    Here is exactly what each button actually does.

    • Retire: This removes company data and unhooks the device from your management. It leaves personal apps and files completely untouched. This is the polite choice for a departing employee who is keeping their own device.
    • Wipe: It performs a full factory reset and deletes all personal and company data. You should use this strictly for lost, stolen, or entirely decommissioned company hardware.
    • Fresh start: Think of this as a deep clean for the operating system. It reinstalls a fresh copy of Windows and removes annoying manufacturer bloatware. The device stays enrolled in your system.
    • Autopilot Reset: This gets a machine perfectly ready for its next owner. It wipes the previous user’s data and settings. The computer stays fully enrolled and ready to hand straight to the new employee.

    Here is my quick cheat sheet to help you remember the differences.

    1. Retire: Unmanage the device but protect personal data.
    2. Wipe: Delete absolutely everything.
    3. Fresh start: Clean up the operating system but keep it enrolled.
    4. Autopilot reset: Prep for the next user without re-enrolling.

    Hopefully, this saves you from a mild panic attack the next time you need to clear a device. Give it a spin and see what you think.

  • Is It Time to Pull Your Data Out of the Cloud?

    For years now we have bought into the idea that everything belongs in the public cloud. Spin it up, let someone else worry about the hardware, job done.

    Lately though, I’ve noticed a lot of businesses quietly doing the opposite. They’re pulling their data and applications back onto their own kit.

    There’s a name for it: cloud repatriation. All that means is moving stuff off someone else’s servers and back onto hardware you own and control.

    It’s got me wondering if a lot of us jumped into the cloud a bit too fast.

    Why People Are Having Second Thoughts

    Here’s what I keep hearing from folks who are reconsidering:

    • The bill shock. Cloud costs can spiral fast. Data transfer fees and storage add-ons creep up on you every month.
    • Steady workloads. If you’re running servers 24/7 with predictable traffic, buying your own hardware is often cheaper over a few years.
    • Data control. Keeping your data on your own network makes privacy and compliance rules a lot easier to satisfy.
    • Speed. Local hardware means lower latency and faster response times for everyday tasks.

    Not an All or Nothing Choice

    I’m not saying ditch the cloud completely. For most setups, a hybrid approach, some things kept local and some left in the cloud, is the real sweet spot.

    But hardware has become so efficient lately that owning your own kit makes more sense than it has in years.

    So what’s your take? Are you sticking with the cloud all the way, or are you starting to bring things back in-house?

  • How Windows updates should be managed on a business network

    How Windows updates should be managed on a business network

    Windows updates have a bad reputation. Most people picture the same thing: a machine that reboots itself halfway through a piece of work, or the update that lands on a Friday and breaks something by Monday.

    That reputation is fair. Left alone, PCs update whenever they like. Multiply that across a company and you get chaos.

    It doesn’t have to be that way. Managed properly, updates should be something nobody in the business even notices. Here’s what good looks like.

    Test before you trust

    The biggest mistake is pushing every update to every machine the moment Microsoft releases it.

    A better approach is to stage it. Give the update to a small group of machines first, then watch them for a few days. If those are happy, roll it out to everyone else.

    The reason is simple. Bad updates happen, more often than Microsoft would like. If one slips through, you want a couple of machines affected, not the whole company. Staging means you catch it early and stop it before it spreads.

    Think of it as tasting the food before it goes out to the whole table.

    Schedule updates around people, not over them

    Nobody should get a reboot in the middle of a meeting.

    Updates should install and machines restart outside working hours. The work happens quietly in the background and the team gets on with their day.

    Set a deadline too. Without one, people click “remind me later” indefinitely and end up months behind. That gap is exactly where attackers get in.

    Stay on a version that works

    Every so often Microsoft releases a big new version of Windows. Those early releases are usually where the teething problems live.

    Machines shouldn’t leap onto the newest version the day it arrives. Keep the whole business on a stable, supported version, and move up once it’s proven itself. Just don’t leave it so long that you fall out of support and stop getting security fixes. That balance matters.

    Keep a fast lane for serious threats

    The careful, staged approach is right for routine updates. It’s the wrong approach for an emergency.

    When a serious security flaw appears, and one that’s actively being exploited, you need to push the fix out straight away. No staging, no deferral. Good update management has both speeds built in.

    Measure it, don’t assume it

    The part most people skip is checking whether any of it actually worked.

    You need visibility. Something that tells you which machines are up to date and which are lagging. If a machine is stuck, you chase it. Assuming everything’s fine because you set a policy once is how estates quietly drift out of date.

    Scale it to the size of the business

    A large estate can afford several staged groups. A small office of a few PCs can’t, and doesn’t need to.

    For a handful of machines, keep it simple. Update everyone together after a short safety delay. There’s no point building a test group when there aren’t enough machines to have one.

    Match the approach to the size of the business, not the other way round.

    The goal behind all of it is the same. Machines that stay secure and current, with a team that barely notices it happening. If your updates don’t feel like that today, they’re worth a second look.

  • Ghost in the Machine: Fixing the Missing Print Management Console in Windows 11

    Ghost in the Machine: Fixing the Missing Print Management Console in Windows 11

    I was recently setting up a printer deployment for a customer when I realized the Print Management console was nowhere to be found. For IT pros, this tool is essential. It lets you manage printer drivers, ports, queues, and servers all in one place.

    In Windows 11, Microsoft often leaves this feature out by default.

    The good news? It’s still there — you just need to reinstall it.

    Why It’s Missing

    In Windows 11, Print Management is treated as an Optional Feature. If it’s not installed, it simply won’t appear in Administrative Tools or search results.

    Fortunately, adding it back only takes a minute.

    How to Install Print Management in Windows 11

    1. Press Windows Key + I to open Settings.
    2. Click Apps in the left sidebar.
    3. Select Optional features.
    4. Click the blue View features button.
    5. Type Print Management in the search box.
    6. Tick the box.
    7. Click Install.

    Once installed, the console is ready to use.

    How to Launch the Tool Quickly

    Instead of searching through the Start menu, use this shortcut:

    1. Press Windows + R.
    2. Type:
    printmanagement.msc
    1. Press Enter.

    This opens the console instantly.

    Why This Tool Is a Lifesaver

    When managing printer deployments for clients, you need visibility. The standard Windows printer settings don’t provide enough detail when:

    • Troubleshooting driver conflicts
    • Cleaning up old print queues
    • Managing ports
    • Deploying printers via Group Policy

    Print Management gives you a clean, centralized view of your entire print infrastructure.

    If you work in IT and haven’t used it in a while, give it another look. It’s still one of the most useful hidden tools in Windows 11.