
Technology Architect, Microsoft MVP, Microsoft Certified Trainer with a passion for #Deployment #Configmgr #Intune #Security #Development #CloudPC #Windows365
Denmark
Joined November 2011
- Tweets11.5K
- Following253
- Followers1.3K
- Likes8.7K
Thomas Marcussen - MVP π©π° retweeted
If you've deployed #Micosoft NDES to issue SCEP certificates with Intune, an attacker can modify a registry key to redirect certificate enrollment. Here's how to restrict access to the MSCEP key and enable auditing to detect unauthorized changes. rmhci.co/4qxSyx5 #mobility #identity #pki
Microsoft turns on "Require risk remediation for high-risk users" in Entra ID P2 tenants the week of Oct 28 (MC1507808).
Check your high-risk users can do MFA and verify break-glass exclusions first.
blog.thomasmarcussen.com/mc1β¦
#MicrosoftEntra #ConditionalAccess
Did your corporate Wi-Fi stop working this morning? Check for KB5127648.
Yesterday's October Patch Tuesday update for Windows 11 (24H2, 25H2 and 26H2) breaks 802.1X PEAP authentication. WPA2-Enterprise Wi-Fi and wired 802.1X both fail.
Home Wi-Fi and hotspots keep working, so it looks like "the office network is down" when it is actually the client.
The fingerprint:
- WLAN-AutoConfig event 12014 "OneX Held State timeout" and 12013 with error 0x80070285
- The request never reaches your RADIUS/NPS server
- Uninstall the update and it works again
The likely cause is not a bug. Microsoft announced a year ago that BlockNtlmv1SSO would flip from Audit to Enforce in October 2026, and PEAP with MS-CHAPv2 still depends on NTLMv1-derived credentials. Microsoft has not listed it as a known issue yet.
In the post I cover:
- How to confirm it in Event Viewer
- How to pause it in Windows Autopatch and Intune update rings
- A remediation script that sets BlockNtlmv1SSO back to Audit mode (temporary, and I explain why)
- Why this is the push to finally move from PEAP-MSCHAPv2 to EAP-TLS
Read it here: blog.thomasmarcussen.com/kb5β¦
If you are seeing the same thing, drop a comment with your Windows version and whether wired or Wi-Fi is affected. It helps everyone triage faster.
#Intune #WindowsAutopatch #Windows11 #PatchTuesday #KB5127648 #8021X #NTLM #EndpointManagement
Thomas Marcussen - MVP π©π° retweeted
Another great category featuring some amazing people.
Our MVPs in the past, present, and future fill the gaps in Microsoft documentation and products overall.
These people personify that sentiment. Make sure you come out and vote for them because they make our careers easier and better daily.
Itβs so amazing to be part of a community that celebrates the people who support us.
Thank you to @SwiftOnSecurity @merill @getrubix @Mister_MDM @Ciraltos and the countless others who contribute every single day
Register now: workplaceninjas.us
Happy Monday!
We're here to announce another set of finalists for the Golden #Clippy Awards. This week it's the "Social Media Superstar" Award, which focuses on someone who does an exceptional job sharing information via social media channels, and supporting people eager to learn.
Let's discuss the finalists!
π¦ @merill, the scourge of #ActiveDirectory is an amazing ambassador throughout social media, with Entra.chat, the newsletters, his website, and his activity throughout all social channels. He's a man of many talents, who has continued to lead the way on the entire #Microsoft #identity stack.
π€ @Ciraltos of @GetNerdio is an amazing star on the #YouTube side of the business, with over 100K followers on his YouTube channel shares content in so many areas like #Azure, #Entra, #DaaS, #MSSecurity, and so much more!
β @getrubix, a fantastic #MSIntune MVP who has continued to grow as his company Get Rubix continues to take the world by storm. His video content is unique, entertaining, and so solid. He's one of the world's favorite MVPs with his relatable content and personality that makes him a blast to watch.
πΊ @Mister_MDM, needs zero introduction, as one of the thought leaders in the Intune space who is constantly reverse engineering, probing, inspecting, and learning about changes Microsoft makes under the covers to educate all of us. He's super smart, very approachable, and an asset to all of us. He releases more blogs and content than anyone else, making him a rockstar.
βοΈ @SwiftOnSecurity, a very secretive and brilliant member of the #Twitter #Infosec community is somewhat overlooked for those of us that aren't on Twitter/X. However, if you are on there, you know EXACTLY what Swifty is, but not necessarily who they are. Their brilliance, incredible stories, entertaining takes, and vision makes them a 100% needed follow. They are the type of person who is simply polarizing, and their impact on our industry is immistakeable and invaluable.
Don't forget to register for @wpninjasus
Check out our registration portal to see the agenda, the speakers, and register now: cvent.me/ZgKb40
#WPNinjaS #WPNinjaSUS #ITPros #Community #MSIntune #MSSecurity #MSEntra #ActiveDirectory #SCCM #ConfigMGR #Windows365 #AzureVirtualDesktop #Copilot #AI #Infosec
Thomas Marcussen - MVP π©π° retweeted
Speaker announcement π€
Weβre happy to welcome Rudy Ooms (@Mister_MDM) to the Modern Endpoint Management Summit in Paris, April 2027.
Rudy is a Microsoft MVP and Technical Product Marketing Manager at Patch My PC, better known to many as Mister DLL. His idea of a good evening? Debugging Intune issues, preferably with a good beer within reach.
That hobby has given him a deep understanding of everything that happens under the hood of Windows Autopilot, Intune and Endpoint Privilege Management. If youβve ever been stuck on an enrollment that just wouldnβt finish, chances are one of his blogs on call4cloud.nl already explained why.
In Paris, heβll take you past the portal and into the moving parts. Bring your toughest questions.
Join us: endpointsummit.com/
#MsIntune #MEMSummit
Windows Update certificates expire in May and June 2027. Most current devices need no action. Older or outdated ones can lose Windows Update if you wait.
Early guidance from Andrew Brown: what to update, what to upgrade, and why to plan now.
techcommunity.microsoft.com/β¦ #windows #intune #WindowsAutopatch
π€ Made with AI
Thomas Marcussen - MVP π©π° retweeted
Call for Speakers is open!
Submit your sessions before the deadline of October 31!
This is your chance to share your knowledge with the community.
For more information, checkout Sessionize sessionize.com/MEMSummit2027
#MEMSummit #MsIntune #Windows #Security #Automation #Copilot
Thomas Marcussen - MVP π©π° retweeted
You asked we promised - we have now delivered Windows 11 26H2 Security Baseline in Microsoft Intune.
Great collaboration between Windows and Intune engineering org.
#MSIntune #Windows11 #SecurityBaseline
Windows 11 26H2 is GA. With Intune + Autopilot it's just a restart, but:
- 24H2 Pro ends Oct 13
- Set ring deferral to 0 days
- 26H1 devices can't take 26H2
- WMIC is gone
- Turn on Windows data for reports
Full guide: blog.thomasmarcussen.com/winβ¦
#Intune #Windows11
Thomas Marcussen - MVP π©π° retweeted
Blogged: Final thoughts on Windows 365 Reserve niallbrady.com/2026/08/27/fi⦠#Windows365 #MSIntune @megahoch
Thomas Marcussen - MVP π©π° retweeted
One of my favorite conferences - I have so lucky to be picked as a speaker every single year, including the virtual one #MEMSummit
#CFS are open
Call for Speakers is open!
We're excited to officially open the CfS for the Endpoint Management Summit 2027.
This is your chance to share your knowledge with the community.
For more information, checkout Sessionize sessionize.com/MEMSummit2027
#MEMSummit #MsIntune #Windows
Thomas Marcussen - MVP π©π° retweeted
Issue #160 of Entra.News is out
Featuring @andresbohren, @cbrhh, @DanielatOCN, @darrenjrobinson, @_dirkjan, @gullett_d, @jvldn1, @martin_rublik, @rucam365, @Mister_MDM, @MarcussenThomas, @12Knocksinna, @TechBrandon and more!
Microsoft retires SMS and voice MFA in Entra ID on Feb 1, 2027.
Full playbook: find affected users, move to passkeys, opt out temporarily, and suppress nudges.
blog.thomasmarcussen.com/entβ¦
#EntraID #MFA #Passkeys
Thomas Marcussen - MVP π©π° retweeted
Good news. IT administrators can now automatically accept SSO permissions on managed Windows devices using a supported registry setting.
Read more: learn.microsoft.com/en-us/enβ¦
Thomas Marcussen - MVP π©π° retweeted
Taking Back Control: Managing the New Entra SSO Prompt in Windows via Intune β Cloud First
#MSIntune #Windows11 #Entra #SSO
osddeployment.tech/2026/07/1β¦
Thomas Marcussen - MVP π©π° retweeted
Customer in EU have been asking - we are delivering, now available: Admin control for SSO prompts in Windows #Windows #MSIntune
techcommunity.microsoft.com/β¦
Thomas Marcussen - MVP π©π° retweeted
π Want to know what's new in the world of #Windows365 #CloudPC?
Check out this week's newsletter‡οΈ
π w365community.com/weekly-newβ¦
π Aarthi Sukumar, @BurgerhoutJ, @ncbrady, @vaishnavk93
Enhanced host pool management for Azure Virtual Desktop just went GA, and it changes how you run session hosts.
Instead of deploying and patching session hosts yourself, your host pool gets a session host configuration: one definition of image, VM size, network and credentials. The platform then creates, updates and replaces the hosts for you, batch by batch. No more registration tokens.
I set it up in my own tenant and wrote a step by step guide, including two gotchas the wizard will not warn you about:
π VM admin credentials must come from Key Vault. If your vault runs access policies instead of RBAC, deployment fails with UnableToAccessKeyVaultSecret. The fix is a single az keyvault set-policy.
π Validation passes even if the VM size is restricted for your subscription in that region. It only fails at deployment. Check az vm list-skus first.
Full walkthrough with screenshots from my own environment:
blog.thomasmarcussen.com/enhβ¦
#AzureVirtualDesktop #AVD #Azure #CloudComputing





























