What's better on a Friday afternoon than dropping a blog about the use of HAADJ and how it fits into "Modern Management"? skiptotheendpoint.co.uk/haad… #MSIntune #HAADJ #Autopilot #CloudNative

#OpenIntuneBaseline Windows v4.0 is here! 🎉 Highlights include: * Continuing to be the most agile and cutting-edge Intune baseline on the planet! * A shake-up of Compliance policies, allowing true grace period granularity (and ditching the EAS Password policy because it's 🗑️) * Edge settings for days! Simple support for the Edge Management Service and security hardening and user experience improvements. * Updated M365 Apps Security baseline alignment. * Fixed MS breaking the in-box app removal policy. * Defender behaviour tweaks based on real customer feedback, not arbitrary check-boxes. * Deprecated and obsolete settings sent to live on a farm. As always: ✅ Take what you want ✅ Change what doesn't suit your environment ✅ Test it before yeeting to 40,000 endpoints on Friday afternoon ❌ Don't treat any security baseline as a magical compliance button Check out the full release notes at: stte.me/oib26h2 Then, head on over to the OIB Deployer to deploy the new and updated policies, or check your current config vs 4.0 with the Settings Validator! https://deploy[.]openintunebaseline.com And, uhh, keep an eye on Friday, too ;) #OIB #Windows #EndpointSecurity #Community #Capybara

This whole thing is super weird. The default for that setting is 0 (Disabled). It was set to 0 in the Microsoft 24H2 Baseline. Are people just configuring a setting to something that nobody is recommending now? Or is there something else going on? bleepingcomputer.com/news/mi…

The Edge Management Service has so many hidden gems. However, if you're using the #OpenIntuneBaseline, you're already benefitting from a *required* user prompt and significantly reduced forced restart period from the Edge defaults 😉

"The S in Intune stands for Speed". GROAN. This rather tedious comment has plagued the internet for years but hasn't actually been justified for some time. Massive back-end improvements have been made to make syncs timely and more performant. That being said, all of this is for nothing if you haven't aligned with your Security and Network teams to not do stupid things to the Intune network endpoints. Below is a link to the docs, but here's my high-level list of things that will make your lives miserable and are entirely solvable: 1️⃣Proxies - The Windows Notification Service (WNS) doesn't like them, a direct connection is preferred. 2️⃣Authenticated proxies - Devices need unauthenticated access to certain URLS! 3️⃣SSL Inspection - *.manage.microsoft.com and *.dm.microsoft.com among others DO NOT SUPPORT TRAFFIC INSPECTION! Stop it. 4️⃣Aging edge firewalls - If your network admin tells you they need a full list of IP's because they can't use wildcard FQDNS, you're going to have a BAD time. CDNs are widely used and change often. So if you're doing any of the above, send your Security and Network teams the Learn link below. These things are non-negotiable. (There's also network endpoint pages for M365, Defender, Windows itself, but one step at a time...) learn.microsoft.com/en-gb/in…

Really @Blizzard_Ent? I created my BattleNet account to play Vanilla WoW in 2004. My account can legally drink in the US, and you KNOW this. You also know that I already have a Credit Card attached to my account. I won't get started on how stupid the whole @GOVUK age verification is, but companies who are consistently failing to apply a single braincell trying to comply need to be called out.

Massive Security win! You can now manage policies for #VSCode in #Intune! As of the #Windows June Preview Update (26200.8524), MS have unblocked the VSCode ADMX registry path, meaning that uploading the ADMX shipped with a VSCode install allows you to create a policy to deploy allowed extensions (either by publisher or individually), as well as things like control chat capabilities and MCP servers - All of which have been proven as a serious supply chain attack or data exfiltration risks! VSCode policy docs: code.visualstudio.com/docs/e…

🚨#OIB #Windows v3.8 & #OIBDeployer updates! I've just released v3.8 of the Windows OIB, which adds some cool things, as well as squashing a bunch of #community submitted bugs! Most importantly, I'm adding policy tracking through unique "OIBID"s, meaning much more flexible options when it comes to policy management through my OIB Deployer tool! Speaking of which, I've updated that too! A small face-lift (including dark mode!), API call improvements, and the functionality to support the new OIBID checks. Full Windows v3.8 Changelog here: stte.me/oibwin3dot8 Deploy or Update it in your tenant here: stte.me/deployoib To everyone that continues to provide support, feedback, and trust in this little project that's gotten way bigger than I ever thought it would - Thank you. 💛

See also: Things that "Pwn Defender". OOTB Consumer Defender and Defender for Endpoint configured properly are very different things.

I'm going to go against the grain here and say that the the knee-jerk reaction happening after the #Stryker incident is stupid. All of a sudden I'm seeing tons of security people now shouting that #Intune Multi Admin Approval needs to be deployed, yet for years they've not even considered that a device management platform is a core part of an orgs security posture. What's worse is from my personal experience presenting topics on this exact issue, they've been actively gatekeeping security from your endpoint management teams, creating a horrible siloed culture. Stryker wasn't a critical failure in the endpoint management platform, it was just another Identity-driven attack where the proper attention to controls around least privilege, Conditional Access and authentication enforcement had been poorly implemented. Intune RBAC and Multi Admin Approval provide strong additional layers of security, but both come at a significant cost to day-to-day operational overhead that many orgs are just NOT prepared or set up to deal with. While I'm glad that it's making security folk realise that Device Management IS Security (something I've been banging on about for years at this point), you don't get to suddenly demand implementation of a thing just because you read something on the internet when you haven't done your part in shoring up security gaps. Stop living in a silo, collaborate, engage. Security is everyone's responsibility, and only working together will provide positive outcomes.

Security folk - You starting to realise that Device Management needs to be part of Security, yet?

Least privilege isn’t optional in your identity platform or in your cloud infrastructure. It shouldn’t be optional in your endpoint management platform either. skiptotheendpoint.co.uk/intu… #Intune #Security #RBAC #ZeroTrust

Keeping Intune compliance-related policies current shouldn’t be a manual chore, so I'm releasing IntuneComplianceMaintainer! ICM is a PowerShell tool that automatically keeps Intune compliance & app-protection policies aligned with supported OS versions across Windows, macOS, iOS/iPadOS, and Android! stte.me/automatecompliance

🚨#Windows #OIB v3.7 - 25H2 Edition is live! Try out the OIB Deployer at deploy.openintunebaseline.co… to get a neat view of new and updated policies and an easy way to get them imported! Full change notes at stte.me/oib25h2

So after 10 years, 2 months, 15 days, #Windows10 reaches end of support. For those having to keep it around, I hope you've got ESU, because they're going to be a perfect target. It wouldn't surprise me if we saw some juicy 0-Days crop up that have just been waiting for this moment. If you don't... Well, to quote my clickbait blog title from Jan 2023: Windows 10 is Dead! Migrate to 11 immediately!

It's both an honour and a privilege to not only sit down and talk #OIB with @rucam365, but also be a part of the incredible Microsoft Practice at @Threatscape. AND, as if Friday couldn't get any better, I've also just published a preview change log of the 25H2 release! Check them out at: stte.me/oib25h2 youtube.com/watch?v=Xe32TzHg…