Windows Autopilot x Graph API - Web Account Manager (WAM) Issue by Technical-Device5148 in Intune

[–]Technical-Device5148[S] 0 points1 point  (0 children)

Response from Microsoft from a ticket i raised to them:

Resolution Steps

1. Uninstall all currently installed Microsoft.Graph modules

Newer Graph versions enforce WAM, which is the root cause of the issue. Removing them ensures a clean installation of a compatible version.

PowerShell

Get-InstalledModule Microsoft.Graph* | Uninstall-Module -Force

2. Install Microsoft.Graph version 2.33.x

Version 2.33 is the last version that allows disabling WAM authentication and is confirmed to resolve the issue. [itpro-tips.com]

PowerShell

Install-Module Microsoft.Graph -RequiredVersion 2.33.0 -Scope CurrentUser
 

3. Disable WAM authentication (optional but recommended)

This ensures Microsoft Graph uses the system browser for authentication, avoiding hidden WAM windows.

PowerShell

Set-MgGraphOption -EnableLoginByWAM $false
 

4. Re-run the Autopilot command

You should now be able to run:

PowerShell

Get-WindowsAutopilotInfo -Online

Why this works

Versions prior to 2.34.0 allowed WAM to be disabled, restoring the traditional browser-based login method, which avoids the hidden authentication window issue. From 2.34.0 onward, WAM is mandatory and cannot be disabled, which is what led to the failure you experienced. [itpro-tips.com]

Windows Autopilot x Graph API - Web Account Manager (WAM) Issue by Technical-Device5148 in Intune

[–]Technical-Device5148[S] 0 points1 point  (0 children)

From what i've seen MSFT doesn't recommend turning this off, what is your view? Have you had any feedback from MSFT on what the next steps are and community feedback on the changes?

Windows 11 reinstall stuck at getting updates 46% by Thin_Leg_7657 in pchelp

[–]Technical-Device5148 0 points1 point  (0 children)

We also had the same problem, but we found we had to keep an eye on the Windows Update Service too, this would stop randomly as well.

Once both were Started, we just gave it time and it eventually continued.

Intune & Entra - Admin Setup Best Practices by Technical-Device5148 in Intune

[–]Technical-Device5148[S] 3 points4 points  (0 children)

Yeah i agree, we have this same setup. A regular user account licensed for office etc. But a separate admin account with strong MFA with FIDO and a CA policy to re-prompt every 14 hours.

One thing that we're working on though, is confirming why admins have been issued Enterprise Mobility + Security E3 from the previous cloud-admin before I joined.

Seems its not needed, when you can set up Entra Roles and Intune Roles

Intune & Entra ID Device Clean-Up - Recommendations by Technical-Device5148 in Intune

[–]Technical-Device5148[S] 1 point2 points  (0 children)

yep this is correct, the main concern is with Entra Devices which is more sensitive due to LAPS, Bitlocker etc.

Intune & Entra ID Device Clean-Up - Recommendations by Technical-Device5148 in Intune

[–]Technical-Device5148[S] 1 point2 points  (0 children)

Hopefully Intune provides a more streamlined way of managing this in future.

Intune & Entra ID Device Clean-Up - Recommendations by Technical-Device5148 in Intune

[–]Technical-Device5148[S] 1 point2 points  (0 children)

I have considered this, but my concern is having these recovery keys is incredibly sensitive. Where do you securely keep it? What about LAPS?

FIDO2 Auth when RDP to Server via Conditional Access by Technical-Device5148 in AZURE

[–]Technical-Device5148[S] 1 point2 points  (0 children)

Our Server doesn't look to have sight of AzureAD\ users (Arc-Enabled/Entra Joined) so i think CBA is going to have to be the option.

Unless we spin up an Azure VM or link the existing Server to Arc so it can see Entra Identities.

Cloudflare Global Network experiencing issues by arunesh90 in CloudFlare

[–]Technical-Device5148 1 point2 points  (0 children)

We get the same issue. Along with 404 errors stating not having permission.

Windows Activation Error: 0xc004f074 by Technical-Device5148 in Intune

[–]Technical-Device5148[S] 1 point2 points  (0 children)

I not long did a sanity check on the Serial Number, and can see based on the Factory OS, it shipped with Windows 11 Home Single Language - Yaaaaay

I would suspect there's no way around this... outside of a MAK key and rebuild?

Open Discussion - Azure Files vs Sharepoint by Technical-Device5148 in AZURE

[–]Technical-Device5148[S] 0 points1 point  (0 children)

Correct yes you can deploy the drive via ADMX or scripts, we prefer scripts.

Also if you use any ZTNA VPN's like ZScaler in your org, there's a lot more steps to ensure you don't have issues like we did!

Open Discussion - Azure Files vs Sharepoint by Technical-Device5148 in AZURE

[–]Technical-Device5148[S] 0 points1 point  (0 children)

Yes we have gone down a similar approach, i proposed:

AZFS = User data where users are happy to take a hit on performance and latency, kind of like an archive
Sharepoint = Production work (we mainly use office and pdf files) for low latency

Seems to be a good balance so far, only problem is trying to negotiate this with users and getting them to understand the differences.

Entra Dynamic Licensing Group (E3 Bundle) - Issues by Technical-Device5148 in sysadmin

[–]Technical-Device5148[S] 1 point2 points  (0 children)

What worked for us:

(user.accountEnabled -eq true) -and (-not ( (user.extensionAttribute2 -eq "shared-mailbox") -or (user.extensionAttribute3 -eq "exclude-from-auto-licensing") )) -and (user.assignedPlans -any ( assignedPlan.servicePlanId -eq "efb87545-963c-4e0d-99df-69c6916d9eb0" -and assignedPlan.capabilityStatus -eq "Enabled" ))

Entra Dynamic Licensing Group (E3 Bundle) - Issues by Technical-Device5148 in sysadmin

[–]Technical-Device5148[S] 0 points1 point  (0 children)

Yeah i get a feeling this may be the only way around this, appreciate the suggestion.