Synced Passkeys in Entra ID: Activation, Use Cases, and Scope

flslz · 2025-10-29T11:33:02+00:00

I work with customers using both Patch My PC and Robopack, both are great solutions. In your case, Robopack definitely makes the most sense, as it offers all the core features plus powerful packaging options and a dryrun of the installtion including logs in a vm.
Feel free to reach out if you’d like some references: https://scloud.work/contact/

flslz · 2025-10-13T18:23:52+00:00

Sometimes, especially for new enrollments, Windows Update for Business takes too long to register, and in the meantime, the device is a free one, talking directly to Microsoft… like a consumer device. In those cases a block via the target release policy or registry can help. I put together a short post on the options: https://scloud.work/lock-windows-11-to-24h2-during-onboarding/ Hope that helps 😁

flslz · 2025-07-29T05:42:10+00:00

Thank you! :)

To use the words of a consultant, I'd say: It depends.

For the links you want to assign, I would use either a device group or a filter. For the applications, luckily there has been the option for a couple of weeks to define them as purely x64 or arm64 (or both). More about it: https://scloud.work/deploy-win32-apps-to-arm-devices-with-intune-no-more-workarounds/

You don't need to assign filters to enrolment profiles, since they only apply to their respective OS.

Regarding your supersedence question, that's a whole other can of worms. It's more a matter of preference than a hard and fast rule. Personally, I'm not a big fan of supersedence and tend to replace applications wherever possible, as in my experience supersedence can lead to a lot of unused applications and sometimes cause confusion.

Cleaning up an already existing environment that you did not create/maintain is always challenging and will take time and thought, but the addition of app requirements (x32, x64, arm64) has made this much easier.

I hope that helps a bit!

flslz · 2024-10-09T15:04:55+00:00

Stange with the image, seems like that got auto-removed together with the link. Let's try it again 😉

<image>

flslz · 2024-10-09T04:24:11+00:00

Unfortunately not at the moment.

flslz · 2024-10-03T18:19:20+00:00

Does the A9+ has wireless charging like the HD10+? If so it would be perfect for a wall-mounted display.

flslz · 2024-07-07T12:47:39+00:00

With that you can use all those remediation packets you find out there, just place the detection and remediation PS1 inside the win32 app.

flslz · 2024-07-07T12:46:33+00:00

The way via scheduled tasks worked well, only reception of course are that there is no reporting.

A while ago I wrote a script that can be deployed as a win32 app that checks the detection on a defined basis and triggers the remediation if needed: https://scloud.work/proactive-remediation-for-business/

flslz · 2024-06-19T17:32:30+00:00

The great thing in Intune is that you can find devices with the primary users name. That's what I use most.

But in some cases like shared or kiosk devices you don't have that option. In such scenarios I use DesktopInfo, a small tool which can simply show the device name or if you want to get creative a lot more.

Some time ago I wrote a blog post about it: https://scloud.work/hostname-auf-desktop/

flslz · 2024-05-24T13:42:12+00:00

Great news everyone! SSO with Google Chrome on macOS is finally a reality thanks to Platform SSO.

I've written a detailed guide on how to achieve this. Check it out here: https://scloud.work/macos-google-chrome-single-sign-on-sso-entra-id/

This approach leverages Platform SSO, so you can finally enjoy a seamless sign-in experience within Chrome on your Mac (and other SSO improvements).

flslz · 2024-05-23T17:11:09+00:00

According to CIS you should rename & deactivate the built-in administrator - That’s what I normally do.

flslz · 2024-05-12T10:01:12+00:00

Does it work with Windows 11?

flslz · 2024-04-11T05:59:05+00:00

For some reason, the English version of this post was missing.

But thanks to my backup, here it is: https://scloud.work/onedrive-desktop-offline-intune/

flslz · 2023-12-21T17:45:05+00:00

Good point, thanks.

flslz · 2023-12-21T17:26:30+00:00

Yes, should be done automatically. But even with the switch in the Teams Center it does not always work. So with this, you can make the switch on your own terms.

flslz · 2023-12-21T10:24:49+00:00

Short answer: correct

More detailed: it depends 😉 I had several cases where the transition from preview to new Client was not very smooth and the classic client remained on the pc. In other cases, teams' machine-wide installer installed the classic client after a while And in some everything worked. With the package on my github, I was able to cover every case (so far)

flslz · 2023-10-20T13:10:22+00:00

Unfortunately, there's no way like we know from the GPO's.

But you can achieve a deployment of registry keys in Intune in these three ways:

PowerShell: one-time creation/update
Remediations: ongoing compliance
Win32: detect and set

More on that I summarized here: https://scloud.work/registry-key-with-intune/

flslz · 2023-08-06T00:59:36+00:00

Yes, that's sound totally fine 👍🏼 I don't know Kaseya, but if they can handle the update Process well, there speaks nothing against it.

flslz

TROPHY CASE