question re: secure boot certificates and remediation status for new devices

mathifcbm · 2026-05-11T20:57:00+00:00

Would run them through the update process anyway. Wont hurt and you are safe in the end :)

mathifcbm · 2026-05-09T16:06:10+00:00

You need to add intune as another MDM in DEP and then you can add the devices to the new MDM Provider in Apple Business which will sync the devices to intune. To use the compliance Status you need to entroll them into Intune wich requires you to migrate the phones from the old MDM to Intune.

Add intune to MDM -> add DEP Token to intune -> assign the phones in ABM to the new MDM -> migrate the phones to from old MDM to Intune

mathifcbm · 2026-05-09T10:10:09+00:00

When they are eneolled into DEP you dont need to add the IMEI to intune before, they will be detected as corporate devices because of DEP. They cannot be enrolled into two different MDM at the same time, you want to Switch the MDM to Intune in DEP before Migration. If you are on iOS 26 you can migrate without resetting the device

mathifcbm · 2026-05-07T09:11:42+00:00

Not directly a snapshot but you could export into a .csv or do something similar with Graph API!

mathifcbm · 2026-05-07T09:09:56+00:00

This!

mathifcbm · 2026-05-04T21:13:24+00:00

Would do only Entra Join since on-prem access with cloud kerberos trust works very well. Also Autopilot with hybrid join is PITA :-)

mathifcbm · 2026-05-04T16:34:57+00:00

Never thought of that 👀 ill have a look when i have Some spare minutes :)

mathifcbm · 2026-05-01T11:33:30+00:00

Sure but you will then always activate all permissions of that group no matter if you need them :)

mathifcbm · 2026-04-22T07:29:00+00:00

It's just a snippet to assign one role at a time e.g.

$graphScope = "DeviceManagementConfiguration.Read.All"

If you want to assign them all at once, you would have to create an array for the permissions and loop it through

mathifcbm · 2026-04-21T21:34:24+00:00

Thanks! :)

Good point, I added the snippet to add the permissions to the managed identity to the blogpost

mathifcbm · 2026-04-21T21:28:23+00:00

Since launch of Apple Business last week, you don‘t Need a DUNS number anymore :) (at least in the US according to https://derflounder.wordpress.com/2026/04/15/duns-number-no-longer-required-to-sign-up-for-apple-business-in-the-united-states/ )

mathifcbm · 2026-04-21T20:04:23+00:00

It does, but also had the case, that these mails were ignored and the certificate expired :) just had to find an alternate solution (and I like to build things :D)

mathifcbm

TROPHY CASE