Olliedawg

We're still fairly new with Intune - Could you please elaborate on the additional conditional access policy - would this not conflict with the existing? If the device is enrolled as a 1:1 device, would this then meet the "compliant" criteria? I've read that shared iPad mode is not officially supported by microsoft CA policies which are using "require compliant device"... bummer

For our staff we completely block access to Office 365 via conditional access, unless you have one of the following. - Hybrid joined device - Compliant Device This is great & ensures that school data can only be accessed on school owned devices, however I'm running into an annoying gripe with Intune Shared iPads. Due to the conditional access policy/policies* - the Shared iPad is never allowed to access 365 as conditional access blocks it (besides from our trusted location which is the schools LAN). I've tried excluding a test user from the policy & signing in as that user, I've tried excluding the share ipad enrolment profile from the policy too, none of this seems to work. Basically I want the staff that are going on our Italy ski trip to be able to take a school owned iPad with them, and sign into it & use outlook, teams, our MIS etc.. Is there any other way to go about this?

All good here (internet only, no filter)

We’ve just had a demo with Securly. Honest opinions what is it like reliability wise? The demo looked brilliant from what I was shown. At the minute we use Sophos filtering through a firewall for our on prem devices, any device off site uses Senso

I would be interested in seeing how yuu have this setup, please

Any luck with Procmon? If you filter the process name you should be able to see what it is trying to do

Nope, as @leegcvcc says, it may be worth buying a single licence for the premium purview features. Luckily we don't get SAR's that often

15 February 2006 16:42:39 I started here in 2021!

I can recommend Wave9 for Sophos licencing, great price. Beat our renewal with our old partner by a few thousand..

Mugs, flasks, socks, pens, lanyards, key rings… the list goes on!

Thanks i'll give that a go. I was specifying similar in my TS %windir%\system32\sysprep\sysprep.exe /oobe /restart /quiet Maybe the reboot was causing problems with the TS never finishing properly.

Starting to dabble with Intune, mostly for staff laptops at the minute & staff mobile devices (company owned). All of our devices are currently domain joined (hybrid joined in 365 using Entra connect tool) How do you all image your devices ready for autopilot? We do have MDT/WDS setup already for our domain joined machines, so could utilise that I suppose? I tried making a fresh task sequence but getting it to cleanly end at the OOBE after a sysprep has been a massive PITA, spent most of the day looking at it... maybe it's just easier to image from a USB, or sysprep the device manually once the OS has installed. Any advice would be appreciated! edit: corrected typos!

I see. I don't even get replies anymore to emails i've sent regarding our case.. shame as we wanted to start using chromebooks

We've been waiting since September. Have you heard anything yet?

Have you tried using Procmon when opening Sibelius to see what it's trying to access? We used to have Sibelius a few years back & it was a bit of a nightmare getting it working, unfortunately can't remember what we did!

Those of you that still use MDT, what are your installed versions? I'm thinking of upgrading ours to whatever the last release is. We're currently on the below with zero issues, deploying Windows 11 25H2 MDT - 6.3.8456.1000 Windows ADK - 10.1.22621.1 Or I might just leave as is, "not broken don't fix"...

Knew the day was coming! We're still riding out on MDT for the time being, works perfectly fine for what we need it to do.

Mid range Dell Latitude for myself, same spec as our staff get.

According to Dell, machines will still boot without the 2023 certificates : Secure Boot Transition FAQ | Dell UK What happens when the current Secure Boot certificate expires? The computer is still able to boot. However, with an expired certificate, the computer cannot get future updates to the bootloader or Secure Boot. Quote from Microsoft Frequently asked questions about the Secure Boot update process - Microsoft Support Q4: What happens if a device does not have the new Secure Boot certificates after the old certificates expire? The device will continue to boot and function normally. However, it will no longer be eligible to receive security fixes related to the Windows boot manager updates or Secure Boot. Obviously this is a big security vulnerability, but according to that, it wont suddenly break.

The system will still boot with the old certificates. We still have some old desktops in 2 of our IT rooms which we are plodding along with for another year minimum with the Windows 10 ESU's, which haven't had a BIOS update for a while now.

Following, have the same situation with Mosyle

I noticed this too. Copilot appearing in the taskbar again with the GPO in place & enabled

We have a couple of machines on 25H2, no issues as of yet

I'm glad we have a little stockpile of DDR4..

As above disable "switch user" on student machines, that helps. Support aren't great. We are sticking on V1 for as long as possible