Endpoint Analytics & Automation Guides

Detect Connected Hardware with Intune Endpoint Analytics

14. September 20222. July 2026 jannikreinhard3 Comments

Modern endpoint estates contain a lot more than the laptop itself: docking stations, external monitors, headsets, USB peripherals, and a long tail of business-specific gear. Microsoft Endpoint Analytics gives you the foundation to detect connected hardware across your fleet with a custom data-collection script and feed it into Log Analytics, where you can correlate peripheral inventory with users, locations and refresh cycles. This post walks through the pattern I use to detect connected hardware: a PowerShell collector that reads CIM classes, normalises the result, and posts it into a custom Log Analytics table — ready for Power BI and procurement reporting.

To see which devices are using a particular monitor or keyboard, it can be very helpful if you can collect this information. In this blog I will show you how to detect connected hardware with the help of Endpoint Analytics. You can then use this information to assign a driver to these devices or to trigger a hardware replacement. How you can automatically populate a group based on the output of an endpoint analytics script I explained in create and fill Microsoft Entra ID group based on local attributes.

Behind the scenes the approach builds on the Endpoint Analytics remediations feature in Microsoft Intune, so you do not need any extra agent on the client to detect connected hardware reliably.

Detect connected hardware with Intune Endpoint Analytics dashboard

Show user dialog with Endpoint Analytics (Smartphone Replacement Tool)

11. September 20222. July 2026 jannikreinhard2 Comments

Sometimes the most underrated way to drive change in a fleet is to just talk to the user. Endpoint Analytics surfaces all kinds of useful insights — battery health, boot performance, application reliability — but those signals only become action when they reach the right person at the right moment. The Smartphone Replacement Tool is a small wrapper I built around that idea: trigger a clean, branded dialog on the user’s PC the next time they log on, with a contextual message and a clear next step. The technical scaffolding is intentionally simple: a Win32-deployed tool with a WPF frontend, an Intune Proactive Remediation that decides who sees the dialog, and an analytics-driven trigger.

It is not always easy to reach users via email or other channels. When there are projects running to exchange e.g. smartphones or migrations of files from a network drive to a SharePoint it is hard to reach the users and get an answer. Intune provides with Endpoint Analytics a very good on board tool to easily reach users via a user dialog. In this blog I will show how you can use this with the example of a smartphone exchange. The dialog and the method can be adapted to many other use cases.

Create and Fill AAD Group based on an local attributes

Create and Fill an Entra ID Group based on Local Attributes

28. August 20222. July 2026 jannikreinhard9 Comments

There is often the need to create an Entra ID group (formerly Azure AD) based on a local registry key or another attribute to make more specific access decisions, to use this group for access rights to an application or many other use cases. Building an AAD group based on local attributes is the perfect way to do exactly that.

In this blog post I will show you how to create an AAD group based on local attributes with the help of Endpoint Analytics and Azure Automation. In my blog I show you how to do this with the example of device manufacturer; of course we already have this info in Intune, but it is just an example of how this works. Of course you can also do this with anything else you can read out on a client.

Send Teams Alerts for Top 5 Intune App Install Errors

21. August 20222. July 2026 jannikreinhard1 Comment

It is always important as an Intune admin to have an overview of the environment. Intune offers a lot of reports but as we all know you don’t look into them every day. Isn’t it easier to get a daily or weekly Teams notification that shows the top failed app installations directly in your channel? I have already released some blogs with the topic of detecting anomalies in Intune with the help of cognitive services. In this blog I want to show you how to send a report that is already available in Intune to Teams as an automated Teams notification using Azure Automation.

Teams notification showing top five Intune app installation errors

Detect anomalies in your Intune environment with Azure Cognitive Services – Part 3 Bluescreen of death detection

3. August 20222. July 2026 jannikreinhard1 Comment

Welcome to the third part of my series in which I describe ways to get proactive notifications when something in your environment has a problem / error. So that this monitoring does not work with static values, I use Azure Cognitive Services (now Azure AI Services) to detect anomalies via machine learning. In this blog we will take a look at the Endpoint Analytics Startup performance bluescreen detection. The goal is to detect anomalies automatically, so we are notified when an unusual number of devices report a blue screen or problem during detection. You can read more about anomaly detection on Microsoft Learn.

Detect anomalies in your Intune environment with Azure Cognitive Services - Bluescreen of death

Introduction of the Intune Device Troubleshooter

31. July 20222. July 2026 jannikreinhard11 Comments

If you follow my blog, you know that there are two things I really like: helping people with their problems, and automating or simplifying processes. In this blog, I want to introduce you to my new tool, the Intune Device Troubleshooter. This is a PowerShell UI application that will help you to check the status of your devices, as well as help you trigger remediation scripts to fix issues ad-hoc on single devices. It also provides you with intelligent recommendations on what to check on a single device to determine any possible issues. So let’s get started and look at the features of the tool.

Automate Intune App Assignment Groups with Azure Runbooks

21. July 20222. July 2026 jannikreinhard1 Comment

Automatic assignment groups are useful when app deployment should stay consistent without manually creating a new Microsoft Entra group every time an Intune app is added. The pattern works best when group names, app names, and assignment intent follow the same convention.

In production tenants I recommend validating the assignment groups flow with one pilot application first. Check the created assignment groups, verify the Intune assignment, and document the naming rule before you let automation build assignment groups for a larger application catalogue.

When creating a new app in the Intune admin center and not assigning it to AllUsers/AllDevices, this is always some work to create your own group for available/required and uninstall assignments for each app. You know I love automation. To save time and automate this work I will describe in this blog how you can create a runbook that takes this work completely over.

Microsoft Intune app overview with assignment groups

Use Endpoint Analytics to clean up the disk

17. July 20222. July 2026 jannikreinhard2 Comments

I have already written several blog posts about Endpoint Analytics. In the Microsoft Tech Community the question came up how to clean up the disk using Intune. This is a question that is difficult to answer generically as it is always very specific. As more and more applications and data move to the cloud and storage becomes cheaper and cheaper, the amount of storage needed on workplace devices and the problems with full hard disks are no longer as present as in the past.

In this blog I will show you how to clean up the disk on your clients with high disk usage. So let’s get started and clean up the disk the smart way.

A default set on assignment Filter

14. July 20222. July 2026 jannikreinhard4 Comments

In one of my posts I have explained how you can create and apply an Intune assignment filter. The assignment filter is a very powerful feature to refine the assignment of a group. For example, you can assign a config profile to all devices and apply an assignment filter to deploy the config profile only on Windows 11 devices within the group. To make it easier for you to start with filters I wrote a script which creates a default set of assignment filters.

Why does this matter for day-to-day device management? Without filters you often end up creating a separate Azure AD group for every variation of a target audience: one group for Windows 11 devices, one for corporate-owned hardware, one for a specific enrollment profile, and so on. That approach quickly becomes hard to maintain, and dynamic group membership can take a while to evaluate.

Filters let you keep a small number of broad assignment groups and then narrow the scope at the moment the policy is assigned. The evaluation happens on the device against live properties, so a machine that gets upgraded from Windows 10 to Windows 11, or re-enrolled with a different profile, is picked up by the right filters automatically without any group churn.

Default set of Intune assignment filter created by the script

Sync Microsoft Entra ID Group with Kiosk Config Profile

10. July 20222. July 2026 jannikreinhard

To Sync Azure AD Group membership with a kiosk configuration profile is mainly about keeping the assignment target reliable. When you Sync Azure AD Group objects to the kiosk policy, the group should clearly describe the kiosk scenario, the device ownership model, and the config profile it belongs to.

Before using the approach in production, validate the group membership, profile assignment, and device check-in behavior on a small number of test devices. This makes it easier to separate assignment problems from kiosk shell or application configuration problems. The goal of this guide is to Sync Azure AD Group members automatically so the kiosk logon list always stays current.

I have already described in a previous blog how to deploy a device as a kiosk device using Intune. This actually works really well. There is only one small thing that is really inconvenient. If a Microsoft Entra ID (formerly Azure AD) user or group is selected as the logon type (only specific users are allowed to log on to these devices), this policy must not only be assigned to a group, but the allowed users must also be defined in the profile.

The option also allows you to add Microsoft Entra ID users and groups, and the SIDs of these objects are written to the local group, but Windows cannot resolve the Microsoft Entra ID groups (bug or feature?). The resolution of whether the user who is trying to log in is a member of one of the groups is done by Windows via Graph; when MFA is disabled, it works. But if MFA is enabled, Windows fails to get the token.

In this blog I want to show you how you can easily work around this and Sync Azure AD Group members with this configuration profile automatically.

Microsoft Intune & AI Insights

Automation — Tutorials & Guides by Jannik Reinhard