If you manage Microsoft Intune at scale, you know the pain: hundreds of policies, most of them with empty or outdated descriptions, and zero visibility into which settings overlap or even contradict each other across policies. I’ve seen this in pretty much every tenant I’ve worked with and honestly, it’s one of the most underestimated operational risks in modern endpoint management. This is where AI-powered Intune policy documentation and conflict analysis comes in.
So I built a tool to fix it. It builds on the same idea I explored in Create your own Intune Co Pilot using Azure OpenAi Studio, but takes it further with automated Intune policy documentation and conflict analysis. Let me walk you through it.
With the service release 2211, microsoft has brought a cool new feature called organizational messages. These are different ways to contact users via different good looking messages to improve end-user communication and experience. This guide shows how to setup organizational messages step by step, offering additional possibilities to the existing Notification Bar messages from Windows 10 and older. These messages can be delivered as a popup above the taskbar, in the notification area or in the Get Started app.
A small disadvantage is that this feature is currently only supported for Windows 11 devices. You can read the official guidance about organizational messages on Microsoft Learn.
This guide explains how to import custom ADMX/ADML into Intune so you can manage Windows apps that still rely on classic Group Policy templates. Most of the policies you’ll ever need are already exposed in Intune’s Settings Catalog — but every IT environment has at least one app whose admins still ship a custom ADMX/ADML template from the on-prem Group Policy days. Adobe Reader, FortiClient, custom in-house tools, and a long tail of vendor utilities all use this format, and Intune supports it natively as long as you know the slightly hidden import workflow.
This post walks through importing a custom ADMX/ADML pair into Microsoft Intune end-to-end — where to grab the template files, how to upload them, how to assign the resulting profile, and what to expect on the client. Plus the debugging steps for the most common import failures.
With the Intune service release 2208 there is a really nice feature that lets you import custom ADMX/ADML into Intune very easily. This helps you create configurations for e.g. third-party products. I will explain how this works based on Firefox. If you are new to device management, you may also want to read my other Intune guides first.
Custom ADMX and ADML imports are helpful when a required Windows policy is not yet available as a native Intune setting. Treat every import like configuration source code: keep the original vendor files, document the version, and test the policy in a separate device group first. When you import custom ADMX/ADML into Intune, you essentially extend the catalog with vendor-defined settings that Intune can then deliver through the MDM channel.
Want to Change Windows 11 Context Menu with Intune across your whole fleet? Windows 11’s redesigned right-click context menu has its fans and its detractors — some users love the cleaner default; others miss “Show more options” being a single click away. As an Intune admin you’ll get pulled into both camps, often by the same VIP. The good news is that the classic context-menu behaviour can be restored centrally with a single registry key, deployed cleanly through Intune via the Settings Catalog or a tiny PowerShell remediation. This post documents the registry tweak, the Intune deployment workflow, and how to make the change reversible per user.
Windows 11 has brought some changes to the Windows Explorer, including the way the context menu looks. By default, the context menu is reduced to the really necessary functions. This is sufficient for most users. However, if you often need functions that are not in the reduced view, then this can be a hindrance in the workflow. In this blog I want to show you how to get back the Windows 10 context menu with the help of Intune.
For the Windows Update reboot notifications scenario, keep the message short and action-oriented. Users should immediately understand whether they can postpone, whether a restart deadline exists, and which business application might be affected if they ignore the prompt.
Also check the policy assignment after deployment. If the same device receives multiple update rings or conflicting restart settings, the notification can look correct while the underlying restart behavior is still confusing for users and support teams.
This guide is about Windows Update reboot notifications in Intune and how to make restart behavior predictable for users. The important part is not only enabling a toast, but also choosing timing, wording, and assignment groups that match your patching process.
Before rolling this out broadly, test the notification on a small pilot group and compare the user experience with your existing update rings. That gives you a clean baseline for support tickets, restart deadlines, and expected device behavior after monthly patch deployment.
Windows Update reboots are one of those topics where the default behaviour annoys exactly the people you want least to annoy: knowledge workers in the middle of a presentation, factory operators on a kiosk, and your CEO on a Friday afternoon. Out of the box, Windows shows generic reboot prompts that users either dismiss without reading or only see seconds before the machine restarts.
The good news is that Microsoft Intune exposes a complete set of CSP-backed settings to tame these notifications: when they appear, how often they nag, when they auto-restart, and how aggressively they enforce. This post collects the small handful of policies I deploy in every tenant for predictable reboot behaviour, with the gotchas that don’t make it into the docs.
In one of my blog posts (Delay Windows Update pending reboot with toast notification) I have already described how to give users more flexibility in deciding when to reboot their device while still reminding them regularly. In this blog I want to explain how to configure the system notification of Windows Update for business. The reason for this blog is a question in the Microsoft Tech Community.
Centrally controlling the Windows 10 background picture is one of those tiny tasks that produces wildly outsized political conversations in any organization — branding, compliance and end users all have opinions, and Intune gives you several ways to enforce it. This post is the short, opinionated guide I wish I’d had: how to deploy a corporate Windows 10 / 11 background image with Microsoft Intune, when to use the Settings Catalog vs. the older ADMX templates, and how to behave nicely on devices where the user has personalised their wallpaper before enrolment. I’ll also cover the gotchas that don’t appear in docs: image hosting, hi-DPI quirks, and how the policy interacts with Personalization → Background.
With Intune it is very easy to change the Windows 10 background picture across all of your managed devices from a single policy. In this blog I explain step by step how you can do this, and why hosting the image on SharePoint keeps the rollout clean and reliable.
If you need to Duplicate Device Configuration Profiles in Microsoft Intune, you already know how easy these profiles are to create and almost as easy to lose track of. Anyone who has run a tenant for more than a year knows the result: a long list of profiles with similar names, slight setting variations between them, and no clear answer to “which one is actually deployed and which one is a copy from a test that nobody ever cleaned up”.
Being able to Duplicate Device Configuration Profiles cleanly — for staged rollouts, test rings, or template-based deployment — is one of the operations where the admin portal is genuinely awkward. In this post I show two reliable ways to clone configuration profiles: the built-in Duplicate button and a Microsoft Graph-based PowerShell function that gives you full control.
There is often the use case that you want to clone these policies to adjust them for a certain device group or use case, or just to have a separation of the name for different device classes. Instead of rebuilding every setting by hand, you copy a known-good baseline and only change what differs.
There has been a user voice with over 1200 votes since 2017, unfortunately this feature has not been added to the Intune admin center for every policy type yet.
