If you have a Copilot+ PC and you are running Windows Insider, you can now enable Recall.
If you have totally missed what Recall is, the short story is that it’s a way to back-track what you have done earlier and move back to snapshots of your workdays to find things for example.
Recall requires that you have Copilot+ PC, otherwise this is not available. So, if you don’t have a Copilot+ PC, you don’t have to worry about users getting this.
Also, Recall is not enabled by default and on a managed PC, you as an admin need to enable it with e.g. Microsoft Intune for the users to even be able to opt-in. This also goes for the Click to Do feature.
Enable Recall
To enable Recall on the device, you need to set a policy using GPO or MDM policies. Since my go-to tool is Microsoft Intune, let’s dive into how to enable and control it.
Head into the Microsoft Intune portal and navigate to Device – Windows -Configuration and create a new configuration profile. Select Windows 10 and later as platform and Settings catalog as profile type.
Give your profile a good name based on your naming convention.
Click the add settings button and search for “Windows AI”. Select all the settings you want to configure.
There are a few settings you can set for Recall based on your needs.
In this example I’ve let the OS define the storage and duration for my snapshots, but you can configure this based on your needs. You can also add exclusions for websites and applications if we need. I’ve added my blog and Teams as an example in the picture, but you can also skip this.
Go thought the wizard and assign the policy toward the Copilot+ PCs you want to target.
User experience
Recall
So how do you get started with Recall? Simply open the new Recall app in your start menu and authenticate with Windows Hello. The first time you start it, it will work a bit on some updates. This might take some time. Once that is done, you will be able to start using Recall.
You can scroll back and forth on your timeline to go back and forth looking for what it was you wanted to find. Once you have found it, you can search the content of the snapshot or visit the app you had open. It even takes you to the exact spot you where in the app at the moment.
Down in the taskbar, you will see a new Recall button. Once its active, it will be light blue, and will indicate if its paused or running. If you click the Recall icon, you will see some actions you can do, like pause Recall or filter the website/application you have opened.
You can also go through settings and see some settings around Recall, such as storage or applications and website you want to filter (if you want to add some additional ones as a user which your admin did not add).
Click to Do
The second thing which get activated with Recall is Click to Do. This feature gives you the same posibilities as in your snapshot, you can search the whole screen for things or open it in specific apps. You can also have it summerizing long text or create a list. There are a bunch of actions here!
To activate Click to Do, simple press the Window-button on your keyboard and click the screen!
Key take aways
I really think Recall anbd Click to Do are two great ways of improving the user experiance and taking advanatge of the NPU and AI functionallity in a Copilot+ PC. As of this blog post being written, this is still a preview feature and things might change when this is released in GA.
I still think it’s a great way to explore how you can use Recall, and find out what limitaitons you need to set for your users. So as always, Windows Insider gives you a sneak peak of what’s to come and something you really should make use of.
What I do want to point out is that all snapshots are processed and stored locally, protected by Windows Hello to limit unauthorized access to your snapshots. Even if they are protected, it could however be a good idea to think about what sites you should add to a filter.
Let’s imagine for a second that you are a large, global organization and you are managing the fleet of PCs.
In a traditional setup you probably have a Configuration Manager server and probably a bunch of distribution points.
On top of this, you each month must distribute security updates to all your global device estate. And make sure your golden image is patched. Not only this, you also need to maintain your infrastructure, keeping Configuration Manager up to date, the server it runs on and also all those distribution points. Not to forget troubleshooting when a distribution point stops and a region +8 hours from your time zone can’t PXE-boot computers.
You have all heard the marketing pitch because cloud native is the future. But if we instead take an approach to discuss this from a business and operations perspective, we can find some other interesting angles.
Background
What I do in my professional life is mostly to advise and help customer moving to a cloud native platform for device management. I’ve been working with Microsoft Intune since 2013, so I’ve seen all the itterations of the platform. I’ve also seen what works and what didn’t work.
Back in 2013, going cloud native was not a thing, even though Windows 8 acutally supported MDM enrollment. Back then we were more talking full management or light management. Intune was the light managed way doing things since there were simply not yet feature parity.
Windows 10 brought a whole lot of new benefits to cloud. You could now argue that you could make the shift to Intune only and onboard using the new cool Windows Autopilot.
Fast forward to 2025 and Windows 11. We now have feature parity in MDM polices vs GPOs (even if it’s not a 1:1 translation), and moving to the cloud is something everyone is talking about. Not everyone has moved, but from what you hear peers, customers and people within the community everyone is looking at “how should we do the transition”.
Moving to cloud native is not only a “keeping up with the IT landscape”. It can also be a huge cost save for a lot of organizations. No more servers, no more imageing, no more maintaining images. It’s simply just more streamlined.
Common pitfalls
There are A LOT of pitfalls out there when it comes to moving to Intune. I thought I would cover a few which I tend to see more often. Not all of these are technical. Because to be 100% honest, the technology isn’t the biggest issue here.
Doing things like we have always done
Moving to cloud native means doing things in a new way. I’ve seen way to many attempts at moving to cloud native which fails because you don’t embrace change. An Entra ID/Intune managed device is not exactly the same as a Active Directory/ConfigMgr managed device. Gone are the days of imaging and GPupdate, we now have Windows Autopilot and syncing with Intune.
Cloud native will mean that we will have to do things different, and it’s not bad. Just different. Many things we have done for the last 30 years with managing devices (yes, the first version of ConfigMgr called SMS 1.0 was release over 30 years ago in 1994).
We need to embrace change and adopt the new ways of working. If we don’t do that, we will never reach all the way. This is where many project fails.
Doing everything at once
The cloud journey looks very different for all companies, even though we want to accomplish the same things. But doing big shift actually impacts user productivity and we need to be smart of what changes we introduce.
Looking at Sweden, a lot of companies are combining their Windows 11 migrations project with a Cloud Native project. This is a great idea since we are doing a big shift in the client anyway. However, time is running out for Windows 10, so today we need to prioritize whats actually important.
But splitting the cloud journey into smaller pieaces could be easier for many, but we can run a lot of these projects in parallel.
Migrating everything
Think about all your GPOs. You have built that over a larger number of years, probably mostly adding to it and never really done a cleanup. A lot of these policies might been configured for Windows 7, and operating system which was released in 2009. You probably don’t need to migrate those settings to your brand new Windows 11 platform since a lot does not apply in the cloud and many are even depricated.
There is really no point in walking through each and everyone of your old setting, trying to find the Intune equalent for it. A much better idea is to look at what you had, implement either the Microsoft Security Baseline or the Open Intune Baseline. Then go look at your old environment or your security requirements and look for what is missing and what makes sense. There is a GPO analytics tool in Intune, but for experience I would say that starting over is a much better idea since you will leave all your Windows 7 and Windows XP settings behind!
Setting the bar way to high
One of the most common things I see when working with customers who are moving from ConfigMgr is like I mentioned, we don’t embrace change. But one more things is thinking that we need to make it perfect in our first Proof of Concept or Pilot, which isn’t really a realistic approach. You need to start somewhere, so find your minimum viable product (MVP). What do we need to have inplace to do a successfull pilot. What I’ve seen with the more successfull projects I’ve been involed in, this has been the MVP:
Windows Autopilot for onboarding
Security baseline
Wi-Fi
VPN
Base applications (the crucial ones for your pilot group)
Compliance policies
One more thing to keep in mind when moving towards a cloud native client is that your pilot and initial rollout might not need to suite 100% of your users. You will have some more cumbersome scenarios like dependency on on-premises or problematic applications. Don’t let this stop you, instead have them in a later phase of your project. Put them on hold, just like you would do with Windows feature updates. Once you have completed your first scenario, move on to the next!
Moving all extisting devices
This is a controversial one. Eventhough it’s nice to have all your devices as cloud native, but the only way to migrate devices from hybrid to cloud native in a supported way is by resetting the device. And this might not be the most productive way of making this shift, since it means actuall downtime for the end-user.
Microsoft recommends to keep hybrid devices in hybrid until they needs to be reinstalled or replaced. Since we can still move to a 100% Intune managed environment with hybrid devices, this could for larger organizations be a more cost efficient way of making the shift to Intune. Re-installting thousands of devices is time consuming. I’m not saying that you shouldn’t make the hard cut and re-install all your devices, but be aware of that there are alternatives eventhough it’s not a pure cloude native solution for all your exisiting devices going down this route.
What’s your first action?
But where should you get started? Well, making sure you have co-management/cloud attach enabled in Configuration Manager is a great first step, to enable the shift of workloads to the cloud.
I would also recommend to start looking at setting up a small proof of concept or pilot in Intune, onboarding a few devices with the base applications and a first version of security baseline (use the Microsoft one or Open Intune Baseline mentioned earlier in the post). Register a few devices for Windows Autopilot manually and enroll them.
Don’t make it to hard on your self, start small with the “simple” scenarios and let them test it. But set a strategy for this and make sure to track your progress and create a project of this. It’s a hard project to pull of as a line activity since there are a lot of moving parts, redesigning and new ways of working while you need to keep the light on for your production environment.
Let’s talk about cloud-native management with Microsoft Intune and Windows 11 for a little while and dive into five reasons why you should make the move.
In the endpoint management world, there are two major things we talk about right now: moving to Windows 11 (the deadline is getting closer and closer) and cloud-native.
I’ve been an advocate for going cloud-native for about 10 years now, but it has changed names over the years from modern management, cloud-only, to cloud-native management.
But let us first define what we mean by cloud-native.
Definition
By “cloud-native,” we mean a device that is 100% managed using cloud services, such as Microsoft Intune. We are not doing hybrid join; we are utilizing Entra ID (previously known as Azure AD). This means that we DO NOT have the computer object in the on-premises AD, and we need to use modern ways to authenticate. In a true cloud-native setup, we should not be reliant on any on-premises resources, but if we look at reality, we will most typically see that we have some connector for, e.g., certificates using SCEP/NDES.
For cloud-native device management, we don’t need to consider where the user has their primary source, whether that is Entra ID or Active Directory. So if you want to go cloud-native, you don’t need to move your master data to Entra ID, but you need to make sure that you have your users in Entra ID (which you probably already have if you are using any Microsoft cloud services like Microsoft 365, Teams, or Intune).
Reason #1 – Reduce complexity
Managing IT infrastructure can often be a complex and time-consuming task. By leveraging cloud-native management with Microsoft Intune, organizations can streamline their processes and reduce the complexity associated with traditional IT management. This approach simplifies device provisioning, configuration, and maintenance, allowing IT teams to focus on more strategic initiatives.
By moving to cloud-native device management, we can reduce the number of dependencies we have on our on-premises system, such as connectors for hybrid join. We can also reduce the total footprint for the service since we can decommission and repurpose servers previously used for, e.g., Configuration Manager services.
Since we rely on a SaaS setup, we don’t need to think about keeping our management platform up to date; that will happen automatically on a weekly basis.
Reason #2 – Increase security and compliance
Security and compliance are critical concerns for any organization. Cloud-native management with Microsoft Intune provides robust security features and compliance tools that help protect sensitive data and ensure adherence to regulatory requirements. With advanced threat protection, automated policy enforcement, and real-time monitoring, organizations can safeguard their IT environment against potential threats.
Since we have our management tool in the cloud, this also means that our devices do not have to “call home” to be able to talk to our services. Since Microsoft Intune talks through the internet, we can make sure that the users have the latest updates and security configurations regardless of whether they are working in the office or remotely. We can also measure device compliance to make sure that the device lives up to our requirements before accessing corporate resources.
Reason #3 – Adopt to an ever-changing IT landscape
The IT landscape is constantly evolving, and organizations need to be agile to keep up with these changes. Cloud-native management with Microsoft Intune enables businesses to quickly adapt to new technologies, software updates, and changing user needs. This flexibility ensures that organizations remain competitive and can efficiently respond to emerging trends and challenges.
Utilizing cloud services for management means that you do not need to think about keeping your device management tool up to date; that is kept up to date for you since Microsoft Intune is a SaaS offering. This will make sure you get the latest features and tools faster, without needing to plan for maintenance windows. You can also more easily make sure to provide your users with the latest tools by utilizing faster and automated deployment flows for applications and the latest updates.
Reason #4 – Improve user satisfaction
User satisfaction is a key factor in the success of any IT initiative. Cloud-native management with Microsoft Intune enhances the user experience by providing seamless access to applications and resources, regardless of the device or location. With intuitive self-service options and consistent performance, users can enjoy a more productive and satisfying work experience.
We should not forget about one of the most crucial elements of device management: the person who uses the device, the end-user.
Hearing people complain about their work computer not working like they are expecting is outdated. You can remove the need to be at the office for updates or having to download applications through VPN. Using cloud-native device management, you can fully support the hybrid workplace, providing an excellent end-user experience regardless of whether the user is working at the office, from home, or in any other location.
Reason #5 – Enhance scalability and flexibility
With cloud-native management, organizations can easily scale their IT infrastructure up or down based on demand. This flexibility ensures that resources are used efficiently, and it allows businesses to quickly adapt to changing needs without significant downtime or additional costs.
No need to think about if you need to scale up or down, outside of licenses. This means that your environment grows without, and all you need to do is make sure you have enough licenses. This frees up a lot of time for your system administrators who would otherwise also need to plan for scaling up or down based on what happens in your organization. This will also make it easier to grow at a lower cost since we do not need to think about setting up infrastructure in that new branch office on the other side of the world. All you need are licenses for your new users, and you are ready to go!
Closing reflections
I’ve been pushing for going cloud-native for almost the last 10 years, and I still strongly believe that this is the future for endpoint management. So far, I’ve helped a lot of larger companies make the shift, and it works really well. Sure, there are hiccups initially, but that goes for all new services, and we need to adapt the way we work as IT admins to make this a successful transformation. We cannot bring our old ways of doing things; we need to adapt to our new tools. As long as we try to work the old way with a new tool that was not built for doing it the same, it will be an uphill battle.
But if we can see the new possibilities with cloud-native and what it brings us, things will get easier. And it’s a moving target. Microsoft Intune has developed tremendously over the last couple of years, and we will probably see even more improvements as we go.
I will leave you with an interesting reflection I’ve made. Larger enterprises, at least in Sweden, are more keen on moving to cloud-native than smaller organizations. Sure, the IT organization of a large enterprise can take on a larger workload making the move, but the small IT organizations would benefit just as much from the lower running cost of being cloud-native.
Some of you might have noticed that when updating a Windows 365 Cloud PC to Windows 11 24H2, the shutdown button appears out of nowhere in the start menu, which can cause some weird behavior for the end-users.
Shutting down the Cloud PC isn’t really anything you should be bothered with. Restarting, yes, but if you do a shutdown, it will boot back up again within a few minutes.
With the Windows 11 24H2 update to Windows 365, if you upgrade from an earlier Windows 11 version, this registry value will be reset.
While I still encourage you to provide feedback to Microsoft, the fix for this problem is fairly simple!
There are two ways we could go about addressing this. We could either create a configuration using the Settings Catalog or use proactive remediation. We will get the same result in the end, so it depends on how you like to do it. I will show you both ways in this blog post, and how you can configure it.
Settings catalog
In Microsoft Intune, head into Devices > Windows > Configuration and create a new configuration profile by clicking “+ Create“. Select Settings catalog as the profile type and click create.
Give the profile a good name which makes sense in your environment.
Search for “Start” and find “Hide Shutdown” in the list, then check the checkbox next to it. Close the fly-out.
Make sure to enable the setting before moving to the next step.
In my case, I will skip scope tags and move straight to Assignments, where I select “All devices” and filter out Windows 365 with a filter.
Last step is to review and create the policy. And then you just need to wait for the policy to apply.
Proactive remediation
The scripts
The easiest way to deploy a scripted solution for this is to use remediation, since then we can also get feedback on how many devices had this issue. We can have it continuously checking or just run once.
But in order to set up a remediation, we need a detection and a remediation script (you could run everything in the detection script, but you won’t get any feedback if you want to run it more than once).
You can find the scripts either on my GitHub repository or just copy them from here.
Detection script
# Created by Ola Ström, olastrom.com
# Date: 2025-01-21
# Version: 1.0
# PowerShell script to update the registry value
# Define the registry path and value
$registryPath = "HKLM:\SOFTWARE\Microsoft\PolicyManager\default\Start\HideShutDown"
$valueName = "value"
# Check the current value
$currentValue = (Get-ItemProperty -Path $registryPath -Name $valueName).$valueName
# Check the value and set the appropriate exit code
if ($currentValue -eq 1) {
Write-Output "Registry value is set to 1."
exit 0
} else {
Write-Output "Registry value is not set to 1."
exit 1
}
Remediation script
# Created by Ola Ström, olastrom.com
# Date: 2025-01-21
# Version: 1.0
# PowerShell script to update the registry value
$registryPath = "HKLM:\SOFTWARE\Microsoft\PolicyManager\default\Start\HideShutDown"
$registryName = "value"
$registryValue = 1
# Set the registry value
Set-ItemProperty -Path $registryPath -Name $registryName -Value $registryValue
Write-Output "Registry value updated successfully."
Intune part
In Microsoft Intune, navigate to Devices > Scirpts and remediations.
Select “+ Create” in the ribbon and give your remedation a good name, then press next.
Now we will add the detection and remediation scripts, which you need to save as PowerShell scripts on your device to upload to Microsoft Intune. Change the “Run script in 64-bit PowerShell” to yes, but leave all the other options at their default values and press next.
On the Assignment tab, select your target group. I’m using “All devices” with a filter for Windows 365.
On this step, you also set the schedule by pressing on the text “Daily”, which is the default value. You can then choose if you want it to run once, hourly, or daily.
When you have selected your schedule, press next to review your settings before pressing create.
And now we wait until the remedation runs…
Monitoring the remediation
You can follow up the progress of your remediation by checking the device status on the remediation you just created.
In this view, you can follow up on individual devices and see how many devices were affected.
If the script detects that the value is set to anything other than “1”, it will run the script to fix it, and you can see here if the issue was fixed or not. This is not dependent on whether the script runs on a schedule or just once; you will still get feedback if any issues were found.
What happens on the Cloud PC?
Both ways will give the same end result for the end-user: the shutdown button will disappear, removing the option to shut down the Cloud PC (which is good).
Take aways
I’m not saying that one way or the other is the correct way; it’s just different ways to address the problem. Both of them have advantages, where the settings catalog will set the value and always keep it that way, and the remediation will check if the value is incorrect and change it if needed.
You can also reuse this script for other registry entries you would like to change, so feel free to reuse it!
As you might know, there is a new category of PCs out there called Copilot+ PCs. These are defined by primarily two things, they have an NPU with over 40 TOPS (trillion operations per second), and they have the Copilot button on the keyboard. Of course they also run Windows 11.
As per writing this blogpost, we have mainly seen ARM based Copilot+ PCs. But x86 based versions from AMD and Intel is around the corner!
One thing that has gain a lot of attention is the Copilot button. When the first devices were released this opened the consumer version of Copilot, the Microsoft Copilot app. This app does not work corporate environment, since we don’t get the “correct” version of Copilot. The Copilot we want to use is the Microsoft 365 Copilot where you sign in with your corporate credentials.
There has been changes
Since the October patches 2024, Microsoft has altered the behavior of the Copilot button based how you sign into your computer.
Another change that has happened is that the Copilot in Windows (preview) experience has been removed and is replaced by either Microsoft Copilot app or Microsoft 365 app based on your scenario (see the table below).
The following table will show you that based on you you authenticated onto you computer, different things will happen.
Configuration
Copilot experience
Copilot key invokes
Copilot not enabled in environment
Neither Copilot in Windows (preview) nor the Microsoft Copilot app are present.
Windows Search
Copilot enabled + do not authenticate with Microsoft Entra
Copilot in Windows (preview) is removed and replaced by the Microsoft Copilot app, which is not pinned to the taskbar unless you elect to do so.
Microsoft Copilot app
Copilot enabled + authenticate with Microsoft Entra + new device
Copilot in Windows (preview) is not present. Microsoft Copilot is accessed through the Microsoft 365 app (after post-setup update).
Microsoft Copilot within the Microsoft 365 app (after post-setup update).
Copilot enabled + authenticate with Microsoft Entra + existing device
Copilot in Windows (preview) is removed. Existing users with Copilot enabled on their devices will still see the Microsoft Copilot app.
IT admins should use policy to remap the Copilot key to the Microsoft 365 app, or prompt users to choose.
In a corporate world, we strive to have the Microsoft 365 app launching when pressing the Copilot button on the keyboard, since that’s where we can use the Microsoft 365 Copilot. So let’s walk though the different scenarios.
New Copilot+ PCs
If you are setting up a new Copilot+ PC (or resetting an existing one), there isn’t that much you need to do. As long as you get the October 2024 monthly security update installed, the Copilot button will remap to the Microsoft 365 app if signed in with an Microsoft Entra account and you have Copilot enabled in your environment, and it doesn’t need to be the “fancy” $30 per month version. If you have disabled Copilot, the button will (as the table says) open Windows ´Search instead.
Existing Copilot+ PCs
For your existing Copilot+ PCs which were setup prior to the release of the October 2024 monthly security update, you as an admin have to take action since the default value for users would be to launch the Microsoft Copilot app. This can be done in two ways, either prompt the users to make the change them self in Settings or push out a new configuration for the computers using a GPO or Intune CSP policy.
As of the latest service release of Microsoft Intune, you can now also do this usign Setting catalog, which is not yet reflected in the Microsoft documentation.
Let’s have a look at how we set this up in Microsoft Intune. (UPDATED with settings catalog instructions)
Navigate to the Microsoft Intune Admin Center and select Devices > Windows > Configuration and create a new policy. Select Windows 10 and later then Settings Catalog. Select it and click “Create“.
We start by giving the new profile a name which makes sense in our environment. Then click Next.
Next step is to add the setting by pressing +Add setting. Search for Windows AI and select the “Set Copilot Hardware Key (user)” setting.
Close the flyout and enter the AUMID for the Microsoft 365 app.
So back in 2019, when I first go back into blogging, I wrote a piece on how we at my former employer adopted a modern approach to digital workplace, transitioning into a more Windows as a service concept internally. If you have missed this post, please pause here and head over the post here and read it.
I wrote that post more than 5 years ago, in a world where Configuration Manager was still king and we were running Windows 10 in a large enterprise (over 35 000 managed Windows devices globally). We never ran the feature upgrades as projects, and neither should you!
This post discussed they way Windows updates work for Windows 10, that we will see continuous innovation with several updates per year. Back then, Microsoft was still doing a spring and a fall release. This was a challenge to keep up with, and many reverted to “let’s at try to do one update per year” which for many was still a challenge. If you had this strategy, you usually went with the fall release since that was supported for longer than the spring release.
Since 2021, Microsoft only does one update per year, which so far has always been a fall update. Each release is supported for 36 months, given that you run Windows Enterprise.
But let’s talk about strategy to handle the Windows update cadence.
Find your tools
Since I’m a big cloud advocate, I will of course recommend to use Windows Update for Business to manage your Windows updates. This is also the recommended way by Microsoft, regardless if you are using Microsoft Intune or Configuration Manager to manage your devices. There is no reason to micro-manage the updates for the vast majority of your devices (there are of course exceptions), and since Windows 10 you cant really say no to update since they are all cumulative. If you skip the October patch, you will get them and bunch of more updates in November.
So making use of the cloud and the smart logics actually built into these tools are great.
If you really want to automate things, you can even move to Windows Autopatch which is almost like doing a set and forget setup. Microsoft will manage your whole setup and make sure your devices are kept up to date, and not updated all at once by using automated rings.
But I really hope that you all have your monthly patching in order. Otherwise we have a different level of problem. So lets pivot and talk about the feature updates which is released once per year, what is often referred to as the 23h2 or 24h2 update by the IT community.
What is a good practice?
So if we look back at my old post, I actually talked about using deployment rings which is still a thing (if you look at how Autopatch configures it self, it will use rings).
Whats important here is to devide this into several deployments, so we dont update everyone at the same time. A good practive could be:
Ring 0: First evaluation group Ring 1: Second evaluation group/application testers Ring 2: Pilot group Ring 3: Broad deployment Ring 4: Devices which needs extra attention
I think that in my original post I had 5 groups, but you can adopt this based on the size of your organization. The purpose of the first 3 groups in this scenario is validate and make sure we catch any compability issues. Any device you find that is cumbersome, or application which need additional testing or validation, you put in the last group to “buy time”. I By doing this, you don’t postpone the update for devices where this will work without any issues.
But what if there are known issues with a certian device model? Well then Microsoft has implememnted something called safeguard hold which will pause the update for the affected devices, so we don’t brake devices and cause issues for the end user. If you want to read more about this, this is a great article covering this.
By utilizing safeguard holds, we can increase the trust in that updates will work since the Windows Update service will block any devices with known issues from recieveing updates. This is also a strong argument to move towards Windows Update instead of using e.g. Windows Server Update Services (WSUS) to handle your updates since it will prevent those supprises. There are also a bunch of reports you can utilize to keep track of any safeguard holds you might be affected by.
Setting up Windows Update for Business
Windows Update for Business can be configured in a few different places. The best way, even if you are using Configuration Manager, is to utilize Microsoft Intune for this. If you are in a hybrid state, move the toggle in Configuration Manager to move the co-managed workload to for Windows Updates to Microsoft Intune. In Microsoft Intune, you then configure your different rings (the number depends on your needs, but at least three). There are many good guides around how to build this, even pre-made ones you can import from e.g. Open Intune Baseline.
You can also enable Windows Autopatch which will create all the rings for you and populate all the groups.
The important part is to create the rings and divide your devices amongst those rings, putting the correct devices in the correct rings. What is correct is based on your needs and your environment, there is no right or wrong here. In these rings you also define the amount of deferal days you want.
Deferal days are the amount of days you want to postpone the update from the release date. There are a lot of different opinions on the cadence here, but it could be a good idea to aim to have ring 0 running the new update within the first two weeks to start evaluating. Then aim to have moved through the rings to your broad deployment within 3-4 months. There is usually no need to rush things, since we need to combine this with end-user communications to communicate any changes in the operating system. If you want to have broad deployments around 5-6 months later, that is perfectly fine to. This comes down to how fast you as an organization can move. But keep in mind that your “upgrade later” group, my ring 4, needs to be even further away. However, the ambition is that this ring should always be empty so as problems gets resolved you move those devices back to the earlier rings.
What is important to keep in mind, is that you need to be able to repet this process every year on a 12 month cycle. So don’t build it to complex!
What is the point behind this post?
My idea behind revisiting this topic is that I still see a lot of companies struggle with this concept. Feature updates are handled as projects and treated as something that is scary.
We have had great tools to manage this for several years now, and Microsoft has done a great job improving on these tools over the years, giving us more options and better reporting.
It’s about time that we stop micro-manage our Windows updates and put out trust into the tools, so we can spend our time doing something more productive than running project to catch up with the feature updates. If we fall one or two versions behind, we all of a sudden need to catch up and then it becomes a project.
I also want to highlight that I’m not just pushing the Microsoft message here. I have worked with several large customers who runs this smoothly as part of their daily operations. Once a Feature update is released, the process kicks in and ring 0 gets the update within a few days to validate that nothing breaks, and then it starts moving between the rings. Not everyone fully automates their rings, but the concept is still there and no internal projects to upgrade Windows is initiated. It’s all business as usual.
So creating a great strategy to handle Windows updates going forward is key, envisioning that “Windows as a Service” which we talked about a few years back, where Windows just keeps evolving and we don’t have to spend that much time thinking about updates.
Microsoft Ignite 2024 was once again back in Chicago, where it all started in 2015. I remeber having such FOMO not being able to go there, since one of my favourite bands at the time (the Chigaco band Fall Out Boy) played at Ignite.
But it was great being back at a large event, and Microsoft does a good job running big events. This was still a “small” Ignite with about 10 000 participants, but that is still A LOT of people. I went there with my colleagues from Advania, which was a lot of fun!
The red tread through Ignite 2024 was of course Copilot, “the UI of AI”. So it was Copilot everything, and you can really tell that this is the big bet going forward. So if you haven’t paied attention to Copilot yet, now is the time to start.
But since that Copilot is the big thing, I decided to actually put Copilot into good use and help me find all the important updates around Windows, Windows 365 and Intune for this blog post. This is the prompt I used to create my draft, it did however miss a few important points so consider using this prompt for drafts.
Can you help me gather all news around Windows, Windows 365 and Microsoft Intune from Microsoft Ignite 2024. I want to devided into each topic, with the topic stated as the H1 heading, and then each news per area as H2 headings.
for each news, write a short descriptive text.
make sure to only reference Microsoft sources
Microsoft gathers all news from Ignite in the Book of News which was released on the first day of Microsoft Ignite. If you want to check out the full list, you can find the Book of News 2024 here.
It was also great meeting all the community people which I haven’t seen in a while, both MVPs and Microsoft people.
Windows
Windows Resiliency Initiative
Microsoft introduced the Windows Resiliency Initiative to enhance the reliability and security of Windows. This initiative aims to allow more applications to run without requiring admin privileges, implement stronger controls for apps and drivers, and improve identity protection. These measures are designed to make Windows more robust and secure for all users[1].
Windows Hotpatching
Windows 11 Enterprise, version 24H2, introduces hotpatch updates that apply security patches immediately without requiring a restart, reducing disruptions. Devices receive a standard monthly security update and restart in the first month of each quarter, followed by hotpatch updates in the next two months. Managed via Intune and Windows Autopatch, hotpatching can auto-detect eligible devices and streamline update deployment. The public preview invites user feedback to improve the service before general availability, with more information to be shared as the rollout continues.
This new feature allows IT administrators to remotely execute targeted fixes from Windows Update on PCs that are unable to boot. This capability is particularly useful for quickly resolving issues without needing physical access to the affected machines, thereby reducing downtime and improving efficiency[1].
Collaboration with Endpoint Security Partners
Microsoft is working closely with endpoint security partners to improve security and reliability. This collaboration includes new requirements for partners, such as controlled gradual rollouts and enhanced incident response processes. These efforts aim to ensure that security updates and patches are deployed smoothly and effectively[1].
Windows Hello Authentication
Windows Hello has been extended to support passkeys, offering a simpler and safer way to sign in. This enhancement aims to improve user convenience while maintaining high security standards[1].
Administrator Protection
This new feature allows employees to make system changes using temporary admin tokens. By granting temporary admin privileges, this feature enhances security by reducing the risk of unauthorized changes while still allowing necessary modifications[1].
The Windows 365 Link is a new class of devices built to connect securely to Windows 365 in seconds. These devices are designed to provide a seamless and secure connection to the cloud, enabling users to access their Windows environment from anywhere[1].
Windows 365 Frontline now supports shared mode for brief, ad-hoc tasks. This feature allows multiple users to share a single device for short-term tasks, improving flexibility and resource utilization[2].
Windows 11 capabilities are now available on mixed reality headsets like Meta Quest 3. This integration brings the power of Windows to the mixed reality space, enabling new immersive experiences and applications[2].
Mobile Application Management (MAM)
Enhanced device redirection and security features are now available on unmanaged devices. These improvements provide better control and security for mobile applications, even on devices that are not fully managed by IT[2].
Microsoft Intune
AI and Analytics
Intune Enhanced device hardware inventory
Intune now offers enhanced device hardware inventory, allowing administrators to query multiple devices and take remote actions based on the query results. This feature provides deeper insights and more control over the device fleet[3].
Security Copilot brings AI-powered endpoint security to Intune, offering real-time threat detection and response. This integration enhances the security posture of managed devices by leveraging advanced AI capabilities[3].
Device Management
Cross-Platform Device Inventory
Intune’s device inventory capabilities are expanding to include iOS, Android, and macOS devices by early 2025. This expansion allows for comprehensive management of a diverse range of devices from a single platform[3].
Enhanced macOS Management
New options for certificate storage in the user keychain have been introduced for macOS devices. These enhancements improve the security and manageability of macOS devices within the Intune environment[3].
Specialty Devices
App Protection Policies for Apple Vision Pro
Intune now supports configuring app protection policies and Conditional Access for Apple Vision Pro. This support ensures that these advanced devices can be securely managed and used within enterprise environments[3].
EPM Support for ARM64
Elevation requests from ARM64-based Windows devices are now supported in Intune. This feature allows for better management and security of ARM64 devices, which are becoming increasingly popular[3].
Through out the years, I’ve worked with a lot off different customers, and almost all of them use some kind of ITSM tool (such as Jira ServiceNow) to order new services and hardware for users. This is usually where Windows 365 is added as a service where I as an end user, or manager, can request it.
But what if you don’t have an ITSM tool, but I still want to offer the self-service option?
Well, in Entra ID there is something called “Access packages” which we can use for this puropse. If you want to read more about what that is, check out the Microsoft documentation here.
With Access packages, we can create a self-service portal, where end-users can request memebership to a group. This group can then have a license tied to it, what is also known as Group Based Licensing. The user will then request membership to the group, you can add approvals and set a time frame that this membership should be valid. You can also add access reviews to check in with the user to see if they are still using the service.
So let’s jump into how an easy setup of this would look like, and then have a look at the user experiance. However, this setup is assuming you have already setup group based licensing for Windows 365.
This setup also assumes that you are targeting provisining policies to all users already (I’m using dynamic, country based groups as descibed in this post).
Setting upp Access packages
To set up access packages, we head into the Entra portal (https://entra.microsoft.com) and navigate to Identity > Identity Governance > Entitlement Management and then look for “Access packages” in the menu.
We will just create a very basic setup for this, so lets go ahead and click on “+ New Access Package“. First step is to give your policy a name and descripton. Remeber, the description is a required field. We will leave the catalog to “General” which is the default value. When done, hit next on the bottom of the windows.
Since we want to configure a memebership to a group, select the option “+ Groups and Teams” and find
Since we are just going with default values, you might need to check the “See all Groups and Teams…” check-box in order to find your group. When you have found the group, click select. If you are not already targeting users with a provisioning group, you need to add that here as well.
When you have added your group, remeber to change the Role to member before hitting next.
In the next step, we will define our Request flow. In this example I will make this apply for all users in my tenant, and I will allow all users to place a request.
The next part is to define the approval process. You can also remove approvals completely, but since Windows 365 comes with a cost we want a manager to approve this request. You can also add additional approvers if required. Default value is that manager will be the approved, and we will leave it to default. What you need to add is a “fallback” approver, and as you can see here I added my Help Desk team for this. Choose an approriate user/group for this task.
Last step on this section, is to select how we will enable this request flow. I’ve also enabled the preview features for this example, but you dont need to do that. Just make sure to enable the top one since this is what makes this request available. We will skip the Verified ID part and press the Next button.
On this step, we could add additional questions or justifications for the requestor, but we will leave this to default and press next. We will still get a question for business justification in the request.
Next step is to set the lifecycle for this, which we in this case will set to 180 days since that is roughly 6 months. And just for the purpose of usign access reviews, we will enable that as well but leave all values to default. When you are done, press next until you reach “Review + Create“.
On the last step, you can review all your settings before pressing Create. It will validate your configuration, and if you missed something or something is wrong it will ask you to correct this before moving forward.
We have now successfully create a Access package for our Cloud PCs!
Let’s have a look at what this looks like when a user requests this.
The request flow
The place where you need to direct your users for placing requests is https://myaccess.microsoft.com/ where they will see all available request packages for them. As you can see, I have three different access packages for Cloud PC I can request. To start a request, I simply click on “Request” on the service I want to request.
This windows will then appear, and you just click continue.
Next step is to add a business justification for my request, here I can also set it to a specific period if I like since we enabled that option when setting things up.
I then submit the request and it is sent of to the approver, which in this case is the manager.
Approver experiance
When the request has been sent, the approved will recieve an email looking like this, where they are asked to approve the request. This email also contains the business justification added by the requestor.
When the approver clicks the blue button in the email, they are redirected to the approval site on My Access.
When the approved selects to approve the request, they will be asked to enter a justification before approval is sent.
When the approver has approved the request, a confirmation email will be sent to the user. However, what is imporant to keep in mind is that this will initiate the provisioning of the Cloud PC.
The process of provisioning will now start and the Cloud PC will be done within usually 30-40 minutes depending on how fast your provisining policy is!
Key take aways
Estalishing a good on- and off-boarding process is important in all IT organsations. This walk though shows you that you can establish this without setting up more advanced tools. However, this is not close to as powerful as proper ITSM tools, but you can build simpler request flows to suite your needs.
This principle can also be applied to other things, not just Windows 365 and Cloud PCs.
I started a blogpost something like this about 4 years ago:
“I’ve been thinking about this post for a long time, probably several years to be honest. What got me to get this done is something Microsoft released, the Windows 10 in cloud configuration, which is a configuration guide for how to move to cloud managed Windows 10 devices.
This is great!
This shows that managing Windows 10 purely from Microsoft Intune is not rocket science and it will make it easier for smaller companies especially to get going.
BUT this is also showing what I’ve been expecting for a couple of years. “
Let’s stop the tape right here. I’ve added to this post once back in 2022 but never finished it. And to be honest, this has been on my mind since 2016. I recall that this was planted in my head in a conference room at the Microsoft Madrid office at a meeting with my team back in the days.
This post was initiated long before the release of Windows 11, and before the release of Windows 365. AI was still something that was being explored but not a massive thing, we were more focusing on machine learning than AI. It feels like ages ago, but it still makes sense to talk about this given what is currently happening with Cloud PCs, AI, and continuous innovation in Windows 11.
This is probably to date the blogpost that has taken the longest to write, but it’s starting to make sense now.
The change of device management
When we talk about device management, and especially Windows, things tend to get technical and hard quite fast. Especially if we throw some on-premises things into the mix and talk about creating custom boot images (which is an artform in itself).
Now we are in the age of AI and Copilots. Copilots showing up everywhere for everything. We have currently seen what is called the Microsoft Security Copilot where security admins can query the Copilot to find issues and even troubleshot device configurations. This is only the beginning of the AI transformation we are on. The Security Copilot also connects into Microsoft Intune, becoming Copilot in Intune.
Looking at Microsoft Intune and how simple it is to get started with a surprisingly good baseline and basic device management, this is a fitting example of how this whole segment has evolved into something which does not need to be that complex anymore with servers, distribution points, image creation, OSD, GPOs. Using Intune, you can get a long way with the guided scenarios or the security baseline which are already existing in Intune today. You can even get suggestions on what to set using the Settings Insight feature in Intune which will give you recommendations on how to configure your security baseline using machine learning. And that is without any Copilots.
AI will help us
What has gotten me to finish this blogpost is the Copilot and Intune story that Microsoft is now telling, I attended WP Ninja Summit 2024 in Lucerne where Copilot was mentioned in a lot of sessions and showed real world value. Copilot can find issues with devices, or policies, which would take admins hours, or even days to find. If you get that in about a minute or two, that is an huge increase in productivity. Copilot is not yet in the state that it will suggest that “you should configure your setup like this”, it’s still learning Intune. But just putting the tools in the hands of admins simplifies their work… Wow.
But there is also a conflict of interest here. If I can use Copilot to find that error in a few minutes… Why do I need to pay expensive consultants to do the work for me? Well, I think we who live and breath device management needs to raise our line of sight a little and find what the next big thing is and how we can stay relevant. This will be challenge for many, but this change will also take several years to complete.
I would assume that this is just the start of a pretty epic journey in device management, making life easier and probably quite drastically changing how we work with device management. Microsoft has a lot of data of what “a good device management configuration” should look like. Even if most organisations think they are unique and have unique needs, most organisations share the same baseline needs but of course with their unique touch on-top of things. This is where the focus should be, not the baselines where we tend to spend way to much time on today.
What about Windows?
By listening to a lot of sessions around Windows 365 and looking at how Microsoft is positioning this as the future of Windows, I think we will see a shift in a few years. Not in the next one or two years, but looking at Windows 365 Boot, the new Windows 365 experience being released for Motorola Think Phone, and the general focus on sustainability I think we will see both a technical and culture shift in what a computer is in the next couple of years. Don’t get me wrong, we will still have some kind of device but it will probably be different to what we are used to today.
Just imagine that you suddenly could access your computer from any device you have, only needing one device to both get a mobile och desktop experience depending on your context. If you are like me, someone who work a lot from places where you don’t have a external monitors, well maybe your device will not be a smartphone only. Or maybe you even have two devices but your “laptop” is something with focus on giving you optimal battery life and great longevity.
One thing that sticks in my head right now though is “we are moving Windows to he cloud” and not just management with Windows 365. Windows as an operating system will still be the foundation of a lot of business work and applications, but how we consume it is where the difference will lie.
My predictions
So my big two predictions about where this whole area is heading, even if we are a few years out:
Intune management will drastically change once Copilot for Intune is more widely used, making device management in general a whole lot easier
Windows will be consumed for “a device” and that device might not have Windows installed on it. We will come back to the world of thin clients, but more optimized for the connected world.
Of course, several years of experience will still be relevant, but doing the clicking and selecting what exact setting to accomplish the wanted state, that will not be a hard part.
One thing that many IT administrators tackles every day is the discussion about “my computer feels slow” or “I need a faster computer”. Sometime the feeling of having a slow computer is legit, and sometimes it’s something else.
There are numerous DEX (Digital Employee Experience) tools out there on the market. This can provide you with a great overview of your whole ecosystem, ranging from Teams call quality to desktop experience. However, even if those tools are great, they come with a new set of data to analyze in a new tool. And in bigger organizations, the complicated puzzle of “who owns this and who makes remediations?” arises.
Since I write a lot about Microsoft stuff, we will dive into the IntuneAdvanced Analytics part of the Intune Suite.
Intune Advanced Analytics is a native part of Intune, which gives you more extensive reporting on your Windows devices. I know Windows isn’t 100% of the fleet in modern organizations but we need to start somewhere.
Setting up Intune Advanced Analytics
To start using Intune Advanced Analytics, you will need these three things.
Intune environment
Intune Suite licenses or Intune Advanced Analytics stand-alone license (remember, this is user based)
Configuring Endpoint analytics in Intune
I won’t go through how to obtain license, since this will vary from case to case depending on your setup.
Configuring Endpoint Analytics
The first thing you need to do is to configure Endpoint Analytics to receive data from your devices. Since I’m all in the cloud, we will look at how you do this for Intune managed devices. To do this, you need to have the Intune Service Administrator role, also known as Intune Administrator.
Head over to the Endpoint Analytics blade in Intune (you can find it under Reports or at https://aka.ms/endpointanalytics). When in there, select the Settings blade.
You can see that my tenant already uses the Intune data collection policy. This default policy exists in all tenants, but you need to make sure it’s assigned to your devices.
Manually create the policy
If you can’t find the policy in your environment, it’s no big deal. You just need create a new policy based on the template for Windows Health monitoring.
If you are configuring this for the first time, make sure to switch Health monitoring to Enable and set the Scope to Endpoint analytics.
Deploy this policy to your devices using either the built in “All devices” group or use a device group.
When you set this up for the first time, it can take up to 24 hours for the data to populate. If you are looking to use Advanced Analytics, expect up to 48 hours.
Allow access to URLs
The last step to do is to make sure that your devices are allowed to reach the URL needed for Endpoint Analytics. This is important if you have a restrictive firewall or if you use a webfilter/proxy to run all your traffic through.
Now when 24 hours have passed, we should start seeing data being populated. If you have additional people who should not be admins who need to review the data. There are a few different built-in roles you can use, or create a custom role.
These are the different options you have:
Role name
Microsoft Entra role
Intune role
Endpoint analytics permissions
Global Administrator
Yes
Read/write
Intune Service Administrator
Yes
Read/write
School Administrator
Yes
Read/write
Endpoint Security Manager
Yes
Read only
Help Desk Operator
Yes
Read only
Read Only Operator
Yes
Read only
Reports Reader
Yes
Read only
Once we have our roles in order, we can start looking at the data!
Looking at the data
The Endpoint Analytics feature consist of 6 different blades
Startup Performance
Application reliability
Work from anywhere
Resource performance
Remoting connection
These features are available with the regular Intune license. With the Intune Advance Analytics license you will get a few more. And it’s automatically integrated into the Intune administrator experience.
But as I stated in the beginning of the post, let’s talk about reviewing resource performance. With the regular Intune license, you will gain access to resource performance for your Cloud PCs. With this, I get insights which Cloud PCs are meeting my targets and what Cloud PCs I should investigate upgrading to a different SKU. This data can be broken down to a device or model. This gives me great data about my environment on CPU and RAM spikes when they are being used.
All devices get a score based on their performance, and you can configure what your baseline is in the Endpoint Analytics settings.
You can break the numbers down based on model or individual device performance to get a better understanding.
With the 2408 Intune Service update, this was also made available for physical devices if you have the Intune Advance Analytics license enabled. This will provide me with insights on how my physical devices are performing when it comes to RAM and CPU. I can also learn if they have continuous spikes indicating that they need an upgrade.
If we stand in the “Device performance” tab, we can see all Cloud PCs and physical PCs gathered in the same place. You can also compare Cloud PC and physical PC performance.
Looking at specific devices
If we click on the name of a device, you will be redirected to the blade “User experience” on the device itself. You can also find it if you search for a device in the device list and click in to view that device.
From here, you can see a lot of data about the device around its performance.
As you can see, my Surface Laptop Go 3 has had a few minor spikes in RAM the last 14 days but nothing major.
And if we look at the overall score, it’s pretty okay.
Device timeline
There is one more really nice feature with the Intune Advanced Analytics we can see, and that is a Device Timeline (last tab on the top).
In here, we can see historical data on events that has happened on the device which impact the user experience. As you can see on this device, I’m having a few issues with applications.
And if we jump back and look at another device, a Cloud PC, we can see the same kind of data.
One interesting thing I found while writing this blog post is that I compared my Surface Laptop Go 3 i5 with 16gb RAM with my 4vCPU/16GB Cloud PC. What I can see was that my Cloud PC scores higher. I would say that I use them in a similar way, the same amount of time. I do know that the Cloud PC has a little bit of a more powerfull CPU (being a cloud PC),
The Cloud PC scores 98 in resource performance.
While my Surface Laptop Go 3 scores 77.
So performance wise, Cloud PCs are doing a lot better. However, the Surface Laptop Go 3 is not a fair comparance being a more “low tier” PC. However, they are still both performing really good for what I use them for. So this is important to take into considerations when looking at the data.
Take away
Knowing how the performance of the devices in your environment chelan p you figure out when devices needs to be replaces or upgraded. As you already know, backing your decisions using data is key! Intune can provide you with a lot of data on your device without the need to buy a third party tool and deploying/maintaining a client on the device.
However, if we start looking at “real” DEX products, Intune Advanced Analytics does not provide the same level of data. You will also need to combine several parts of Intune to be able to perform e.g. remediations on the things you find. You still need to manually take actions or create remediation scripts on your findings.
But if you are just getting started and need “something”, this will provide you with a great overview of your environment! This will help you make better decisions and help your end-users even better!
I hope you liked this post and that it gave you some insights to what you can do with Intune Advanced Analytics!
We use cookies on our website to give you the most relevant experience by remembering your preferences and repeat visits. By clicking “Accept”, you consent to the use of ALL the cookies.
This website uses cookies to improve your experience while you navigate through the website. Out of these, the cookies that are categorized as necessary are stored on your browser as they are essential for the working of basic functionalities of the website. We also use third-party cookies that help us analyze and understand how you use this website. These cookies will be stored in your browser only with your consent. You also have the option to opt-out of these cookies. But opting out of some of these cookies may affect your browsing experience.
Necessary cookies are absolutely essential for the website to function properly. These cookies ensure basic functionalities and security features of the website, anonymously.
Cookie
Duration
Description
cookielawinfo-checkbox-analytics
11 months
This cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Analytics".
cookielawinfo-checkbox-functional
11 months
The cookie is set by GDPR cookie consent to record the user consent for the cookies in the category "Functional".
cookielawinfo-checkbox-necessary
11 months
This cookie is set by GDPR Cookie Consent plugin. The cookies is used to store the user consent for the cookies in the category "Necessary".
cookielawinfo-checkbox-others
11 months
This cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Other.
cookielawinfo-checkbox-performance
11 months
This cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Performance".
viewed_cookie_policy
11 months
The cookie is set by the GDPR Cookie Consent plugin and is used to store whether or not user has consented to the use of cookies. It does not store any personal data.
Functional cookies help to perform certain functionalities like sharing the content of the website on social media platforms, collect feedbacks, and other third-party features.
Performance cookies are used to understand and analyze the key performance indexes of the website which helps in delivering a better user experience for the visitors.
Analytical cookies are used to understand how visitors interact with the website. These cookies help provide information on metrics the number of visitors, bounce rate, traffic source, etc.
Advertisement cookies are used to provide visitors with relevant ads and marketing campaigns. These cookies track visitors across websites and collect information to provide customized ads.
