Intune Archives

Winsage

July 20, 2026

Enable BitLocker on Windows 11: 11 Steps, 45 Min [2026]

A stolen laptop can lead to a significant data breach, particularly when taken from public places. Windows 11 has introduced BitLocker, a full-disk encryption feature that became mandatory for Australian businesses in 2026. The Office of the Australian Information Commissioner reported 766 notifiable data breaches in the latter half of 2024, with unauthorized access to devices being a major cause. Full-disk encryption is crucial for compliance with the Essential Eight framework, which mandates data protection on portable devices. BitLocker ensures that data on an encrypted drive becomes unreadable if the drive is removed and connected to another computer. It aligns with the Essential Eight framework, requiring evidence of encryption rather than just claims of protection. There are three types of encryption on Windows 11: Device Encryption, BitLocker Drive Encryption, and File-Level Encryption. BitLocker is available only on Windows 11 Pro and higher editions. To use BitLocker, certain prerequisites must be met, including having Windows 11 Pro or higher, a Trusted Platform Module (TPM) 2.0, UEFI firmware with Secure Boot enabled, and local administrator rights. The process to enable BitLocker involves confirming the edition, checking TPM status, enabling BitLocker through Windows Settings or PowerShell, and backing up the recovery key. Organizations can deploy BitLocker fleet-wide using Microsoft Intune, and additional security measures like TPM+PIN can be implemented for pre-boot authentication. Common pitfalls during BitLocker rollout include skipping recovery key backup and assuming that Home edition machines are covered. Troubleshooting common BitLocker issues involves identifying symptoms and applying appropriate fixes. Advanced tips for enhancing security include suspending BitLocker before maintenance and auditing compliance at the fleet level. BitLocker is integral to protecting data on portable devices, and compliance documentation is essential for proving that every device has an active recovery key.

Winsage

July 19, 2026

The 200GB catch hiding in Windows 11’s new recovery feature

Microsoft has introduced point-in-time restore for Windows 11 users, enhancing the traditional System Restore. This new recovery tool allows users to recover their PCs from software issues, problematic drivers, or faulty updates, even when Windows won’t boot. It uses the Volume Shadow Copy Service (VSS) to automatically generate restore points every 24 hours, which include both system and user files, unlike System Restore. Point-in-time restore manages storage by deleting restore points after 72 hours and integrates seamlessly into Windows Settings, being activated by default for volumes over 200GB. Users with smaller volumes must activate it manually. It also incorporates Reserved Storage to ensure restore points do not consume regular disk space. The feature is available on Windows 11 Home and Pro editions with the installation of the optional Preview Update KB5095093. Users can access point-in-time restore through Windows Settings under System > Recovery, and initiate recovery via the Windows Recovery Environment (Windows RE).

Winsage

July 18, 2026

Windows 11 Secure Boot certificates have expired, and Microsoft says what to do next

Microsoft held its OEM Secure Boot Office Hours event on July 15, where engineers collaborated with OEM representatives from companies like Acer, Asus, Cisco, Dell, and HP. IT administrators were able to ask live questions about the Secure Boot 2023 rollout. The discussion thread became a detailed technical record, especially following the expiration of the first certificates three weeks prior. Concerns raised by IT admins included BitLocker recovery loops, stuck confidence ratings, and unhelpful Intune error codes. Key facts include: - Devices offline for long periods will still receive the 2023 certificates upon reconnecting to Windows Update. - Devices with existing 2023 certificates in firmware will switch to the new boot manager after the latest Windows patches are installed. - A new script, Detect-SecureBootCertUpdateStatus.ps1, is available in Windows for checking certificate status. - BIOS updates may reset a device’s confidence rating to unrated, which is normal and does not indicate certificate failure. - Admins should edit the AvailableUpdates registry key, not the AvailableUpdatesPolicy, which is managed by Intune and Group Policy. - A licensing bug affecting AvailableUpdatesPolicy on devices upgraded from Pro to Enterprise was resolved by Microsoft in 2026. - BitLocker recovery is not typically linked to the certificate update process but may relate to firmware or PCR issues. - Dell and HP provided guidance on which BIOS versions include the 2023 certificates for their newer models. - Older HP EliteBook 840 G5 units require a manual update package for the new certificates. - Eligible devices can still receive the 2023 certificates in the future, and Surface devices released from 2024 onward come pre-equipped with them. - Microsoft confirmed that devices running 2011 certificates will not lose the ability to receive the 2023 chain. - The Microsoft Corporation KEK CA 2011 and Microsoft UEFI CA 2011 certificates have expired, with the Microsoft Windows Production PCA 2011 set to expire on October 19, 2026.

Winsage

July 17, 2026

Windows 11 Gets Policy to Automatically Grant SSO Permissions

Microsoft has introduced a new policy to simplify the Windows sign-in process for IT administrators by allowing automatic approval of Single Sign-On (SSO) permissions on eligible managed devices. This feature will be available with the July 2026 security update for Windows 11 versions 24H2 and 25H2. Users in the European Economic Area (EEA) have been facing prompts for consent due to regulatory changes, prompting Microsoft to streamline access for managed devices. IT administrators can use a specific registry setting (HKLMSOFTWAREPoliciesMicrosoftWindowsAAD, Value: AutoAcceptSsoPermission (DWORD) = 1) to automatically grant SSO permissions. This feature is designed for managed enterprise devices linked to Microsoft Entra ID and does not affect personal accounts or unmanaged devices. Organizations must ensure their devices are updated and can enable the feature through various enterprise management tools.

Winsage

July 16, 2026

Microsoft makes Windows SSO prompts easier to manage

Microsoft is introducing a registry-based policy to improve the management of Single Sign-On (SSO) permissions for devices running Windows 11 versions 24H2 and 25H2, specifically for those managed through Microsoft Entra ID. This policy allows IT administrators to automatically accept SSO permissions, enhancing the user experience in corporate environments. Users with personal Microsoft accounts or unmanaged devices will still receive prompts for SSO permissions. The change aims to provide users, particularly in the European Economic Area (EEA), with more control over their account usage across Microsoft applications. Deployment options for IT administrators include Group Policy, Microsoft Intune, other mobile device management solutions, Microsoft Configuration Manager, and any management tool that supports registry policy deployment. Administrators are advised to validate SSO behavior after deployment.

Winsage

July 16, 2026

Windows 11 gets new registry policy to give IT admins more control

Microsoft will introduce a new registry policy in Windows 11 in July 2026 that allows IT administrators to enable automatic acceptance of single sign-on (SSO) prompts on managed devices. This policy will streamline user authentication by using Windows sign-in credentials automatically for Microsoft apps or services, reducing the need for manual authentication. The registry path for this policy is HKLMSOFTWAREPoliciesMicrosoftWindowsAAD, with the value AutoAcceptSsoPermission (DWORD) set to 1. It can be deployed using Group Policy Objects (GPO), Intune, Microsoft Configuration Manager, or mobile device management (MDM) tools. This setting is applicable only to Windows 11 versions 25H2 and 24H2 that have received the July 2026 Patch Tuesday updates (KB5101650 and KB5094126) and is designed for managed devices using Entra ID accounts, not personal Microsoft accounts or unmanaged devices.

Winsage

July 13, 2026

Microsoft demystifies how Windows updates work

Microsoft has released a guide on the Windows servicing model, detailing monthly security updates, optional preview releases, hotpatch updates, and feature rollout mechanisms. Patch Tuesday occurs every second Tuesday of the month, delivering cumulative security updates to supported Windows versions. For consumers and small businesses, updates are managed through Windows Update, while enterprises can use various tools like Windows Autopatch and WSUS. Hotpatch updates, which focus on security fixes, can be installed without a restart, unlike quarterly baseline updates that require one. Optional non-security preview updates are released in the fourth week of each month for testing upcoming fixes and new features, available only for the latest supported Windows versions. Unmanaged devices can access these updates through Windows Update settings, while IT-managed devices depend on organizational policies. Microsoft also issues out-of-band updates to address urgent issues, which can be deployed through enterprise management tools. New features for Windows 11 are rolled out throughout the year via various channels, with a gradual rollout strategy to monitor quality and compatibility, using the Controlled Feature Rollout approach.

Winsage

July 12, 2026

We explain why Cloud Rebuild is one of Windows 11’s most important new features, and how it lets you recover your PC without a USB drive or complicated steps

Microsoft has introduced a new recovery feature for Windows 11 called Cloud rebuild, currently in preview mode. This feature allows users to restore their systems by downloading the Windows 11 image and necessary device drivers directly from Windows Update, eliminating the need for USB installation media or custom recovery images. OneDrive remains unaffected during the recovery process, enabling users to restore their files after signing back in. For organizations, devices managed via Windows Autopilot and Microsoft Intune can automatically re-enroll and restore settings post-rebuild. However, Cloud rebuild requires compatible hardware, a healthy Windows Recovery Environment, and internet connectivity. Currently, it can only be initiated from the Windows Recovery Environment or an elevated Command Prompt, with remote deployment not yet supported. The feature aims to simplify recovery processes and reduce reliance on USB drives, although it is not intended to replace existing recovery tools.

Winsage

July 11, 2026

AI Threat Forces Microsoft To Update Windows Patch Guidance

Microsoft is advocating for a reevaluation of Windows patch management practices due to the rapid evolution of artificial intelligence (AI) impacting cybersecurity. The company emphasizes that traditional timelines for patch deployment, typically spanning several weeks after the monthly Patch Tuesday, are inadequate against modern cyber threats. Microsoft recommends organizations shorten deployment windows to under three days for quality updates, with immediate installation deadlines and minimal user grace periods. To support these changes, Microsoft is enhancing Windows Autopatch with a new reporting dashboard for patch compliance and security insights. The company is promoting cloud-managed deployment through Microsoft Intune and Windows Autopatch while continuing to support legacy tools. Additionally, Microsoft is introducing Windows Hotpatch technology, allowing security updates to be installed without immediate reboots, and advocating for the use of identity-based access controls to isolate unpatched devices. The guidance reflects a shift from scheduled patching to continuous risk management, encouraging organizations to prioritize high-risk assets and automate update deployments. Microsoft is also investing in AI-assisted vulnerability discovery and automated code analysis to improve defensive capabilities. The overarching message is that enterprises must adapt their update strategies to address the accelerated pace of AI-driven exploitation.

Winsage

July 10, 2026

Microsoft is rewriting Windows patch guidance because of AI

Microsoft advises organizations to expedite their Windows update deployment timelines due to advancements in artificial intelligence that allow cyber attackers to quickly exploit vulnerabilities after security updates are released. Jeremy Chapman, Director of Microsoft 365, warns that delaying critical quality updates with security fixes increases the risk of exploitation. Microsoft recommends a quality update deferral period of fewer than three days, update deadlines of zero or one day, and a grace period of no more than two days. The Windows Autopatch report within Microsoft Intune helps identify unpatched devices, allowing administrators to adjust update deferral policies. Organizations can configure update delivery settings through policy controls in Windows Autopatch and Microsoft Intune, as well as other management tools like Microsoft Configuration Manager and Windows Server Update Services. Microsoft also promotes the use of Hotpatch for quicker installation of security updates without rebooting and encourages Conditional Access policies to restrict access to corporate resources for devices that lack required updates.