Sascha Stumpler 💻

Sascha Stumpler 💻

@sastu-insights.com

IT Professional working with #Intune #CM #ConfigMgr #M365 #Windows #OSD #PowerShell #Azure #EPM #LeastPrivilege #EPM

207 followers235 following1.3K posts

Sascha Stumpler 💻
@sastu-insights.com
dlvr.itIntel vPro Fleet Services Part 1: Onboarding the Tenant and Connecting Entra IDThere is a good chance your fleet already has Intel vPro. Enterprise customers have been buying vPro hardware for well over a decade, mostly because it is the default SKU in business laptop lines, and in most of those fleets it has never been switched on. Intel Active Management Technology (AMT), the out-of-band management part of vPro, sits in the firmware of every one of those devices: remote power control, KVM even when Windows does not boot, remote reboot into a recovery image. All of it already paid for, almost none of it used.
Sascha Stumpler 💻
@sastu-insights.com
dlvr.itIntel vPro Fleet Services Part 1: Onboarding the Tenant and Connecting Entra IDThere is a good chance your fleet already has Intel vPro. Enterprise customers have been buying vPro hardware for well over a decade, mostly because it is the default SKU in business laptop lines, and in most of those fleets it has never been switched on. Intel Active Management Technology (AMT), the out-of-band management part of vPro, sits in the firmware of every one of those devices: remote power control, KVM even when Windows does not boot, remote reboot into a recovery image. All of it already paid for, almost none of it used.
Sascha Stumpler 💻
@sastu-insights.com
dlvr.itHow Windows Autopatch Tattooed My Edge SettingsWith Edge 154.0.4258.37, address bar search stopped working on devices that had the DefaultSearchProvider* settings deployed: type a search, press Enter, nothing happens. Florian Salzmann covered the cause and fix in Google Search Broken in Edge 154.0.4258.37 - Fix & Cause: Edge now validates OpenSearch URL templates more strictly and rejects trimmed-down Google search URLs. Besides fixing the URL template, I wanted to test moving from the DefaultSearchProvider* settings to the ManagedSearchEngines policy as a workaround. Remove the old settings, add the new one, done. In one tenant, that is exactly what happened. In the other, the old values never left the device, even though no assigned policy controlled them anymore.
Sascha Stumpler 💻
@sastu-insights.com
dlvr.itHow Windows Autopatch Tattooed My Edge SettingsWith Edge 154.0.4258.37, address bar search stopped working on devices that had the DefaultSearchProvider* settings deployed: type a search, press Enter, nothing happens. Florian Salzmann covered the cause and fix in Google Search Broken in Edge 154.0.4258.37 - Fix & Cause: Edge now validates OpenSearch URL templates more strictly and rejects trimmed-down Google search URLs. Besides fixing the URL template, I wanted to test moving from the DefaultSearchProvider* settings to the ManagedSearchEngines policy as a workaround. Remove the old settings, add the new one, done. In one tenant, that is exactly what happened. In the other, the old values never left the device, even though no assigned policy controlled them anymore.
Sascha Stumpler 💻
@sastu-insights.com
dlvr.itMicrosoft Removes memberOf for Dynamic Groups - Now What?Microsoft published MC1448379: the memberOf rule operator in Microsoft Entra ID is being retired on November 3, 2026. If you’ve used memberOf to build dynamic groups whose membership depends on nested group membership - user.memberOf -any (group.objectId -eq '...') - those rules stop being evaluated once the deadline hits. Membership freezes at its last known state instead of erroring out, which is the annoying part: nothing breaks loudly, access and licensing just quietly go stale.
Sascha Stumpler 💻
@sastu-insights.com
dlvr.itMicrosoft Removes memberOf for Dynamic Groups - Now What?Microsoft published MC1448379: the memberOf rule operator in Microsoft Entra ID is being retired on November 3, 2026. If you’ve used memberOf to build dynamic groups whose membership depends on nested group membership - user.memberOf -any (group.objectId -eq '...') - those rules stop being evaluated once the deadline hits. Membership freezes at its last known state instead of erroring out, which is the annoying part: nothing breaks loudly, access and licensing just quietly go stale.
Sascha Stumpler 💻
@sastu-insights.com
dlvr.itAuto-Accepting the “Continue to sign in” SSO Prompt with IntuneIf you manage Windows devices in the European Economic Area, you have met this dialog: a user signs in, opens Word, and Windows asks whether it may share the signed-in work account with Microsoft apps - “Continue to sign in”. Microsoft added the prompt to comply with the Digital Markets Act, and on paper it gives users control over their credentials. In a managed environment it mostly gives them a new way to break single sign-on.
Sascha Stumpler 💻
@sastu-insights.com
dlvr.itAutomatically Migrate Apple Enrollment Profiles as Enrollment PolicyAfter I wrote about migrating Apple ADE enrollment profiles to the new enrollment policies, someone asked me on LinkedIn whether the recreation step could be scripted. The article covers that part manually: open the wizard, tick through every Setup Assistant screen, one profile at a time. That’s fine for a single token with two or three profiles. It stops being fine once you’re doing it across several enrollment program tokens with iOS and macOS profiles on each.
Sascha Stumpler 💻
@sastu-insights.com
dlvr.itAuto-Accepting the “Continue to sign in” SSO Prompt with IntuneIf you manage Windows devices in the European Economic Area, you have met this dialog: a user signs in, opens Word, and Windows asks whether it may share the signed-in work account with Microsoft apps - “Continue to sign in”. Microsoft added the prompt to comply with the Digital Markets Act, and on paper it gives users control over their credentials. In a managed environment it mostly gives them a new way to break single sign-on.
Sascha Stumpler 💻
@sastu-insights.com
dlvr.itAutomatically Migrate Apple Enrollment Profiles as Enrollment PolicyAfter I wrote about migrating Apple ADE enrollment profiles to the new enrollment policies, someone asked me on LinkedIn whether the recreation step could be scripted. The article covers that part manually: open the wizard, tick through every Setup Assistant screen, one profile at a time. That’s fine for a single token with two or three profiles. It stops being fine once you’re doing it across several enrollment program tokens with iOS and macOS profiles on each.