General Archives - MDM Tech Space

Intune’s New Device View: Less Clicking, More Context (Finally)

May 22, 2026 Joymalya Basu Roy 0

Microsoft’s new Intune Device View isn’t about new features—it’s about better context. By consolidating device data, actions, compliance, and reporting into a single experience, it reduces admin friction and improves audit visibility. Here’s what changed, why it matters, and how it aligns with real-world endpoint operations. [Read More]

Secure Boot Certificate Update Rollout: Series Wrap‑Up

Secure Boot Certificate Update Rollout at 50,000 Feet (and Devices): Series Wrap‑Up

March 31, 2026 Joymalya Basu Roy Comments Off

The Secure Boot 2023 CA transition was never just a certificate update. This epilogue looks back at what actually changed at enterprise scale—broken assumptions, firmware realities, and why proof matters more than deployment success. [Read More]

Microsoft Intune: Secure Boot 2023 CA Certificate Update Rollout - Part 4 || Cover Picture

Secure Boot Certificate Update Rollout at 50,000 Feet (and Devices): A Field Guide for the Sleep‑Deprived IT Admin – Part 4

March 30, 2026 Joymalya Basu Roy 1

Secure Boot certificate updates won’t flip Secure Boot ON for you. This post shows how to safely enable Secure Boot at scale using Intune orchestration + PowerShell execution, with BitLocker readiness gates, and OEM-supported tooling for Lenovo and Dell. [Read More]

WinCsFlags.exe for Secure Boot 2023 CA Certificate Updates: What It Really Does and the OS → Firmware Flow.

WinCsFlags.exe and Secure Boot 2023 CA Updates – A Bridge Between Part 2 & Part 3

March 27, 2026 Joymalya Basu Roy 1

WinCsFlags.exe doesn’t write Secure Boot certificates into firmware — it sets intent.
This deep‑dive explains how WinCS works behind the scenes, how the Secure Boot 2023 CA update actually flows from Windows to UEFI firmware, why two reboots are expected, and how to validate success using UEFICA2023Status. A practical, engine‑room explanation bridging Part 2 (0x5944) and Part 3 (validation) of the Secure Boot series—without vibes, myths, or guesswork. [Read More]

Microsoft Intune: Secure Boot 2023 CA Certificate Update Rollout - Part 3

Secure Boot Certificate Update Rollout at 50,000 Feet (and Devices): A Field Guide for the Sleep‑Deprived IT Admin – Part 3

March 24, 2026 Joymalya Basu Roy 2

Deploying the Secure Boot 2023 certificate update is the easy part. Proving it actually worked is where things get uncomfortable. In Part 3, the spotlight shifts from execution to evidence—where dashboards stop being trusted, reboots start to matter, and firmware finally gets a vote. This is the phase where Windows claims success, devices boot happily, and yet half your fleet may still be clinging to the 2011 trust chain like it’s a security blanket. Validation is where assumptions die, receipts are demanded, and “updated” stops being a feeling and starts being something you can prove. [Read More]

Why Agentic AI Needs Guardrails: A Zero Trust Take on Microsoft Agent 365

March 16, 2026 Joymalya Basu Roy Comments Off

The Claude / Terraform incident wasn’t AI going rogue—it was automation executing perfectly without governance. This post breaks down why agentic AI is a Zero Trust problem, not an intelligence one, and how Microsoft Agent 365 signals a shift toward scoped, observable, and approval‑gated agents designed to limit blast radius before damage happens. [Read More]

Intune Multi-Admin Approval: The Security Feature You’ll Wish You Enabled Before Someone Presses “Wipe All”

Intune Multi-Admin Approval: The Security Feature You Wish You’d Enabled Before Someone Pressed “Wipe All”!

March 13, 2026 Joymalya Basu Roy Comments Off

There are some security lessons that arrive as a whitepaper, and then there are the ones that arrive like a brick through the server room window. This post explores why Intune Multi-Admin Approval is no longer just a nice governance feature, but a critical security control for preventing destructive remote actions like wipe, retire, and delete from being abused at scale. [Read More]

Secure Boot 2023 CA Certificate Update Rollout - Part 2

Secure Boot Certificate Update Rollout at 50,000 Feet (and Devices): A Field Guide for the Sleep‑Deprived IT Admin – Part 2

March 11, 2026 Joymalya Basu Roy 10

Part 2 of the Secure Boot 2023 CA Update series dives into the actual rollout: how Windows applies the new KEK/DB certificates, why automatic updates aren’t guaranteed, and how Intune admins can safely trigger and manage the update workflow using registry‑based signals and proactive remediations. [Read More]

Secure Boot 2023 Certificate Update Rollout

Secure Boot Certificate Update Rollout at 50,000 Feet (and Devices): A Field Guide for the Sleep‑Deprived IT Admin – Part 1

March 9, 2026 Joymalya Basu Roy 11

Before you roll out the Secure Boot 2023 certificates, map your fleet. This guide shows how to inventory posture with Intune—reports, proactive remediations, JSON outputs, and OEM gotchas. [Read More]

Modern Windows Provisioning - Autopilot Internals - Part 2

Modern Windows Provisioning Internals – Part 2

March 3, 2026 Joymalya Basu Roy Comments Off

Behind the first OOBE screen, Windows launches a dense chain of provisioning tasks that never surface in the UI. As soon as the device comes online, CloudExperienceHost and the provisioning engine begin executing ZDP update checks, initializing and validating the TPM (EK, SRK, AIK), and activating hardware attestation. In parallel, Autopilot performs token‑based device discovery, retrieves its deployment profile, and drives the consumer‑vs‑enterprise pivot that determines the rest of setup. This part of the series breaks down those hidden flows — the CEH pipelines, TPM trust establishment, Autopilot token exchanges, and the orchestration logic that shapes modern Windows provisioning. [Read More]