Microsoft Intune on justinverstijnen.nl

10 scripts for Ubuntu MDM with Microsoft Intune

Thu, 18 Jun 2026 00:00:00 +0000

Last week I described how to add Ubuntu endpoints to Microsoft Intune and improve their manageability. This guide can be found here: https://justinverstijnen.nl/adding-ubuntu-endpoints-to-intune

This guide is a sort of “Part 2” and covers additional customization options for Ubuntu endpoints enrolled in Microsoft Intune, building on the configuration described in the first guide.

The scripts

You can find the scripts I used in this guide here on GitHub:

View on my GitHub page

Important action: Configure additional authentication for Bitlocker leaks

Fri, 12 Jun 2026 00:00:00 +0000

When Bitlocker is configured to only unlock with the TPM, we create an attack path which allows access to the unencrypted data. This is because you only need the disk and the TPM module to unlock by default.

In the Bitlocker settings, there is an option “Require startup PIN with TPM”. This will show an extra PIN code window to the end user at startup, and then Bitlocker can only be unlocked after the PIN and then with the TPM module, instead of only the TPM module. It also makes you a lot less vulnerable to Bitlocker leaks and directly exposing your cimportant personal and company data in any case your device is stolen.

Adding Ubuntu endpoints to Microsoft Intune

Thu, 11 Jun 2026 00:00:00 +0000

Why add your Ubuntu endpoints to Microsoft Intune?

This question has a very simple answer: compliance, management, and security.

As IT professionals, we want to manage every endpoint from a single pane of glass while keeping compliance and security at a consistently high level. Linux endpoints are often overlooked in IT departments, especially compared to Windows and macOS devices. This makes them an interesting attack vector, because they are not always properly managed, monitored, or secured.

Automatically start Windows App at startup

Thu, 25 Dec 2025 00:00:00 +0000

Creating the Intune script

We can achieve this with Intune using a PowerShell script. As Intune doesn’t support login/startup scripts, we have to create a Platform script that creates a Scheduled Task in Windows for us. This is a great way, as this is visible at the client side and can be disabled pretty easily.

To create this task/script, go to the Intune Admin center: https://intune.microsoft.com

Go to Devices -> Windows -> Scripts and remediations, then open the tab “Platform scripts”.

Deploy Google Chrome Single Sign On with Intune

Thu, 11 Dec 2025 00:00:00 +0000

How the extension works

The Microsoft SSO extension for Google Chrome uses the same token/session you already have when you have your device Entra ID joined. It will send that to every Microsoft Online webpage to show you are already authenticated and have a valid token. This makes the user experience a lot better as they don’t have to authenticate first before starting to use the web applications.

Disable Windows Taskbar Widgets through Intune

Thu, 06 Nov 2025 00:00:00 +0000

Method 1: Settings Catalog

The easiest way to disable these widgets is through a Settings Catalog policy. Open up Microsoft Intune admin center and create a new policy through the Settings Catalog.

Search for “widget” and these options are available:

News and Interests: Disable Widgets on Lockscreen
News and Interests: Disable Widgets Board
Widgets: Allow Widgets

In my case, I have set all three options to disabled/Not allowed.

Using and configuring Windows Backup for Organizations in Intune

Sat, 01 Nov 2025 00:00:00 +0000

Requirements

Windows 11 with the latest feature updates installed for both creating and restoring backups
Entra ID joined or Entra Hybrid joined device
Microsoft Intune-capable license
Around 15 minutes of your time

What is Windows Backup for Organizations?

Windows Backup for Organizations is a feature where Windows creates a backup of your Windows settings and Windows Store applications every 8 days. This will be saved to your Microsoft business account. If ever having to re-install your device or to use a new device, you can easily restore your old configuration. This is a revolution on top of the older Enterprise State Roaming feature, who did around 20% of this.

Remove Pre-installed Windows Store Apps with Intune

Tue, 21 Oct 2025 00:00:00 +0000

This new feature described

In Intune we can now select which default shipped apps must be removed from Windows clients. Before, this was a complete package we had to use or remove with custom scripts, but now we can select the apps to remove (and deselect to keep).

Keep in mind, we have the following requirements for this new feature:

Windows 11 25H2
Education or Enterprise version

Also worth mentioning, removing an application needs a manual reinstall, which is easy to do.