Dumitru Razvan

Into Azure, Intune, Exchange & other related Server, or Cloud technologies. My mission is to help you achieve the needed configuration or learn something new.

Intune

Prepare for the expiration of the Secure Boot certificates on Windows - using Intune

Introduction A huge attack vector in today's world is to load malware even before booting your PC / Windows OS on your device, commonly known as a RootKit or a boot-level malware. To combat this, Secure Boot (a feature of UEFI) was invented, so that by using certificates and

How to create a Transport Rule in Exchange Online

Introduction In your M365 tenant you might need to configure a special behavior for your mail flow, or stamp certain email properties on some emails, or define a rule for specific cases (ie. emails from John). This is where an admin, or consultant, or a specialist with skills around Microsoft

Members only

Get rid of App & Browser Control Warning in Defender using Intune

Introduction If you enabled recently Defender, depending on the settings you are pushing, you might get the following warning: App & Browser Control The setting to block potentially unwanted apps is turned off. Your device may be vulnerable. You can solve this using Intune for all your users. Configuration Head

onedrive

Configure One Drive to Backup Automatically important folders via Intune

Introduction If you are getting the following error / warning in Windows Defender Virus & threat protection "Set up OneDrive for file recovery options in case of a ransomware attack." and you want to solve it via Intune for all users: Then you need to setup OneDrive to auto

Intune

Deploy M365 Apps (Office Suite) for Windows 10/11 with Intune

Introduction One of the first deployments you'll likely make, together with Company Portal, which was covered in the last blog post, are the M365 Apps, or otherwise known as the Office Suite (Word, Excel, Outlook, PowerPoint etc.). Configuration In order to achieve this, you'll have to

hybrid

Hybrid join will break☠️at the end of May 2025

Introduction Yes, you've read the title right. Microsoft has anounced that by the end of MAY 2025, they will be radically changing the way devices are hybrid joined. Thus, with the existing Intune connector no new enrollments will be possible after MAY 2025. Overview You can find the

Deploy Company Portal on all company Windows devices with Microsoft Intune

Introduction One of the first things you should do once you sort out device onboarding/enrollment to Intune, would be to centrally manage and deploy Company Portal. The Key Benefits of Company Portal: * If you are not familiar with this app, it's like an internal "corporate store&

Members only

How to onboard Intune enrolled Windows devices to Defender 🛡️

SUBSCRIBE NOW TO ACCESS THE DOWNLOAD ↓

Microsoft Intune Device Cleanup Rules

Introduction In large organizations stale devices can become a security threat because enrolled devices can still have access to company ressources, and can be easily misplaced. Our reccomendation is to set an automatic task to purge them after a certain period of time. Configuration Luckily enough, Intune offers a built-in

How to test Conditional Access policies? -> "What If" 🤔tool

Introduction In a previous post we have explored how to create a Conditional Access Policy and have set it to Report Only, so we can observe its potential effects before turning it on. Naturally, we would then use 2 tools provided by Microsoft to assess the impact. One of the

Stop and find out: Why you need Conditional Access Policies

Introduction Conditional Access Policies in Azure are typically one of the first layers of security that a tenant will have as they control who signs in, from where, to what, using what IP/Location etc. Defining a good set of CAs can set you way ahead in securing your O365

Keep Google Chrome Auto-Updating with Intune

Introduction In the previous post we saw how to deploy Chrome via Intune. Now, what happens is that generally you are pushing a certain app version, and some users might never use it (say they have a preference for Mozilla Firefox or Edge). If they never start/use these apps,

How to deploy Google Chrome on Windows Devices via Intune

Introduction In your organization, you might need at some point to centrally deploy apps, if your devices are enrolled in Intune. You may package and deploy a multitude of apps from browsers ; archive/zip managers ; business applications ; media players ; even scripts or drivers. In today's example, we are

Cancel and remove the calendar events for a mailbox in Exchange Online

Introduction There might come a time when you need to cancel or remove the meetings and events from a mailbox. Maybe the user left the organization (and the mailbox is still around), or maybe someone has an unplanned leave of absence and you need to clean up the meetings they&

Restore Deleted Mailbox in O365/M365/EXO

Introduction In the event one of your users has been completely removed from Azure AD/Entra ID (including has been removed from the Entra Deleted Users/recycle bin), you are basically in the worst scenario possible, as a restore of the old account (and relationships in Teams, Exchange, One Drive,

m365

Windows 10/11 Sandbox

Introduction Considering the threats we are facing today, this feature can come in very handy when you need to test some attachments/files. It's basically a VM you can use on your laptop/desktop PC for all sorts of purposes. Configuration Windows Sandbox is the perfect environment to

Intune

Block users from logging in on Windows devices (via Intune)

Introduction In the effort of terminating individual users you may be required to block them from being able to access their Windows devices (logging in). This may be to prevent them from exfiltrating data (downloading stuff, copying work over on USB sticks etc.), or to limit their capability of doing

Manage BitLocker encryption from Intune

Introduction Hello again, and welcome back! We are going to discuss today about a topic that involves security of data at rest. We already know that data in M365 is encrypted, all of the communication channels are encrypted well via SSL or HTTPS, but what about our physical devices? What

How to upgrade all Intune managed devices to Win 11?

Introduction We spoke last time about controlling Windows Updates via Update Rings, you can check that article here - https://www.cloudpersistence.com/can-you-control-windows-updates-with-microsoft-intune-yes-to-a-degree/ This time we are going to discuss Feature Updates which can be found in the same place in Intune: You can use these Feature updates to

Assign Full Access Permissions in Bulk to a list of mailboxes

Introduction You might be handed a task one day to give access to some people to be able to manage the Calendars of all your room mailboxes, or a subset of them from a specific building. It could be that your board wants all time access to know who booked

Archiving in Exchange Online

Introduction First and foremost I would like to make a clear distinction between Archiving and Retention. They are not the same thing. The terms might be used one instead of another here and there, but they define 2 distinct things. In simple terms, I would define archiving as the move

How to enable auto-forwarding in Exchange

Introduction Recently I had the need to enable auto-forwarding for one user account and I figured it would be a perfect subject for another post. It is very important to gain control over forwarding, as this can be the most dangerous method in data exfiltration. Users can easily configure auto-forwarding

Top 6 things to consider when configuring Windows Updates in Intune

Introduction With Intune you have the option to control most parts of Windows Updates for Win10/11 devices. It's very useful to gain control over the behavior of Windows Updates. Options The Winodws Updates in Intune have the following sections: * Windows Update Rings * Feature Updates * Quality Updates * Driver

You need to secure your Windows devices with Microsoft Intune? Here's how

Introduction As the title reads, you might have a request to secure your Windows Devices and you have those devices enrolled in Intune (Endpoint Manager). Well, then you have a very low hanging fruit option, and it's called Security Baseline for Windows. Security Baseline is a group of

SPF

Secure your newly bought email domain (SPF, DKIM, DMARC)

Record Name Type Pointer Data TTL SPF TXT @ v=spf1 include:spf.protection.outlook.com include:service.domain.name -all 3600 Record Name Type Pointer Data TTL DKIM1 CNAME selector1._domainkey selector1-dom-ain._domainkey.domain.onmicrosoft.com 3600 DKIM2 CNAME selector2._domainkey selector2-dom-ain._domainkey.domain.onmicrosoft.com 3600