Intune Deployments roll Windows apps and policies out in rings, but pause and cancel only stop progression. What that means for rollback, payload edits and approvals.
Modern Endpoint · Security Insights Conditional Access Authentication Strengths: What the Policy Accepts and Where the Guarantees End MSMenahem SuissaMicrosoft MVP · AI Workforce & Security Tech Lead 16 min read ArticleModernEndpoint Contents 10 sections · 16 min read 🎯 The Design Question Conditional Access Authentication Strengths Actually Answer 🏗️ Where Authentication Strengths Fit in
Modern Endpoint · Security Insights Windows LAPS on Entra-Joined Devices: The Join State, Recovery, and Permission Dependencies That Define the Design MSMenahem SuissaMicrosoft MVP · AI Workforce & Security Tech Lead Consider an organization that has fully migrated its endpoint fleet to Entra-joined Windows 11 devices, enabled Windows LAPS through
Field Incident Analysis The Conditional Access Exclusion That Did Not Exist Fixing Microsoft Edge MAM sign-in when a "Block All Resources" policy intercepts Microsoft Edge Auth before app protection can be evaluated. 10 min read Microsoft Entra IDConditional AccessMicrosoft Intune Contents 16 sections · 10 min read Executive
Modern Endpoint Governance Series Manage Samsung Galaxy Firmware Versions to Improve Security and Compliance using… Most enterprise Intune deployments treat Samsung Galaxy firmware the same way they treat Windows cumulative updates — push a policy, wait for compliance, move on. That assumption breaks in production. Samsung firmware updates include bootloader changes,
Governance Four Microsoft End-of-Support Dates Converge This October Most IT teams track end-of-support dates one product at a time. This October, four converge at once — and at least one of them is easy to miss because it doesn't look like an end-of-support
Modern Endpoint · Security Insights Enable Enterprise Application Management EAM Auto-Updates in Intune to Keep Apps… Imagine this: you're sitting in the office of a Fortune 500 company. The IT team is grappling with constant application updates that drain resources and cause operational drift. Unmanaged updates lead to
Modern Endpoint · Security Insights Operational Security Controls I've been called into more than a few organizations where Microsoft Defender is proudly enabled but nearly abandoned in practice. It's there, casting a comforting glow of potential security — a potential often unfulfilled. Someone, somewhere, set it up; perhaps
```html Modern Endpoint Governance Series Microsoft Defender for Endpoint on Windows 11 Is GA. That's Not the Interesting Part. The real story is not another security feature becoming available. The real story is how fast security platforms are changing — and how many organizations still treat governance as something
Microsoft Purview · DLP + DSPM + AI Data Security · Interactive Workshop Data Security Governance Builder An interactive planning document for enterprise data security: DSPM, DLP, Endpoint DLP, Sensitivity Labels, Insider Risk, External Sharing and Copilot readiness — including a live builder that generates recommendations, risk score, policy names, rollout plan and executive summary.
ME Modern Endpoint Modern Security. Modern Management. June 2026 — Update Review What's New in Microsoft Intune 2025–2026 From Ignite 2025 through June 2026 — AI Agents, default Hotpatch, Linux SSO, Android XR, macOS Platform SSO, Security Baseline 25H2, and dozens of improvements that will transform your daily operations.
Effective July 1, 2026 What is coming to Microsoft 365 E5? Microsoft is adding major security and endpoint-management capabilities to Microsoft 365 E5, including Security Copilot access and advanced Intune Suite capabilities, alongside a pricing update. 🤖 Security Copilot 💻 Intune Suite 🔑 Cloud PKI 💰 $57 → $60 Microsoft 365 E5 JULY 2026
Secure Boot · Certificate Lifecycle · Intune Governance Secure Boot Certificates 2026: A Lifecycle Governance Problem The 2026 Secure Boot certificate rollover is not only a Windows Update task. In enterprise environments, it is a lifecycle governance event that crosses firmware, Windows servicing, Intune reporting, inactive device management, compliance policy, and operational
AVD
Azure Virtual Desktop · Identity · Session Risk Token Lifecycle Risk in Azure Virtual Desktop Why AVD security is not only about host hardening, Conditional Access, and session isolation — but also about understanding what happens to identity tokens during long-running sessions, reconnects, profile reuse, and multi-session operations. Modern Endpoint Governance
Entra ID
Security Governance Defender Onboarding Governance Why enabling Microsoft Defender is not the same as controlling it 8–10 min read One of the biggest gaps I still see in customer environments is the way Microsoft Defender is approached operationally. In many organizations, Defender onboarding is treated as a deployment task
Entra ID
Microsoft Entra · Device Identity Hybrid Join Lifecycle Model Hybrid join is not a destination — it is a lifecycle stage. Understanding each phase, from provisioning to retirement, is what separates a stable identity posture from an environment full of stale objects, broken trust, and unresolved dependencies. For many organizations, Microsoft Entra
Entra ID
Identity & Privileged Access When Identity Becomes the Perimeter: Why Token Theft, Dormant Accounts, and Privileged Access Are the Real Risk Attackers no longer need to break in the traditional way. A valid token, a forgotten account, or a single privileged session is often all it takes — and the real
Home / Intune Object Drift Modern Endpoint Architecture Intune Object Drift is a lifecycle architecture problem. The silent lifecycle problem behind stale devices, broken enrollment, and Azure Virtual Desktop operational noise. By Menahem Suissa Modern Endpoint Architect Published 2026 Object Drift Signal MapLive model Duplicate identitiesMultiple objects representing one endpoint lifecycle
featured
Most Entra ID environments don't fail because of misconfiguration.
AVD
Home / Insights / AVD Architecture Field Architecture · AVD vs RDS What changed when I stopped managing servers — and started designing platforms. A field-based reflection on Remote Desktop Services, Azure Virtual Desktop, Intune, licensing, operations, and the architectural shift from keeping systems alive to designing better user experiences. By Menahem Suissa
App Attach
AVD Architecture · Identity Lifecycle · Governance Why Most Azure Virtual Desktop Environments Accumulate Silent Technical Debt Azure Virtual Desktop environments are designed for elasticity and scale. Session hosts are deployed, scaled, patched, and eventually decommissioned. But most organizations do not properly decommission AVD session hosts — and that creates silent operational, financial,
App Attach
Azure Virtual Desktop · Application Layer · Architecture MSIX App Attach in Azure Virtual Desktop: From Feature to Architecture Your organization implemented MSIX App Attach. The packages mount correctly. Users get their applications. Then production starts behaving differently — storage latency spikes, apps disappear for a subset of users, and no obvious error
App Attach
Microsoft Endpoint · Azure Virtual Desktop · MSIX App Attach Why MSIX App Attach Is a Practical Requirement for Azure Virtual Desktop Lessons learned from real-world AVD environments: why MSIX App Attach moved from “interesting feature” to a natural part of stable, scalable, and secure Azure Virtual Desktop architecture. AVD Operations
AVD
A production failure analysis of WindowsAppRuntime 1.4 in AVD multi-session environments.
Use these quick controls to improve readability while browsing Modern Endpoint.