Microsoft Intune from Zero: the complete series

Ten chapters that go from a Microsoft 365 tenant with nothing configured to a Windows 11 device that unboxes itself: joins Entra ID, enrols in Intune, installs its applications, encrypts its disk, rotates its own local administrator password, and can be reached over Remote Desktop from outside the network.

Everything here was built and broken on real hardware and real VMs during July 2026. The chapters carry the dates on which each part was verified.

What makes this different from the documentation

Microsoft documents the procedures well. What is missing everywhere is what happens when a step does not work — and in this deployment, more than twenty things did not work.

A policy that applies nothing and reports success. An event log that blames the TPM for a mounted ISO. A group that looks empty because the tool cannot describe its members. A token refused with a message about Conditional Access before any Conditional Access policy exists.

Those are in here, at the point where they happen. Not collected in a “known issues” appendix nobody reads before they need it.

What you are building

A pure Entra ID join: the device belongs to the cloud directory and has no object in an on-premises domain controller. No dependency on a DC during OOBE, which is the modern model Microsoft recommends and the one that behaves predictably when the device is not on the company network.

If you need on-premises Active Directory as well, that is a different architecture and a different series.

The chapters

1 — Preparing a Microsoft 365 tenant for Intune Licensing that actually matters, break-glass accounts, and the automatic MDM enrolment setting that quietly breaks everything if you miss it.

2 — Autopilot: dynamic groups, branding and deployment profiles The profile decides the join model, not the import script. Groups by ZTDId, a 10 KB logo limit, and device names truncated at fifteen characters.

3 — Importing the hardware hash Three failures in a row: PowerShell exiting silently, AADSTS530035, and a VM with no serial number. Then how to make it non-interactive, and what that convenience costs.

4 — Deploying apps and OneDrive Required apps during OOBE, Chrome as a line-of-business MSI, and the Tenant ID field that fails in complete silence.

5 — Compliance, BitLocker and LAPS Why not to manage the built-in Administrator, and a BitLocker policy that took a deleted baseline, an unmounted ISO and the right registry key to apply.

6 — Windows Update: rings, deadlines and active hours Without deadlines, patches are downloaded and never active. Quality tight, feature loose, and why pre-release builds stay off.

7 — Defender: dedicated policies instead of a baseline What a silent policy conflict costs, and the rule that came out of it: configure as little as possible.

8 — Remote Desktop on Entra-joined devices Five obstacles in a chain, ending at AADSTS293004 — the name you connect to must be the device name in Entra.

9 — Conditional Access: MFA yes, compliant device not yet Two policies instead of one, break-glass excluded by name, and why requiring a compliant device tenant-wide locks you out of your own tenant.

10 — Italian keyboard on an en-US image The Autopilot profile requests a language, it does not install one.

Before you start

A note on honesty

One thing in this series did not fully work, and it is written up as such: BitLocker ended at Used Space Only rather than Full encryption, despite the registry saying otherwise. The explanation is in chapter 5, and it turns out to be by design rather than a mistake.

Guides that never fail are guides where the failures were edited out. This is what actually happened.