HomeLessons Learned

Technical source document

Lessons Learned

Rendered from the retained public repository snapshot. Original wording and result boundaries are preserved.

Original GitHub document All documentation

Lessons Learned

  1. Pilot-scoped groups reduce blast radius and simplify troubleshooting.
  2. Assigned or Active is not proof of endpoint enforcement; validate the resulting device state.
  3. End-to-end validation matters more than portal configuration screenshots.
  4. Backup and recovery readiness are part of change management for destructive enrollment testing.
  5. Keep normal users standard and provide a separate administrative elevation path.
  6. runas is not the same as UAC elevation; validate the actual token.
  7. Troubleshoot compliance from both endpoint evidence and the Intune management plane.
  8. Firmware settings such as Secure Boot can determine cloud compliance.
  9. Endpoint-side PowerShell plus Intune portal status provides stronger evidence than either source alone.
  10. Never publish recovery codes, private keys, VPN profiles, browser password exports, or BitLocker recovery values.