Intune Tips on PaulyCloud

Confirm Escrow of FileVault Recovery Keys in Microsoft Entra

Mon, 18 May 2026 00:00:00 +0000

A couple of weeks ago I wrote about confirming the escrow of BitLocker recovery keys in Microsoft Entra — driven by the urgency of the Secure Boot certificate changes. On the macOS side, there is no equivalent certificate crisis forcing our hand right now, but that does not make FileVault key escrow any less important.

macOS continues to grow as a platform in the enterprise. More and more organizations are offering Macs as a choice — or even a default — for their workforce, and with Apple Silicon delivering strong performance across developer, creative, and general productivity workloads, that trend is only accelerating. As your Mac fleet grows, so does the importance of managing it with the same rigour you apply to Windows.

IntuneTip: Reset Windows Hello for Business Using On-Demand Remediation

Mon, 04 May 2026 00:00:00 +0000

Sometimes users need to have their Windows Hello for Business container reset. This can happen for a myriad of reasons:

Biometrics stopped working
“Something went wrong” errors during sign-in that won’t resolve
Trust relationship between the credential and Microsoft Entra ID broke
User suspects their PIN was observed or compromised
Device was lost briefly and recovered — user wants to re-key

For this support request, you can easily push a small script using Intune’s on-demand remediation feature (preview). All it does is use certutil to delete the Windows Hello container and return the exit code.

Secure Boot Certificates – Confirm Escrow of BitLocker Recovery Keys in Microsoft Entra

Mon, 27 Apr 2026 00:00:00 +0000

With the change of the Secure Boot certificates coming in fast and furious as summer approaches, it is paramount to ensure that your estate is ready to deploy the changes swiftly and securely.

The change and deployment has been documented thoroughly by several great community articles and contributions in recent months, along with the expansion of Microsoft’s own documentation on the subject.

I will not delve further into that here other than to provide links for further reading, but if you’re looking at a deployment guide, I would highly suggest taking a look at Mindcore’s blog linked below: