Step-by-step guides for the people who run mobile device management (MDM) and unified endpoint management (UEM). Each one explains what to do, in what order, how to check it worked, and where it usually goes wrong. They are written from more than 20 years of hands-on work and checked against the vendors’ own documentation.
Every guide has the same parts:
- Before you start: the access, licenses and information you need in hand.
- Numbered steps: what to do in order, with an illustration for each step.
- Check your work: how to confirm it worked, and the mistakes I see most often.
- My take: the short opinion, plus sources, so you can check my reading against the vendor’s own documentation.
Guides are dated close to the MDM Monthly issue that explains why the topic matters, and each carries a “Last updated” line. New here? Start with the Start here page.
Guides
- How to find and migrate Android device administrator devices in Intune. Find the devices, block new enrollments and move the rest to Android Enterprise in waves.
- How to use Intune device query to count exposed Windows devices. Turn a patch or security question into a number, with setup, example queries and limits.
- How to respond when an on-premises MDM server is exploited. A short response plan, using the May 2025 Ivanti EPMM flaws as the example.
- How to secure Intune admin roles. Put a second administrator and phishing-resistant sign-in in front of wipes, scripts and role changes.
- How to move Apple updates to declarative device management in Intune. Replace legacy Apple update policies with declarative updates, and retire the old ones safely.
- How to set up an exploited-flaw patch lane. A fast, pre-approved path for vulnerabilities that vendors or CISA say are being exploited.
- How to deploy Secure Boot certificate updates with Intune. Check firmware, build the profile, verify status and handle blocked devices.
These guides follow the news in MDM Monthly. Each one links back to the issue that explains why it matters.