Operations overview and admin calendar¶

Most Intune outages aren't caused by a bad change. They're caused by something nobody looked at: an expired Apple certificate, a connector that stopped weeks ago, a retirement notice in the Message center. This page is the recurring checklist that prevents that.

Put these tasks in a shared calendar or your ticketing system with owners, not in one person's head.

Daily¶

• Service health and incidents: Tenant administration > Tenant status. Know about Intune incidents before your users report them.
• Failures from yesterday's changes: app install status for newly assigned apps, and Devices > Monitor > Assignment failures.
• Enrollment failures: Devices > Monitor > Enrollment failures, especially on days with new starters.
• Pending approvals: Multi Admin Approval requests and Endpoint Privilege Management support-approved elevation requests.
• High-risk devices: Defender for Endpoint alerts and devices with a high risk level, which compliance will block.

Weekly¶

• Message center: read new Intune, Entra and Windows posts and add actions to your backlog. Look for "Plan for change" notices.
• Windows update progress: Windows Autopatch and Windows update reports. Chase devices that are behind.
• Noncompliance trend: devices noncompliant for more than 7 days, grouped by reason.
• Connector health: Tenant administration > Connectors and tokens. Certificate connectors, Defender for Endpoint, Managed Google Play, the Active Directory connector, Apple tokens.
• Audit log review: Tenant administration > Audit logs. Look for changes nobody expected, especially role, script and assignment changes.

Monthly¶

• Patch Tuesday (second Tuesday): watch quality updates move from test to pilot to broad. Remember that hotpatch baseline months (January, April, July, October) need a restart.
• What's new in Intune: Intune ships a service release every month. Read What's new and In development.
• App versions: update Win32 and Enterprise App Catalog apps with supersedence. Check apps with outstanding security updates.
• Configuration hygiene: conflicts, unassigned profiles, and profiles that apply to nobody.
• Device hygiene: results of device cleanup rules, Autopilot registrations that never enrolled, devices on the retire list.
• Licensing: assigned licenses versus active devices and users.
• Backup: export your Intune configuration and commit it to version control. See Change management.

Quarterly¶

• Access review: role assignments, PIM eligibility, Multi Admin Approval approvers, custom roles. See Admin roles and RBAC.
• Break-glass test: sign in with each emergency access account and confirm alerts fire.
• Compliance thresholds: raise minimum OS versions and the Android security patch level as your fleet moves on.
• Conditional Access exclusions: still needed? Still small?
• Security baselines: is there a newer version? Plan the upgrade.
• Restore test: restore one policy from your backup into a test tenant or as a copy, to prove the backup works.
• Documentation: update runbooks and this calendar.

Annual tasks¶

These expire. When they do, things break without warning. Set reminders 30 days before each date.

Every year, around these releases¶

Event-driven work¶