Practical Intune guidance: RBAC, Microsoft Graph, and more.https://dave-randall.com/https://dave-randall.com/rbac/day-05/https://dave-randall.com/rbac/day-05/Every Intune permission is a category plus an action. A role is just a set of those pairs, and each category stands on its own. Plus the actions to watch closely.Fri, 16 Oct 2026 00:00:00 GMThttps://dave-randall.com/rbac/day-04/https://dave-randall.com/rbac/day-04/A role defines what someone can do. An assignment decides who gets it and where it applies. Getting this split right is the foundation of everything else.Thu, 15 Oct 2026 00:00:00 GMThttps://dave-randall.com/rbac/day-03/https://dave-randall.com/rbac/day-03/Intune has ten built-in RBAC roles, each designed for a specific job. How many are you actually using?Wed, 14 Oct 2026 00:00:00 GMThttps://dave-randall.com/rbac/day-02/https://dave-randall.com/rbac/day-02/Is Intune Administrator an Intune role? It isn't. It's a Microsoft Entra role, and that difference matters a lot.Tue, 13 Oct 2026 00:00:00 GMThttps://dave-randall.com/rbac/day-01/https://dave-randall.com/rbac/day-01/If you had to stop and check, you're not alone. That's why this series exists. Here's the four-week roadmap and who it's for.Mon, 12 Oct 2026 00:00:00 GMThttps://dave-randall.com/graph/day-19/https://dave-randall.com/graph/day-19/19 days, one theme. The key wasn't API syntax. It was discipline.Thu, 29 Jan 2026 00:00:00 GMThttps://dave-randall.com/graph/day-18/https://dave-randall.com/graph/day-18/Raw Graph output is powerful, but leaders don't want JSON. They want answers about risk and trajectory.Wed, 28 Jan 2026 00:00:00 GMThttps://dave-randall.com/graph/day-17/https://dave-randall.com/graph/day-17/Production automation fails. Mature automation expects it, and explains failures in a way operators can act on.Tue, 27 Jan 2026 00:00:00 GMThttps://dave-randall.com/graph/day-16/https://dave-randall.com/graph/day-16/Automation isn't complete until humans know when to step in. Push the signal to where admins already work.Mon, 26 Jan 2026 00:00:00 GMThttps://dave-randall.com/graph/day-15/https://dave-randall.com/graph/day-15/Route Intune logs into Azure Monitor and let KQL show you API outcomes, deployment trends, and admin activity.Fri, 23 Jan 2026 00:00:00 GMThttps://dave-randall.com/graph/day-14/https://dave-randall.com/graph/day-14/"Just grant .ReadWrite.All so the script works" isn't RBAC. It's crossing your fingers. Here's the model to use instead.Thu, 22 Jan 2026 00:00:00 GMThttps://dave-randall.com/graph/day-13/https://dave-randall.com/graph/day-13/Updating Intune at scale isn't hard. Updating it safely is the real challenge.Wed, 21 Jan 2026 00:00:00 GMThttps://dave-randall.com/graph/day-12/https://dave-randall.com/graph/day-12/Baseline drift across tenants is one of the fastest ways configuration risk creeps in. Detect it with disciplined queries and regular comparisons.Tue, 20 Jan 2026 00:00:00 GMThttps://dave-randall.com/graph/day-11/https://dave-randall.com/graph/day-11/The report export APIs turn ad-hoc portal downloads into a scheduled data pipeline.Mon, 19 Jan 2026 00:00:00 GMThttps://dave-randall.com/graph/day-10/https://dave-randall.com/graph/day-10/When something breaks, the first question is "what changed?" Audit events stitched into a timeline answer it.Fri, 16 Jan 2026 00:00:00 GMThttps://dave-randall.com/graph/day-09/https://dave-randall.com/graph/day-09/App inventory, versions, and assignments are the foundation of safe app updates at scale.Thu, 15 Jan 2026 00:00:00 GMThttps://dave-randall.com/graph/day-08/https://dave-randall.com/graph/day-08/How compliance policies map to device state and per-setting state, and when to pull it all in one call versus chaining requests.Wed, 14 Jan 2026 00:00:00 GMThttps://dave-randall.com/graph/day-07/https://dave-randall.com/graph/day-07/What actually happens behind the scenes when Intune evaluates compliance, and how to find out why a device is noncompliant, not just that it is.Tue, 13 Jan 2026 00:00:00 GMThttps://dave-randall.com/graph/day-06/https://dave-randall.com/graph/day-06/The Graph endpoints behind Settings Catalog policies, plus a repeatable pattern for exporting, comparing, and auditing them across tenants.Mon, 12 Jan 2026 00:00:00 GMThttps://dave-randall.com/graph/day-05/https://dave-randall.com/graph/day-05/Grant only what's needed, prefer delegated auth where you can, and know exactly where permissions get assigned.Fri, 09 Jan 2026 00:00:00 GMThttps://dave-randall.com/graph/day-04/https://dave-randall.com/graph/day-04/Graph throttles to protect service health. Automation at scale has to listen for the signals and back off.Thu, 08 Jan 2026 00:00:00 GMThttps://dave-randall.com/graph/day-03/https://dave-randall.com/graph/day-03/OData is the query language baked into Microsoft Graph. Mastering it is the difference between pulling everything and pulling exactly what you need.Wed, 07 Jan 2026 00:00:00 GMThttps://dave-randall.com/graph/day-02/https://dave-randall.com/graph/day-02/The first gate to automating Intune with Graph is authentication, and that means choosing between delegated and application permissions.Tue, 06 Jan 2026 00:00:00 GMThttps://dave-randall.com/graph/day-01/https://dave-randall.com/graph/day-01/The biggest unlock for managing endpoints at scale isn't another console click. It's automation and integration through Microsoft Graph.Mon, 05 Jan 2026 00:00:00 GMT