Fixing what your users don’t even know to complain about (yet).
You’ve joined your devices to Entra ID. Everything works. But it doesn’t feel quite right, does it?
In my previous post, I laid out the foundational pieces to make Entra ID-only hybrid environments actually work. But once the basics are in place — device joins, sign-ins, and security — it’s time to give users that little bit extra.
This post is all about the “nice to haves”: small, intentional tweaks that make the user experience smoother, faster, and less annoying.
We’re not talking about massive changes — just clean defaults, fewer first-run prompts, less disk clutter, and smart app behavior. The kind of stuff that makes devices feel ready out of the box.
🧠 Policy naming convention:
Windows - Config - *Whatever we're configuring*
All the configs in this post are available as JSON files right here:
📦 github.com/ludwigmoeller/techwithludwig
Let’s walk through each one — what it does, why it matters, and how to get it deployed in minutes.
✨ Windows – Config – Edge
This policy configures Microsoft Edge to provide a consistent, secure, and user-friendly browser experience out of the box.
- Force sign-in with Entra ID
- Auto sign-in to the default profile
- Sync enabled without prompting
- Google as the default search provider
- First-run experience and splash screen skipped
- No desktop shortcut after install
- Homepage set to https://www.google.com
📍 Deployed via Intune Settings Catalog
🎯 Goal: A browser that’s ready to go, fully managed, and familiar — no weird prompts, no user setup required.
☁️ Windows – Config – OneDrive
This policy gets OneDrive set up for a smooth and secure experience from day one — with no user prompts, no manual setup, just sync and go.
- Silent sign-in with Entra ID
- Known Folder Move (KFM) silently enabled
- Files On-Demand turned on by default
- Mass deletion protection
- Auto bandwidth management
- Low disk warning at 1000MB
- First-run tutorial popups disabled
- *Sync admin reports enabled
- Dehydrate synced Teams/SharePoint sites
🎯 Goal: OneDrive “just works” — silently, securely, and without eating up disk or user patience.
* This feature requires that you set up the admin reports, it’s really quite easy. Follow this guide and paste the Tenant Association ID into the setting once you’ve enabled it.
🧹 Windows – Config – Storage Sense
This policy keeps devices tidy by automating Storage Sense, reducing clutter without user intervention.
- Storage Sense enabled system-wide
- Temp files deleted automatically
- Recycle Bin cleared after 30 days
- Downloads folder cleaned up after 30 days
- Unused cloud content dehydrated after 30 days
- Runs every 30 days
🎯 Goal: Reclaim disk space silently, predictably, and with zero user effort.
💼 Windows – Config – Microsoft 365
This policy configures core Microsoft 365 apps for a smoother first-run experience and fewer interruptions.
- Skip Office intro wizards and movies
- Suppress Teams auto-launch
- Enable automatic updates and hide toggles
- Monthly Enterprise update channel
- Auto-configure Outlook profiles and cache shared mail
- Disable Customer Experience Improvement Program
- Allow ribbon/QAT roaming
🎯 Goal: Get users productive faster, with fewer prompts and better update hygiene.
🧩 Tying It All Together: The “Nice to Haves”
Beyond just getting Entra ID devices working, these extra policies help polish the experience:
- Edge behaves like a grown-up browser
- OneDrive syncs without IT getting involved
- Storage Sense declutters quietly
- M365 launches with no noise
You’ll find each of these under Devices > Configuration profiles in Intune, all named consistently based on the platform, if it does config, security or something completely different:
Windows - Config - Edge
MacOS – Config – Edge
Windows – Security – Microsoft Security Experience
Small touches, big impact. And the best part? You only have to do it once — your users will thank you (or just never notice, which is the goal).
📅 Looking ahead:
Got your own favorite “nice to haves”? Or maybe a compliance or update policy that belongs in this list? Hit me up — it might make it into Part 3 😉