Microsoft Intune method of Secure Boot for Windows devices with IT-managed updates

In this Article:

• Introduction

• Microsoft Intune configuration method

• Setting Description

• Resources

Introduction

This document describes the support for deploying, managing, and monitoring the Secure Boot certificate updates using the Microsoft Intune. The settings consist of:

• The ability to trigger deployment on a device

• A setting to opt in/opt out of high-confidence buckets

• A setting to opt in/opt out of Microsoft managing updates​​​​​​​

Microsoft Intune configuration method

This method offers Secure Boot setting using Microsoft Intune that domain administrators can set to deploy Secure Boot updates to all domain-joined Windows clients. In addition, two Secure Boot assists can be managed with opt in/opt out settings.

In Microsoft Intune,

1. Under Devices > Manage devices, select Configuration.

2. Select Create and select New Policy.

   • Go to Create a profile in the right-hand pane.

   • Fill in Platform with Windows 10 and later.

3. Select the Settings Catalog under the Profile Type. ​​​​​
   
   

4. Begin creating a profile by giving the profile a name. In this example, we are using “Secure Boot” as the name. Press Next.​​​​​​
   

5. Under Configuration settings, select Add settings and use the Settings picker to find the Secure Boot settings by searching for Secure Boot. You should see three settings in the Secure Boot category. These are the same settings described in the Registry key updates for Secure Boot: Windows devices with IT-managed updates and the Group Policy Objects (GPO) method of Secure Boot for Windows devices with IT-managed updates documents.

   • Enable Secureboot Certificate Updates is selected by default and enabled.

   • The opt in and opt out settings described below can be configured to suite your environment and deployment needs. ​​​​​​​
     ​​​​​​​
     

6. Finish the profile for the devices that will use these settings.

Setting Description

Resources​​​​​​​

See also Registry key updates for Secure Boot: Windows devices with IT-managed updates for details on the UEFICA2023Status and UEFICA2023Error registry keys for monitoring device results.

See Secure Boot DB and DBX variable update events for events useful in understanding the status of devices, device attributes, and device bucket IDs. Pay special attention to events 1801 and 1808 described on the events page.