July 15, 2026

Deploying DNS filtering to a Windows fleet with Intune

If your Windows fleet is already enrolled in Microsoft Intune, Intune is the obvious rail for shipping an endpoint DNS filtering agent. It is also where most rollouts quietly lose devices. This is the deployment shape that works, and the verification step most teams skip.

The moving parts

An Intune-based agent rollout needs four things: an installer, an enrollment secret that ties each device to your tenant, a target group, and a way to see per-device results. In Intune terms that is a platform script (or Win32 app) assigned to an Entra ID group, with the enrollment key embedded at deploy time, and device run states as the feedback channel.

Scope the Entra permissions tightly. Script deployment needs DeviceManagementConfiguration.ReadWrite.All; listing groups to target needs Group.Read.All. Both are application permissions granted with admin consent to a dedicated app registration — not a personal account, and not a service account with directory-wide write.

Assignment is not installation

The failure mode we wrote about in the 100%-coverage story is structural: Intune reports what it assigned, not what is running. Devices that are offline for the assignment window, fail the script silently, or get re-imaged after deployment all show up as covered in a dashboard that never re-checks. Treat three numbers as separate: devices assigned, script run states reporting success, and agents actually enrolled and syncing policy. Only the third one protects anything.

Run states give you the middle number. Every deployed script reports success, error, or pending per device — pull those counts and chase the errors instead of assuming green. The gap between "run state success" and "agent enrolled" is your re-imaging and tamper drift, and it should be near zero on a healthy fleet.

How ClearScreen does it

ClearScreen's Business plan builds this rail into the admin console. You connect an Entra app registration once (client credentials, verified against Microsoft Graph before anything is stored — the client secret is encrypted at rest). Then you pick an Entra group, and ClearScreen creates and assigns the deployment script with your enrollment key embedded, so devices install the agent and enroll to your tenant in one pass. The deploy status view shows success, error, and pending run states per device — the middle number, live, without opening the Intune portal.

Because enrollment closes the loop, the console can also show the third number: which devices are actually syncing policy. Assigned-but-never-enrolled devices stop being invisible.

Rollout order that survives contact with users

Do not assign to All Devices on day one. Start with an IT pilot group, confirm run states and enrollment match, then widen by department. Category policy deserves the same staging — begin with the always-on security categories (malware, phishing, C2) that nobody disputes, and add content categories after the pilot proves the false-positive path works. A filter that arrives quietly and blocks only obvious threats builds the trust you will need when the gambling and AI-tool toggles come later.

Running Intune but not yet filtering DNS? See what the agent enforces, or check what your fleet is currently resolving against our free domain checker.