From the moment it's provisioned, your Ainos PC is registered in Windows Autopilot and then continuously managed by Microsoft Intune: security, updates, apps and compliance are all driven remotely by IT for the device's entire lifecycle. First-time setup is covered on I have a new device; the details of updates and compliance are on Updates & compliance.

Every Ainos PC has a local administrator account whose password is generated and rotated automatically by Windows LAPS (Local Admin Password Solution), then stored securely in Intune. Nobody needs to remember it: if a technical intervention requires it, only IT can retrieve it, in a fully traceable way.

The Company Portal app (already installed) isn't just for phones: on PC, it acts as a dashboard for your device.

The enrollment method depends on the device type. This page (Company Portal) mainly covers mobile devices; work Windows PCs are pre-configured via Windows Autopilot.

The procedure is nearly identical on both systems. Select the tab matching your phone to display only the steps relevant to you.

iOS procedure — Company Portal

›

Enrolling an iPhone or iPad in Microsoft Intune via the Company Portal app. First: install Intune Company Portal from the App Store, open the app, sign in with your prenom.nom@ainos.lu account, and approve MFA. Then follow the wizard.

📥

Prerequisite — install the appDownload Intune Company Portal (publisher Microsoft Corporation) from the App Store, then open the app.

iPhone / iPad

Open the App Store ↗

"Intune Company Portal" (Microsoft Corporation) listing on the App Store.

Open the app and tap "Sign in"

Launch Company Portal then tap Sign in to start signing in.

Home screen: tap "Sign in".

Sign in with your work account

Enter your work address prenom.nom@ainos.lu, tap Next, then enter your password and approve MFA (approval in Microsoft Authenticator).

Enter the work address, then "Next".

Allow notifications

The app requests permission to send notifications (compliance-related alerts). Tap Allow, then Ok.

Allow notifications, then tap “Ok”.

Start setup

Work access setup screen: tap Begin.

"Set up access" screen: tap "Begin".

Read the privacy information

Overview of what the organization can and can't see on the device. The Can't tab lists what stays private (browsing history, personal emails and documents, passwords, photos, location of a personal device). Tap Continue.

Privacy: the "Can't" tab details what IT can't see → "Continue".

Start preparation

The "Review privacy information" step is complete. Tap Continue to download the profile.

Privacy step complete — "Continue".

Download the management profile

At the browser prompt, tap Allow to authorize the profile download.

Allow downloading the management profile.

Profile downloaded

The profile is downloaded. Tap Close: it will need to be installed manually from Settings.

“Profile Downloaded” → tap “Close”.

Open the Settings app

Company Portal shows the procedure to follow: open the iPhone's Settings app.

Home screen: tap the "Settings" icon.

Tap "Profile Downloaded"

At the top of Settings, tap the search field for "Profile Downloaded".

Settings → "Profile Downloaded".

Install the profile

On the "Install Profile" screen, tap Install (top right).

Settings → "Install Profile" → "Install".

Enter the device passcode

Enter the device's unlock code, then tap Done.

Enter the device passcode, then tap “Done”.

Confirm installation

Confirm by tapping Install again.

Confirmer l'installation du profil.

Trust remote management

A warning lists the root certificate and remote management (MDM). Tap Install, then Trust.

Root certificate + remote management: "Install" then "Trust".

Profile installed

The "Profile Installed" screen confirms installation. Tap Done.

“Profile Installed”: tap “Done”.

Finish in Company Portal

Go back to Company Portal and tap Continue: the app checks the device's compliance ("Checking device settings"). Enrollment is complete.

Back in Company Portal → "Continue" → compliance check.

Setup complete

The "You're all set!" screen confirms the device has access to work resources. Tap Done.

“You're all set!” → tap “Done”.

Set a lock code

To stay compliant, the device may require an unlock code. Tap Change Now and set a code (at least 6 digits).

"Passcode Requirement" → "Change Now".

Install work apps

The organization can automatically deploy apps (Outlook, Teams…). At the "App Installation" prompt, tap Install.

"App Installation" → "Install" (apps deployed by IT).

Open Microsoft Defender to finalize compliance

Once the apps are deployed, open the Microsoft Defender app (automatically installed by IT) and let it finish initializing. It's this first launch that reports the device's security status to Intune: as long as Defender has never been opened, the device may appear non-compliant. When the screen shows "Device Secure", compliance is OK.

Microsoft Defender → "Device Secure": the device is compliant.

Precise limits depending on the platform — a common question from BYOD users.

On a personal smartphone, Outlook is a Microsoft app protected by app protection policies (MAM), without full device enrollment. The flow differs slightly:

Outlook automatically sorts mail into two tabs: Focused (important messages) and Other. To move a message, open it → menu (•••) → Move to Other / Move to Focused, and choose "Always" for that sender.

Outlook mobile supports multiple accounts (usually only one Ainos work account is needed). To add one: Settings → Add Account → Add Email Account. Switch between accounts via the avatar in the top left. On a personal device, the work account stays protected by MAM policies, independently of your personal accounts.

Rather than attaching a copy of the file, share a link to the document stored in OneDrive or SharePoint (a "cloud attachment").

Classifying an email based on the confidentiality of its content helps protect it (encryption, restrictions) and prevent leaks.

The level you choose determines exactly what the recipient sees of your agenda:

• Lasting access goes through the team: in Teams, ⋯ next to the team → Manage team → Members. Not folder by folder.
• One-off sharing goes through the file: for an occasional reader, share the file rather than adding them to the team.
• Someone only needs to read the site: add them as a visitor (site ⚙ → Site permissions).
• Standard channels: your members can create them. To prevent it: Manage team → Settings → Member permissions.
• A library with different permissions from the rest: ask IT for it.

While you're at it, check the rest:

A folder's ⋯ menu: Manage access shows who has access, and through which links.

The whole journey in one picture: Share with someone outside Ainos.

My guest can't sign in

• They haven't accepted the invitation, or opened it with a different address from the one invited: ask them to look for the "Microsoft Invitations on behalf of Ainos" e-mail, including in their junk folder, and select Accept invitation with the right address. Can't find it? IT can resend the invitation.
• They're asked for two-step verification when they sign in: that's normal, they must complete it.
• Sign-in can be refused from some countries.
• They can sign in but no longer open a file: the access may have expired (180 days without extension). Share the file with them again: their guest account still exists.

• Confidential work with a partner: a separate project space, where IT adds only the guests named for this project. Put in it only what concerns that partner.
• To ask for one: a Other request on the Self-Service Portal, saying the content is sensitive and who must have access.
• Sharing based on sensitivity level (labels) is planned for 2027.

• Sender: Microsoft, MSSecurity-noreply@microsoft.com. Depending on the language of your account, the e-mail and the review page are in English or French.
• Content: the name of the review, your team's name, the due date, and a button to start the review (Start review or Review access, depending on the version).
• A short message from IT comes with it: keep only the guests who still work with your team.

Example e-mail (screenshot: Microsoft Learn, CC BY 4.0, demo tenant). At Ainos, it shows your team's name.

• At the end of the 14 days, the decisions apply automatically: a denied guest is removed from the team. They no longer see the team's channels or files.
• Their account is not deleted: a file or folder shared with them directly stays accessible. Access given since 1 October 2026 expires after 180 days; older access stays until someone removes it. If they should no longer have it, remove it: ⋯ → Manage access.
• Removed by mistake? Make a new Invite an external guest request on the Self-Service Portal: IT adds them back to the team.
• The next review comes the following quarter, for every team that has guests at that time.

• I didn't receive anything. Your team may have no guests. Check myaccess.microsoft.com → Access reviews, and your junk e-mail.
• I'm no longer an owner of this team. Tell IT. The current review stays yours: answer for the guests you know, and choose Don't know with a reason for the others. The new owner will get the next review.
• I'll be away during the review. If there is another owner, tell them: they receive the same review. If you are the only owner, answer before you leave: from January 2027, guests without an answer are removed. An owner added during the review only gets it the following quarter.
• Will the guest know I denied them? They get no e-mail from the review; they just find they no longer have access to the team. Let them know if the collaboration continues another way.

Your Ainos PC comes configured. Nothing below needs switching on: these are enforced settings, worth knowing so you don't mistake them for faults.

Microsoft 365 puts some files in your OneDrive without asking. Here is what these folders are for. Their names may appear in English or French, depending on the language of your account.

In File Explorer, each OneDrive file carries a small icon that tells you where it really is: online only, already on the disk, or kept on the PC for good.

On an Ainos PC, the Status column: green tick = on the PC, blue cloud = online only, arrows = syncing.

Your team's files in File Explorer

To work on a team's files from File Explorer, add a shortcut: it shows up in your OneDrive folder, on all your PCs.

⋯ → Add shortcut to OneDrive → My files.

If IT asks you to sync a library: ⋯ → Sync. Otherwise, prefer the shortcut.

Almost everything can be recovered, as long as you pick the right tool. This section covers your personal files and your team's files.

Tick the file, then ⋯ → Version history. Right-clicking the file opens the same menu.

Each version has its date, author and size. The arrow next to the date opens View and Restore: no need to keep "v2" or "v3 final" copies.

Restore puts this version back.

Always start by reading the icon: hover over the OneDrive icon near the clock, the tooltip shows the real status and the name of the file at fault. Only these icons call for action.

In File Explorer

On the OneDrive icon, near the clock

Keeping space free

In a team library, + Create or upload makes a new document right where it belongs, and a simple drag and drop uploads your files.

• On the web: onedrive.com or microsoft365.com, with your Ainos account.
• In Teams: the OneDrive icon in the left bar (if it isn't there: … → OneDrive).
• What others sent you: the Shared view in OneDrive (not to be confused with a Teams channel's Shared tab) gathers everything shared with you, and what you shared.

On your phone: scan the code for your phone to install the OneDrive app, then sign in with your Ainos account.

Before asking for a new team, check whether a channel in an existing team would do: for a small topic, it usually does. Otherwise, submit an Other request on the Self-Service Portal, or message IT in Teams. Say:

• what the space is for (one sentence is enough);
• two named owners, so it stays managed when someone is away or leaves;
• the members;
• whether people outside Ainos will join, and whether the content is sensitive (HR, finance, legal, contracts).

IT creates the space and names it. A team also has a group mailbox (calendar and conversations): it is not a shared mailbox.

A chat is a conversation between two people or a small group. A channel is a team topic, visible to all its members.

Sharing a team file in a conversation: in the library, tick the file → Copy link, then paste the link into the channel or chat. Team members already have access to the file: the link is all they need.

File ticked → Copy link: a link to the up-to-date version, instead of a copy as an attachment.

• Open the file from the channel's Shared tab: in Teams, in the browser or in the app. Several people can edit at the same time, and everyone sees the others' cursors.
• Comment: an @mention in a comment notifies the person by e-mail (and usually in Teams Activity too). Click Resolve once it's settled.
• For a formal review, turn on Track Changes in Word.
• Planner (tasks) and OneNote (notes) can be added as tabs at the top of the channel, with +.
• Create a document or upload files in the team library: + Create or upload, or a simple drag and drop.

Create or upload: a folder, files, or a new Word, Excel or PowerPoint document… right where it belongs.

Choose where files open

In Teams: ⋯ (Settings and more) → Settings → Files and links → "Always open Word, PowerPoint, and Excel files in": Teams, Desktop (the installed app, with all its features) or Browser.

Files and links: where Office documents open, and which browser opens links.

Saved a wrong version? I deleted or overwrote a file.

The Teams calendar is your Outlook calendar: a meeting created in one shows up in the other.

Before joining: camera, microphone and speaker. The Test mic and speaker link starts a three-screen test.

The test: the speaker plays a sound, you speak and hear yourself back, then Teams confirms your audio is ready.

• The lobby: people who received the invitation (directly, through a distribution list or forwarded) and who sign in with their account get straight in. People who join without signing in, or with just the link and no invitation, wait until the organizer, a co-organizer or a presenter admits them.
• Who can present: everyone, by default. So every participant can also share their screen and admit people from the lobby. When external people attend, restrict it in Meeting options.
• No files in the chat of a meeting or conversation with outsiders: they would be stored in your OneDrive, which can't be shared outside Ainos. Share your screen instead.
• Bringing someone into a team: that requires a guest created by IT. See Share with someone outside Ainos.

Choose your notifications

Turn on an out-of-office message

⋯ → Settings → General → Out of office: turn on automatic replies, write the message (and its version for outside senders), tick the time period, then Save. It is the same message as in Outlook.

General → Out of office: message, replies to outside senders and time period. Synced with Outlook.

You won't miss anything: your @mentions always reach Activity. The search bar at the top finds messages, people and files, with filters. For the AI assistant: Copilot.

The same window opens from OneDrive, Teams, SharePoint, Word, Excel or PowerPoint. Screenshots taken on the Ainos tenant; when one shows the French interface, the English labels are given underneath.

Click “Share”

On the file: the Share button, or right-click the file → Share.

Tick the file, then Share in the toolbar.

Add the names

In To: Name, group or email, type each person's name and pick them from the list. The message is optional.

The Share window: the recipients at the top, then an optional message. The gear ⚙, next to Copy link, opens the link settings.

Open ⚙ Link settings

Under The link works for, keep People you choose.

The ⚙ Link settings gear, between Copy link and Send.

Three choices only: “Anyone” does not exist at Ainos. Under More settings, the four permissions; here Can edit was chosen, keep it for people who need to write.

Choose the permission

Under More settings: Can view is offered. Switch to Can edit only if the person needs to write. Add an expiration date if needed, then Apply.

Expires: pick the day access stops, then Apply.

Send, or copy the link

Send: each person receives an email with the link. Copy link: paste it into a Teams conversation or an email.

From Outlook: dragging a file into an email

When you drag a file from your PC into a new message, Outlook offers two zones. For a colleague, drop it on Upload to OneDrive and share link: the message carries a link, not a copy. Attach files sends a copy: avoid it.

✅ For a colleague: Upload to OneDrive and share link: the message carries a link.

🚫 Attach files: a copy of the file goes into the e-mail.

What you'll see on screen

“Anyone” (a link that would open for anybody) does not exist at Ainos. Besides the permission, there are only two options: an expiration date and, depending on the link, blocking downloads.

🤖 When you add people, Copilot may offer a summary of the file in the message: read it before sending, and don't add it to a sensitive document.

You can adjust a share at any time, always in the same place:

The People tab of the same panel shows who has access, name by name.

Manage access: the link, its permission under Settings, and the bin icon to delete it.

This screen lists all the active methods on your account. For each method, depending on the case, you have a Change and/or Delete button. The + Add sign-in method button at the top of the list lets you register a new method.

Overview: phone, password, Microsoft Authenticator (MFA) and passkey are all configured on this account.

Available methods

Several types of methods can coexist on your account. Here are the main ones found at Ainos:

Click + Add sign-in method at the top of the list. A window then lets you choose the type of method to register, and guides you step by step through the setup.

The "Add a sign-in method" window: choose the type of method to add (passkey, Authenticator, hardware token, office phone, email…).

The options offered may include:

• Passkey in Microsoft Authenticator — a passkey stored in the Authenticator app (face, fingerprint, PIN).
• Passkey — a passkey via biometrics, PIN, or a physical security key.
• Microsoft Authenticator — sign-in approval via notification or one-time codes.
• Hardware token — a hardware token generating a code.
• Office phone — a call received on your professional landline.
• Email — receiving a code to reset your password (reset only, not for sign-in).

Select the desired method and follow the on-screen instructions (scanning a QR code, entering a number, registering the key, etc.). Once verification succeeds, the new method appears immediately in the list.

For each listed method:

• Change — click Change to the right of the relevant row (for example to change a phone number or password), then follow the wizard.
• Remove — click Delete to the right of the row, then confirm. The method is removed from your account immediately.

At every sign-in, several signals are analyzed (who you are, your device, your location, the risk detected). Depending on the result, access is allowed, subject to additional verification (MFA), or blocked — before it even reaches your apps and data.

Here are the most common situations and what to do in each case.

• A network share or an old business application keeps asking for your username and password, or shows Access denied.
• A share opened by its IP address (for example \\10.0.0.5\share) no longer opens, while it opens by its name.
• An old printer, scanner or NAS refuses the connection.

An exception allows NTLM to one specific server, only when it can't work any other way. It isn't permanent: the aim remains to move that server to Kerberos.

• Every exception is automatically documented: the server, the date it entered the exceptions and the person who requested it.
• After 6 months, IT asks you to confirm it is still needed.
• The list of servers in the exceptions is not published.

Controlled folder access protects Documents, Pictures, Videos, Music and Favorites, including when they are backed up to OneDrive. Only trusted programs can save, change or delete files there: ransomware that tries to encrypt them is blocked.

• Most well-known programs (Office, OneDrive, Teams…) are recognized automatically.
• An unknown program (a recent tool, a rare business application) may be blocked: you see “Unauthorized changes blocked”. Save to another OneDrive folder instead (not Documents or Pictures).
• The history of blocks is in Windows Security → Virus & threat protection → Protection history.

After 10 wrong passwords, your account is temporarily blocked: this is what stops an attacker trying to guess your password.

• Wait a few minutes: the block lifts on its own, but it lasts longer after each new mistake. Before trying again, check Caps Lock and the keyboard language.
• Forgot your password? Reset it yourself: MFA · Passkey · SSPR. This also lifts the block straight away.
• Locked without typing anything? A device (phone, tablet) may still hold your old password, or someone may be trying your account: tell IT.

With Windows Hello (PIN or face), this counter doesn't apply: the PIN has its own protection. See Windows Hello (PC).

The Windows firewall is on for every network (office, home, public Wi-Fi) and refuses connections that come in to your PC (except those IT has allowed), without showing a message. Internet, Teams, Outlook and OneDrive are not affected: those connections go out from your PC.

An application that needs to receive connections (a copier dropping a scan into a folder on your PC, a tool running locally) may therefore fail without explanation. If it is a business application, IT can allow it.

Hyper-V is built into Windows: nothing to download. Open PowerShell as administrator (right-click → Run as administrator), then:

Enable-WindowsOptionalFeature -Online -FeatureName Microsoft-Hyper-V -All

Answer Y to restart. After the restart, Hyper-V Manager appears in the Start menu.

Without PowerShell: type features in the taskbar search → Turn Windows features on or off → tick Hyper-V → OK, then restart.

Search → Turn Windows features on or off.

Tick Hyper-V, then OK.

If the command fails, note the full error message and contact IT.

Use the Windows 11 Enterprise evaluation, free and legal for testing, valid for 90 days, with no product key: Microsoft Evaluation Center → Windows 11 Enterprise (not LTSC) → fill in the registration form → 64-bit (x64) ISO (Arm64 only if your PC has a Snapdragon processor), any language.

• First create the folder, in an administrator PowerShell: New-Item -ItemType Directory -Path "C:\VMs\ISO" -Force, then save the ISO there.
• Never download Windows from anywhere other than a Microsoft site.
• After 90 days, delete the VM and create a new one: an expired evaluation shuts down every hour.

If you have your own Windows 11 product key, you can also take the standard ISO from the Windows 11 download page → Download Windows 11 Disk Image (ISO) for x64 devices. Without a key, Windows stays unactivated: use the evaluation instead.

The standard Windows 11 ISO, which needs a product key (page shown in French).

In an administrator PowerShell, adjust the ISO path, then paste:

$vm  = "VM-Quarantine"
$iso = "C:\VMs\ISO\Windows11-Evaluation.iso"
New-Item -ItemType Directory -Path "C:\VMs" -Force | Out-Null
New-VM -Name $vm -Generation 2 -MemoryStartupBytes 4GB -Path "C:\VMs" -NewVHDPath "C:\VMs\$vm\$vm.vhdx" -NewVHDSizeBytes 64GB
Set-VMProcessor -VMName $vm -Count 2
Set-VMKeyProtector -VMName $vm -NewLocalKeyProtector
Enable-VMTPM -VMName $vm
Add-VMDvdDrive -VMName $vm -Path $iso
Set-VMFirmware -VMName $vm -FirstBootDevice (Get-VMDvdDrive -VMName $vm)
Set-VMHost -EnableEnhancedSessionMode $false
vmconnect.exe localhost $vm
Start-VM -Name $vm

What these lines do: a generation 2 VM with 4 GB of memory, 2 processors and a 64 GB disk in C:\VMs, secure boot and a virtual TPM (required by Windows 11), no network, and enhanced session mode turned off (for all VMs on the PC). The VM window opens, then the VM starts: press a key right away to boot from the ISO. If you miss it, use Action → Reset, then press a key. Install Windows with a local account, never your Ainos account or a personal Microsoft account.

Create both VMs: run the script once as is (VM-Quarantine, no network), then a second time with $vm = "VM-API", and connect the latter:

Connect-VMNetworkAdapter -VMName "VM-API" -SwitchName "Default Switch"

Without PowerShell: Hyper-V Manager → New → Virtual Machine: tick Store the virtual machine in a different location and enter C:\VMs; generation 2, 4096 MB, network Not connected, 64 GB disk in C:\VMs, the ISO. Then Settings → Processor: 2 virtual processors; Security: tick Enable Secure Boot and Enable Trusted Platform Module.

1. Action → New → Virtual Machine.

2. Name the VM (VM-Quarantine or VM-API), tick Store the virtual machine in a different location and enter C:\VMs.

3. Generation 2. Then, Assign Memory page: 4096 MB.

4. Connection: Not Connected for the VM-Quarantine. Default Switch, as here, only for the VM-API.

5. Replace the suggested location with C:\VMs\ + the VM name, and the size with 64 GB.

6. Installation Options: Install an operating system from a bootable image file, then pick the ISO, ideally stored in C:\VMs\ISO.

Before starting the VM, set what the wizard doesn't:

7. Right-click the VM → Settings.

8. Processor: at least 2 virtual processors (4 here).

9. Security: Enable Secure Boot (Microsoft Windows template) and Enable Trusted Platform Module, then OK.

All the commands below run in an administrator PowerShell.

Connect-VMNetworkAdapter -VMName "VM-Quarantine" -SwitchName "Default Switch"
# … activation and updates inside the VM, then:
Disconnect-VMNetworkAdapter -VMName "VM-Quarantine"

Stop-VM -Name "VM-Quarantine"
New-VHD -Path "C:\VMs\transfer.vhdx" -SizeBytes 2GB -Dynamic
Mount-VHD "C:\VMs\transfer.vhdx" -Passthru | Initialize-Disk -Passthru | New-Partition -AssignDriveLetter -UseMaximumSize | Format-Volume -FileSystem NTFS -Confirm:$false
# if File Explorer offers to format the disk: Cancel.
# copy the file to the new drive that appears, then:
Dismount-VHD "C:\VMs\transfer.vhdx"
Add-VMHardDiskDrive -VMName "VM-Quarantine" -Path "C:\VMs\transfer.vhdx"
Start-VM -Name "VM-Quarantine"

After the test, delete the transfer disk (C:\VMs\transfer.vhdx) without reopening it on your PC: it may have been changed inside the VM.

Delete a VM when you no longer need it: Stop-VM -Name "VM-Quarantine" -TurnOff, then Remove-VM -Name "VM-Quarantine" -Force, then delete the C:\VMs\VM-Quarantine folder (if a file is "in use", wait a few minutes).

If the shared mailbox does not appear automatically after a restart, add it manually via the Exchange settings.

Send from the shared mailbox (Classic Outlook)

In a new message, click the From: field and select shared@ainos.lu from the drop-down list.

In the new Outlook, shared mailboxes usually appear automatically under “Shared with me” once rights are granted. To add one manually, follow these steps: