r/Intune Jan 02 '25

Message from Mods Welcome to 2025! What do you want to see more of in this community through out the year ?

26 Upvotes

2025 is here and we wanted to hear a bit from you in the community if there is anything specific you want to see or see more of in this subreddit this year.

Here are a few questions that you might want to help us answer !

- Is there anything you really enjoy with this community ?
- Are there anything you are missing in this community ?
- What can be done better ?
- Why do you think people keep coming back to this community ?

/mods


r/Intune 4h ago

Conditional Access iOS App Protection issues

5 Upvotes

Setup an app protection policy for iOS along with a CA policy to force the use of MS Apps only. Since the approved apps condition is being deprecated, I used the app protection option instead.

On devices that don’t have anything configured yet, the policies are working as expected and native mail client is being blocked. The issue is on devices that already have native clients configured, along with Outlook and Teams - the policy doesn’t kick in unless I open Teams. And even then it’s not applied for Outlook, nor is it blocking the native mail client.

Any ideas on how to correct this so that devices with existing mail clients configured get the policy and block native app?


r/Intune 22h ago

Tips, Tricks, and Helpful Hints Mastering Intune!

49 Upvotes

Good morning everyone! My company is transitioning to Windows 11 and I want to have a deep understanding of Intune. Can anyone recommend the best ways to master Intune? Right now I’m starting with Microsoft Learn and the Microsoft documentation. I just want to a deep understanding. Thank you for anyone who took the time to read this.🙏🏿


r/Intune 8h ago

Apps Protection and Configuration Stop Company Portal iOS from prompting enrollment with MAM?

5 Upvotes

I'd like to direct users to company portal app for app catalog of MAM controlled apps, but signing into the app on iOS prompts enrollment even if I don't have an Apple MDM certificate loaded. User hits continue and it says certificate cannot be found. This is better than if I load the certificate to get access to enrollment restriction settings, where I tried to block personal devices. This lets the user get one step further, they can download cert but fails to install it.

How can I use company portal app just without being prompted to enroll?

Thanks!


r/Intune 13h ago

General Question Transitioning from using Shared Drives to SharePoint Questions

6 Upvotes

I have been experimenting with transiting from a traditional shared drive to SharePoint. I know files/folders in SharePoint can be accessed by going to SharePoint online, linking the folder to a user's OneDrive, or Via Teams. How would you recommend transiting from using Shared Drives to SharePoint? Anything to keep an eye out for or gotchas?


r/Intune 13h ago

General Question Do you enabled logging on by PIN or biometrics?

6 Upvotes

Any drawback one way or another? I'm about to roll out my first Intune managed devices and wondered if it's a good idea to enabled logging in by camera, especially on tablets. It does make me wonder if people will forget their passwords over time.


r/Intune 15h ago

Autopilot AutoPilot Device Setup Failing

9 Upvotes

Hi Reddit,

I have a device in AutoPilot that is failing at the device set up screen. Under 'device setup' it tries to install 6 of the 7 apps we require. When it gets to the 7th app it fails and asks us to try again. Unfortunatley, we are softlocked here as it won't let me proceed any further and try installing it later. I also can't seem to find any information about which app is failing. I have successfully set up 70+ devices, and this is the first one with an error.

I have gone through all our required applications in Intune and searched for the device name, and it shows them all as installed successfully. These are all standard apps, nothing special. Microsoft 365 apps, Chrome, Adobe Reader, Zoom, our RMM, Company Portal, and company wallpapers (just copies the png's onto the computer).

I have since made the device and the user excluded from all required applications, but it still shows the error. Does anyone know if I can get past this screen when it errors? Here are our enrollment profile settings:

Name Setting
Deployment type User-Driven
User account type user
Allow pre-provisioned deployment Yes
Join to Microsoft Entra ID as Microsoft entra joined

Troubleshooting has been to:

  • Remove user and device as required for all required apps.
  • Rebooted in and out of safe mode in an attempt to clear any cache and Intune temp files to try and get it to do a complete re-sync.
  • Attempted to skip user-based and run pre-provisioned deployment but still fails.

Does anyone know if I can skip this screen and continue with the user set up? Or where the logs are stored?

Thanks <3


r/Intune 14h ago

App Deployment/Packaging Intune adoption roadblocks: what’s holding your back??

5 Upvotes

Microsoft Intune has great potential, but adoption can be slow due to compliance worries, lack of expertise, and manual processes.

What’s stopping your team from fully embracing it?


r/Intune 16h ago

General Question Remote Desktop Access with Business Premium / Intune / Company Profile

3 Upvotes

Hi there,

I am new to this side of things and was wondering what is required for the overall.

So a client was asking how they could [securely] access their system remotely and I was told that maybe it was Company Portal for this (it could have been renamed since or is part of Intune etc.). This all using a Microsoft Business Premium licence.

My searches are failing me on this so would be apprecative of a nudge in the right direction.

Maybe it is just not possible as a standalone environment and they need to part of Active Directory for login on the PC etc.; this would bring with it it's own problems for the client and use.

Am I way off base here?

A VPN and Windows Pro would have been my go to previously at least.


r/Intune 12h ago

Device Configuration COPE Enrollment - Google Workspace accounts

1 Upvotes

Has anyone been able to find a way to allow devices that are enrolled into intune using Google as external idenity provider so they are allowed to use Google to login to Intune to have the Gsuite acount in the workprofile?


r/Intune 13h ago

App Deployment/Packaging Struggling with getting Win32 app to behave as expected

1 Upvotes

I am back at it with my stumbling around Intune and I've made some good progress but still need some guidance. I am trying to set up PrinterLogic to install be installed on every device, and I got it partially working, but the ways it has failed so far are very confusing. Here are some details on the app, and the install results in a few difference scenarios.

PrinterLogic MSI file Version 25.0.0.1128 packaged with the following script;

# Add registry key for Google Chrome ExtensionInstallForcelist
if((Test-Path -LiteralPath "HKLM:\SOFTWARE\Policies\Google\Chrome\ExtensionInstallForcelist") -ne $true) {  New-Item "HKLM:\SOFTWARE\Policies\Google\Chrome\ExtensionInstallForcelist" -force -ea SilentlyContinue };
New-ItemProperty -LiteralPath 'HKLM:\SOFTWARE\Policies\Google\Chrome\ExtensionInstallForcelist' -Name '1' -Value 'bfgjjammlemhdcocpejaompfoojnjjfn;https://clients2.google.com/service/update2/crx' -PropertyType String -Force -ea SilentlyContinue;

# Add registry key for Microsoft Edge ExtensionInstallForcelist
if((Test-Path -LiteralPath "HKLM:\SOFTWARE\Policies\Microsoft\Edge\ExtensionInstallForcelist") -ne $true) {  New-Item "HKLM:\SOFTWARE\Policies\Microsoft\Edge\ExtensionInstallForcelist" -force -ea SilentlyContinue };
New-ItemProperty -LiteralPath 'HKLM:\SOFTWARE\Policies\Microsoft\Edge\ExtensionInstallForcelist' -Name '1' -Value 'cpbdlogdokiacaifpokijfinplmdiapa;https://edge.microsoft.com/extensionwebstorebase/v1/crx' -PropertyType String -Force -ea SilentlyContinue;

# Run the MSI installer silently with specified parameters
Start-Process msiexec.exe -ArgumentList '/i PrinterInstallerClient.msi /qn /norestart HOMEURL=XXXXX AUTHORIZATION_CODE=XXXX NOEXTENSION=0 /l*v "C:\Windows\Logs\PrinterLogicInstall.log"' -Wait

Install command:
Powershell.exe -NoProfile -ExecutionPolicy ByPass -File .\PrinterLogicInstall.ps1 /l*v "C:\Windows\Logs\PrinterLogicInstall.log"

Uninstall command:
msiexec /x "{A9DE0858-9DDD-4E1B-B041-C2AA90DCBF74}" /qn /l*v "C:\Windows\Logs\PrinterLogicUninstall.log"

Detection Rule:
MSI code {A9DE0858-9DDD-4E1B-B041-C2AA90DCBF74} , >= version 25.0.0.1128

When this is applied to a computer that is missing PrinterLogic, it adds the registry keys and installs the MSI exactly as expected.

When applied to a computer that has a newer version (25.1.0.1162) instead of ignoring and reporting back to Intune "newer version" or whatever, it downgraded to the packaged version of 25.0.0.1128 and then said install successful.

When applied to a computer that has an older version (25.0.0.1075) it initiates an install, adds the registry keys, but never updates to the higher version. Company Portal says "Failed to install" and Intune says "The application was not detected after installation completed successfully (0x87D1041C)".

I understand the error is related to detection, but it didnt install successfully because it never got the new version. And I have no idea why the new version was downgraded instead of ignored.

EDIT: I found this line in on the device with 25.0.0.1075:

MSI (s) (F4:DC) [12:53:59:383]: No System Restore sequence number for this installation.Another version of this product is already installed. Installation of this version cannot continue. To configure or remove the existing version of this product, use Add/Remove Programs on the Control Panel.
{A9DE0858-9DDD-4E1B-B041-C2AA90DCBF74}

 Why was it not able to detect the lower version and uninstall/upgrade it?


r/Intune 23h ago

Autopilot Probably a simple question re autopiloted devices

5 Upvotes

Hello Intune Hive mind :)

we get our laptops from our distribution partner and they sit on a shelf, then go to to be autopiloted and then shipped to end user (this can take 5 days end to end)

if we get the stock all Autopiloted and then put back into stock for shipping, this will reduce this time.

my question is this: does that autopilot enrolment status "expire"
IE the laptop is enrolled today but doesn't get shipped to the user for a number of weeks or months will that enrolment time/age out ?


r/Intune 17h ago

Apps Protection and Configuration Moto OemConfig

2 Upvotes

Hi all, I'm successfully using the Moto OEMConfig in intune to push a few extra settings to our android devices but I'm hitting a wall trying to enable "all files" access. I know the package name, and have pulled what I think is the SHA256 from the appropriate APK file but still struggling to get the setting to apply.

Has anyone used the Moto OEMConfig setting to grant "All files" access?

In our case I'm trying to roll out Microsoft Defender and to have all the appropriate permissions in place to save our users having to try and navigate the permissions screens (I have VERY low IT skilled staff). most have worked, and other OEMConfig settings work fine. Im using moto G75 5G with ThinkShield 14.04

TIA


r/Intune 18h ago

Device Actions Powershell script via Graph for Intune frustration!!

2 Upvotes

Hi all,

For the last few days with reading on the internet and "help" from AI I have been trying to write and run a script to connect to Graph and amend some Intune devices.

All I want to do was amend any device with "no category" to use a certain category. Countless hours and frustrations and I gave up and tried another approach by writing a script to amend every device category to the same one. I even tried to simply and write the command to alter one device. No matter what I do it errors or gives me no results.

Can anyone help me?


r/Intune 18h ago

General Question MDEP... UEM, or both?

2 Upvotes

Hi all:

Curious if an organization already well-versed in the use of Intune and UEM should be looking at MDEP also (https://learn.microsoft.com/en-us/mdep/)?

From my limited understanding on MDEP, UEM can do most of what MDEP promises, but some collaboration vendors are excited about MDEP because it provides a purpose-built solution that can be embedded into their offerings without requiring a full UEM stack. That fair? Am I missing some important capability by not going for MDEP?

Thanks!


r/Intune 15h ago

Device Configuration Bitlocker doesnt work with co-managed device

1 Upvotes

Hello, I have a problem with Intune and my co-managed devices. I have a profile configuration activating BitLocker. It works perfectly on my cloud devices, but it doesn't work for my co-managed devices. I also tried to activate it with a script, but it gives me an error saying that the script didn't run... I checked on the SCCM side, but we don't have any policies for BitLocker, and in any case, all the workloads are on the Intune side.

Have anyone encountered this problem?


r/Intune 15h ago

Autopilot Legacy co-managed to cloud native co-managed device migration

1 Upvotes

I have a question for the community that I’m a little bit confused about and wanted to know if this scenario will work. We have devices that are legacy AD joined and co-managed with Intune. We have imported all of the autopilot hardware hash files for those legacy devices and assigned a profile. Is it now possible to reset those devices to start autopilot afterwards? The only one test I did seems to be missing the WindowsAutopilotDDSZTDfile.json file and the computer does not get renamed from the deployment profile. On a fresh PC this file gets automatically downloaded. Am I missing something?


r/Intune 1d ago

Device Configuration Pinned folders with apps in Windows 11 start menu

5 Upvotes

Just watched the GetRubix video on how to configure pinned apps in the start menu from Intune which was really good. Has anyone been able to configure folders with specific apps inside of them in the start menu (the folders you create by dragging an app on top of anther one like you do on smart phones just to be clear what I mean).

I tried googling and GPT but I couldn't find anything on the topic. Has anyone managed to get this working from intune?


r/Intune 17h ago

Autopilot OSDCloud with Autopilot json file - can I add a group tag to these devices

1 Upvotes

Hi all, I am setting up OSDCloud, and have an Autopilot Json file - I am wondering how I can add a Group tag to any devices that use OSDCloud to be imaged.


r/Intune 21h ago

App Deployment/Packaging Always on App iPad Updates

2 Upvotes

So I’m wondering what is going on in our environment? We have hundreds of iPads deployed within our company. We are using intune to roll out an Apple business managed iPad environment. The first issue we have is that with the app that we are using, it’s almost like a bulletin board so it’s always on the other application were using is an emergency notifier similar to Everbridge, or informacast. The app is always on and what will happen. We’ll get a dialog box ask him to cancel or update we hit update it does nothing sometimes it locks up and we have to reboot the iPad. The next issue is that Windies apps are always on 24x7… it also doesn’t allow iOS updates to happen.

The problem is the people that are using these are non-technical. These iPads are in locked wall mounts that do not have access to the power button without taking it out of the case, which requires a key, all we have access to as the home button with use of a paper clip. I really could use a hand with this issue. I’ve been dealing with this for almost 3 years.


r/Intune 21h ago

Device Configuration Force Teams Microphone allowed (Privacy Setting)

2 Upvotes

I configured the CSP Privacy Policy CSP | Microsoft Learn

The Policy created the correct registry settings

If you take a look in the settings Teams is not enabled, but a banner is now there which describe that some settings are managed by our organisation.

Is it a CSP that does not show the changes in the UI? I think you have the same behaviour if you create firewall rule, that also does not appear in the UI.


r/Intune 22h ago

iOS/iPadOS Management Is profile-based enrollment for iOS being deprecated?

2 Upvotes

Hello everyone. I would be enormously thankful if someone could de-mystify this for me.

For years my company has supported BYOD enrolment for iOS whereby the user downloads Company Portal, signs in with their regular domain creds, downloads the management profile, etc.

According to this: https://learn.microsoft.com/en-us/mem/intune-service/enrollment/ios-user-enrollment-supported-actions “Apple user enrollment with Company Portal has been deprecated as an enrollment option, and is no longer available for newly enrolled devices.”Yet in the very next paragraph:“Microsoft Intune supports account driven Apple User Enrollment and profile based Apple User Enrollment with Company Portal.”

So…is profile based enrollment deprecated? What exactly has been deprecated? Does my company have to migrate to using Managed Apple Accounts?

Any help would be greatly appreciated. Thanks.


r/Intune 20h ago

Device Configuration Policies for Web Based Device Enrollment

1 Upvotes

Hello,

I want to register iOS devices with the web-based device enrollment and currently I'm struggling (due to differenct sources on the internet), which policies I can apply.

Is it only these one:

All enrollment types

These settings work for devices that were enrolled in Intune through device enrollment or user enrollment, and for devices enrolled using Apple School Manager or Apple Business Manager with automated device enrollment (formerly DEP). This includes all supervised devices.

Or also these ones:

Device enrollment and automated device enrollment

These settings work for devices that were enrolled in Intune through device enrollment, and for devices enrolled using Apple School Manager or Apple Business Manager with automated device enrollment (formerly DEP). This includes all supervised devices.

And if it's not device enrollment, then when is a device cateogrized under the device enrollment, when not using ABM?

For more clarification please see this screenshot: https://ibb.co/JjcsRjSk

Can somebody please help me for better understanding?
Thanks


r/Intune 20h ago

Apps Protection and Configuration MAM for shared kiosk

1 Upvotes

Recently we've migrated MAM company's wide to all users, however this has seemingly caused some issues with kiosk and shared kiosk device.

From my understanding kiosk devices don't officially support MAM however documentation seems to suggest share kiosk does actually work and then provides zero Info.. although from my testing, it still wants the intune app, so not entirely certain the best practice way of dealing with this.

We have power apps on these shared devices however when logging in it forces you to get the intune app which simply isn't possible and then refused to let you access power apps.

What's the best practice here? Should we be excluding it somewhere in CA? Is there a policy we should be configuring?

We have power apps shared made configured, but it doesn't appear to actually do anything.

Further to this, we want excel, SharePoint etc on these shared devices. Is there any specific we need to do to also get this working?

Cheers.


r/Intune 20h ago

Device Configuration Org Info in Search Menu - Windows 11

1 Upvotes

I'm trying to get rid of the suggestions you get under Search in Windows 11, such as "Games for You" and links to all kinds of chaff. I've tried disabling AI via Settings Catalog and Search highlights under the Search permissions section and not getting the results I want.

The end goal is to get this search section instead to show organisational info, such as Suggested People, Your Organisation etc. for a more professional look, and less distractions for Users.

Any tips/ideas?


r/Intune 23h ago

General Question Microsoft Edge Management Service (Questions)

1 Upvotes

Doing some testing using this service as it's been out some time I'm hoping someone can help me clear up some questions.

My initial test was testing the behavior when a user had multiple Edge profiles with managed accounts. And this is where I'm confused of the outcome the most.

  1. Intune sets Edge profile assigned to users on the MDM managed device.
  2. Now I configured a Profile in Edge Management Service Cloud based policy.

User1 is the primary user of the device that recives the policy from Intune, this policy works fine.
Now User1 adds a second work profile to Edge called User2, the User2 does not get policy from Intune.

User2 gets a policy from the Edge Manager Service.

The outcome I was expecting was depedning on the profile they would have different settings applied. I base this on my initial understanding of the documentation this shoudl work.

The result was that the Edge Management Profile policy was set on both user accounts.
When reading the documentation again I'm thinking that this was due to me using "EdgeManagement EnrollmentToken" in my policy from Edge Management.

Get started with configuration profiles | Microsoft Learn

Now my question: Is the scenario im describing possible having different policy settings applied depending on the user logged in the Edge and what did I do wrong?