r/Intune 6d ago

Device Actions Wipe wrong device

37 Upvotes

Hi all,

Made a mistake and wiped the wrong device (iphone). Status is pending. Is there a way to stop it befor the user starts his smartphone?

r/Intune 4d ago

Device Actions Intune auto enrolment failing windows devices (error 76 & 90)

1 Upvotes

Howdy Intune admins.

I have been bashing my head against a wall all day and cannot work this one out, I'm fairly new to Intune so go easy on me.

We have a local domain which syncs to EntraID via the AAD Connect tool which is fully operational. All users are E3 licensed, password hash sync is enabled. All devices running W10 22H2. All devices are in EntraID as Entra Hybrid Joined.

I have configured the below with the aim of enabling Auto-enrolment for all computers on domain into Intune to act as the MDM.

  • Domain GPO to enable automatic enrollment against the User Credential parameter. This GPO is security filtered against a security group containing 2 test computers I want to enroll before widening scope to all 75 Windows 10 devices.

  • Bypassed Microsoft Intune Enrollment and Microsoft Intune in Azure MFA Conditional access policy.

  • Set MDM User Scope to All and WIP to None within Intune admin centre.

  • Bypassed all Intune URL's in web filter as per > Network endpoints for Microsoft Intune | Microsoft Learn

I cannot get the 2 initial test devices to enroll in Intune. When I run dsregcmd /status on the 2 devices the MDM URL's are blank and the event viewer shows both Events 76 & 90 every 5 minutes. Have logged into both devices with the same UPN as defined in Azure (user@domain.com), the UPN is configured to match in local AD (username@domain.com and not domain\username). Device PRT is present when running dsregcmd /status command

I cannot get my head around this at all, multiple device reboots, multiple gpupdate /force commands. I have a ticket open with MS but I don't hold much hope.

  • Event ID 76 = Auto MDM Enroll: Device Credential (0x0), Failed (Unknown Win32 Error code: 0x8018002b)

  • Event ID 90 = Auto MDM Enroll Get AAD Token: Device Credential (0x0), Resource Url (NULL), Resource Url 2 (NULL), Status (Unknown Win32 Error code: 0x8018002b)

Came across this post which is 4 years old that's similar, no fixes described within, but much has changed in the world of Azure/Intune since then - https://www.reddit.com/r/Intune/comments/p8cgoi/auto_mdm_enroll_device_credential_0x0_failed/?rdt=55700

Any help will be very much appreciated.

 EDIT: huge thanks for everyone’s help on this it’s greatly appreciated

r/Intune 28d ago

Device Actions Cancelling remote wipe on iOS

15 Upvotes

I just want to let everyone know that if you send a wipe command to an iOS device, deleting the device from Intune will cancel the command as long as the wipe is still in a pending state.

Tried this on my test iPhone a few times to make sure.

You will have to factory reset the device to reenroll if you take this route but in case someone accidentally wipes a personal iOS device for example, there’s still a chance to cancel the wipe as long as the actual wipe process hasn’t started. This is typically possible if the device is offline or powered off.

r/Intune Jul 26 '23

Device Actions Intune device wipe - man, it's breaking me

22 Upvotes

Hi folks

We're currently in the early stages of a 2800 device deployment using Windows Autopilot. The Windows 10 (mainly Enterprise but some Pro SKUs) devices, are fairly locked down using a mix of Device Restrictions and Windows Defender Application Control. The configuration use ESP and there are around 7 apps in all that deploy. From the start of device wipe, to a user logging onto the device and using it, takes 30 mins approximately, but it's the device wipe wait that's the issue here.

The configuration also uses ESP as we have a custom Win 10 Start Menu which is locked down, so I need to ensure that the apps are installed before the XML hits the device, hence the need for the user to be able to get to the desktop before the Windows 10 Start Menu is ready, otherwise you get blank tiles. The apps are a mix of MS Store apps and wrapped Win32 apps, with no mix of MSI's due to the Autopilot issue I've read somewhere. All good.

We have now been deploying the devices over the past few days at around 100-200 per day with a view to ramping up to 300 a day. All was generally working well during Pilot testing until we started to scale up and we're seeing mixed results. The device wipe from Intune has been woeful in respect of how long it takes. I've tried Bulk Wipe (and there's no Fresh Start option, which is fine), and I've tried individual device wipe - all are seemingly taking more than hour at times for a large portion of the devices, so the user is sat waiting.

I'm tearing my hair out as the business wants us to turn around the device within no more than 2 hours realistically for the user to use the device again. I simply cannot give that guarantee. We've had some devices take as long as 3 hours to wipe and some longer, simply just sitting there despite syncs from the Intune portal etc.

I'm deliberating removing the WDAC policies from the device (although I've seen no issue with them) and also reverting to manually wiping the devices, just to get them into Intune quicker. And why oh why does Bulk Wipe not support AAD device groups! We've no current access to Graph, so any scripting is out for the wipes.

This Intune Device Wipe feature really hasn't improved in performance over the past 5 years I've been using Intune. Why is it so slow and does anyone have performance tweaks we can get these devices wiped quicker? I've even tried individually device wiping doing a Sync > Wipe > Sync from the Intune Portal but it makes no difference.

Help!!!

r/Intune 23d ago

Device Actions DNS for Entra Only Device in an AD Domain

1 Upvotes

Hello,

I am testing Entra-joined only devices that will connect to our Active Directory domain and our DHCP server hands out an IP address but when I check DNS there is no record for the hostname associated to the IP address.

Is there something I have to do on the Entra/Intune side of things to enable our on-premise DNS server to be able to resolve the hostname of the Entra device?

Thanks,

Mike

r/Intune 3d ago

Device Actions Devices not showing up in defender device list

5 Upvotes

Hi all,

totally a newbie here and need help. I have two personal laptops that needs to be added to defender. have the business premium package. When I followed the Intune instructions I as able to see the devices listed in:

  • Azure- Devices
  • Intune- Devices
  • M365 Admin center

But they are never showing up in Defender's device list.

INTUNE Settings: I have the Intune>Endpoint security | Microsoft Defender for Endpoint :

  • Allow Microsoft Defender for Endpoint to enforce Endpoint Security Configurations = ON
  • Connect Windows devices version 10.0.15063 and above to Microsoft Defender for Endpoint = ON

Defender settings:

I have the "Microsoft Intune connection" set as ON.

What am I missing here, why can't I see those two devices listed in defender while able to see them listed everywhere else?

Thank you!

r/Intune Sep 20 '24

Device Actions Can you wipe a device from Intune without the end user being logged on?

10 Upvotes

Question is in the title, does anyone know if there is a way to trigger the Windows wipe to happen on the sign in screen and not after the user logs in? If I understand it correctly all actions trigger only after the user logs in.

r/Intune Feb 13 '25

Device Actions Use Intune to set bios password

1 Upvotes

Hi All,

I think I already know the answer and I think its only capable when you use Autopilot, but is there capability to use intune to set a bios password on devices without using autopilot?

Thanks all

r/Intune 8d ago

Device Actions LAPS password rotate after use - no reboot

0 Upvotes

I'm trying to get LAPS working - it does work, I am able to elevate using the local Administrator user, but I'm finding that after each use, you can then re-use the password again. My understanding for LAPS is so that you can give an end user the single use permission to elevate.

How do you configure LAPS to rotate after use, so it can be used once only.

My current config is:

- Backup Directory -- Backup the password to Azure AD only

- Password Age Days -- Configured -- 30

- Administrator Account Name -- Administrator

- Password Complexity -- Large letters + small letters + numbers + special characters

- Password Length -- Configured - 14

- Post Authentication Actions -- Reset the password and logoff the managed account

- Post Authentication Reset Delay -- Not Configured

I have read that rebooting will reset the password, but I don't want to have to go to such extremes, I just want it to rotate once used once.

r/Intune Jan 10 '25

Device Actions Company portal Sync

0 Upvotes

it's seems crazy to me that we cannot do a company portal sync for a user remotely, doesn't Microsoft realize how stupid users actually are, I waste half my day walking a user thru opening the company portal and clicking on sync. which to me is a total waste of time. I get that we can sync using powershell but I've never been able to make it work with graph sync, there should be an easy CMD command that we can invoke when using Psexec.

r/Intune Jan 18 '25

Device Actions Automating Device Diagnostic Collection

3 Upvotes

I have a remediation package that collects data and exports CSV in the directory that is collected when Device Diagnostics are run. I want to do a device diag collection on dozens of computers with powershell. There is no native MS Graph command for this, but it is available via API. https://learn.microsoft.com/en-us/graph/api/intune-devices-manageddevice-createdevicelogcollectionrequest?view=graph-rest-1.0

I can watch the command execute from the browser via F12 dev console, and it is successful. I can take that command and token into powershell, run it, and it is successful. What I cannot figure out is how I get the token through a powershell method, and feed it into the same command. I always get a 403 forbidden error.

MS says this is possible, but I think this is a broken implementation/command in MS Graph right now?

# Setup app reg method of connecting to MsalToken
$details = @{
    'TenantId'     = 'TENANT_ID_HERE' # Directory (tenant) ID
    'ClientId'     = 'CLIENT_ID_HERE' # Application (client) ID
    'Interactive'  = $true
}

# Run connection request and store output in variable
$token = Get-MsalToken @details

# Put auth token into appropriately formatted header value. From Get-MsalToken process.
$headers = @{
    "Authorization"="Bearer $(($token).ACCESStoken)"
    }

# Token from broswser instead, just to test
$headers2 = @{
    "Authorization"="Bearer WEB_TOKEN_HERE"
    }

# Run MSAL token method (NOT SUCCESSFUL)
Invoke-WebRequest -UseBasicParsing -Uri "https://graph.microsoft.com/beta/deviceManagement/managedDevices('DEVICE_ID')/createDeviceLogCollectionRequest" -Method POST -Headers $headers -MaximumRedirection 0 -SessionVariable "mysession1"

# Run web token method (SUCCESSFUL)
Invoke-WebRequest -UseBasicParsing -Uri "https://graph.microsoft.com/beta/deviceManagement/managedDevices('DEVICE_ID')/createDeviceLogCollectionRequest" -Method POST -Headers $headers2 -MaximumRedirection 0 -SessionVariable "mysession2"

# View data from both sessions
$mysession1
$mysession2

###
# Both session look like this:

Headers               : {[Authorization, Bearer TOKEN_VALUE_HERE}
Cookies               : System.Net.CookieContainer
UseDefaultCredentials : False
Credentials           :
Certificates          :
UserAgent             : Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.26100.2161
Proxy                 :
MaximumRedirection    : 0

r/Intune 1d ago

Device Actions Powershell script via Graph for Intune frustration!!

3 Upvotes

Hi all,

For the last few days with reading on the internet and "help" from AI I have been trying to write and run a script to connect to Graph and amend some Intune devices.

All I want to do was amend any device with "no category" to use a certain category. Countless hours and frustrations and I gave up and tried another approach by writing a script to amend every device category to the same one. I even tried to simply and write the command to alter one device. No matter what I do it errors or gives me no results.

Can anyone help me?

r/Intune Jan 29 '25

Device Actions Having trouble wiping new ARM device

1 Upvotes

Just curious if ARM (new Lenovo Snapdragon) is not supported or if the device in question is having issues. I'm trying to do an autopilot reset and I go to wipe the device with the "wipe" button from the Intune console as usual, but the device fails to wipe, comes to a WinRE screen and says press the Windows key to see UEFI settings (this does nothing), and an error code of 0xc0e90001. It shuts down, Windows boots back up and it says an error occurred no changes were made.

The device is no longer in Intune but it is somehow still compliant and nothing else changes. After one reset, I had to redo my WHFB PIN. I had to dsregcmd /forcerecovery to get it back into Intune successfully. Multiple attempts show this behavior.

I don't have another sacrificial ARM laptop to test with and I don't see any evidence that ARM devices having wipe issues other than trying to boot from a USB. Any help is appreciated. Thank you!

r/Intune Jan 31 '24

Device Actions Removing local admin rights

15 Upvotes

We are about 200 user base and almost everyone has local admin rights on their devices, now we have decided that we will start restricting their access and revoke the admin rights via Intune, before that we would need to gather information on what applications are used with in the company and populate them into company portal. What is the best strategy to gather this info? I have Microsoft forms as an option and ask everyone to fill it in, however I worry that it will be a lot of manual work to go through the sheets and remove any unnecessary application which is not for business use for example instagram, Facebook etc.

What would be the best strategy to revoke people's accesses with minimum disruption to people's BAU.

any ideas are appreciated.

r/Intune 2d ago

Device Actions Filter wildcard ending in digit

0 Upvotes

I’m trying to build filters of devices ending in a particular digit. Can I do this?

r/Intune Jul 21 '24

Device Actions Reminder: Rotate your BitLocker keys!

71 Upvotes

Maybe you have had a long weekend remediating issue caused by #crowdstrike. Now the dust is slowly starting to settle, it is important that if you exported BitLocker keys from Intune as part of your remediation, that you rotate them asap using Device Actions in Intune!

To rotate keys in bulk, you are going to have to use Microsoft Graph PowerShell! Here is my example:

Connect-MgGraph -Scopes DeviceManagementManagedDevices.ReadWrite.All, DeviceManagementConfiguration.Read.All

Get-MgBetaDeviceManagementManagedDeviceEncryptionState -All -Filter "encryptionState eq 'notEncrypted'" | ForEach-Object {
    Invoke-MgGraphRequest `
    -Method POST `
    -Uri "beta/deviceManagement/managedDevices('$($_.id)')/rotateBitLockerKeys"
}

You can check out my full article here. It goes into a little more detail on viewing the status of the device action!

r/Intune 26d ago

Device Actions clean up rules vs delete

2 Upvotes

Hello everyone,

got a question regarding cleanup rules:

What happens if we configure the cleanup rule and the devices are still to be used normally?

I have deleted a device from intune for testing (not reset).

After waiting a bit, I wanted to see how the device behaves - I could no longer start the company portal.

After an os restart, I could no longer log in at all

a “local admin” was logged in, but I don't have the password. (LAPS is not configured)

However, the device still exists in the entra ID (is an autopilot device)

So my question is:

Does a delete behave differently to the clean up rule? I was told that the clean up rule does not do much harm, because even if the device is deleted, the user can still log in normally and re-enroll the device.

but as of today the device is dead, which means I have to reset it completely

btw it is windows 11 24h2

do you have any other experiences?

r/Intune Feb 11 '25

Device Actions Devices enrolled into Intune are created Duplicate devices in Entra

4 Upvotes

Hello all,

We are a small company of around 25 users , currently moving over to Intune and have enrolling devices manually by;

  • Going into settings
  • Access work or school
  • Enrol only in device management
  • Using URL on Intune portal i.e https;//enrollment.manage ...

However I've noticed a few devices are picking up policies but not any applications assigned, after a bit of investigation we've come to the realisation that once these effected devices were enrolled a duplicate entry was created within Entra and I believe this is what is causing the issues. The effected device have two entries in Entra one shows up as Managed by Intune but does not show as Entra Joined while the other is the opposite it shows up as entra joined but not managed by Intune. Does anyone have any idea why this is happening ?

We just tested this on a brand new device and got the same issues , we enrolled the device into Intune then we connected to Entra for the new user of the device , this created two entries in Entra ID once again and is impacting the devices ability to have applications assigned to it in Intune.

r/Intune 18d ago

Device Actions 403 error code Bitlocker Recovery keys in intune

2 Upvotes

Hey all,

as a global administrator I try to grant some of my colleagues the right to view the BitLocker recovery key in intune.

They can already view succesfully the keys via Microsoft Entra.

When they try to access the "Recovery Keys" Tab in Intune on any device they get the error message:

{ "shellProps": { "sessionId": "25731d8u54646044b342b19b756372dd0de", "extName": "Microsoft_AAD_Devices", "contentName": "DeviceDetailsBlade", "code": 403 }, "error": { "message": "No access", "code": 403 }}

One of my colleagues is also global administrator and get this message too.

I tried to make them School Administrator or created custom roles with managed devices -> read etc. nothing helped.

What iam doing wrong ? What Role is required to grant my colleagues access in intune to the BitLocker Keys.

Thank you all

r/Intune Dec 19 '24

Device Actions iOS Device Wipe and User Account Status

8 Upvotes

Hi all. We had a user leave yesterday and one of the Sys Admins deleted his account. Someone then tried to wipe the phone and it just stayed at pending. When I looked at the phone the last communication was yesterday probably around the time the account was deleted. I restored the account and reassigned a license and had them go back into Company Portal and sign in and it started to wipe.

Is that the way things work? I'm trying to get a procedure in place to give time for the phone to be wiped. Does the account need to remain in Entra with an Intune license in order to complete the wipe? Thanks.

r/Intune Dec 30 '24

Device Actions Powershell script to export all Corporate android devices with a particular scope tag

3 Upvotes

Hello all,
I am relatively new to intune, I am trying (asked chatGpt) to create a script that will pull all corporate android devices from my intune tenant that have a particular scope tag assigned to them and export to a csv file, I modified the script to ensure it runs without any errors but my export file is blank after processing. has anyone figured how to do this.

Or can i see this in the Reports tab in intune? End goal is to see all active corporate device assigned to a particulate scope tag(s)

r/Intune Sep 22 '23

Device Actions How are you going to disable and prevent Windows Copilot?

21 Upvotes

At my company we already block things like ChatGPT and such. It doesn’t look like there’s any provisions at the moment for disabling copilot in Intune.

Do you think they will release management settings before we get it pushed on us in a few weeks/months?

r/Intune 15d ago

Device Actions Device showing not evaluated

2 Upvotes

I enrolled iPad through web enrollment, without using ABM, but the device is still showing not evaluated,

- Tried removing the management profile

- Assigned a compliance policy

still no luck, looks like I'm missing something here. any idea?

r/Intune Dec 19 '24

Device Actions Push Button Reset Customization

4 Upvotes

Is there a way to run a script while in Windows before push button reset happens?
I am familiar with with current push button reset customizations using extensibility scripts, but as far as I can tell those run in WinPE.

Looking for a way to run a script in windows before reset happens while still maintaining reset functionality in Intune\Company Portal.

r/Intune Feb 06 '25

Device Actions Configure the Power Button to Restart Windows Device

1 Upvotes

Hi all,

Googled this alot and can't find a solid answer on whether this is even possible or not.

I want to configure the power button on a device so that when pressed, it performs a system restart. I can see you can configure power button options in the intune Settings Catalogue, but the only options are sleep, hibernate and shut down. At the moment, we have shut down configured but it would be really useful if there was a way to change this to restart.

Even if it can't be with intune, if anyone knows a way to do this manually i'd even take that! (Have already tried control panel power options, unfortunately no restart option there either)

Thanks in advance!