Microsoft Intune - Knowledge Share/Visit?

[Davida1992]

We are a college in the North West of England, with approx 300 iPads currently running on Meraki which we use for MDM. The solution for the most part is pretty robust but our Microsoft Licensing gives us access to InTune. So my task is to setup and configure InTune so that our Service Desk team can start to move our devices over from Meraki to InTune.

 

At the moment without existing feel of iPads we provision them as managed by bringing them back to the office here, connect them to an iMac and wiping them with Apple Configurator 2 which installs our College profile onto them. When they boot up, the profile is applied, the device appears in Meraki and everything is perfect

 

With little knowledge of InTune, I made a profile on InTune, exported the URL and added it to Apple Configurator. Initially this would work and I was getting the device registered in InTune, but being totally honest, I have had nothing but trouble with InTune.

 

I was essentially wondering if anyone else uses InTune in a similar way to us that would be willing to knowledge share/allow us to visit on this? It would be nice to see how others have this setup in education and we can go from there. Thanks in advance

[CHiLL]

We are a college in the North West of England, with approx 300 iPads currently running on Meraki which we use for MDM. The solution for the most part is pretty robust but our Microsoft Licensing gives us access to InTune. So my task is to setup and configure InTune so that our Service Desk team can start to move our devices over from Meraki to InTune.

 

At the moment without existing feel of iPads we provision them as managed by bringing them back to the office here, connect them to an iMac and wiping them with Apple Configurator 2 which installs our College profile onto them. When they boot up, the profile is applied, the device appears in Meraki and everything is perfect

 

With little knowledge of InTune, I made a profile on InTune, exported the URL and added it to Apple Configurator. Initially this would work and I was getting the device registered in InTune, but being totally honest, I have had nothing but trouble with InTune.

 

I was essentially wondering if anyone else uses InTune in a similar way to us that would be willing to knowledge share/allow us to visit on this? It would be nice to see how others have this setup in education and we can go from there. Thanks in advance

How old are the iPads and are they registered in DEP? We migrated from Apple Configurator to InTune (after trialing ZuluDesk and Jamf) before we had our iPads registered in DEP, so we had to connect the iPads to our Mac to install the profile. However with DEP - you don't need to connect it to the Mac. Instead, when you get a new iPad or one gets reset, you just join it to a Wi-Fi network and it automatically automatically talk to Apple, detect DEP and tell you there's a management profile to be installed from Intune. Then the rest is down to how you've configured your groups/settings in Intune.

 

Note I: We restricted our iPads from joining other Wi-Fi networks, so it as only connected to our specified Wi-Fi profile in Intune. However this had a problem where the iPad was either fully reset or had it's network settings reset, it couldn't join the network again because joining Wi-Fi networks was disabled (due to being specified in Intune)...thus it couldn't talk to Intune to get the profile! We had to connect it to the Mac to manually install the profile. We ended up disabling that restriction and used a MAC address blacklist to stop the iPads from being able to join other networks via DHCP in our Ruckus management.

 

Note II: Only iPads newer than a certain age can join DEP. Our iPad 4 (Retina) and iPad Mini 2s are all on DEP. Though some had to be added by the supplier we purchased them from. Newer ones can be added by us.

 

Note III: Once an iPad is in DEP - it can never be removed, even if you come to sell/recycle the iPads - they will always be assigned to your college's DEP. At least that's Apple's official stance at the moment.

[NicholasEsping]

iPads can be removed from DEP. If you are going to sell or recycle your iPads you should definitely release them from your DEP.

[CHiLL]

iPads can be removed from DEP. If you are going to sell or recycle your iPads you should definitely release them from your DEP.

Our reseller told us that they can't be removed from DEP not long ago. I also stumbled across this old Reddit thread about leased iPads and DEP, which seems to suggest that devices can be removed from DEP - but they cannot be added to another organisation's DEP, even if the device is sold/recycled. It is a bit of a mess by the looks of it.

[Andycat]

We remove them all the time, once the pupils have finished paying for them or leave.

[Brimstone]

How old are the iPads and are they registered in DEP? We migrated from Apple Configurator to InTune (after trialing ZuluDesk and Jamf) before we had our iPads registered in DEP, so we had to connect the iPads to our Mac to install the profile. However with DEP - you don't need to connect it to the Mac. Instead, when you get a new iPad or one gets reset, you just join it to a Wi-Fi network and it automatically automatically talk to Apple, detect DEP and tell you there's a management profile to be installed from Intune. Then the rest is down to how you've configured your groups/settings in Intune.

 

Note I: We restricted our iPads from joining other Wi-Fi networks, so it as only connected to our specified Wi-Fi profile in Intune. However this had a problem where the iPad was either fully reset or had it's network settings reset, it couldn't join the network again because joining Wi-Fi networks was disabled (due to being specified in Intune)...thus it couldn't talk to Intune to get the profile! We had to connect it to the Mac to manually install the profile. We ended up disabling that restriction and used a MAC address blacklist to stop the iPads from being able to join other networks via DHCP in our Ruckus management.

 

Instead of manually adding via configurator, create a guest network (if you or your team are deploying them) Create the WiFi Profile in InTune then when you deploy them connect to the guest network and it will then switch to your protected network.

 

Note II: Newer ones can be added by us..

 

Unless using AC2 an end user CANNOT add devices to DEP themselves, they have to request DEP enrolment from the reseller they are buying them from.

 

Note III: Once an iPad is in DEP - it can never be removed, even if you come to sell/recycle the iPads - they will always be assigned to your college's DEP. At least that's Apple's official stance at the moment.

 

Devices in DEP have to be institution owned, if you decide the sell them, you can unassign them from your DEP. You can resassign again (only via AC2) if they need to be DEP enrolled again. You can also override an orIginal DEP request for a new DEP ID, this can only be done via an ASE Reseller though.

[Rob_D]

We use intune to manage a smallish fleet of around 50 ipads. They're a mixture of DEP and Configurator managed devices depending on age.

Are you're ipads issued as 1:1 or shared devices?

I assume you're already signed up for Volume purchasing and/or apple school manager.

 

The one thing we've found is that (even for shared devices) user affinity was a lot more reliable than device affinity.