Moving to MS Endpoint Manager - your experiences

[Ditto]

I'm looking to people who have moved to using MS Endpoint Manager.

 

 

• What did you have before?
  
• How much work was it to roll-out?
  
• How are things now?
  
• Did you do it fully internally of use outside support?
  

[chaplic]

AD and standard GPOs. 100 pupil school so 40 laptops, 30 ipads.

 

It was lots of work. It's a product that MS are massively improving but it's a HUGE learning curve if you're comfortable with GPOs. I had to write quite a lot of powershell scripts and do some 'interesting' setups to make it work the way it's desired. in some ways it feels more like IaC setup where you get building blocks but assemble it yourself.

 

It's awesome now, I've pretty much automated myself out of a job. New PC just gets signed into AAD and added to a group, all software comes down, might be a manual task to remove crapware.

 

For some reasons updates are more reliable too

 

All acheive with utterly excellent outside support (well, that's me)

[ColonelPanic]

We've used Intune for a couple of years now - it looks after a few things...

 

• iPad MDM - formerly Meraki and Apple Configurator
  
• iMac MDM - formerly Apple configurator/blueprints
  
• AV installation and management with Microsoft Defender
  
• Hybrid enrollment with SCCM for the Windows machines, so no real additional effort once SCCM was talking to AAD.
  
• Remote install of apps (still on top of a golden image though)
  
• Deployment of PowerShell scripts (for random things, adding a scheduled reboot to task scheduler comes to mind)
  
• We autopiloted the DfE Dell Latitudes, as the 64gb emmc storage wouldn't take our image over a USB network adapter - this enrolled into Intune, and installed the O365 suite.
  
• Windows update rings (much like Chaplic) work so much better than disabling updates, or keeping on top of a WSUS library
  

 

Happy to answer any questions, it was all done in house.

[KK20]

if you are moving GPO to intune fully there are a few gotchas, the biggest for us was lack of link order equivalent. you need to be very specific with your intune configurations. Some of our GPOs have gone back to the stone age with intune powershell scripts, this is simply because we need to make sure X is configured before doing Y. Installation of software is also mainly done with powershell scripts - Intune deployment of software is good but very one-shot, redeploying and updating is a bit messy. Another gotcha is no concept of OU in intune, I created a script that sync's our OUs into groups instead, that way I can use these groups within intune and I know they are synced with my AD OU. Autopilot puts its registered devices into a separate AD OU, I move those manually afterwards.

 

Time? im in the middle of it now, it took around a month to sort what GPO I wanted to move then create FRESH intune configurations - I did not attempt to migrate the GPOs as this was a time to thin the GPO herd so to speak. We have decoupled 2 labs from GPO and they are currently running from intune. Im sorting it all out myself.

 

Intune is a lot slower at rolling changes, if you are a gpupdate /force impatient type of person then you are going to struggle.

[MS2011]

We've used Intune for a couple of years now - it looks after a few things...

 

• iPad MDM - formerly Meraki and Apple Configurator
  
• iMac MDM - formerly Apple configurator/blueprints
  
• AV installation and management with Microsoft Defender
  
• Hybrid enrollment with SCCM for the Windows machines, so no real additional effort once SCCM was talking to AAD.
  
• Remote install of apps (still on top of a golden image though)
  
• Deployment of PowerShell scripts (for random things, adding a scheduled reboot to task scheduler comes to mind)
  
• We autopiloted the DfE Dell Latitudes, as the 64gb emmc storage wouldn't take our image over a USB network adapter - this enrolled into Intune, and installed the O365 suite.
  
• Windows update rings (much like Chaplic) work so much better than disabling updates, or keeping on top of a WSUS library
  

 

Happy to answer any questions, it was all done in house.

 

Hi,

 

We are using SCCM and need to move to intune, initially hybrid setup and then fully move to intune.

 

Please advice.

 

Thanks