Intune - Device Restrictions and Admins

[liamrobinson]

Afternoon all. Apologies if this has already been covered but i couldn't find anything similar to my issue on here.

 

We've had Intune setup since covid, all our Staff and Student Laptops are Azure AD Joined and managed via intune. I did set this up whilst on my own and in a rush to push remote learning so it wasn't the cleanest setup but it has suited us fine but i'm looking for some guidance on how you've correctly locked down your devices.

 

Currently our student devices are secured via a config profile that applies to 'All Students' and staff have a less restrictive policy assigned to 'All Staff', this works okay as they are mainly 1-1 devices, the issues arise when i or my technician login, the device is still restricted as it was from the last user, so we essentially are locked out of settings, cmd etc. We've tried forcing a sync via Intune and via the scheduled task but it doesn't seem to want to update, if we go away and leave it for a few hours it eventually may realise an admin is logged in and grant access, but this can take hours.

 

I'm looking at overhauling my entire intune configuration policies now we have a bit of time as it looks like its come on leaps and bounds in the last 3 years (no more manual CSP mapping!), before I torture myself with how to fix it, has anyone experienced similar?

 

I can imagine those schools that are fully Azure AD would have this issue, so maybe its just me but interested to see what the craic is!

 

Cheers

[Steve21]

Afternoon all. Apologies if this has already been covered but i couldn't find anything similar to my issue on here.

 

We've had Intune setup since covid, all our Staff and Student Laptops are Azure AD Joined and managed via intune. I did set this up whilst on my own and in a rush to push remote learning so it wasn't the cleanest setup but it has suited us fine but i'm looking for some guidance on how you've correctly locked down your devices.

 

Currently our student devices are secured via a config profile that applies to 'All Students' and staff have a less restrictive policy assigned to 'All Staff', this works okay as they are mainly 1-1 devices, the issues arise when i or my technician login, the device is still restricted as it was from the last user, so we essentially are locked out of settings, cmd etc. We've tried forcing a sync via Intune and via the scheduled task but it doesn't seem to want to update, if we go away and leave it for a few hours it eventually may realise an admin is logged in and grant access, but this can take hours.

 

I'm looking at overhauling my entire intune configuration policies now we have a bit of time as it looks like its come on leaps and bounds in the last 3 years (no more manual CSP mapping!), before I torture myself with how to fix it, has anyone experienced similar?

 

I can imagine those schools that are fully Azure AD would have this issue, so maybe its just me but interested to see what the craic is!

 

Cheers

 

Is there anything you think you need to do with a network admin account it?

 

If not can’t you just setup local admin users for that purpose?

 

Steve

[liamrobinson]

Is there anything you think you need to do with a network admin account it?

 

If not can’t you just setup local admin users for that purpose?

 

Steve

 

I suppose that’s an option for us but how are people managing it in general? Our staff have slightly less restrictions than the students, works perfect via GPO as it applies on login but Intune managed devices don’t work as quick (unless I’m missing something) we’d have the same issue if a teacher logged into a machine a student had recently used and be locked down, and vice versa, a student could end up with staff privileges.

 

Maybe intune managed devices should just be 1-1 but then how does this work for shared it suites in fully cloud schools 🤔