intune device groups in a hybrid environment with SCCM

[tcable]

Hi

 

Just starting to migrate from on premises SCCM to intune, and most is going well; the only thing that i can't get my head round is how to do dynamic device groups if i want to target software.

 

At the moment, in SCCM, i have device groups based on the OU that the computer is in, be it computer room or department, and that's how it decides what software should be installed on that device.

 

I can't work out how to do that in intune as i can't use OU as a filter, so was wondering how others get round this.

 

I'm looking for something fairly automated like SCCM at the moment, as i know it will either get messy or forgotten if i am left to try and remember it myself.

 

Thanks

[MS2011]

Hi

 

Just starting to migrate from on premises SCCM to intune, and most is going well; the only thing that i can't get my head round is how to do dynamic device groups if i want to target software.

 

At the moment, in SCCM, i have device groups based on the OU that the computer is in, be it computer room or department, and that's how it decides what software should be installed on that device.

 

I can't work out how to do that in intune as i can't use OU as a filter, so was wondering how others get round this.

 

I'm looking for something fairly automated like SCCM at the moment, as i know it will either get messy or forgotten if i am left to try and remember it myself.

 

Thanks

 

Hi

 

I have a similar project to do this summer. I wonder if you can share your experience?

 

Thanks

[CrootUK]

I ended up using collection sync from sccm into groups in azure ad (entra id) to get around this issue.

 

Works super well once you got the config right.

 

https://learn.microsoft.com/en-us/mem/configmgr/core/clients/manage/collections/synchronize-collections-aad-group

Edited July 29, 2023 by CrootUK

[tcable]

For the moment, i have a PowerShell script that populates ad security groups based on the OU, and removes any computers that was in the group but it can't find in the OU. (i.e. any computer objects in the staff computer science OU is put into the staff computer science AD group)

Set as a scheduled task to run every 20 minutes. These groups sync to azure AD and then used in intune where specialist software is deployed to certain groups.

 

works fine as a stop gap for the moment. I do have collections set up in SCCM, however i wanted to avoid using these as i want to phase out SCCM which is likely to go before i get rid of active directory.

Edited March 17, 2024 by tcable