InTune - Trying to understand

[garethEds]

Hi,

 

I'm still having an issue understanding when configuration policies get applied to devices connected to InTune. Here with an on-premise doman we have: Machine Setting GPOs which is easy enough to understand and then depending on the user type we get settings from either a staff settings GPO or a user settings GPO. These are on shared machines.

 

Does InTune work the same way?

 

I have just made a configuration policy for a machine but can see the need to put some user settings in there - which I didn't think was the right thing to do.

 

So the question is.... if I create a device with machine policies - they will get applied at the machine level. If I then split off the user policies into staff/pupil, when do they get applied? If I log in as a staff user does that configuration policy get downloaded on logon? So any changes come immediately? Example being a configuration policy that allows access to BlueTooth settings - staff can see it on our current domain, but I've set it as a machine setting on InTune so nobody can see it. I want to split that off.

 

Do I then target policies to the user groups instead of the machines?

 

I know how it should work, and how I want it to work - but am I missing something?

 

Cheers

 

Gareth

Edited April 12, 2024 by 6Foot2

[snagrat]

Get applied at the next sync, which could be anything up to 8 hours I believe.

 

If you sign out and in as a Pupil then the Staff policy will remain until the sync runs again and it pulls the pupils config

[garethEds]

That's annoying. I had a pupil log into the test machine and he could see the C drive. Later in the lesson I asked him to do it again and the setting had taken and he couldn't. Bit crap that - but I get it now.

[jslate1980]

Here is a good post explaining the sync process. https://oofhours.com/2024/03/30/when-does-a-windows-client-sync-with-intune/

[PotNoodleTech]

I think Microsoft are still struggling to understand how intune works to be honest. In these days of MDMs and free google for education allowing you to manage a hundred thousand chrome devices a the click of a mouse - Microsoft are retarding ever and ever further backwards.

[mjhardisty]

Because of the synchronisation delay I've chosen to have policies based upon devices rather than users.

[IKWeb]

I think Microsoft are still struggling to understand how intune works to be honest. In these days of MDMs and free Google for education allowing you to manage a hundred thousand chrome devices a the click of a mouse - Microsoft are retarding ever and ever further backwards.

 

A statement I disagree with - if you look at what Microsoft Intune offers vs Google - then yes, it’s going to be a lot more in-depth on what you can do and the number of settings you have at your fingertips. It's going to be huge vs Google and due to this, it is going to take a lot more knowledge to set up and manage.

 

Microsoft’s offering vs Google’s. They are 2 systems you really can’t compare.

 

I have started the migration of 45 schools (part of the same Trust) from on-prem to Intune and to do this I have taken the Microsoft exams around MS Intune and MDM management so I have the skills to be able to do this. Even then it's not been easy and I have had to reach out to others for help, as well as spend hours on testing back and forth.

 

Does Intune still have a way to go – oh heck yes. Is it far superior to Google – 110% (IMO) and do Microsoft get some things wrong – Of course they do – but when you take a step back and look at what advancements have come from Google with Chromebooks / management in the last 5 years which is almost nothing and then look at how far Intune has come in the same timeframe – its night and day.

 

When I see others doing an Intune migration or setting up a system from scratch (not just other schools) but IT people in general - 9 times out of 10 (and I include myself in this) when things go wrong and it's not working its normally down to the fact the person doesn't fully know or understand what they are doing and how that fits in with Intune. My very first step learning curve moving to intune was that it is totally different than having an on-prem setup and you cant treat them the same. or you will go wrong very fast.

[Oaktech]

My gripe is that is really feels like it's designed for 1:1 devices not shared ones.

 

I need Microsoft to understand that all policies and assigned apps need to be complete and available - including onedrive login and applicable sharepoint sync - before the student sees even the desktop like it was with GPO & mapped drives. Whatever MS need to do to achieve that.

[IKWeb]

You can do shared devices OK with intune - you would use OneDrive setup in Files on Demand - I guess as you would with staff these days so it doesn't have to sync everything to the local device.

 

That said tho - I have found these days lost of schools are going down the 1:1 route for devices. student gets a laptop on day 1 in Year 7 and that is then refreshed in year 9 and that lasts them till the end of school and the device is then kept by the kid.

 

IMO schools need to re think devices per user - the days of ICT suites have come to or are coming to an end I think.

 

My gripe is that is really feels like it's designed for 1:1 devices not shared ones.

 

I need Microsoft to understand that all policies and assigned apps need to be complete and available - including onedrive login and applicable sharepoint sync - before the student sees even the desktop like it was with GPO & mapped drives. Whatever MS need to do to achieve that.

[User3204]

... schools are going down the 1:1 route for devices. student gets a laptop on day 1 in Year 7 ...

 

 

But, this is would cost me £50k per year just to buy Chromebooks for all the year 7.

How much money do you have ?

[IKWeb]

But, this is would cost me £50k per year just to buy Chromebooks for all the year 7.

How much money do you have ?

 

The school uses its PP funds but also the parents get involved via 3rd party companies who offer the finance to do this. So not all the cost is put onto the school.

[DrCheese]

Does Intune still have a way to go – oh heck yes. Is it far superior to Google – 110% (IMO) and do Microsoft get some things wrong – Of course they do – but when you take a step back and look at what advancements have come from Google with Chromebooks / management in the last 5 years which is almost nothing and then look at how far Intune has come in the same timeframe – its night and day.

The difference is, Google are getting the basics right.

 

• I can make a change in the Admin console and have it applied 30 seconds later.
  
• I can enrol a device within 20 seconds of unboxing - Even if that device isn't pre-registered in my Google Tenant. With Intune, I have to either get my reseller to pre-enroll in my tenant, or faf about waiting an age for an Autopilot profile to apply.
  
• I don't also have the risk that it fails randomly during Autopilot & need to download various powershell scripts just to figure out what's wrong.
  
• I can do user policies that are different depending on user type and *know* that my students aren't going to get access to things that staff can.
  
• I can lock a lost device out in seconds. I can powerwash a device in the same amount of time.
  
• I can guarantee that low-cost devices will be updated without the user even noticing, unlike with Windows devices
  

 

That Google hasn't really added much in the past 5 years isn't really the point - What they have works. Intune still feels like a beta product & is a shadow of Active Directory. (It hurts me saying this, as it makes me feel like an old man raging against new stuff, when it's actually just rubbish )

 

I am Microsoft's biggest fan - 365 is leaps ahead of Gsuite & I think Android is hot garbage, but I love ChromeOS. I've gutted all the Gsuite stuff from our Chromebooks and essentially made them Winbooks - They log on with Azure & all the shortcuts point to 365.

That Microsoft refuse to make something similar with Edge & keep trying to ram half baked full versions of Windows out for low spec/cheap devices (11se) blows my mind. I would much prefer to go the Microsoft route with 1:1 but right now I would Chromebook all the way.

Edited April 30, 2024 by DrCheese