Intune Policies

[maxrebo]

How do you stop a device from picking up a Intune Policy? 

 

Just starting to use Intune in anger in our school after a while...

 

Mistakenly, I've applied a policy to all devices and caused a little panic yesterday!  , I've unapplied this policy by removing the assignment to these PCs.

 

I then check a device and in Device configuration these policies that I've disabled are in there, should they be? when they aren't assigned to this device anymore?

It seems that the Policy is listed for each user that logs in to this machine.

 

Thanks in advance

Edited February 13 by maxrebo

[AlphamaleZed]

in anger lol.

You need to wait 90 mins, depending on how may devices you can bulk sync devices but max 10 which is annoying.

 

i literally just set some policies today and its not the same as gpo policies the sign in page is skewed but got to wait 90 mins across the whole school now!

[maxrebo]

4 minutes ago, AlphamaleZed said:

in anger lol.

You need to wait 90 mins, depending on how may devices you can bulk sync devices but max 10 which is annoying.

 

i literally just set some policies today and its not the same as gpo policies the sign in page is skewed but got to wait 90 mins across the whole school now!

Thanks.

Does it reflect somewhere when the policy hass been applied?

I was assuming that it was in the Device Configuration page? but some of the policies that dont have any devices assigned to them are in there? 

[AlphamaleZed]

5 minutes ago, maxrebo said:

Thanks.

Does it reflect somewhere when the policy hass been applied?

I was assuming that it was in the Device Configuration page? but some of the policies that dont have any devices assigned to them are in there? 

check Devices > Windows Devices then Device Configuration. you can see whats being applied.

 

 

Edited February 13 by AlphamaleZed

[itskdog]

A phrase I often see on r/Intune on Reddit is "The S in Intune stands for speed".

 

There's been a lot of things I've had to learn getting into Intune, mostly patience, and making sure to use a test group first. I've made a clone of our baseline policies and assigned it to my PC, and I always make changes there before changing on the main one that affects all devices.

 

 

[ZeroHour]

Just to say the Device Configuration page there can take a bit to update when changes are applied.

[maxrebo]

So if you want to stop one of these policies being applied how would you do it? remove the Devices from the Group assignment?

 

I only ask as ive doen this and its still showing got specific PCs even though I removed it 2 days ago?!

[ZeroHour]

Yeah you only want devices that need the policy in the group. Excluding devices seems to be glitchy at times where it doesnt remove properly although I was trying to exclude a device that had got that policy already, exclude might work better if the device has never got the policy in the first place.

 

It might be worth spinning a Hyper-V W11 up so you can test quickly with things.

[DavR]

1 hour ago, maxrebo said:

So if you want to stop one of these policies being applied how would you do it? remove the Devices from the Group assignment?

 

I only ask as ive doen this and its still showing got specific PCs even though I removed it 2 days ago?!

 

Removing the devices from assignment should do it, it just takes time.

 

First delay is the waiting for the device to pick up the policy change. 

 

Second delay is then waiting for the device to report that they've picked up the policy change.

 

If the device hasn't been on for enough hours, it may not have done both stages yet. But it will. Probably....

[DavR]

If you happen to have access to the devices which haven't updated the policy change, you can force the update on the device using command line

 

intunemanagementextension://syncapp

 

Or from the settings app: Settings > Accounts > Access work or school, select your account, click Info, and press Sync

 

I'm not sure if there's an equivalent command to force reporting, I generally don't put too much confidence in the reports.

 

[itskdog]

1 hour ago, DavR said:

If you happen to have access to the devices which haven't updated the policy change, you can force the update on the device using command line

 

intunemanagementextension://syncapp

 

Or from the settings app: Settings > Accounts > Access work or school, select your account, click Info, and press Sync

 

I'm not sure if there's an equivalent command to force reporting, I generally don't put too much confidence in the reports.

 

 

I may be wrong, but if I understand the documentation correctly, the former syncs Win32 apps, scripts, and anything else that's handled by IME, the latter syncs policies and LOB apps.

 

The former can also be done via Company Portal, in the settings page there's a "Sync" button (can't 100% remember if that triggers both or just the IME sync).