Katy

Well, I think it might have been a red herring that I had so recently changed the filtering.... the PCs with AUTOPILOTVETOESTS worked after their third re-image from the Windows ISO/delete from Autopilot/re-add to Autopilot, and the laptops eventually synced after 5 restarts and an hour's wait.

Hello, Has anybody else experienced the same issue I am facing, or found a workaround? We have configured the DNS forwarding (so it requires the user to authenticate when they try to access anything filtered in the browser, but it doesn't require this for unfiltered sites e.g. Microsoft.com), however if we have a device which isn't logged on we find it won't check in to Intune, presumably being blocked by Securly (although nothing ever shows up in the Activity log). We can make the device check in if we log on to it and manually sync, but at this point it's installed the admin user's SmartPAC and authenticated. I don't want to have to do this with every device that comes back. Similarly we get AUTOPILOTVETOESTS error when trying to build self-deploying PCs now (but only in 50% of cases), previously these were sporadic, although I've only tried 4 PCs since implementing the DNS setting so not sure if it is related, but we have 260 devices to go out in September. Our devices have the browser extension and Smart PAC but we have added the DNS as a catch-all to make sure anything else on the network still gets filtered as we do not have any traditional on-site appliance any more. There is very little on the Internet about this, very frustrating, so hoping somebody else has got Intune managed devices and the DNS filter method set up? Or do other people have a subnet without the DNS filtering for this kind of thing? Cheers Katy

They have finally updated the status page Securly System Status pointing the blame at AWS

All pages (not just Microsoft) take a long time to load, at which point they either sort-of load or go 504 Gateway Timeout. Blocked sites are still blocked, but the block page either takes ages to load or 504 Gateway Timeout. SharePoint appears to work but then all the page content besides the static header/menu just never loads. The admin interface... 504 gateway timeout. It's a very fun morning to come in to after a late night at the school musical and glad it's only been deployed on 75 devices at the moment, but not a good look to a new customer such as ourselves

I tried this to link mine up to the office TV and it didn't work, but to be fair I didn't put much time into it. Does it also carry audio from the laptop through the USB-C then through the P2425HE out the display port, then into the HDMI on the screen?

I was looking at these (recently got some P2425HE for offices, with P2425H on the Display Port pass-thru), how are you linking the laptops to the Smart boards? We have Promethean ActivPanel LX but I can't think how I'd link this in - USB for the touch is easy, but the display - it's only got HDMI, and the P2425HE only has DP output. Can't really USB-C it as that flakes out when you go more than about 1.8m on the cable. (We currently have PCs connected with HDMI and USB cables, but I want to get a monitor for docking laptops/tablets instead - rather than using the built in laptop display which is never at the right height for DSE requirements, and we don't have departmental offices so classrooms get used for admin work by teachers)

We're iSAMS, with Access Dimensions for the finance system (no idea what it's proper name is, the company is Access Group (of My School Portal etc fame), and we use Focalpoint (web based ordering/expenses) and Dimensions (full fat client for doing the accounts). Can't comment on Access but we've found iSAMS to be good, been using it since about 2016 maybe? Previously used Doublefirst Engage, Phoenix e1 and Phoenix Gold. I think e1 was my favourite (web based, back in 2008) but that doesn't exist any more. We recently moved from self-hosted iSAMS to their cloud hosted, not really noticed any difference in speed or uptime since moving over around November last year. Edit: I should add, we use iSAMS to raise the fee invoices and this has a connector that makes them appear in Dimensions.

We pay in GBP by invoice, direct with FreshDesk. Email them and ask and they'll change your account from card to bank transfer.

There's a few things on the MS docs about what would make an app not show up in the Intune store search, so make sure your app doesn't fall under any of these: The app is not available in US region. The app is not available if there is an age restriction. The app is a paid app, which is not supported.

Assuming your users are all synced from on-prem AD, then logging on using username/password to an Azure AD joined device they will automatically be able to access on-prem domain file shares, printers etc. To have this work if they log in with Windows Hello you need to set up (preferably, as it's the easiest) Cloud Kerberos Trust - as per https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/deploy/hybrid-cloud-kerberos-trust?tabs=intune - basically creates an object in AD and sets a couple of settings in Intune policy. You also need ms-KeyCredentialLink attribute to be writing back from Azure AD to on-prem AD (I think this is configured by default in Azure AD Connect, unless it's a very old configuration). This attribute is where the public key for the Windows Hello lives for the user (the private key being on the specific device).

We are currently in a split, of shared devices being hybrid joined but Configuration Manager managed, 1:1 devices (currently only for staff) are Intune managed and Azure AD joined. With the recent Cloud Trust you can still seamlessly sign on to on-prem resources with a user logged in using Windows Hello (assuming the user is synced from on-prem rather than cloud only), one of the previous sticking points for us (there were ways round this - key trust/certificate trust - but they were not very reliable)

I also have the problem of devices clinging on to far away Unifi APs despite having one AP per room so I've made the changes mentioned by Primus... will see how much of a difference it makes over the next week. I would expect it to make a decent improvement, especially the minimum RSSI.

I don't know what AI they have been using but I'm sure it is not the same one the rest of us have seen! I don't understand this. Having three "learning coaches" means it's not about saving money, as that'd pay for a teacher capable of teaching a class of 20 kids.

Bit of a thread necromancy here but "sort of" - I have just had a load of LX panels with OPS-A boards, and I have got the OPS-A boards onto Intune as dedicated kiosk devices - see https://katystech.blog/mem/promethean-ops I would have thought the panels with built in Android might be enrollable in the same manner. Big word of advice DO NOT block factory reset as if the device disappears from management there isn't a way to factory reset it without going into Android Recovery, and Promethean don't know how to do this (On a mobile it'd be holding Power and a volume key, there is no volume key on the OPS-A. So I have one board that is stuck not properly managed but not resettable.)

I'd do it via a Run registry entry (HKLM\Software\Microsoft\Windows\CurrentVersion\Run), the way I'd deploy it is create an MSI using Advanced Installer (the free version is adequate and is actually free even for commercial use). Then deploy the MSI through Intune (either package as a win32 or use the "Line of Business" app type). That way it can be easily uninstalled by just setting the Intune deployment from "Required" to "Uninstall". Alternatively you can push a PowerShell script to set the reg entry but more difficult to remove unless you write a script that will handle the removal.