NicholasEsping

As long as you BCC the address reply all will go back to only the sender.

A3 incudes Intune and Minecraft licensing and I believe it is also required to do group based license assignments in Azure AD. We run a mix of A3, and A5 licenses. if you use Minecraft or Intune I would definitely go with the A3 at a minimum.

I am not sure I follow with the policy I use when a student tries to open powershell or powershell ise they will see a message saying the app has been blocked. The policy does allow all administrators to still open the applications with elevation. Below is what a student will see if running the policy I posted.

Here's a link to Microsofts documentation. There's a bunch of how to guides to check out depending on your current set up. What is Microsoft Intune | Microsoft Docs

The deny rules are listed as exceptions in the allow all files rule.

Try the one below my original example came from my intune csp file so was missing the AppLockerPolicy Version. I was able to import this example into my group policy editor.

We use applocker. Below is my policy it blocks cmd powershell/powershell ise and registry. [color=#0000FF][font=Consolas]<[/font][/color][color=#800000][font=Consolas]RuleCollection[/font][/color][color=#FF0000][font=Consolas]Type[/font][/color][color=#000000][font=Consolas]=[/font][/color][color=#0000FF][font=Consolas]"Exe"[/font][/color][color=#FF0000][font=Consolas]EnforcementMode[/font][/color][color=#000000][font=Consolas]=[/font][/color][color=#0000FF][font=Consolas]"NotConfigured">[/font][/color][color=#000000][font=Consolas] [color=#0000ff]<[/color][color=#800000]FilePathRule[/color] [color=#ff0000]Id[/color]=[color=#0000ff]"fd686d83-a829-4351-8ff4-27c7de5755d2"[/color] [color=#ff0000]Name[/color]=[color=#0000ff]"(Default Rule) All files"[/color] [color=#ff0000]Description[/color]=[color=#0000ff]"Allows members of the local Administrators group to run all applications."[/color] [color=#ff0000]UserOrGroupSid[/color]=[color=#0000ff]"S-1-5-32-544"[/color] [color=#ff0000]Action[/color]=[color=#0000ff]"Allow">[/color] [color=#0000ff]<[/color][color=#800000]Conditions[/color][color=#0000ff]>[/color] [color=#0000ff]<[/color][color=#800000]FilePathCondition[/color] [color=#ff0000]Path[/color]=[color=#0000ff]"*"[/color] [color=#800000]/[/color][color=#0000ff]>[/color] [color=#0000ff][/color][color=#800000]Conditions[/color][color=#0000ff]>[/color] [color=#0000ff][/color][color=#800000]FilePathRule[/color][color=#0000ff]>[/color] [color=#0000ff]<[/color][color=#800000]FilePathRule[/color] [color=#ff0000]Id[/color]=[color=#0000ff]"ce9d9fd5-d765-48df-b87b-e1bafd5653ed"[/color] [color=#ff0000]Name[/color]=[color=#0000ff]"All files"[/color] [color=#ff0000]Description[/color]=[color=#0000ff]"Allows members of the Everyone group to run applications that are located in any folder."[/color] [color=#ff0000]UserOrGroupSid[/color]=[color=#0000ff]"S-1-1-0"[/color] [color=#ff0000]Action[/color]=[color=#0000ff]"Allow">[/color] [color=#0000ff]<[/color][color=#800000]Conditions[/color][color=#0000ff]>[/color] [color=#0000ff]<[/color][color=#800000]FilePathCondition[/color] [color=#ff0000]Path[/color]=[color=#0000ff]"*"[/color] [color=#800000]/[/color][color=#0000ff]>[/color] [color=#0000ff][/color][color=#800000]Conditions[/color][color=#0000ff]>[/color] [color=#0000ff]<[/color][color=#800000]Exceptions[/color][color=#0000ff]><[/color][color=#800000]FilePublisherCondition[/color] [color=#ff0000]PublisherName[/color]=[color=#0000ff]"O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US"[/color] [color=#ff0000]ProductName[/color]=[color=#0000ff]"MICROSOFT® WINDOWS® OPERATING SYSTEM"[/color] [color=#ff0000]BinaryName[/color]=[color=#0000ff]"cmd.exe">[/color] [color=#0000ff]<[/color][color=#800000]BinaryVersionRange[/color] [color=#ff0000]LowSection[/color]=[color=#0000ff]"*"[/color] [color=#ff0000]HighSection[/color]=[color=#0000ff]"*"[/color] [color=#800000]/[/color][color=#0000ff]>[/color] [color=#0000ff][/color][color=#800000]FilePublisherCondition[/color][color=#0000ff]><[/color][color=#800000]FilePublisherCondition[/color] [color=#ff0000]PublisherName[/color]=[color=#0000ff]"O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US"[/color] [color=#ff0000]ProductName[/color]=[color=#0000ff]"MICROSOFT® WINDOWS® OPERATING SYSTEM"[/color] [color=#ff0000]BinaryName[/color]=[color=#0000ff]"powershell.exe">[/color] [color=#0000ff]<[/color][color=#800000]BinaryVersionRange[/color] [color=#ff0000]LowSection[/color]=[color=#0000ff]"*"[/color] [color=#ff0000]HighSection[/color]=[color=#0000ff]"*"[/color] [color=#800000]/[/color][color=#0000ff]>[/color] [color=#0000ff][/color][color=#800000]FilePublisherCondition[/color][color=#0000ff]><[/color][color=#800000]FilePublisherCondition[/color] [color=#ff0000]PublisherName[/color]=[color=#0000ff]"O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US"[/color] [color=#ff0000]ProductName[/color]=[color=#0000ff]"MICROSOFT® WINDOWS® OPERATING SYSTEM"[/color] [color=#ff0000]BinaryName[/color]=[color=#0000ff]"powershell_ise.exe">[/color] [color=#0000ff]<[/color][color=#800000]BinaryVersionRange[/color] [color=#ff0000]LowSection[/color]=[color=#0000ff]"*"[/color] [color=#ff0000]HighSection[/color]=[color=#0000ff]"*"[/color] [color=#800000]/[/color][color=#0000ff]>[/color] [color=#0000ff][/color][color=#800000]FilePublisherCondition[/color][color=#0000ff]><[/color][color=#800000]FilePublisherCondition[/color] [color=#ff0000]PublisherName[/color]=[color=#0000ff]"O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US"[/color] [color=#ff0000]ProductName[/color]=[color=#0000ff]"MICROSOFT® WINDOWS® OPERATING SYSTEM"[/color] [color=#ff0000]BinaryName[/color]=[color=#0000ff]"reg.exe">[/color] [color=#0000ff]<[/color][color=#800000]BinaryVersionRange[/color] [color=#ff0000]LowSection[/color]=[color=#0000ff]"*"[/color] [color=#ff0000]HighSection[/color]=[color=#0000ff]"*"[/color] [color=#800000]/[/color][color=#0000ff]>[/color] [color=#0000ff][/color][color=#800000]FilePublisherCondition[/color][color=#0000ff]><[/color][color=#800000]FilePublisherCondition[/color] [color=#ff0000]PublisherName[/color]=[color=#0000ff]"O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US"[/color] [color=#ff0000]ProductName[/color]=[color=#0000ff]"MICROSOFT® WINDOWS® OPERATING SYSTEM"[/color] [color=#ff0000]BinaryName[/color]=[color=#0000ff]"regedit.exe">[/color] [color=#0000ff]<[/color][color=#800000]BinaryVersionRange[/color] [color=#ff0000]LowSection[/color]=[color=#0000ff]"*"[/color] [color=#ff0000]HighSection[/color]=[color=#0000ff]"*"[/color] [color=#800000]/[/color][color=#0000ff]>[/color] [color=#0000ff][/color][color=#800000]FilePublisherCondition[/color][color=#0000ff]>[/color] [color=#0000ff][/color][color=#800000]Exceptions[/color][color=#0000ff]>[/color] [color=#0000ff][/color][color=#800000]FilePathRule[/color][color=#0000ff]>[/color] [/font][/color] [color=#0000FF][font=Consolas][/font][/color][color=#800000][font=Consolas]RuleCollection[/font][/color][color=#0000FF][font=Consolas]>[/font][/color]

That shouldn't need to be set when using provisioning packages since the package is enrolling the device. To get the devices to enroll into Intune and not just in Azure do you have Intune set as your MDM under Mobility in Azure AD?

Below is the powershell command I use I have it added in the State Restore section right after Applications and Updates get installed. After running the PowerShell I have the computer reboot and then let it finish the task sequence. I do have to update the package every 6 months as it does have an expiration date. There is no user interaction needed for adding the provisioning package. Add-ProvisioningPackage -Path "\\WDS\DeploymentShare$\Scripts\ProvisioningPackage\AzureEnroll.ppkg" -Quietinstall

Is the device enrolled as a shared device or enrolled by a user?

We use Intune to set up the OneDrive sync built into windows. The policy automatically logs the user in and sets the files as On-Demand. Missed the part about shared drives there is a way to map site libraries as well but I have not tested.

We just use MAK keys while imaging and call to increase the limit when getting close to running out of licenses. I think there is a way to do a version switch using an Intune policy if you do not reimage when purchasing. For licensing we license all of our Full time Staff and receive a student use benefit that has licenses for all of our students. Any account that logs into a Intune joined device should have a Intune license assigned.

Check out the Full Flash Update method to deploy windows with a USB. Capture and apply Windows Full Flash Update (FFU) images | Microsoft Docs

Do you apply any web filtering to the iPads?

You can add a device to more the one group if the autoenroll group doesn't have any assigned policies or anything that will conflict with the group you want it in I would just add the device to both. if you are trying to add to a different dynamic group the device will just need to have whatever property you set in the dynamic rule.

We do the same have a OneDrive account that we move OneDrive files to after they leave for Staff for quick access if someone needs something. Other then that we have retention policies in place for Exchange/Teams/Sharepoint/Yammer to capture everything else.

Do they have them hidden? If you click on the Gear by the Join or create team and choose Manage teams you can see if they have them hidden. Also if the teams are created with School data Sync you may need to have the teacher active the team before they show up for students.

That screenshot is from the intune for education portal right? If you check in Big Intune can you see the if the policy is still being assignd? That policy shows up as a custom csp named something like Deny Adminstrative Apps.

In exchange admin center you can use message trace under mailflow to do this. You would put *@schooldomain.com for the recipient and choose a custom date range.

I am thinking the problem might be all the switches you are using here I have had problems when using more then just the /qn. Are you using the win32 content prep tool or just uploading the msi? If you take your install command and save it as a .cmd and bundle it with the msi you can install using the script in the bundle. GitHub - microsoft/Microsoft-Win32-Content-Prep-Tool: A tool to wrap Win32 App and then it can be uploaded to Intune

I usually bundle the install files msi or exe into an intunewin file with the Win32 content prep tool and deploy them with intune that way. I have done a few msix packages but I think its easier if you don't have to repackage everything.

I am not familiar with Foldr but I package a lot of apps with intune. Can you share how you are packaging the app and what your app settings look like in intune?

I have not tried this but it might work. You could look at making a mail flow rule that has the School Governors as the recipient and then send an incident report to their personal email with the report including who the sender\subject is.

This should be possible. I really haven't found anything I cant do in the Developer program that I can with our Regular Tenant besides access the education specific things like the intune for education portal.