Search the Community

Received an alert that an (admin) Entra ID account had been assigned the PurviewRoleAssignmentMigrator Role outside of PIM. Further investigation suggests it was initiated by a new Enterprise App called PurviewRoleAssignmentMigrator. As the properties of the APP states "you can't delete this application because it's a Microsoft first party application. Learn more.", this suggests Microsoft has added it. - But of course, I can revoke membership of Role etc. Just wondered if anyone else has detected this recently? Thanks,

Hi all, We're using Riso MFDs, and so are stuck with PaperCut MF (as they only support the "Lite" version of Hive, so we wouldn't be able to monitor copying, and the print quota system on Coreza Print doesn't support manual admin topups). For the last year since moving to Entra+Intune (syncing with the Standard Entra ID method, rather than paying out for an Entra ID DS), we've been working without the user client, and people are checking their balance on the MFD or the web UI. I am starting to investigate once again how to roll out the user client. PaperCut have instructions on how to install it with Intune, but they don't explain any way of getting it to do username matching correctly with Entra-joined machines. At present, it prompts for a username and password because Entra creates the local profile's username based on the Display Name (but without spaces, e.g. if the display name is "John A Smith", it uses "JohnASmith"), so it tries to automatically log in with that and of course fails as the user doesn't exist. Aliases would help (if they could be configured to remove the spaces), but we use RM Unify for account creation/deletion (which names staff accounts as "Mr J Smith") and we have two staff with the same first initial and surname, which would probably make a different local username and presumably cause conflicts when matching the username. Has anyone had success rolling out the PaperCut User Client to Entra-joined machines? Either there's no documentation out there or my Google-fu isn't working on this particular issue. I would hope there was a way it could be configured to check the UPN instead of the local profile's name, e.g. the output of "whoami /UPN" (which would give "[email protected]", which will match the UPN in PaperCut) instead of just "whoami" (which would give "azuread\johnasmith")

Good morning Hive Mind, I'm looking at setting up a server in Azure that will handle Entra Connect, but wanted some advice from anyone that's done this previously. Here's the scenario: - We have an on-prem AD that currently syncs to a 365 tenancy - We will be doing a tenant-to-tenant migration in the near future, so the environment will change - Entra Connect for the on-prem AD is then going to have to point to the new tenant, however... - This isn't the only tenant-to-tenant migration that will happen to this destination, and we don't want the Entra Connect server to be placed on-prem at any one location. We'd rather have it in the cloud on the destination tenant so future on-prem environments can also point to it I'm ready to set up the Azure server, but I wanted to know if anyone had done something similar before I hit 'Create' in case there's anything in particular I need to watch out for. Advice is welcome, thank you in advance!

Hello all, So I'm facing a brick-wall here, and I'm hope someone can provide some insight or advice to get past this issue(s). I work for an organization (education, higher-ed) where I was tasked to assist in the implementation of Intune within our environment as our main MDM. So far we were able to have the iOS/iPad portion configured to the way we want however for Windows-based devices is where we're facing issues where only a select few devices are populating (about 180 devices) however we have more being shown and active in Entra ID. We notice this issue more prominent for lab devices and devices that have been already present in our AD before Intune existed; however some older devices do eventually show up. We're a hybrid environment so we have: -an active hybrid join connector for Intune -we have a GPO running, 'Enable automatic MDM enrollment using Microsoft Entra credentials'. -MDM Scope set to all within Intune -Under Microsoft Entra Join and registration, users may join devices to Microsoft Entra scope is set to all I feel like we could be missing something but I'm not sure what exactly. Has anyone ran into a similar situation or if anyone has advice on what to look into to resolve this? Thank you in advance

Hi, I am hoping I can find some assistance with Apple School Manager and M365 Single Sign on. We currently have a single M365 tenant across the trust, but multiple Apple School Managers. Does anyone know if its possible to enable Single Sign On with multiple ASM's and 1 M365 tenant? My concern is that schools all use a single domain name across all sites, and didnt know how this would affect enabling single sign on. Chris

Couldn't find this online easily so thought I'd post a quick guide to help others. Ran into a situation where I needed security groups via student year and figured I could use the Grade SDS attribute to do it with dynamic security groups in AzureAD/EntraID. You can Use extended attributes in dynamic groups to it was just a case of finding the name and using it in a rule. Some searching found a PowerShell script to pull the attributes back out of Azure so I had an easy reference for the extension names. https://github.com/OfficeDev/O365-EDU-Tools/blob/master/SDS%20Scripts/Get-All_SDS_Attributes.ps1 In the dynamic rule builder, I just added an expression to pick out the year level for each group and made sure the accounts were live: Year1: Rule Syntax: (user.accountEnabled -eq True) -and (user.extension_fe2174665583431c953114ff7268b7b3_Education_Grade -eq "1")

Please excuse my inexperience with most things Microsoft cloud related, I've been working more with on-site OS and application deployment than anything cloud related for far too long. We have received a number of email from a local authority that they have sent as rights protected. The right protection requires our users to authenticate against the LA's tenant. When the user enters their school email address and password to try to authenticate the error we get back (translated by me) says the account (user's school email address) is not recognised and as such is not authorised to use the rights protection {GUID} application. We have reported this back to the sender but they keep saying we should be able to read the emails if we log in. Are there any settings on our tenant that would stop the LA's tenant authenticating one of our users and allowing that user access to the rights protection app?

My org is in the process of preparing for Cyber Essentials and are looking to roll out conditional access policies to lock down BYOD access and ensure that any devices accessing our cloud data are compliant. The hurdle we've found as always is iPads. Co-managing windows devices and enrolling android devices in to Intune has been fine, however we use Jamf School for our iPads and are struggling to find any way that we can enroll them in to intune in order to assign a trusted device based conditional access policy for iOS devices. Without this we can't see any way that we can reliably monitor BYOD iOS devices and force enrollment for personal iPhones. Has anyone else come across this issue and found any sort of solution that doesn't require moving every iPad to Jamf Pro or Intune? We've already moved MDM once a few years ago and it isn't an exercise any of our team are excited at the idea of doing again any time soon.