u/psversiontable

Thanks for chiming in. Is there a public support article about this that we can reference? I have a director requesting a resolution to ask of the new vulnerabilities that showed up on our reports this morning.

Man, it's been bad lately. I guess that's what happens when you fire 30,000 people.

If you're getting MFA prompts, that's pointing to Conditional Access or Azure AD settings more than Intune as the source.

Have you looked at the sign-in logs for one of the users having a problem? That should tell you what's triggering MFA.

That's the way to go. The built in reporting is.... what it is.

Correct. I'm fairly sure that there's no MDM setting to force location services on. It's a privacy concern from Apple's perspective.

Lost Mode is the workaround for this.

Android is just not great to deal with.

You have to deal with different manufacturers' customizations to the OS, a lack of updates and just general inconsistencies across the board.

I agree though, it sounds like this is an issue with Edge and probably worth a support case.

Intune is still, and will continue to be until they have a local agent for macOS, a solution that will meet the bare minimum that many need but not go much beyond that.

Jamf is still the standard for macOS management, as much as I'd like to see MS step it up and compete with them more.

I'd lean on support again and ask to have the request escalated. I've had some trouble with Premier support lately and have had to make multiple requests to get things taken care of.

I don't know for sure if the limit is different on macOS or not, but it doesn't hurt to request some clarification.

I'll second the suggestion to use the enablement package and add that I've had very good luck deploying OS upgrades using Windows Servicing over a Task Sequence.

Edit: And if bandwidth is a concern, you can configure your boundaries and deployments to allow clients to pull the update directly from Microsoft and not over the CMG, which brings your costs down to near zero.

I have to agree with this, it's time consuming and adds potential failure points. At most, add it at the very end.

It's about all you can do, and only works sometimes, but it's worth a try.

I've been having issues in the portal all morning. Searching for devices is very unreliable, and a few other operations are sluggish. Also had to try several times to enroll Windows and iOS devices.

Nothing in the message center for me.

I've gotta be honest here, I've had the opposite experience.

Yes, you have to read the instructions and follow a few extra rules but if you do it right, it's so much easier to manage drivers and firmware on them.

Bonus points given for the lack of any goofball bloatware to make audio and touchpads work

It's a fairly recent addition. Might have been announced at Ignite, but I don't remember. Sometime around summer/fall of last year

Sure, for a criminal case. What if they decided to sue him personally?

All I'm saying here is that leaving the passwords alone generates some risk.

Making sure they're changed before you leave does nothing but help keep you safe

Sure, but if it were me, I wouldn't want to have to prove that I wasn't at Starbucks using their wifi.

Better to avoid it completely and cya.

Let's say some jerk from the company logs in remotely from Starbucks wifi using OP's password to get through the VPN and do bad stuff.

How would OP prove that was someone else?

The right move here is to sit down with someone and let them change the passwords to something OP doesn't know, or don't provide them at all.

Keeping your database separate from the primary site server and redundant on its own is a big component here.

The built in HA feature allows manual failover to a warm spare, for the primary server.

From there, you just need to plan out management and distribution points. That will depend on how much you want to spend, how much you can leverage p2p caching, CMG availability, and what your network topology looks like. Plan for the capacity that you need and then think about redundancy. If every client has a backup source for MP/DP traffic, you should be good.

Happy to help!

One thing to keep in mind is that the quality and behavior of third party Winget packages is all over the place.

Some will present dialogs even if you suppress them and others are designed to be installed in the user scope and not local system.

You'll need to test out each one carefully and deploy them using the right scope. Unfortunately, Winget in its current state isn't a great tool for enterprise deployments. A few tweaks would get it there.

I have something for you. 🙂

https://github.com/zebulonsmith/WingetToMECM

Figuring out who these users are is more of a problem for an identity manager, in reality. Those non-hourly users should be put into a group based on their roles as an employee as part of their onboarding.

You could write some PowerShell to populate a group with users that are associated with a mobile device and rub it on a schedule, I suppose.

If you can't get past Bitlocker recovery, you're looking at a fresh install.

It's a good example of why everyone should supplement Autopilot with some way to handle bare metal osd.

Intune is not Grip Group Policy and you'll be disappointed if you try to build like for like.

Start fresh with it and leave old songs behind. You've probably got 20 year old GPOs out there that nobody can explain. Leave the old dusty condos behind and build better.

This is the answer OP is looking for.

I have no idea why everyone is talking about Applocker. A) It's old and busted, use WDAC instead. B) It doesn't have much to do about delegating admin rights.

I think that the typical number of 'yaddas' is three. So definitely missing that.