Forum Discussion

LFagni's avatar
LFagni
Level 2.0: Eclair
2 years ago

Force settings on Dedicated devices during enrollment

Hello all, I'm trying to deploy a Dedicated device profile in Microsoft Intune, I created the configuration profiles and the compliance policy with some settings, in specific about PIN creation an...
Devices
Enrolment
Management
Security
Zero-touch
LFagni's avatar
LFagni
Level 2.0: Eclair
2 years ago

Hi ReeceK , all good here, hope the same on your side.
During the enrollment of standard Corporate Device with Work Profile we're asked to protect the device, just after the device registration.

 

and this is fully fine, same happen on Personally Owned Devices with Work Profile and also on Device Administrators (I'm anyhow working for remove them).

Device administrators are not in GZT so I suppose that the PIN request is part of the standard setup of the device, so I do not understand why it's not requested for dedicated devices.

I created a compliance policy too, that require the presence of a PIN protection, but those devices are marked as non-compliant with no real useful indication about the reason for the users, and PIN need to be created manually for make the devices compliant. 

ReeceK's avatar
ReeceK
Former Community Manager
2 years ago

Hey LFagni 

 

Thanks for reaching out and for the insights you provided. I'll do some research and let you know what I find. I'll also pass on this information to my colleagues to see if they have any input.

 

Your explanation has been really helpful, and I appreciate it. I dont think I have come across this one before. 

 

Thanks again!

Reece

  • LFagni's avatar
    LFagni
    Level 2.0: Eclair
    10 months ago

    Hi ReeceK , do you have any update on this topic?
    I wonder how this is failing for the Dedicated Device profile only.

    Thanks
    /Lucio

    • Moombas's avatar
      Moombas
      Level 4.1: Jelly Bean
      10 months ago

      Isn't the compliance police exactly doing that?
      If a pin is not set the device is highlighted as uncomliant until a pin is set.

       

      On dedicated devices (i think you mean COBO?) you can set the pin via the MDM while on a COPE or BYOD you can force a security password policy which the user has to fulfill in complexitiy and so on. And both take part only after they have been enrolled to the MDM as the settings are rolled out only then.

      • LFagni's avatar
        LFagni
        Level 2.0: Eclair
        10 months ago

        Hi Moombas , thanks for your reply.

        This is exactly my question, compliance policies are really similar, but on the other enrollment profile the user is asked to create a passcode during the device setup, this not happen only for the Dedicated Device ones.

        As example, I just made some fresh test and an S22 configured as Corporate Device with Work Profile on GZT ask to create a passcode after device registration:

        For the Dedicated Device this is not happening at all if I use the Token QR from Intune, and I'm just asked to create one if the profile is assigned from GZT, but as example my policy set a minimum lenght of six chars and other settings, that are just ignored in this phase (now I just tried with a Pixel 8Pro)

         

         


        The device at the end is just not compliant, but the error is not self-explanatory and might create confusion.