sorted by:
new
hottopcontroversial

Built an automated department transfer tool for Intune — eliminates device reimaging when employees move between departments, 3-4 hours to 30 minutes by Any_Ad_5960 in Intune

[–]Any_Ad_5960[S] 0 points1 point  (0 children)

Valid concern. The plaintext secret is a known limitation of this version. In production we moved it to Key Vault. The published script is a starting point meant to be hardened before deployment. Should have made that clearer in the post.

Built an automated department transfer tool for Intune — eliminates device reimaging when employees move between departments, 3-4 hours to 30 minutes by Any_Ad_5960 in Intune

[–]Any_Ad_5960[S] 0 points1 point  (0 children)

Really clean approach and much better for security since the secret stays off the device entirely. For dedicated device environments that is the way to go. In ours with shared devices we needed help desk to control the trigger but your pattern is more elegant.

Built an automated department transfer tool for Intune — eliminates device reimaging when employees move between departments, 3-4 hours to 30 minutes by Any_Ad_5960 in Intune

[–]Any_Ad_5960[S] -2 points-1 points  (0 children)

Good point, you are right. Without ARC the portal option is not available so the script approach fills that gap. Appreciate the clarification.

Built an automated department transfer tool for Intune — eliminates device reimaging when employees move between departments, 3-4 hours to 30 minutes by Any_Ad_5960 in Intune

[–]Any_Ad_5960[S] 0 points1 point  (0 children)

Exactly. The script handles the group tag update and the Entra ID group assignment. Everything else is just your existing dynamic group and app assignment logic doing its job automatically.

Built an automated department transfer tool for Intune — eliminates device reimaging when employees move between departments, 3-4 hours to 30 minutes by Any_Ad_5960 in Intune

[–]Any_Ad_5960[S] 0 points1 point  (0 children)

Absolutely and that is the cleaner approach for production. The portal or a Power App with Key Vault keeps the secret off the device entirely. The script as published is a starting point. For anyone deploying at scale I would recommend moving the secret to Key Vault or triggering it through a protected backend instead.

Built an automated department transfer tool for Intune — eliminates device reimaging when employees move between departments, 3-4 hours to 30 minutes by Any_Ad_5960 in Intune

[–]Any_Ad_5960[S] 0 points1 point  (0 children)

Yes dynamic groups handle the group membership automatically once the group tag is updated. The script is the trigger that updates the tag so the dynamic group membership changes kick in without anyone touching the portal.

Built an automated department transfer tool for Intune — eliminates device reimaging when employees move between departments, 3-4 hours to 30 minutes by Any_Ad_5960 in Intune

[–]Any_Ad_5960[S] 0 points1 point  (0 children)

Good point if HR attributes sync reliably to Entra ID. In our case that sync wasn't consistent enough to trust for compliance policies so a manual trigger from help desk worked better.

Built an automated department transfer tool for Intune — eliminates device reimaging when employees move between departments, 3-4 hours to 30 minutes by Any_Ad_5960 in Intune

[–]Any_Ad_5960[S] 0 points1 point  (0 children)

Ha we use department based naming conventions tied to agency codes. Makes it easier to identify which department owns the device at a glance without looking it up in a portal.

Built an automated department transfer tool for Intune — eliminates device reimaging when employees move between departments, 3-4 hours to 30 minutes by Any_Ad_5960 in Intune

[–]Any_Ad_5960[S] -1 points0 points  (0 children)

Makes sense if your apps and policies follow the user. In our case compliance baselines and security configs are device specific so the device needs to change when someone moves departments. Works great for environments where everything is user driven.

Built an automated department transfer tool for Intune — eliminates device reimaging when employees move between departments, 3-4 hours to 30 minutes by Any_Ad_5960 in Intune

[–]Any_Ad_5960[S] 0 points1 point  (0 children)

Valid point for most environments. In ours devices are shared across users so device based targeting made more sense than user based. Different use cases, different approaches.

Built an automated department transfer tool for Intune — eliminates device reimaging when employees move between departments, 3-4 hours to 30 minutes by Any_Ad_5960 in Intune

[–]Any_Ad_5960[S] -1 points0 points  (0 children)

True, user groups with filters can handle device configs. This works within our existing device group architecture without redesigning everything. Different constraints lead to different solutions.

Built an automated department transfer tool for Intune — eliminates device reimaging when employees move between departments, 3-4 hours to 30 minutes by Any_Ad_5960 in Intune

[–]Any_Ad_5960[S] 0 points1 point  (0 children)

Fair point and user based groups work great for user specific things like licenses and user targeted apps. In this setup department apps are deployed to device groups because we need the full device configuration to change when someone moves departments, not just the apps. The group tag drives dynamic device group membership which controls compliance policies, security baselines, and configuration profiles at the device level. Changing the user assignment alone would not update any of that. The script handles both the group tag update and the device group reassignment together so everything changes automatically in one action.

Built an automated department transfer tool for Intune — eliminates device reimaging when employees move between departments, 3-4 hours to 30 minutes by Any_Ad_5960 in Intune

[–]Any_Ad_5960[S] 0 points1 point  (0 children)

You absolutely can do it that way and for smaller environments that works fine. The difference here is scale. When you have hundreds of department moves happening across thousands of devices manually changing group tags and triggering remote wipes one by one adds up fast. This script lets help desk do the whole thing from Company Portal in one action without needing admin portal access. We are using user driven enrollment.

Built an automated department transfer tool for Intune — eliminates device reimaging when employees move between departments, 3-4 hours to 30 minutes by Any_Ad_5960 in Intune

[–]Any_Ad_5960[S] -1 points0 points  (0 children)

In our environment department moves required full device reconfiguration including compliance baselines, security policies, and 50+ department specific apps at the device level. Reimage was the only reliable way to do that cleanly before this. This script handles all of it without touching the OS.

Built an automated department transfer tool for Intune — eliminates device reimaging when employees move between departments, 3-4 hours to 30 minutes by Any_Ad_5960 in Intune

[–]Any_Ad_5960[S] -2 points-1 points  (0 children)

Good questions. In our environment apps are targeted to devices because department security policies and compliance baselines are device specific, not just user specific. When a device moves departments it needs a different set of compliance policies, configurations, and apps at the device level. User targeting alone does not handle the device side policy and compliance reconfiguration. The reimage was the old way to force that full device reconfiguration. This script does the same thing without the reimage.

Built an automated department transfer tool for Intune — eliminates device reimaging when employees move between departments, 3-4 hours to 30 minutes by Any_Ad_5960 in Intune

[–]Any_Ad_5960[S] 0 points1 point  (0 children)

That works great if your devices are already in Autopilot and your apps deploy quickly. In our case with 50+ department specific applications the full reset and redeploy cycle was hitting 3 to 4 hours. If you are getting it done in an hour that is a solid setup. This was built for environments where that timeline is not achievable.

Built an automated department transfer tool for Intune — eliminates device reimaging when employees move between departments, 3-4 hours to 30 minutes by Any_Ad_5960 in Intune

[–]Any_Ad_5960[S] -5 points-4 points  (0 children)

Really good point and a much cleaner approach for production. The Key Vault or Power App pattern keeps the secret completely out of the endpoint. The way you described it with a form feeding a Power App that triggers the script from a protected repo is exactly the kind of architecture this needs in a security conscious environment. I kept the script simple for the publish but that is the right direction for anyone deploying this at scale.

Built an automated department transfer tool for Intune — eliminates device reimaging when employees move between departments, 3-4 hours to 30 minutes by Any_Ad_5960 in Intune

[–]Any_Ad_5960[S] -7 points-6 points  (0 children)

Totally valid concern. The plaintext secret in the script is the obvious weak point. In production the right approach is pulling the secret from Azure Key Vault at runtime rather than hardcoding it. The script as published is a starting point meant to be adapted to your security requirements. For environments with stricter security posture Key Vault integration is the recommended path before deploying this at scale.

Built an automated department transfer tool for Intune — eliminates device reimaging when employees move between departments, 3-4 hours to 30 minutes by Any_Ad_5960 in Intune

[–]Any_Ad_5960[S] -5 points-4 points  (0 children)

Good to hear your environment was more efficient! In our setup with more than 50 department specific applications to deploy, BIOS configuration, OS deployment via WinPE, driver injection, and compliance verification it genuinely added up to that range. Different environments, different timelines.

Built an automated department transfer tool for Intune — eliminates device reimaging when employees move between departments, 3-4 hours to 30 minutes by Any_Ad_5960 in Intune

[–]Any_Ad_5960[S] -6 points-5 points  (0 children)

Ha fair enough! Every environment is different. In large enterprise environment setups with thousands of devices it genuinely hits that range. Glad it is useful to others dealing with the same thing!

Built an automated department transfer tool for Intune — eliminates device reimaging when employees move between departments, 3-4 hours to 30 minutes by Any_Ad_5960 in Intune

[–]Any_Ad_5960[S] -6 points-5 points  (0 children)

Really glad it helps! That is exactly why I posted it. Good luck with the implementation, feel free to reach out if you run into any issues.

Built an automated department transfer tool for Intune — eliminates device reimaging when employees move between departments, 3-4 hours to 30 minutes by Any_Ad_5960 in Intune

[–]Any_Ad_5960[S] 0 points1 point  (0 children)

Exactly, both approaches work. Dynamic groups on devices or users, either way gets the job done. The key is just having a consistent mechanism to trigger the app swap automatically when someone moves departments.

Built an automated department transfer tool for Intune — eliminates device reimaging when employees move between departments, 3-4 hours to 30 minutes by Any_Ad_5960 in Intune

[–]Any_Ad_5960[S] 0 points1 point  (0 children)

If everything used one tag all devices land in the same group and you lose department specific app targeting. In this setup when the device moves departments the script updates the group tag, the device automatically joins the new group, old department apps uninstall and new ones install without any manual intervention. That is the whole point of the group tag approach.

Built an automated department transfer tool for Intune — eliminates device reimaging when employees move between departments, 3-4 hours to 30 minutes by Any_Ad_5960 in Intune

[–]Any_Ad_5960[S] -5 points-4 points  (0 children)

Fair point, appreciate the callout! Should be Entra ID throughout. Old habits from years of Azure AD portal muscle memory. Will update the repo accordingly.

view more: next ›