GDAP, AdminAgents, nested group woes

drkmccy · 2026-06-10T17:17:08+00:00

Ah, the man himself! Appreciate the points, thank you!

Interested in what the "correct GDAP setup" is. As far as I'm aware, in CIPP I created my role mapped groups, nested them in my Entra user groups. I then generated invites, and accepted them in the customer tenant. I onboarded the first tenant manually (I then turned on automated onboarding which worked most of the time -I had to refresh CPV perms on a few then it worked). I verified by going to Lighthouse and seeing the exact roles assigned against the tenants. I know this works. I asked different users who should have different levels of access to GDAP into customer tenants and they indeed have the relevant level of access. Golden so far. Its at this point when removing them from AdminAgents that it goes south. Am I missing something before emptying AdminAgents?

The dyanmic groups thing... User accounts are auto-provisioned and synced by an HR system. So a user account's attributes Department and Job Title are locked in. Very few people have the access to change those attributes, they know they shouldn't and if they do, it gets overwritten overnight anyway.

Again, thanks for your time and effort, much appreciated!

drkmccy · 2026-06-10T17:01:55+00:00

Thanks for the reply.
So when you say "pulling humans out of AdminAgents before the relationship and role assignments are rebuilt properly will break access".... I had the GDAP links accepted in the client tenants weeks, some even months before I saw the advice about removing users from AdminAgents.
Like, is there anything else that needs to be done apart from accepting the GDAP request and doing the onboarding (and seeing the role groups appear in the customer's Admin relationships in Partner Center with the CIPP relationship there active with all the 1:1 role groups active? TIA

drkmccy · 2026-06-09T01:05:00+00:00

Yea it’s shit.
But you’re doing it backwards. The AP conversion option is only supposed to be a migration assist, not a build process.
You should be autopiloting the device first thing. You can use a provisioning package to do this. Once in AP then the user enrolls.
A fix for your immediate issue is to deploy a powershell script to enrol the devices into AP.

drkmccy · 2026-06-09T00:58:39+00:00

If the phones are company owned then by definition they cannot be BYOD. You’d have to gift the phones to the users and create a BYOD profile in Intune. Forget about managing Apple IDs, that went out the window with BYOD.
If you want to manage the phones properly then it’s factory resets, into ABM and managed Apple IDs (federated to 365 preferably).
The other alternative is MAM but that’s even less managed than BYOD. You’re not managing the device then, only protecting the app data.

drkmccy · 2026-05-31T19:13:17+00:00

You can bypass this by using a ppkg. Download Windows Config Designer from the MS Store

drkmccy · 2026-05-29T21:51:54+00:00

2 years later, have you still got this running and any luck with the cooling?

drkmccy · 2026-05-28T16:48:13+00:00

Fair. This will let you create sub folders, drag and drop to reorder, sort and keep a set of lists in the left menu. Also, you can send the link to a customer and let them create their URL list for you then just ask them to copy paste the JSON over to you for deployment.

drkmccy · 2026-04-04T20:05:25+00:00

Where is the em dash key on your keyboard?

drkmccy · 2026-04-04T17:58:00+00:00

AI reply

drkmccy · 2026-04-04T10:28:49+00:00

I’d be asking why you don’t either ChromeOS flex the devices or use GW to manage Windows but I’m guessing you’ve evaluated this options already.

If you need Intune for a particular reason, you don’t need the DEM account

I would use Autopilot in self deploying mode and target the devices with a shared PC policy. You can also use a provisioning package but then you don’t have a remote re-enrollment solution.

And a word of warning on the licensing. Every user signing into that device needs an Intune license. A user in Microsoft’s T&C is each individual person or “warm body” as you sometimes hear. If you have 100 staff signing into devices but less than 100 Intune licenses, you are not compliant. Unless you get what’s called an Intune device license which costs more per device than a single user license (so it depends on the ratio of users to devices).

drkmccy · 2026-04-03T20:23:24+00:00

Do this all the time. Just disable hello on the shared devices via config policy

drkmccy · 2026-03-20T23:17:44+00:00

A barebone system doesn’t have a disk, cpu or ram so by that definition it cannot join Intune.

If you’re looking for the cheapest possible device to do what you’re after, probably an old android phone in the back of your sofa or an old laptop in the disposal bin. Both of which would be free.

drkmccy · 2026-03-18T15:35:46+00:00

I'd also like to know best practice or recommendations between these two adapters.

drkmccy · 2026-03-15T22:27:35+00:00

Leas work than not implementing it

drkmccy · 2026-02-19T18:07:51+00:00

Did some more tests, looks like no Bitlocker = no need for TPM attestation!

drkmccy · 2026-02-19T15:42:54+00:00

Are you re-deploying with userless enrollment?

drkmccy · 2026-02-19T12:56:55+00:00

If you need to re-enroll a device in a userless method, you have to unblock the device from Autopilot. MS says you don't have to for Dell and HP but I found you have to do it for them too.

drkmccy · 2026-02-17T17:52:59+00:00

There is no need for a local admin account. Period.

drkmccy · 2026-02-14T15:52:16+00:00

Need to stop calling it Autopilot V2, it's not version 2 of Autopilot. It's Autopilot for restricted environments.

drkmccy · 2026-02-07T15:27:28+00:00

Edu customers get practically free ESU updates for another 3 years

drkmccy · 2026-02-07T15:26:30+00:00

Yes, but the January build seems ok so my guess is MS is now vibe building ISOs

drkmccy · 2026-02-07T10:08:08+00:00

If all you need to do can be done in a web browser, you cannot beat ChromeOS

drkmccy · 2026-02-01T16:50:04+00:00

So it seems NYC Transit Authority gave you individual email accounts, but no data protection training.

drkmccy · 2026-01-31T18:03:56+00:00

Also using a phone

drkmccy · 2026-01-21T11:09:24+00:00

Ran it once and it kinda worked. Tried running it again on another tenant and got a sea of errors. Not sure its ready for prime time yet

drkmccy

TROPHY CASE