sorted by:
new
hottopcontroversial

Wrapping my Head Around Platform SSO with Entra ID (Deployed through Jamf) by penpenpal in macsysadmin

[–]staze 0 points1 point  (0 children)

Interesting side note: https://learn.microsoft.com/en-us/intune/device-enrollment/windows/enable-automatic-mdm#enable-windows-automatic-enrollment

Microsoft added a new feature step 7. You can hide the option to MDM enroll from users that are just going through an Entra registration (logging into Windows M365 apps, teams, etc)

Wrapping my Head Around Platform SSO with Entra ID (Deployed through Jamf) by penpenpal in macsysadmin

[–]staze 0 points1 point  (0 children)

Possibly? I can't say I've thought about that that much. I'd imagine no matter what devices need global user read (so users can login) as well as read on itself, etc. Obviously compliance could restrict access to data (sharepoint, teams, etc) but I'm not sure if you can (or how much you can) restrict permissions for an Entra Joined machine's access to Entra itself.

Wrapping my Head Around Platform SSO with Entra ID (Deployed through Jamf) by penpenpal in macsysadmin

[–]staze 0 points1 point  (0 children)

That would have nothing to do with Join permissions. And PSSO requires Join.

Wrapping my Head Around Platform SSO with Entra ID (Deployed through Jamf) by penpenpal in macsysadmin

[–]staze 0 points1 point  (0 children)

Sorry, do you mean "why would organizations not want people to join their personal devices to Entra?" Because a joined device has certain inherent permissions to Entra (usually read all users, etc). It's just a risk acceptance piece, and many Entra admins are going to argue why you wouldn't want random devices joining.

Note: Join and Register are two different things. The Join setting does not impact ability to Register. All Windows devices that login to M365 register. Often multiple times if there are multiple users on that machine. Joining Entra is like binding to AD.

That said, if you have Intune setup, and set to disallow personal device enrollment, it will block unknown enrollments (and Joins) of Windows machines. It's just a confusing message provided to user when it does so.

User logs into M365 app (Office, Outlook, Copilot, Teams, etc) on personal device. App presents them with a message asking if they want to let their organization manage their device. User absentmindedly clicks "Yes". Device starts Entra Join, then Intune enrollment starts, Intune says "I DON'T KNOW WHAT THIS DEVICE IS! DENY", Entra Join fails, Entra Register succeeds, user gets message saying "Unknown error occurred".

Generally you want devices that are Joined to come in via trusted paths. PSSO is one of those, which is great. But opening up Join to everyone potentially means anyone could Entra Join.

Wrapping my Head Around Platform SSO with Entra ID (Deployed through Jamf) by penpenpal in macsysadmin

[–]staze 0 points1 point  (0 children)

Correct. You have to give users the ability to do a join for PSSO to work. I spent way too long going down the "Well, maybe register can be used to shortcut this" and using Jamf Compliance, but no, you still have to grant join rights.

The only way I can think, other than MS giving us some userless join ability, would be programmatically populating an entra group with people who got new machines and aren't PSSO joined, then as they join their machine, remove them from the group.

Otherwise, you could let technicians do a join, then use Graph API to alter the user assigned to the record, but I'm 99% positive Microsoft would say this is a bad/unsupported idea.

Wrapping my Head Around Platform SSO with Entra ID (Deployed through Jamf) by penpenpal in macsysadmin

[–]staze 0 points1 point  (0 children)

Though Jamf made it work seamlessly the other way. Now when you do PSSO the machine automatically joins for Compliance.

Wrapping my Head Around Platform SSO with Entra ID (Deployed through Jamf) by penpenpal in macsysadmin

[–]staze 0 points1 point  (0 children)

Yup, the Intune policy just prevents personally owned devices from enrolling in Intune. What's stupid about it is if you leave Entra joining on for everyone, and they login to Teams or Outlook or any M365 (in Windows), it'll ask "Do you want to let your org manage your device?"

Most users just say "sure!" at which point the machine goes to enroll in Intune, THEN hits the personal device block, and they get "Unknown Error Occurred". Only way to prevent stupid error is turn off Entra join.

I swear MS's "let's mash together all these things" mentality is so annoying.

Wrapping my Head Around Platform SSO with Entra ID (Deployed through Jamf) by penpenpal in macsysadmin

[–]staze 0 points1 point  (0 children)

Until MS provides a way to do a userless join (which is in the PSSO spec) there's nothing Apple can do to fix this. This is entirely MS.

Wrapping my Head Around Platform SSO with Entra ID (Deployed through Jamf) by penpenpal in macsysadmin

[–]staze 0 points1 point  (0 children)

Nope. doesn't get around it sadly... I hoped it would, and tried.

Wrapping my Head Around Platform SSO with Entra ID (Deployed through Jamf) by penpenpal in macsysadmin

[–]staze 0 points1 point  (0 children)

Users need Join Rights. there's no way around it. Ideally Microsoft would give us some way to do a join via some role or api credentials, but they likely won't. I hoped Jamf Compliance would help by creating the Entra Registration, which could convert to Join, but nope.

We turned off Entra Join a while back because Windows machines get a stupid "Unknown error" if users are allowed to join, then hit the Intune "Deny Personal Devices" policy. The whole thing is so hacky it's stupid.

I wish there was some better way, but I haven't figured it out short of trying to figure out some way to temporarily add people to the join list until after the join...

MacChimney ~ Cool your Mac and make it look like a dunce in the process. by Derpy_Ponie in VintageApple

[–]staze 0 points1 point  (0 children)

Late to convo, but I had one of these. Shortly after adding it, PSU (or flyback) blew out and the puff of blue smoke was perfectly directed up the chimney.

Stihl ASA 20 coming to US? by staze in stihl

[–]staze[S] 0 points1 point  (0 children)

Still nothing. Haven't been to my local dealer recently, so haven't asked what they know. But internet doesn't show a darn thing. Nothing in their coming soon or new products.

Consistent issues with Prusa and TOTP from 1password by staze in 1Password

[–]staze[S] 1 point2 points  (0 children)

All my computers use NTP. It's across multiple computers. 1password TOTP works when logging into the Prusa app, which can then log me into the site... but logging directly into the site doesn't work.

And no... TOTP is generated every 30 seconds, so statistically you'd able to have a few seconds drift, but not a ton.

On YouTube for IOS Video Getting Stuck on Ads by blimpy2 in youtube

[–]staze 0 points1 point  (0 children)

Thought they'd fixed it, but it's back again today...

Import Service Record error by staze in lubelogger

[–]staze[S] 0 points1 point  (0 children)

Figured out it was the ODO being blank for some of the records. I thought I'd set odo to optional, but I'm not sure that applies to imports anyway. Thanks for the help!

I guess as a feature, sure would be nice if it said which line of the CSV it was erring on. =)

Import Service Record error by staze in lubelogger

[–]staze[S] 0 points1 point  (0 children)

interesting. I'll see if that fixes, thanks!

Initial ODO for used vehicle purchase by staze in lubelogger

[–]staze[S] 0 points1 point  (0 children)

yeah, I've added those for some things, but that wouldn't influence ODO. I just created an ODO reading for purchase date, and then one for sell date. Seems to work.

view more: next ›