How to Delete Clean Tidy Intune Azure Active Directory Environment | Microsoft Endpoint Manager

How to Delete Clean Tidy Intune Azure Active Directory Environment | Microsoft Endpoint Manager? Clean Intune environment always gives us better deployment results and one of the important steps to keep your environment clean is explained in this post.

This is not the only way to keep your Intune environment clean. Rather you should have regular sanity checks for your environment to make sure that you don’t have duplicate copies of policies and applications.

Moreover, you should take care to avoid duplicate deployments of policies and applications. Duplicate deployments of policies can cause conflicts and could result in unexpected results.

Introduction

We SCCM Admins are familiar with the process of deletion and removal of a device in SCCM and Microsoft Intune. However, we are always not sure when you remove a device from SCCM then that device record will automatically get removed from On-prem Active Directory or not.

The removal or deletion of a device or machine from Active Directory is not SCCM’s responsibility and this should be handled separately by on-prem Active Directory.

So how these operations are handled in the modern device management world in terms of Intune SA (or SCCM Hybrid) and Azure Active Directory. In most of the cases, I have not seen that when you retire and delete a device from Intune, that device record will automatically get purged from Azure Active Directory (AAD).

To have better results for your Compliance/configuration policy and application deployments in the modern device management world, we should ensure that we have a clean environment with clean Azure AD. You can get a better understanding of this issue from the above video tutorial. How to Delete Clean Tidy Intune Azure Active Directory Environment | Microsoft Endpoint Manager?

How to Delete Clean Tidy Intune Azure Active Directory Environment | Microsoft Endpoint Manager
How to Delete Clean Tidy Intune Azure Active Directory Environment | Microsoft Endpoint Manager

How to Delete Clean Tidy Intune Azure Active Directory?

In the above example, Intune console shows me only one device assigned against my user account. Whereas if you look at my Azure AD user ID and check for the devices assigned against my account then you can see there are a total of 3 devices and all the 3 devices have been shown as managed by Intune.

This is not accurate data that is getting reflected in Azure Active Directory. I’m not saying every time this scenario will happen. I’ve seen some devices automatically get removed from Intune and AAD. How to Delete Clean Tidy Intune Azure Active Directory Environment | Microsoft Endpoint Manager?

I suppose we should have a better accuracy/sync between Intune and Azure AD database.  I don’t see a scheduled task in Azure AD to purge the deleted records from Microsoft Intune. I’m not sure whether this is coming in near future or not.

To ensure better results for Intune device management policies, when you delete a device from Intune you should make sure that the device record is removed from Azure AD as well. I’m planning to post a video tutorial to show How to delete a device from Azure AD to have clean and tidy environment.

How to Delete Clean Tidy Intune Azure Active Directory Environment | Microsoft Endpoint Manager
How to Delete Clean Tidy Intune Azure Active Directory Environment | Microsoft Endpoint Manager

Windows 10 Intune Enrollment Manual Process AAD Registration (anoopcnair.com)

Validate Azure AD Dynamic Group Rules | Intune

How to Sync On-Prem AD Users with Azure AD Intune ConfigMgr

Using Azure AD connect you can sync on prem user identities/attributes and passwords to Azure AD. Azure AD connect installation and configuration is very straight forward if we use (express settings 🙂 ).

I’ve a video tutorial here which helps you to understand the AAD connect configuration, How to enable MFA for Azure AD join Windows 10 device and Twitter app integration with Azure AD.

In this post, I’m going to cover two other topics related to Azure AD (AAD) Sync.

  1. Where is the Scheduled Task used to get created for Azure AD?
  2. How to Create a service connection point in on-premises Active Directory?
  3. Video Tutorial – How to Sync On Prem AD User accounts With Azure AD

Windows 10 MDM devices can write back to on prem AD more details available here. AAD Connect is mandatory for the write back feature of Windows 10 devices.  

Earlier versions of Azure AD connect used  Windows task scheduler to schedule the Azure AD sync of on-prem objects and attributes. The latest version of Azure AD connect has a sync engine inbuilt. Hence we won’t find a scheduled task for AAD Connect. 

The new default synchronization frequency is 30 minutes. We can change the AD Sync Schedule using the PowerShell command “Get-ADSyncScheduler” and other parameters documented here. Window  

How to Sync On-Prem AD Users with Azure AD Intune ConfigMgr
How to Sync On-Prem AD Users with Azure AD Intune ConfigMgr

  PS C:\Users\anoop\Desktop> Get-ADSyncSchedulerAllowedSyncCycleInterval            : 00:30:00
CurrentlyEffectiveSyncCycleInterval : 00:30:00
CustomizedSyncCycleInterval         :
NextSyncCyclePolicyType             : Delta
NextSyncCycleStartTimeInUTC         : 26-05-2016 02:06:23
PurgeRunHistoryInterval             : 7.00:00:00
SyncCycleEnabled                    : True
MaintenanceEnabled                  : True
StagingModeEnabled                  : False

I was getting trouble to Create a service connection point in on-premises Active Directory. This service connection point is used for “Connect domain-joined devices to Azure AD for Windows 10 experiences“. I followed the documentation here to configure service connection point in on-prem AD but was getting stuck with PowerShell Commands. I ran the PowerShell commands as per the above documentation however with no luck.

After that, I installed the appropriate version of the Windows Azure Active Directory Module for Windows PowerShell and then . Then tried to run the following PowerShell commands and that worked like a champ !

How to Sync On-Prem AD Users with Azure AD Intune ConfigMgr
How to Sync On-Prem AD Users with Azure AD Intune ConfigMgr
PS C:\Users\anoop\Desktop> Connect-MsolService

PS C:\Users\anoop\Desktop> Import-Module -Name "C:\Program Files\Microsoft Azure Active Directory Connect\AdPrep\AdSyncPrep.psm1"

PS C:\Users\anoop\Desktop> Initialize-ADSyncDomainJoinedComputerSync

cmdlet Initialize-ADSyncDomainJoinedComputerSync at command pipeline position 1
Supply values for the following parameters:
AdConnectorAccount: nair\Anoop
AzureADCredentials
Initializing your Active Directory forest to sync Windows 10 domain joined computers to Azure AD.
Configuration Complete

How to Sync On Prem AD User accounts With Azure AD

httpv://www.youtube.com/watch?v=embed/14kIKSp35Rw
How to Sync On-Prem AD Users with Azure AD Intune ConfigMgr

Resources

Learn How to Setup Dynamic Device Groups in Intune

Learn How to Setup Dynamic Device Groups in Intune? Do you want to add mobile devices automatically to Microsoft Intune Device Groups? Intune Dynamic groups are always a customer request since long back.

This feature is similar to dynamic collections in SCCM/ConfigMgr. There is two way to do it. One is using the Azure AD Premium feature called AAD Dynamic Groups and another one is pretty new in Intune something called Device Group Mapping.

How to add devices/users automatically to Intune Groups using Azure AD Dynamic Groups ?

Learn How to Setup Dynamic Device Groups in Intune?

  1. Login to Azure AD portal (AAD Premium subscription should be there).
  2. Navigate via – Directory –> Groups –> Open the group (MDM Group) –> Configure. Enable Dynamic Group (Only available for AAD Premium subscriptions) Membership –> Add Users where <Department> is equal to “IT”.  In this scenario all the users from IT department will get added to AAD Dynamic Security Group called MDM Groups. Don’t be panic if the group is not reflecting with users immediately, give it some time. It will get updated. 
  3. Once  AAD Dynamic Group is created and updated login to Intune portal (manage.microsoft.com)  and Create a New User Group to fetch all the devices of IT department users.
  4. Whenever new user joins to IT department that user will automatically get added to Intune MDM group as well. Provisioning and de provisioning of groups made easy with this.
Learn How to Setup Dynamic Device Groups in Intune
Learn How to Setup Dynamic Device Groups in Intune

How to Add Devices automatically to Intune Device Groups using Device Group Mapping ?

Learn How to Setup Dynamic Device Groups in Intune?

  1. Click on the Admin tab in Intune console. Navigate via Device Group Mapping – enable Device Group Mapping – Create a Device Group and ADD a CATEGORY to manage device group mapping rules. Once you click on Create Device Group then it will guide you to create one device group.
  2. When every user enrolls (During Enrollment Process) to Intune using the Microsoft Intune Company Portal application, the User will get an extra/additional screen to select “Choose the best category for this device“. Right now, I have only created one category “ADMIN” for users to select. You are free to create Intune device category for each department !!    

SCCM Related Posts Real World Experiences Of SCCM Admins (anoopcnair.com)

SCCM Video Tutorials For IT Pros – HTMD Blog #2 (howtomanagedevices.com)