Pinned Posts
Forum Widgets
Latest Discussions
INTUNE: Problems with the Google address (Managed Google Play)
Hello everyone, Ever since we added our email address under “Managed Google Play” (in the Intune Admin Center), we can no longer use that address to sign in to Google, Google Docs, Google Drive, or similar services... Is this normal? - If not, what settings do I need to adjust, and where, to get it working again? The error message looks something like this: "Error message: We’re sorry, but you don’t have access to Google Docs. Please log in to your Admin Console to enable it" Thanks and best regards Chris
RemoteHelp.exe reports FileVersion 10.4.10008.1000 while the product version is 5.2.1037.0
Problem 1 - File Version Because RemoteHelp.exe reports FileVersion 10.4.10008.1000 while the product version is 5.2.1037.0, this makes Intune detection, packaging, inventory reporting, and supersedence unnecessarily difficult. Remote Help publishes release versions such as 5.2.1037.0, but the primary executable reports a different FileVersion (10.4.10008.1000). This prevents administrators from using standard file-version detection methods in Intune, Configuration Manager, and software inventory solutions. Administrators must instead enumerate uninstall registry entries and distinguish between the Burn bundle and MSI entries. Aligning the executable FileVersion/ProductVersion with the published release version would significantly simplify enterprise application management. Remote Help combines both common enterprise packaging mistakes: The executable version doesn't match the advertised product version. The installer creates two uninstall entries with the same DisplayName. Neither issue is fatal, but together they make what should be a trivial Intune detection rule far more complicated than it needs to be. From an enterprise management perspective, this causes several problems: Application detection scripts become more complicated. Supersedence rules are harder to create. Administrators waste time investigating apparent version mismatches. Software inventory reports show different versions depending on which source is queried. Automated packaging systems cannot simply use file versioning. Documentation has to explicitly state "do not use the EXE version". Problem 2 - Duplicate Uninstall entries The Burn bootstrapper situation makes it even more confusing because there are two uninstall entries, both called Remote Help, both reporting version 5.2.1037.0, but representing two different installer components. This isn't unique to Remote Help unfortunately. Microsoft has a history of doing similar things with: Company Portal Teams (various generations) Edge WebView2 Visual Studio bootstrapper installers Azure VPN Client Some Defender components where the executable version represents the underlying codebase rather than the product release version that administrators actually deploy. The file version should be treated as an API contract with administrators. Once an application is broadly managed by enterprises, changing versioning schemes or exposing an internal build number instead of the published product version makes lifecycle management considerably harder than it needs to be. Problem 3 - Unversioned download URL The URL to download the latest version https://aka.ms/downloadremotehelp is only a redirect link, not a versioned artefact. The download URL itself does not expose any metadata about: The current Remote Help version The release date When the installer was last updated Previous versions A changelog Microsoft's documentation simply points administrators to the download link for installation. When you download the 'latest version' you always receive whatever Microsoft currently considers the latest installer, but the URL itself provides no version information. For enterprise deployment scenarios, the ideal solution would be one of: A "What's New" page with version history. A release notes page containing: Version Release date Changes Versioned download URLs, for example: RemoteHelp-5.2.1037.0.exe RemoteHelp-5.2.1037.0.msi Solution? Please can these three problems be resolved to ease some of the unnecessary burden placed on Intune Administrators?Account Protection Policy Unable to Save
I am trying to configure an Account Protection policy to allow but not enforce Windows Hello for Business in my org's tenant. If I configure any of the device- or user-settings, the policy throws an error when trying to save. Two errors actually, both pretty generic. This has been persisting for the last 24hrs. Does anyone know what may be the culprit here?
Android 12 Sign-In Issue with HP Corporate Accounts via Intune Company Portal
Since yesterday, HP employees using older mobile operating systems (Ex. Android 12) have been unable to access Microsoft Outlook and Microsoft Teams on their smart devices. When launching Outlook or Teams, users are prompted to install the Microsoft Intune Company Portal app for authentication and device compliance. However, the latest version of this app appears to require a newer operating system version and is not supported on older devices. As a result, users with devices running Android 12 or earlier cannot complete the authentication process and are unable to use Outlook or Teams. ■ Please provide additional details 1) The issue started yesterday and affects employees using older Android and iOS versions. 2) On iOS devices, users can typically resolve the issue by upgrading to a newer iOS version. 3) However, some Android devices cannot be upgraded further due to manufacturer limitations. 4) For example, Samsung Galaxy Note 10 officially supports Android 12 as its final OS version and cannot be upgraded to Android 13 or later. 5) Because of this limitation, affected Android users are unable to install or use the required Microsoft Intune Company Portal app, which prevents access to Microsoft Outlook and Microsoft Teams. 6) This issue may impact multiple HP employees who are using Android devices that do not support Android 13 or later. Example affected device: Samsung Galaxy Note 10 (Android 12) Affected applications: Microsoft Outlook, Microsoft Teams, and Microsoft Intune Company Portal Business impact: Users cannot access corporate email, messaging, and collaboration services from their mobile devices. I have already posted this issue on the Microsoft Feedback Portal: https://feedbackportal.microsoft.com/feedback/idea/7bba2697-a2a2-f111-85ce-7c1e529382f4 However, this issue cannot be reproduced when using a personal Microsoft account. It only occurs when using an HP corporate email account because HP requires the use of the Microsoft Intune Company Portal app for authentication and device compliance. Since the problem appears to be related to the Intune Company Portal rather than Outlook or Teams themselves, I would like to post this issue here and seek guidance on resolving the Intune Company Portal authentication and compatibility issue affecting Android 12 devices.
IOS Enrollment Policys - User affinity with modern auth, does not work with Company Portal VPP
IOS Enrollment Policys - User affinity with modern auth, does not work with Company Portal VPP I am trying to test the newer iOS Enrollment Policies using User Affinity with Modern Authentication instead of the older Enrollment Profiles. One thing I've noticed is that the "Install Company Portal with VPP" setting exists in Enrollment Profiles, but I don't see an equivalent setting in the new Enrollment Policies. My test Policy configuration is using: User Affinity with Modern Authentication Company Portal deployed as a VPP app I tested deploying Company Portal as a required VPP app, and it installs successfully. However, when I launch Company Portal and sign in with my Entra ID credentials, it immediately prompts me to set up company access and download a management profile. This doesn't seem correct because the device was already enrolled through ADE. If I select Postpone, Company Portal reports that I can't access company resources, and when I check further, it states that the device must be managed before apps can be installed. this has to be a bug or something right? the microsoft docs on this are very confusing or missing details. I also noticed that the device initially appears in Intune/entra as "iPad". After some time, the name eventually updates in entra and intune, However, within the Company Portal app, I end up seeing two devices: "iPad" (This is the Ipad that you're currently using) "ipad123-testing" ( this is the proper name and matches intune / entra) Under Settings > General > VPN & Device Management, I can see the correct Intune management profile installed. Sync and restart actions from Company Portal also work successfully. It appears that Company Portal is not associating itself with the existing ADE enrollment record. Instead, it seems to be attempting a user-driven enrollment workflow on a device that is already enrolled and managed through ADE. Has anyone else seen this behavior when using the new iOS Enrollment Policies with User Affinity and Modern Authentication? its unusable in this state. i saw a random blog about using an app config to set xml for the company portal app but that cant be right for such a vanilla use case? didnt need to do that with the old profiles.I am trying to test the newer iOS Enrollment Policies using User Affinity with Modern Authentication instead of the older Enrollment Profiles. One thing I've noticed is that the "Install Company Portal with VPP" setting exists in Enrollment Profiles, but I don't see an equivalent setting in the new Enrollment Policies. My test Policy configuration is using: User Affinity with Modern Authentication Company Portal deployed as a VPP app I tested deploying Company Portal as a required VPP app, and it installs successfully. However, when I launch Company Portal and sign in with my Entra ID credentials, it immediately prompts me to set up company access and download a management profile. This doesn't seem correct because the device was already enrolled through ADE. If I select Postpone, Company Portal reports that I can't access company resources, and when I check further, it states that the device must be managed before apps can be installed. this has to be a bug or something right? the microsoft docs on this are very confusing or missing details. I also noticed that the device initially appears in Intune/entra as "iPad". After some time, the name eventually updates in entra and intune, However, within the Company Portal app, I end up seeing two devices: "iPad" (This is the Ipad that you're currently using) "ipad123-testing" ( this is the proper name and matches intune / entra) Under Settings > General > VPN & Device Management, I can see the correct Intune management profile installed. Sync and restart actions from Company Portal also work successfully. It appears that Company Portal is not associating itself with the existing ADE enrollment record. Instead, it seems to be attempting a user-driven enrollment workflow on a device that is already enrolled and managed through ADE. Has anyone else seen this behavior when using the new iOS Enrollment Policies with User Affinity and Modern Authentication? its unusable in this state. i saw a random blog about using an app config to set xml for the company portal app but that cant be right for such a vanilla use case? didnt need to do that with the old profiles.
Blocking/Disabling SMS, RCS and iMessage services on a device
Hi all, I'm trying to gather more information on Intune capabilities around blocking or disabling various text messaging services on mobile devices. I have done some research and here are my current understandings: SMS Android: This can be disabled on Samsung Knox Only devices. Not 100% if this means devices that are enrolled via Samsung's Knox enrollment, but that's what it sounds like. iOS: Did not find any capabilities here. iMessage: Android: N/A iOS: This can be disabled on iOS ADE enrollment device, no other types of enrollment support this for iOS. RCS: Android: Need to utilize OEMConfig profiles, which means it's vendor specific. Don't have any details here so not sure which OEMs support this for Android. iOS: N/A Any further information on this would be very appreciated. Thanks, Durango2k13
Intune partner compliance onboarding
Hello, We develop a MDM solution and we would like to become device compliance partner to offer our customers conditionnal access functionality. After filling twice (the first time almost two month ago) the form "Intune partner compliance onboarding request" whose link is available on this page https://learn.microsoft.com/en-us/intune/device-security/compliance/third-party-partners, we didn't get any reply to our request. Would you know if there is any other way to integrate this partnership ? Any contact or anything to get some news about our request ? Thank you for your help. Best regards,
