Event banner
Event details
Just some feedback around policy... When applying it the first time, it works great. The large settings catalog is amazing. The GPO analytics to convert to policy saves a lot of time migrating... However, anytime you have to change applied policies or revert them, it becomes a VERY inconsistent experience. Sometimes it may undo the change, sometimes it may tattoo, sometimes a non-tattooing policy just may feel like not reverting depending on the device. The last thing I want to tell management if I ever have to revert a policy change is that MAYBE it will revert, Maybe it won't. It depends on how the device is feeling that day....
We really need a better way to identify which policy settings will actually tattoo, or even better yet have none of them tattoo so whatever is set in the policy will be set on the device. Or if there is a way to identify which will tattoo now, I would love to know.
I feel like as Intune policy gets as old as GPO, people are going to end up with a mess of random policies that were created just to overwrite tattooing settings. A web of included/excluded settings.
- Mike-Danoski
Microsoft
Hi James, thank you for the feedback. Where I've seen this is where we don't have a default for a setting, so the setting doesn't have something to fall back to. When a setting is removed from a policy or unassigned, we send a remove command for that CSP node that is acted on at a per-setting basis. Many times, the setting state stays the same, but the enforcement is removed. E.g. if a 20-digit pin is reduced to 6, we won't tell the user to change the pin but the next time they change it they can reduce it if they like. Can you please share some examples of setting types you've experienced tattooing so we can make some improvements? - Well said, James!
- Agree with this - we've had lots of problems undoing Intune policies too
- I have had to assign the same group as an exclusion and that only works some of the time.
- I have had to assign the same group as an exclusion and that only works some of the time.
