Hopefully someone in the community has observed this behaviour and can shed some light / be a shoulder to cry on....
I'll describe the scenario:
Solely intune managed devices, no SCCM or co-management.
Multi user device, shared with multiple users.
When a user logs into the device, built-in compliance policy runs.
Assigned compliance policy runs.
Each user that logs on, creates an entry in the compliance records for the device (as I would expect).
However, when a user leaves the company, the user object is moved in on premise AD to an OU that is not synchronised by AD connect. It is deleted after a period of time.
When this happens, the object no longer exists in AAD, and so the compliance check for that user can no longer locate that user, displaying it as a 'None' entry where the username once was. This causes the device to go noncompliant in some instances, falling foul of the 'Enrolled User Exists' check.
So.... What is the recommended action here? I can think of a few ways out but none that are a long term resolution:
Convert the multi-user devices to Kiosks (cannot do this as the limitations are too great for user experience and app requirements etc)
Wipe terminal machines every time a new user logs on (unacceptable).
Syncronise the OU that disabled users are moved to, keeping them in AAD (poses problem when they are finally deleted though).
Never delete users from AD (security risk).
Are we doing something fundamentally wrong here and has anyone else experienced this?
