Pros and Cons of Using Microsoft Endpoint Manager Policy Sets Feature

What else can be a great feature in Microsoft Endpoint Manager other than bundling up all the policies and create that “Golden Image” type policy and assign it to the Device or User groups so from an Administrators perspective, you don’t need to individually assign groups in to policies and apps and managing this will be super easy. A great MEM function which is still in Preview though, but I already see great benefits as well as some caveats using it.

Benefits of Using Policy Sets

Most of the organizations when they move from SCCM or from their current management solution to MEM/ Intune, they look for similarities so things can be managed without an additional hassle. In a world where you don’t have MEM Policy Sets feature, you would have apps – each app assigned to a group, device profiles – each one assigned to group/s, Compliance policies – each one assigned to group/s etc. It is an overwhelming task to make sure every policy that’s created, every app that has been added has been assigned to the group/s etc.

The main usage of Policy Sets is very simple to understand. It’s basically bundling up the policies, apps, configuration profiles etc. in one place and from that point onwards, if you have your set of users/ devices that needs to be assigned to those, rather than going to each policy and assigning them, you can go other way round. Assigning the Policy Set to the group/s. Also this is a great feature to set up that SOE level and maintain it as one single entity. You always have the ability to do modifications as you go.

As an example, you can maintain 3 policies for Windows, iOS and Android devices which are manages by MEM.

At this stage, below are available to configure in Policy Sets

• Apps
• App configuration policies
• App protection policies
• Device configuration profiles
• Device compliance policies
• Windows autopilot deployment profiles
• Enrollment status page

Caveats of Using Policy Sets

Microsoft have already identified some known issues with Policy Sets which is basically stopping the administrators to think twice before using it.

In high level,

• Some policies can’t be applied to User groups
• Some apps which will be required by special devices/ users must be added separate to the policy sets

Even in this form, the goal of creating that Super Policy and add all the policies and Apps that needs to go in and then assigning groups (Device or User) is bit dicey as if you assign a device group to the Policy Set object, the underlying policies that needs to be assigned to a user policy will not work. So to overcome this you would introduce chaos by direct assigned policies which are not a part of the policy set.

According to Microsoft documentation, below are the Policy sets issues new to version1910

• The following app types are currently supported by policy sets:
  • iOS/iPadOS store app
  • iOS/iPadOS line-of-business app
  • Managed iOS/iPadOS line-of-business app
  • Android store app
  • Android line-of-business app
  • Managed Android line-of-business app
  • Microsoft 365 Apps (Windows 10)
  • Web link
  • Built-in iOS/iPadOS app
  • Built-in Android app

• Setting a policy set assignment of All Users to Autopilot Profile is unsupported.

• Policy sets have the following enrollment restrictions and Enrollment Status Page (ESP) issues:
  • Restrictions and ESP do not support virtual group assignments.
  • Restrictions and ESP do not strictly support exclusion group assignments.
  • Restrictions and ESP use priority-based conflict resolution. Restrictions and ESP might not be applied to the same users as the rest of a policy set’s payloads if the restrictions and ESP are also targeted by a higher priority restriction and ESP.
  • The default restrictions and ESP cannot be added to a policy set.

• MAM policy types that support policy sets include the following:
  • MAM WIP (Windows) MDM targeted managed app protection
  • MAM iOS/iPadOS targeted managed app protection
  • MAM Android targeted managed app protection
  • MAM iOS/iPadOS targeted managed app configuration
  • MAM Android targeted managed app configuration

• MAM policy types that do not support policy sets include the following:
  • MAM WIP (Windows) targeted managed app protection

• MAM processes policy set assignments as direct assignments for the following policy types:
  • MAM iOS/iPadOS targeted managed app protection
  • MAM Android targeted managed app protection
  • MAM iOS/iPadOS targeted managed app configuration
  • MAM Android targeted managed app configurationIf a policy is added to a policy set that is deployed to a group, the group would show as directly assigned in the workload, not “assigned via the policy set”. As a result of this, MAM does not process group assignment deletions coming from policy sets.

• MAM does not support deployment to All Users and All Devices virtual groups for any policy types.

• The Device Configuration Profile of type “Administrative Templates” cannot be selected as part of a policy set.

The Verdict

I believe Policy Sets are still in Preview because of this situation as they have these known issues than the usages. Everyone’s requirement is not he same and If you can tackle the caveats, you can still use the Policy Sets, but since this is out there for a while now and because Microsoft has identified the issues, they may working on a better version of this that we call can use without any hesitation.

Pros and Cons of Using Microsoft Endpoint Manager Policy Sets Feature – Shehan Perera:[techBlog]