User Configuration profiles - Intune

Question

User Configuration profiles - Intune

Johan 21

Hi,

I have some User Configuration profiles in Intune. Example:

Profile type: SCEP certificate, with Certificate type: User
Profile type: VPN (for Always On VPN)

Non of them are being deployed unless I login in the Company Portal app on the machines.

Other machine Configuration profiles are being deployed without needing to login in the Company Portal app. Example:

Profile type: SCEP certificate, with Certificate type: Device
etc....

Do you really need to login in the Company Portal app on the machines to get User Configuration profiles deployed? What if you have not deployed the Company Portal app on the machines, it's not there by default.

Br

0 comments

2 answers

Your answer

Answer 1

Johan 21

Hi,

All Configuration Profiles are deployed to Device groups. When I logon to the device (Windows 10 devices), all Configuration profiles are deployed except the User Configuration profiles (listed above), unless I login in the Company Portal app.

I have also tested to deploy the User Configuration profiles to both User and Device groups, the same result. You need to login in the Company Portal app to get the profiles.

If I understand you right, I need to deploy the User Configuration profiles only to User groups to get it work without need to login in the Company Portal, or?

Br

Lu Dai-MSFT 28,531 Reputation points

2021-11-26T00:46:55.513+00:00

@Johan Yes. Generally, we deploy the User Configuration profiles only to User groups. For windows devices, we only need to use the user account to login in the devices and don't need to login in the company portal app.
Lu Dai-MSFT 28,531 Reputation points

2021-11-29T07:22:11.527+00:00

@Johan Haven't heard from you for some time, is there any other assistance that we can provide? If you have any questions or concerns, please don't hesitate to let me know.
Johan 21 Reputation points

2021-11-29T14:57:14.037+00:00

Hi,

I have found what was causing the issue, it was a Conditional Access policies that require MFA are applied to all cloud apps. The solution is to exclude the Microsoft Intune app from the policies that require MFA to allow device sync by using the user credentials.

A similar issue is described in this article, https://learn.microsoft.com/en-us/troubleshoot/mem/intune/troubleshoot-co-management-auto-enrolling#devices-fail-to-sync-after-auto-enrollment

Thanx for all assistance regarding the issue.

Br
Lu Dai-MSFT 28,531 Reputation points

2021-11-30T00:49:53.757+00:00

@Johan You're welcome. Thanks for your kindness to share the root cause. It will make someone else who has the similar issue pay attention to Conditional Access policies.

Thanks again and have a nice day. : )

Answer 2

@Johan Thanks for posting in our Q&A.

For this issue, if the profile is deployed to user, for windows devices, it is not needed to login in the Company portal app, but it is needed to use the target user login in the device.

For android and iOS devices, it is needed to use the target user to login in the Company portal app. If there is no Company Portal app on the devices, I don't think that the profile will be deployed to the device successfully.

Hope it will help.

If the answer is the right solution, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Share via

User Configuration profiles - Intune

2 answers

Your answer