Microsoft

Microsoft Endpoint Manager Intune Feedback

Suggestion box powered by UserVoice - Update: Microsoft will be moving away from UserVoice sites on a product-by-product basis throughout the 2021 calendar year. We will leverage 1st party solutions for customer feedback. Learn more

How can we improve Microsoft Endpoint Manager Intune?

← Ideas

Add a policy to prevent device unenrollment from Company portal

Companies provide devices to their employees and generally wants to make sure that these devices will always remain managed through Intune. It could be interesting to have a policy that prevent users to unenroll a device identified as a company device from the Intune company portal.

1,073 votes
Vote

We're glad you're here

Please sign in to leave feedback
Signed in as (Sign out)
Close
Close
You have left! (?) (thinking…)
Jean-Baptiste Frossard shared this idea  ·   ·  Flag idea as inappropriate…  ·  Admin →

94 comments

We're glad you're here

Please sign in to leave feedback
Signed in as (Sign out)
Close
Close
Submitting...
An error occurred while saving the comment
  • Mårtin W commented  ·   ·  Flag as inappropriate

    Policy seems to be there but unfortunately not working yet:
    It possible to assign the Company Portal App to users and setting it with an option to not be removable. Unfortunately it's removable on iOS 12.x nevertheless.
    Is it for just working for newer releases? Or is there a different place to set up this functionality rather then in the App assignments section?

  • Vikas commented  ·   ·  Flag as inappropriate

    To uninstall or deactivate the account from this app is really frustrating..

    How to do that to use new company"s account with it???

  • Aaron Couch commented  ·   ·  Flag as inappropriate

    I saw that new Company Portal device enrollment settings were added as part of the Intune 2003 Service Release (March 2020) - https://docs.microsoft.com/en-us/mem/intune/apps/company-portal-app#device-enrollment-setting-options

    However, this new Comp Portal setting equally impacts the Company Portal on both iOS + Android. Would it be possible for Microsoft to allow distinct Company Portal settings for Android vs. iOS?

  • Anonymous commented  ·   ·  Flag as inappropriate

    i'm very happy that you put this functionality in the app/ intune policy's. honestly i didn't expect a reply on this topic after 4.5 years :-)

  • Anonymous commented  ·   ·  Flag as inappropriate

    As already mentioned this is available in AirWatch. We desperately need to be able to prevent users from un-enrolling devices.

  • JoeC commented  ·   ·  Flag as inappropriate

    For supervised iOS devices, we should be able to see the status of the Company Portal installation and initiate the installation of Company Portal if the app has been removed.

    We use DEP and VPP to manage devices and push the Company Portal installation when a phone has completed setup assistant.

    Once a user has been enrolled in Company Portal and receives the profiles (Restrictions, Mail, Wifi, etc), if Company Portal is later uninstalled, those profiles should be removed.

  • Michael van Ee commented  ·   ·  Flag as inappropriate

    This would save a lot of time and irritation in the ICT department. There are always users who don't like "ICT" or need extra space on there smartphone, and just delete the company / work-apps. And sometimes updates can also cause problems with the membership of Intune. This policy would be a nice gift for the holidays.

  • PiersMH-DwrCymru commented  ·   ·  Flag as inappropriate

    Agree this prevention is required, and concur this needs to be implemented for supervised corporate devices.

    In addition to the comments already made, as I can't see this specific item mentioned (specific to iOS):
    There also needs to be a policy to prevent a user from removing the Comp Portal app at all. We can stop icons from being re-arranged but not uninstalled. System apps such as Messages & Photos can't be removed (General > iP* Storage > Comp Portal > Delete app)

    In our example, we remove the ability to factory reset, so if the user removes the portal app, the device can no longer be reset (or at least not very easily). For some of our kiosk devices this effectively bricks a device.

    Please include this as part of the above functionality.

  • Anonymous commented  ·   ·  Flag as inappropriate

    Cathy Moya, here is what I have personally witnessed with the relationship between Intune and Apple devices.

    • The device must be built as a new device, not from an iCloud or iTunes backup to be a supervised device. Unless you use a ridiculous third device work-around.
    o Apple design – restoring from a backup makes it an un-supervised device
    • Un-supervised devices are treated as BYOD. The user has the ability to remove the management profile from the device.
    o Settings > General > Device Management > Management Profile
    o If the device is un-supervised, the user has the ability to remove the profile using “Remove Management”
    • Supervised devices, built as a new device, can be defeated by restoring the device in iTunes, then restoring it from a personal backup.
    o The device will become un-supervised and vulnerable to the above issues

    How can we secure our smartphone environment when users have the ability to remove a corporate owned DEP enrolled device from our control?

  • Alan B commented  ·   ·  Flag as inappropriate

    This is a critical feature for maintaining a mobile estate which is demonstrably compliant to a given governance standard. Tech support just point me to this thread.. I hope this is a priority on the Intune roadmap.

← Previous 1 3 4 5

Ideas: Mobile Device Management (general)

Categories

Feedback and Knowledge Base

(thinking…)