Add a policy to prevent device unenrollment from Company portal
Companies provide devices to their employees and generally wants to make sure that these devices will always remain managed through Intune. It could be interesting to have a policy that prevent users to unenroll a device identified as a company device from the Intune company portal.
I can confirm that we have this on our plan for early in 2020/ Thanks for your patience!
Aaron Couch commented
I saw that new Company Portal device enrollment settings were added as part of the Intune 2003 Service Release (March 2020) - https://docs.microsoft.com/en-us/mem/intune/apps/company-portal-app#device-enrollment-setting-options
However, this new Comp Portal setting equally impacts the Company Portal on both iOS + Android. Would it be possible for Microsoft to allow distinct Company Portal settings for Android vs. iOS?
Checkout this new MDM tool we are using, they have 1000s of built in policies including preventing user to unenroll.
Vadivelu Balusamy commented
Cathy, We didn't find any roadmap in MS portal as of now.
i'm very happy that you put this functionality in the app/ intune policy's. honestly i didn't expect a reply on this topic after 4.5 years :-)
This is a must have feature! Please take this seriously.
Davide Gatti commented
4 years and no certainty if this features will ever be created ......
As already mentioned this is available in AirWatch. We desperately need to be able to prevent users from un-enrolling devices.
For supervised iOS devices, we should be able to see the status of the Company Portal installation and initiate the installation of Company Portal if the app has been removed.
We use DEP and VPP to manage devices and push the Company Portal installation when a phone has completed setup assistant.
Once a user has been enrolled in Company Portal and receives the profiles (Restrictions, Mail, Wifi, etc), if Company Portal is later uninstalled, those profiles should be removed.
Michael van Ee commented
This would save a lot of time and irritation in the ICT department. There are always users who don't like "ICT" or need extra space on there smartphone, and just delete the company / work-apps. And sometimes updates can also cause problems with the membership of Intune. This policy would be a nice gift for the holidays.
Agree this prevention is required, and concur this needs to be implemented for supervised corporate devices.
In addition to the comments already made, as I can't see this specific item mentioned (specific to iOS):
There also needs to be a policy to prevent a user from removing the Comp Portal app at all. We can stop icons from being re-arranged but not uninstalled. System apps such as Messages & Photos can't be removed (General > iP* Storage > Comp Portal > Delete app)
In our example, we remove the ability to factory reset, so if the user removes the portal app, the device can no longer be reset (or at least not very easily). For some of our kiosk devices this effectively bricks a device.
Please include this as part of the above functionality.
Cathy Moya, here is what I have personally witnessed with the relationship between Intune and Apple devices.
• The device must be built as a new device, not from an iCloud or iTunes backup to be a supervised device. Unless you use a ridiculous third device work-around.
o Apple design – restoring from a backup makes it an un-supervised device
• Un-supervised devices are treated as BYOD. The user has the ability to remove the management profile from the device.
o Settings > General > Device Management > Management Profile
o If the device is un-supervised, the user has the ability to remove the profile using “Remove Management”
• Supervised devices, built as a new device, can be defeated by restoring the device in iTunes, then restoring it from a personal backup.
o The device will become un-supervised and vulnerable to the above issues
How can we secure our smartphone environment when users have the ability to remove a corporate owned DEP enrolled device from our control?
Alan B commented
This is a critical feature for maintaining a mobile estate which is demonstrably compliant to a given governance standard. Tech support just point me to this thread.. I hope this is a priority on the Intune roadmap.
Jason Lazerus commented
Any updates on this? For corporate devices, this is a must. Removal should be doable at the console level.
Minh H. commented
We would need to have that feature. We don't want user to be able to remove the profile that approves access of Intune to manage the device. Otherwise, corporate device may become personal device. However we should be able to remove profile only by using some kind of admin account (but not the current local admin account). Can you suggest something to implement that?
Anything new about this? Seems like a sorely needed feature!
Jo Below commented
any progress on this? If corporate (company) owned, I think only domain admins or InTune admins should be able to unenroll (disconnect) the service.
Is this still on-going, it would be great to have this in place for our company with >3000 managed devices.
Odd, If you are speking of iOS devices and you are using DEP this is already baked in.
Device enrollment - Apple enrollment
Enrollment program tokens
(YOUR PROFILE) - Profiles
(YOUR PROFILE NAME) - Properties
Device Management Settings
If you are not using or did not purchase your devices through DEP, then you can have a DEP setup then add the devices manually using a Mac OS device such as a Mac Mini. iOS 11+ required along with Mojave and Apple Configurator 2.9+.
@Cathy would be a good solution - any updates about this?
Rob de Roos commented
@Cathy, that would indeen be briliant! I can imagine however that in some cases (testing for example) you have to be able to exclude devices.