Add a policy to prevent device unenrollment from Company portal
Companies provide devices to their employees and generally wants to make sure that these devices will always remain managed through Intune. It could be interesting to have a policy that prevent users to unenroll a device identified as a company device from the Intune company portal.
Jean-Baptiste Frossard
shared this idea
I can confirm that we have this on our plan for early in 2020/ Thanks for your patience!
89 comments
-
Vikas
commented
To uninstall or deactivate the account from this app is really frustrating..
How to do that to use new company"s account with it???
-
Anonymous
commented
It is possible for iOS and iPadOS ind Intune 2003 Service Release (March 2020) - https://docs.microsoft.com/en-us/mem/intune/apps/company-portal-app#device-enrollment-setting-options
But why not for Android?!
-
Janet Stam
commented
Any update on this one? Is there a new expected release date?
-
Aaron Couch
commented
I saw that new Company Portal device enrollment settings were added as part of the Intune 2003 Service Release (March 2020) - https://docs.microsoft.com/en-us/mem/intune/apps/company-portal-app#device-enrollment-setting-options
However, this new Comp Portal setting equally impacts the Company Portal on both iOS + Android. Would it be possible for Microsoft to allow distinct Company Portal settings for Android vs. iOS?
-
Sam
commented
Hey Folks,
Checkout this new MDM tool we are using, they have 1000s of built in policies including preventing user to unenroll.
https://www.zerotouch.ai/ -
Vadivelu Balusamy
commented
Cathy, We didn't find any roadmap in MS portal as of now.
https://www.microsoft.com/sv-se/microsoft-365/roadmap?filters=
-
Anonymous
commented
i'm very happy that you put this functionality in the app/ intune policy's. honestly i didn't expect a reply on this topic after 4.5 years :-)
-
Anonymous
commented
This is a must have feature! Please take this seriously.
-
Davide Gatti
commented
4 years and no certainty if this features will ever be created ......
-
Anonymous
commented
As already mentioned this is available in AirWatch. We desperately need to be able to prevent users from un-enrolling devices.
-
JoeC
commented
For supervised iOS devices, we should be able to see the status of the Company Portal installation and initiate the installation of Company Portal if the app has been removed.
We use DEP and VPP to manage devices and push the Company Portal installation when a phone has completed setup assistant.
Once a user has been enrolled in Company Portal and receives the profiles (Restrictions, Mail, Wifi, etc), if Company Portal is later uninstalled, those profiles should be removed.
-
Michael van Ee
commented
This would save a lot of time and irritation in the ICT department. There are always users who don't like "ICT" or need extra space on there smartphone, and just delete the company / work-apps. And sometimes updates can also cause problems with the membership of Intune. This policy would be a nice gift for the holidays.
-
PiersMH-DwrCymru
commented
Agree this prevention is required, and concur this needs to be implemented for supervised corporate devices.
In addition to the comments already made, as I can't see this specific item mentioned (specific to iOS):
There also needs to be a policy to prevent a user from removing the Comp Portal app at all. We can stop icons from being re-arranged but not uninstalled. System apps such as Messages & Photos can't be removed (General > iP* Storage > Comp Portal > Delete app)In our example, we remove the ability to factory reset, so if the user removes the portal app, the device can no longer be reset (or at least not very easily). For some of our kiosk devices this effectively bricks a device.
Please include this as part of the above functionality.
-
Anonymous
commented
Cathy Moya, here is what I have personally witnessed with the relationship between Intune and Apple devices.
• The device must be built as a new device, not from an iCloud or iTunes backup to be a supervised device. Unless you use a ridiculous third device work-around.
o Apple design – restoring from a backup makes it an un-supervised device
• Un-supervised devices are treated as BYOD. The user has the ability to remove the management profile from the device.
o Settings > General > Device Management > Management Profile
o If the device is un-supervised, the user has the ability to remove the profile using “Remove Management”
• Supervised devices, built as a new device, can be defeated by restoring the device in iTunes, then restoring it from a personal backup.
o The device will become un-supervised and vulnerable to the above issuesHow can we secure our smartphone environment when users have the ability to remove a corporate owned DEP enrolled device from our control?
-
Alan B
commented
This is a critical feature for maintaining a mobile estate which is demonstrably compliant to a given governance standard. Tech support just point me to this thread.. I hope this is a priority on the Intune roadmap.
-
Jason Lazerus
commented
Any updates on this? For corporate devices, this is a must. Removal should be doable at the console level.
-
Minh H.
commented
We would need to have that feature. We don't want user to be able to remove the profile that approves access of Intune to manage the device. Otherwise, corporate device may become personal device. However we should be able to remove profile only by using some kind of admin account (but not the current local admin account). Can you suggest something to implement that?
-
Anonymous
commented
Anything new about this? Seems like a sorely needed feature!
-
Jo Below
commented
any progress on this? If corporate (company) owned, I think only domain admins or InTune admins should be able to unenroll (disconnect) the service.
-
Dylan
commented
Is this still on-going, it would be great to have this in place for our company with >3000 managed devices.