question

PuDerBaer avatar image
0 Votes"
PuDerBaer asked LuDaiMSFT-0289 commented

Move device configuration profile from device to user?

Actually I have assigned a device configuration policy for my edge settings to a device group. Now I would like to assign that policy to a user group instead to devices.
So my first idea is to add the user group assignment to the same policy and then to wait until more or less all users have received that policy too. After that I would remove the device assignment and everything is done.....hopefully.
I‘m not quite sure if it is a good idea to assign the same policy to a device and a user at the same time?
Eventually someone already did a scenario like that and can point me to problems that can come up?
Thank you in advance!

mem-intune-device-configurations
5 |1600 characters needed characters left characters exceeded
Toggle Comment visibility. Current Visibility: Visible to all users

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

2 Answers

LuDaiMSFT-0289 avatar image
0 Votes"
LuDaiMSFT-0289 answered LuDaiMSFT-0289 commented

@PuDerBaer Thanks for posting in our Q&A.

For this issue, in general, you can first remove the device group and then add the user group.

But it is not sure that every device configuration profile will no longer apply to the device group. In our official article, for windows devices, when remove devices from a group that's assigned the profile, some CSPs remove the setting, and some CSPs keep the setting, also called tattooing. So, it is suggested to try to test specific settings to confirm if it is available.
https://docs.microsoft.com/en-us/mem/intune/configuration/device-profile-troubleshoot#what-happens-when-a-profile-is-deleted-or-no-longer-applicable

If there is anything unclear, feel free to let us know..

If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.


· 2
5 |1600 characters needed characters left characters exceeded
Toggle Comment visibility. Current Visibility: Visible to all users

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

PuDerBaer avatar image PuDerBaer ·

Thank you fpr your answer!
When I remove a device from the policy all of the setting are gone. So no problem with tatooing.
When I remove the assigment to the devices first I´m not sure if the new user assignemnt will arrive fast to enough to not let the users device unconfigured.
Because of that I would like to overlap the device and user assignment for a while. But as @PaD-7009 mentioned there should be no negative impact because it is exactly the same policy.....

Thank you for your help :-)

0 Votes 0 ·
LuDaiMSFT-0289 avatar image LuDaiMSFT-0289 PuDerBaer ·

@PuDerBaer You're welcome. If you have any problem in the future, welcome to post in our Q&A.

Thanks and have a nice day. : )

0 Votes 0 ·
PaD-7009 avatar image
0 Votes"
PaD-7009 answered

There is no negative impact to this.

See device vs user group section
https://docs.microsoft.com/en-us/mem/intune/configuration/device-profile-assign#user-groups-vs-device-groups



5 |1600 characters needed characters left characters exceeded
Toggle Comment visibility. Current Visibility: Visible to all users

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.