Microsoft Intune

What do you like best?

No need for AD controller so no need to patch it and this managament is accesible from anywhere. Computers can access new policy updates from intune server. This allows to control every pc either it is connected to vpn or not. Very easy to reset devices. Can create full automatisation for workstation so no need for local support to do manual work after it administrator has created politics for workstations depending usersgroups and or other parameters. My collegues were very suprised what can be done watching popup window magics. No need to remember username - it is your email adress. Easy to push some settings like wifi passwords, printers, sharepoint settings. So no need to tell users corporate wifi passwords. Integrated option to install office 365 from microsoft cloud with option to chose exact office version and/or difference from current version. For example 2 versions behind.

What do you dislike?

Group policy restrictions that does not allow to work like with classic ad. It was complicated to start using it to get everything ready for everyday users. Had to change my logics from clasic domain controller to intune that is different. Different settings in different places. Many things are not automated and there is need a lot for powershell scripts. Also license costs are high for personal/ home usage. Also Microsoft license politics that allows one type of licenses for some max count ~250 each. No integrated solution for data loss protection on workstations like usb port blocking for data write. Had to implement registry hacks and third party software for this task. Did not find oportunity to create administrator account for group of workstations as there was no groups/folders like in classic active directory. I had workstations in several countries and local support actualy could login to different country workstation as administrator. Also imposible to connect to hiden administrator shares ( c$) so very hard to shadow copy data from workstation without user knowladge. Some printer models could not be pushed to workstations due driver limitations (canon) that require local default administrator account to be used while installing network installation of the driver. sometimes it takes time to apply new politics from server so during setting configuration you can never be sure if everything works as expected. Very hard to debug configuration and powershell scripts as there are very few logs that can be found on device managament console. Hard to find manuals internet as intune mangament console has changed several times and sometimes manual is from old version that differs a lot from current one. There are some regions where cloud instalation was not so easy or did not happen at all

Recommendations to others considering the product:

Be very patient. Start using it when you have plenty of time to experiment and investigate. Change you way of thinking from Active directory as this service works very different and the rules are not the same. Sometimes it takes some period of time to apply new settings and you can understand if you have configured all good and you just have to wait or something is wrong. Remember that it is hard to find info about intune as it is not so popular as Active Directory. Also it has changed a lot since first version and very often manuals are outdated. So new vision and be pacient. Be ready to experiment so there will be a lot of wasted time in unsuccessfull experiments.

What problems are you solving with the product? What benefits have you realized?

I built whole computer infrastructure for workstations instead of domain controller. It gave ability to control workstations without any vpn connection. The main benefit is that you dont need several domain controller servers. Very good implemetnation with all other office 365 products - like teams, sharepoint, etc. Good control over workstations. Just add license, enter name, surname and user is ready.