Block Intune policies and apps installing on Microsoft DevBox?

Once we provision a Microsoft DevBox, Intune policies and apps install where they're assigned to "all devices" or user groups where the user logging on to the DevBox is a member of. How can we best prevent these existing and future Intune apps and policies applying to Microsoft DevBox please?

Find more posts tagged with

Microsoft Intune

Sign in to participate and unlock exclusive content 🔓

It looks like you're new here! Sign in or register to be able to comment, access member-only content and follow the spaces relevant to you.

Accepted answers

Jon Jarvis

@5MH - There would be two ways to do this

Create device groups for your Windows devices (Autopilot group works best), iOS, Android and macOS devices then go through your assignments and ensure that your assignments go to specific device groups. I personally dislike assigning to "all devices" for this reason.
Create a dynamic device group for your Microsoft DevBox, I do not have one in my lab to test but you could define this group based on Device model or name. Then go to each policy and exclude this group.

Any questions, let me know!

Jon

All comments

Jon Jarvis

@5MH - There would be two ways to do this

Create device groups for your Windows devices (Autopilot group works best), iOS, Android and macOS devices then go through your assignments and ensure that your assignments go to specific device groups. I personally dislike assigning to "all devices" for this reason.
Create a dynamic device group for your Microsoft DevBox, I do not have one in my lab to test but you could define this group based on Device model or name. Then go to each policy and exclude this group.

Any questions, let me know!

Jon

5MH

Thanks Jon, how best to do this for 100s of apps and policies?

Also, is there a way to automate this for future apps and policies too please?

Jon Jarvis

There are some 3rd party applications like IntuneManager (GitHub - Micke-K/IntuneManagement: Copy, export, import, delete, document and compare policies and profiles in Intune and Azure with PowerShell script and WPF UI. Import ADMX files and registry settings with ADMX ingestion. View and edit PowerShell script.) that could potentially help with this

There's potential if you are using Microsoft 365 E5 licenses for building an agent to get Security Copilot to automate it in the future

5MH

Thanks Jon, we used Warp to fine tune a PS1 script to export/backup all app assignments to a CSV, remove and replace (POST) the existing assignment with the exclude filter added, because they cannot be replaced using PATCH.