AppStore Apps not coming down (DEP enrolled)

Hey everyone,

I have created several iOS AppStore apps in SCCM and deployed them to both a User collection and a Device collection as Required installations (some devices will not have user affinity, thus the deploy to device as well).

The Devices have an enrollment profile assigned with DEP integrated into SCCM.  The devices show up properly in SCCM once enrolled (during activation) however none of the deployed iOS apps are coming down the device.  There is an Apple ID tied to the devices.

As a side note, I have a single Web app deployed the same way via SCCM and that is installed upon activation.  Am I missing something?  

If I enroll a device via the Company Portal app (i.e. non DEP), AppStore apps come down right away.

Thoughts?


September 10th, 2015 5:02pm

The hits keep rolling..

No RBAC support for managing the Company-owned node in SCCM.  You have to be Full Administrator with no Scope limits.

No way to unassign a device from a DEP enrollment profile.  Once assigned, it can only be reassigned to another profile. 

Enrolling using the Company Portal after DEP doesn't appear to be a viable option.  Apps, although required in the SCCM deployment are not enforced and can be removed.  Since they are not required they will not come back down.  Not all apps came down either and no apps in the company portal.  

Moral of the story, DEP integration is worthless at this time unless you do not plan on deploying any Microsoft Office (i.e managed) apps, or conditional access.  Looks like we will need to remove the DEP integration and touch every device with Apple Configurator to Supervise.

Here's a couple of quotes from the Intune support contact:

After reviewing the public facing articles, I haven't seen any documentation stating either way that pushing Managed Apps is possible/not possible at the present time. I can submit a request to have these articles updated to clarify such information to hopefully prevent confusion in the future.

Just to confirm, I have verified with multiple engineers in the product group that this scenario is not possible at this time. 

And:

This is a direct quote from one of our Product Group engineers:

DEP (Apple's Device Enrollment Program) enrolled devices are not compatible with:

- Conditional Access

- Mobile Application Management (MAM, aka. Managed Apps)

- Company Portal App (WPJ features)

NOTE: Using CA or MAM with DEP enrolled devices is unsupported.

During the DEP account setup process, the Microsoft Intune account is uploaded to the Apple Admin Console and is tied to the DEP account.  Intune is deployed as part of the DEP package and does not use the Company Portal app for enrollment.  Therefore, Workplace Join does not occur, which MAM and Conditional Access require for use.

ALSO NOTE:  The customer won't be able to use these features with DEP enrolled devices.  Applying a MAM policy to the device will cause login issues because the device is looking for (Company Portal app) enrollment which is required to be compliant



Free Windows Admin Tool Kit Click here and download it now
September 11th, 2015 6:20pm

Hi Folks - 

I'd like to try and help clarify a couple things here. 

  1. At this time, a device enrolled in Intune using DEP supports pushing policies/profiles to that device
  2. Please do not try to install/enroll thru Company Portal on DEP devices, this is not yet supported (bad stuff will happen). And as a result, the following scenarios will not work for DEP-enrolled devices.
    - Conditional Access
    - Mobile App Mgmt (you cannot deploy any managed apps from this list)
  3. App deployment (for apps *not* on the above list) should work as long as you use the Required Install deployment method
    - you must setup your user/device groups appropriately

We are working on changes to ensure that DEP + Company Portal app can work together, and should have a fix available in the next couple months. Once we release the update, it will be required that you setup your DEP enrollment profile with Prompt for User Affinity (per these instructions) in order to work with Company Portal. If you choose "No user affinity" then the Comp Portal app will never work.

Additional notes:

  • The Apple ID you use to setup the DEP device is not relevant, and does not need to match the one from the DEP Portal.
  • If you are observing that Required Install apps (except for ones from this list) are not getting deployed, please open a support ticket. Same deal if you're observing policies/profiles not making it to the device. These should both work.

-Kieran Gupta, Intune Product Team


September 11th, 2015 7:08pm

"Once we release the update, it will be required that you setup your DEP enrollment profile with Prompt for User Affinity (per these instructions) in order to work with Company Portal. If you choose "No user affinity" then the Comp Portal app will never work."

Will we see an update that will allow managed apps to be deployed to a device that will not be tied to a user?  i.e. a shared device, thus no prompt for user affinity?

Our model for managed Microsoft apps requires a user account (UPN) be associated with the device. This may change in the future, but today the DEP userless model is not compatible with Mobile App Management. As mentioned before, you can still deploy other managed apps (just not ones from this list).

William - can you please provide me with the Case # for the ticket you opened on this issue? We'd like to follow-up and make sure our Support channels have the most up to date accurate information. Thanks!

Free Windows Admin Tool Kit Click here and download it now
September 12th, 2015 12:26pm

This topic is archived. No further replies will be accepted.

Other recent topics Other recent topics