Questions for HAADJ co-management with Intune

Ahmed Sh 100 Reputation points
2024-05-30T07:17:36.08+00:00

Hello,

-I have HAADJ tenant with Intune Co-Management.

-AD connect syncs devices only and not users to Entra (as users are third party provisioned and federated).

-The above means for users on upn matching for users between onpremise and cloud and this is why enrollment is done via device credentials.

-Devices appear in Azure then are added to group for Intune policy enrollment. Enrollment is done via GPO.

-They get enrolled in Intune using Co-management with SCCM, Auto MDM enrollment with device credentials and appear in Intune as co-managed.

-Bitlocker is applied via Intune on the devices to encrypt fixed data drives and operating system drives. GPO is applied to avoid backing up recovery key in AD as explained here. 

https://www.burgerhout.org/the-bitlocker-haadj-nightmare/

Question(s):

1-For testing, We encrypt and remove semantics drive encryption, Restart is done during removal then recovery key screen appears and key is requested to access device. Second Restart after uninstall, The Key is not requested.

2-After testing Recovery key is stored in Intune but not stored in the below location

https://myaccount.microsoft.com/ -> Devices -> Manage Devices -> Select devices -> View Bitlocker Keys (It appears only in test environment where enrollment is done via User credentials as opposed to device credentials)

3-Devies in Azure under the following URL Devices - Microsoft Entra admin center -> Show an owner when device is first moved with AD sync however later on owner is removed and the behavior is very random, However in Intune, Devices show a Primary user logged in as long as someone is logged in to office which is fine and acceptable. So what could be the reason for issue in Azure/Entra?

Microsoft Intune
Microsoft Intune
A Microsoft cloud-based management solution that offers mobile device management, mobile application management, and PC management capabilities.
5,358 questions
Microsoft Entra ID
Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
22,622 questions
0 comments No comments
{count} votes

1 answer

Sort by: Most helpful
  1. Deleted

    This answer has been deleted due to a violation of our Code of Conduct. The answer was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.


    Comments have been turned off. Learn more

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.