u/Rudyooms

After noticing the new Sync Status window in Intune, I started wondering where the information in that pane actually comes from... (.. i still can't fully explain it :P)

So I traced the sync through Graph, SyncML, the Windows MDM debug logs and the IME logs. The interesting part is that the Numbers and information are coming from different places.

Applications: the offered count maps to the required Win32 apps Intune returns to the IME for evaluation.
Scripts: They come from the HealthScripts side, including Remediations and custom compliance. As regular platform scripts are only executed once (so only new ones are added to the count)
Policies: That one is the odd one, i can't explain....yet

The normal Device Configuration view can be traced back to the Graph reporting data, but the new Sync Status window can show a slightly different total. That extra number does not appear in the SyncML trace or the device side MDM debug logs, so there is still some service side aggregation happening that we cannot see.

It would be interesting to know whether anyone has identified exactly what Intune is adding to that Policies count :) ... something magic?

Inside Intune's New Sync Status Window - Patch My PC

​

First, the Device Sync moved away from triggering Windows MDM only and started waking IME workloads too: Win32 apps. PowerShell scripts. Proactive Remediations.

Now, when triggering the remote Device Sync, the IME request no longer arrives through a second WNS notification. It comes through the existing IC3 and Trouter connection: WNS for Windows MDM. IC3 for IME. With the move to IC3, the device kicks off all the workloads within second!!

At the same time, a new StatusSync flow is tracking the progress of those workloads. That part deserves its own blog.

Intune On Demand Device Sync Now Uses IC3 for IME Workloads

https://preview.redd.it/voxg54ngzxgh1.png?width=680&format=png&auto=webp&s=dd7e96f399294d365f5a09cdf9aeb5a279b2695a

Even after ESP finishes and the desktop appears, the remaining required Win32 apps may still wait up to 60 minutes before IME checks for them again. That delay now seems to be changing!!!

IME 1.103.101.0. introduces a new handover that lets IME detect when enrollment has finished and trigger the Win32 app workload again, instead of waiting for the normal hourly poll.

The one-hour timer still exists, but Autopilot devices may no longer need to wait for it. Full technical breakdown:

https://patchmypc.com/blog/autopilot-required-apps-no-longer-need-to-wait-60-minutes/

https://preview.redd.it/e8hdxcgfzsdh1.png?width=1214&format=png&auto=webp&s=38819deb57e658f39ce90f37e9997dff8f0f9101

The Sync button is finally starting to behave the way most admins always expected.

Instead of only refreshing the regular Windows MDM policy path, the improved on-demand Sync action in Intune will also kick off the IME workloads (Win32 apps, PowerShell scripts, and Remediations)

That means one remote action can now trigger both the MDM policy check-in and the IME workload check-in.

The Win32 app part is already live.

Full breakdown here:
https://patchmypc.com/blog/inside-the-improved-on-demand-sync-for-windows-devices/

https://preview.redd.it/0l01m6us4cdh1.png?width=1620&format=png&auto=webp&s=a9e11b602f6b00ed4b909d58dd4d91c4f7d41074

Intune Management Extension: the changelog we do not get

When the Intune portal changes, we usually get a “What’s new” update.

When the IME changes, we mostly get a new MSI....That’s it.

And that is a bit weird, because the Intune Management Extension is no longer just that small agent on the device. It handles Win32 apps, scripts, remediations, reporting, APv2 related pieces, and that list keeps growing.

The problem is that most of what it does still sits inside a black box. So I built my own IME release notes....

Every time a new IME version appears, the automation pulls it apart and compares it with the previous one. The MSI, custom actions, payload files, DLLs, and changed methods are checked to see what actually changed inside the SideCar and IME agent.

Because the IME is getting way too important to only notice what changed service side... and not on the client side:

Intune Management Extension: Release Notes

https://preview.redd.it/09ubsufrhm3h1.png?width=1252&format=png&auto=webp&s=69d68883685e1cf1d787984a0401537c6556c002

Microsoft describes it as an extension of Tamper Protection (AKA v2 😄?) , with cloud delivered policy (MMP-C) becoming the source of truth.

That means Defender settings managed from Intune or Microsoft Defender for Endpoint security settings management should be better protected against local changes. This is a big shift in how Defender settings are protected and enforced.

Read the blog to find out more!

Controlled Configuration for Microsoft Defender Antivirus settings

https://preview.redd.it/t5hts1ghsg0h1.png?width=680&format=png&auto=webp&s=807782f572da0350b1b83e9520f0c64bf2132928