App Phased deployment in Intune
In this article, Iād like to cover the following scenario where youāre piloting an Endpoint solution in 2 phases where phase1 the new tool runs side-by-side with existing antivirus and in the phase2 thereās a detection script that detects and removes existing antivirus then push new Endpoint Protection solution.
Topics:
- Intune Application
- Intune Filters: used to prevent existing CORP Apps to be reinstalled.
Phase | Features | Targeted devices | Notes |
Phase1 | Norton read-only
Side by side with existing Antivirus |
Norton Install Phase 1 (sec. group) | Pilot phase 1 cloud-based security group – assigned members |
Phase2 | Norton policies enabled.
Any detected Antivirus is removed from the Device |
Norton Install Phase 2 (sec. group) | Pilot phase 2 cloud-based security group – assigned members |
How to prevent Antivirus part of CORP core apps targeted to All managed devices from being reinstalled on Phase2 devices?
- Create a Filter in Intune
- Go to Tenant admin – Microsoft Intune admin center (Tenant Admin \ Filters \ )
- Create your Filter
- Name:
- Description:
- Platform:
- Rules: Here you need to add all devices one by one using āORā to make sure all devices will be properly resolved
- Rule syntax:
- Single device: (device.deviceName -eq “M365-6521”)
- Multiple devices: (device.deviceName -eq “M365-6521”) or (device.deviceName -eq “M365-9492”)
- Go to the CORP application āCORP ā Default Antivirusā
- Go to Apps \ Windows \ search for your App Name
- Click on the app
- Go to Properties
- Scroll down to āassignmentsā
- Click edit
- Under the ārequiredā assignment find the targeted Group
- Click on the āfilterā column
- Under filters
- Select āExclude filtered device in assignmentā
- Select the Filter you created in step #1 and check the āselected filter optionā
- Click āSelectā ā blue button in the bottom of the page/tab
- Then click in āReview + saveā to save the changes to this application
- Rule syntax:
Filters might take up to 24 hours to replicate their changes on the devices.
Click on Home \ Devices \ Windows \
Search for the targeted device that was added to the filter.
Under Monitor select āfilter evaluationā
Make sure the filter you assigned this device to is listed as āfilter evaluatedā. Otherwise, double check filter or open a ticket with Microsoft.
Screenshots
Create Filter Order
Intune existing devices list
Populating Norton Phase 2 sec. group
Cheers,
Thiago Beier
2 thoughts on “App Phased deployment in Intune”
Comments are closed.