App Phased deployment in Intune
In this article, I’d like to cover the following scenario where you’re piloting an Endpoint solution in 2 phases where phase1 the new tool runs side-by-side with existing antivirus and in the phase2 there’s a detection script that detects and removes existing antivirus then push new Endpoint Protection solution.
- Intune Application
- Intune Filters: used to prevent existing CORP Apps to be reinstalled.
Side by side with existing Antivirus
|Norton Install Phase 1 (sec. group)||Pilot phase 1 cloud-based security group – assigned members|
|Phase2||Norton policies enabled.
Any detected Antivirus is removed from the Device
|Norton Install Phase 2 (sec. group)||Pilot phase 2 cloud-based security group – assigned members|
How to prevent Antivirus part of CORP core apps targeted to All managed devices from being reinstalled on Phase2 devices?
- Create a Filter in Intune
- Go to Tenant admin – Microsoft Intune admin center (Tenant Admin \ Filters \ )
- Create your Filter
- Rules: Here you need to add all devices one by one using “OR” to make sure all devices will be properly resolved
- Rule syntax:
- Single device: (device.deviceName -eq “M365-6521”)
- Multiple devices: (device.deviceName -eq “M365-6521”) or (device.deviceName -eq “M365-9492”)
- Go to the CORP application “CORP – Default Antivirus”
- Go to Apps \ Windows \ search for your App Name
- Click on the app
- Go to Properties
- Scroll down to “assignments”
- Click edit
- Under the “required” assignment find the targeted Group
- Click on the “filter” column
- Under filters
- Select “Exclude filtered device in assignment”
- Select the Filter you created in step #1 and check the “selected filter option”
- Click “Select” – blue button in the bottom of the page/tab
- Then click in “Review + save” to save the changes to this application
- Rule syntax:
Filters might take up to 24 hours to replicate their changes on the devices.
Click on Home \ Devices \ Windows \
Search for the targeted device that was added to the filter.
Under Monitor select “filter evaluation”
Make sure the filter you assigned this device to is listed as “filter evaluated”. Otherwise, double check filter or open a ticket with Microsoft.
Create Filter Order
Intune existing devices list
Populating Norton Phase 2 sec. group
2 thoughts on “App Phased deployment in Intune”
Comments are closed.