Perform Windows Device Sync in Microsoft Intune

The Sync device action in Intune forces a selected device (or devices) to immediately check in with Intune. When the sync action is successfully performed, the device immediately receives any pending actions, policies, or configurations assigned to it. This sync action is invaluable for validating and troubleshooting policies assigned to a device, without having to wait for the next scheduled check-in.

In this blog post, we’ll explore various methods to initiate a device sync in Intune, each with its advantages and use cases. We will also dive into a PowerShell script that enables administrators to trigger device sync across multiple devices simultaneously.

Methods to Intune Windows Device Sync

Using the Company Portal App

The Company Portal app offers a user-friendly way for users to manually sync their devices. This method is ideal when a user wants to ensure that their device is up-to-date with the latest policies and configurations.

• Pros:
  • Easy to use and doesn’t require administrative intervention.
• Cons:
  • Relies on the user to initiate the sync, which might not be ideal for quick compliance enforcement.

How to use:

• From the Start menu, search for “Company Portal.”
• Click on “Sync this device.”
• The sync will occur automatically after signing into the Company Portal.

Intune Windows Device Sync via Settings in Work or School Account

Users can also sync their devices via Windows Settings under the Work or School Account section. This method is quite similar to using the Company Portal app but is directly accessible through the system settings.

• Pros:
  • Accessible without additional app installations.
• Cons:
  • Still requires user initiation and awareness.

How to use:

• Go to Settings > Accounts > Work or School Account.
• Select the user account, and click on Info.
• Click on Sync.

Device Sync through the Intune Portal

Intune Administrators or users with permissions assigned through RBAC roles can initiate a sync for individual devices directly from the Intune portal. This method is useful for IT support teams who need to push updates or troubleshoot specific devices.

• Pros:
  • Allows remote initiation by administrators, useful for immediate policy application.
• Cons:
  • Limited to one device at a time and requires administrative access to the Intune portal.

How to use:

1. Log in to the Intune portal with permissions to perform sync.
2. Navigate to Devices > Windows.
3. Search for the device.
4. In the device overview, click Sync.

Creating a Shortcut on the Start Menu

Admin can create a shortcut on the Start Menu that triggers a scheduled task for Intune sync. This approach provides users with an easy way to sync their devices without navigating through apps or settings.

• Pros:
  • Convenient for users.
  • Reduces reliance on manual navigation.
• Cons:
  • Still requires user initiation and may require initial setup by IT.

How to use:

• Create a shortcut using a PowerShell script that creates a scheduled task to trigger the Intune sync action (“PushRenewal”) based on event generation.

Triggering Sync via PowerShell Script

For IT administrators managing multiple devices, using a PowerShell script to trigger a sync across a list of devices is the most efficient method. This approach allows for automation and scalability, making it ideal for larger environments.

• Pros:
  • Highly scalable, allowing you to automate sync across many devices simultaneously.
• Cons:
  • Requires scripting knowledge and appropriate permissions.

Here’s a PowerShell script to trigger a sync on a list of devices:

Requirements before running the PowerShell:

1. Microsoft Graph PowerShell module.
2. Admin consent to Microsoft Graph PowerShell with scoped permissions DeviceManagementManagedDevices.PrivilegedOperations.All.

3. 

High-Level Steps of the PowerShell Script

1. Initialize Variables:
   • Set up variables like the script path, log file name, and current date for logging and folder creation.
2. Check and Install Microsoft.Graph Module:
   • Ensure the Microsoft.Graph module is installed. If not, attempt to install it. If installation fails, the script will exit.
3. Authenticate to Microsoft Graph:
   • Ensure the user is authenticated with Microsoft Graph using the required DeviceManagementManagedDevices.PrivilegedOperations.All scope. If not authenticated, the script will attempt to connect to Graph.
4. User Input (Device Name or File):
   • Prompt the user for either a device name (for a single device) or a filename containing a list of device names. The script checks if the file exists and isn’t empty.
5. Create Output Folder:
   • Create a folder to store log files, named after the current date if it doesn’t already exist.
6. Validate Data:
   • Inform the user of the number of devices found and ask for confirmation to proceed with the synchronization. If the user decides to stop, the script exits.
7. Device Synchronization:
   • For each device, the script checks if the device exists in Intune using partial matching. If found, it sends a sync request to Intune. If not found, it logs the failure.
8. Logging:
   • Logs each sync attempt’s success or failure, along with timestamps, to a log file.
9. Completion:
   • After processing all devices, the script completes and informs the user of the log file’s location.

Output Log Example

The script logs the status of each device sync, indicating whether it was successful or failed, along with timestamps.

Download the PowerShell Script

You can download the PowerShell script from the GitHub repository.

Intune Windows Device Sync Conclusion

Choosing the right method to trigger device sync in Intune depends on your specific needs, whether it’s user-initiated or admin-initiated. For bulk or automated syncs, a PowerShell script provides an efficient solution for IT administrators. The methods outlined above allow you to maintain device compliance and troubleshoot configurations promptly.

References:

Device sync https://learn.microsoft.com/en-us/intune/intune-service/remote-actions/device-sync

Graph module https://learn.microsoft.com/en-us/powershell/module/microsoft.graph.devicemanagement/get-mgdevicemanagementmanageddevice?view=graph-powershell-1.0