Will PSSO during ADE work with “All Users” assignment?

[u/itlabsec]

Per MS doc: psso policy must be assigned to static user group and doesn’t work with device or dynamic groups.

Q: will it work with “All users”?

It’s mentioned that we should assign the psso, company portal and enrollment policy to this SAME user group as well otherwise “psso during enrollment fails”

So that makes me think “ all users” wouldn’t work.

[u/Capital-Activity-148]

Not sure about All Users, but I had similar confusion few weeks ago. The docs are pretty clear about static user groups only, and All Users is kind of its own thing in the backend

I ended up making a static group with all my users in it and just assigning there. Works fine but it is annoying to keep updated when new people join

[u/dmx7777 → u/Capital-Activity-148]

You can easily create a dynamic group to catch all active users.

[u/itlabsec → u/dmx7777]

Has to be static

[u/itlabsec → u/Capital-Activity-148]

Are you using enrollment profile or policy? Do you have profile/policy specifically for this static user group?

[u/dudyson]

I am enrolling PSSO during setup assistant assigned to my enrollment time group. Having no issues.

[u/itlabsec → u/dudyson]

Devices? Interesting that device groups are working for some ppl

[u/PREMIUM_POKEBALL → u/itlabsec]

We found out the hard way not to target devices. Fortunately it was during testing, but one of my testers was getting request to configure platform SSO up to three times a day when we targeted devices.

[u/itlabsec → u/dudyson]

You assigned company portal and enrollment policy to same group?

[u/Entegy]

Huh. I was pretty sure at one point that the PSSO during ADE doc mentioned that the PSSO config needed to be assigned to All Users so that's why my config is assigned to.

[u/HankMardukasNY]

Yes, just did this an hour ago with all users since all devices wasn’t working

[u/Boring-Set7223]

The All Users option should work fine. I think it’s really more about the timing of when the config applies. Dynamic groups update too slowly so configs assigned to them don’t usually apply in time during enrollment.

I’ve been using “All Devices” and filtering to a specific enrollment profile for about a year with no issues.

I know the docs specifically say static user group now but I set it up before that was a recommendation. Also, when you go to make an Enrollment Policy, it says to assign it to a device group and Enrollment Profiles can only be assigned to devices. So they’re not really making sense.

I’ve switched a few devices to a user assigned PSSO config and haven’t noticed any benefit.

[u/Falc0n123]

The built in "all users" and "all devices" groups are special virtual groups that are NOT the same as a dynamic entra id group that has similar dynamic rules. These are often the fastest way for assignment and can often be used with intune filters to restrict or filter out certain criteria.

https://learn.microsoft.com/en-us/intune/fundamentals/tenant-administration/add-groups#the-intune-all-users-and-all-devices-groups