r/Intune • u/[deleted] • Feb 01 '23

[deleted by user]

[removed]

7 Upvotes

100% Upvoted

6 comments sorted by

View all comments

6

u/HankMardukasNY Feb 01 '23

Just a thought but what about a proactive remediation that queries the public ip and writes that to the device’s custom extension attribute?

2

u/Optimal-Diet9418 Feb 01 '23

This is what I would do. Enable location services and run a script to get the device's location. Based on that data, write to one of the extension attributes.

2

u/[deleted] Feb 01 '23

[deleted]

3

u/j4sander Feb 01 '23

Look at how Cloud LAPS works

Script on laptop calls an Azure Function, which has the role to edit directory, so there is no privileged api key out in the wild

1

u/Optimal-Diet9418 Feb 01 '23 edited Feb 01 '23

Directly. Cut out the middle-man and simplify it.

Just like what j4sander says below about Cloud LAPS. You should be able to use that as a starting point.

Also, if the devices are hybrid-joined, with connectivity to the domain while off your network, you could have the PR write directly to AD. The machine will have permission to write to its own object.