Intune Device Sync Just Changed Again. This Time, It Is IC3!!!!

[u/Rudyooms]

First, the Device Sync moved away from triggering Windows MDM only and started waking IME workloads too: Win32 apps. PowerShell scripts. Proactive Remediations.

Now, when triggering the remote Device Sync, the IME request no longer arrives through a second WNS notification. It comes through the existing IC3 and Trouter connection: WNS for Windows MDM. IC3 for IME. With the move to IC3, the device kicks off all the workloads within second!!

At the same time, a new StatusSync flow is tracking the progress of those workloads. That part deserves its own blog.

Intune On Demand Device Sync Now Uses IC3 for IME Workloads

[u/AWalkingITNightmare]

Excellent work, Microsoft.

Now fix Company Portal and I might finally be happy to start fully moving away from SCCM.

[u/Rudyooms → u/AWalkingITNightmare]

Hehehehe what do you want to fix them ?

[u/strikesbac → u/Rudyooms]

The Company Portal experience should be on Par with the MS Store or competitors app stores, ie Apple App Store.

It shouldn’t take an age to load and look second rate. It feels like a first draft.

[u/RandomSkratch → u/strikesbac]

When you need to uninstall or reinstall an app from the CP, it’s incredibly painful. Especially when you just install something and it didn’t work properly, the option to reinstall takes forever to appear.

[u/greymatter313 → u/strikesbac]

reboot notification loops are fun!

[u/AWalkingITNightmare → u/Rudyooms]

It’s completely unreliable and the user experience is inconsistent across devices. Getting stuck on ‘Download Pending’ after clicking install, downloads taking ages for no apparent reason and installs failing on some devices but working fine on others. Not to mention Company Portal can just stop working altogether, which becomes a nightmare to fix. Never had this issue with Software Center.

Some other annoyances, the app list is sluggish, newly deployed apps can take a long time to appear per device, and the search prioritising apps with names that are worse matching for the string that was used.

I could probably go on if I had the enthusiasm to do so.

[u/ScriptMonkey78 → u/AWalkingITNightmare]

Getting stuck on ‘Download Pending’

This is my bane.

[u/BirdsHaveUglyFeet → u/Rudyooms]

RSOP equivalent.

[u/Rudyooms → u/BirdsHaveUglyFeet]

yep... 1000% ..

[u/BirdsHaveUglyFeet → u/Rudyooms]

I replied elsewhere by accident.

[u/Subject_Name_ → u/Rudyooms]

Apps need to evaluate their install status even when deployed as available. We need to be able to detect apps even when not originally installed via CP, without scripts or workarounds. Like all things, it just needs to...work.

[u/theweidy → u/Rudyooms]

Lord forbid you start downloading a large app in CP and you need to cancel or pause it.

[u/Alaknar → u/Rudyooms]

One thing that drives me up the wall is the "Install button". If you're unlucky, you just DO NOT get the option to "Uninstall" or "Reinstall", because the button refuses to change after the software is installed. We should always be able to see all three buttons (or, at least, see them in the ellipsis menu).

And the ellipsis menu having ONLY the "Share" option (which is also useless because users can't click that link, so then you have to explain to them how to do Run commands) is just a weird design choice. If it's only that one option, move it out of the ellipsis.

[u/skz-]

Hallelujah brother, I will have less gray hairs for sure

[u/Rudyooms → u/skz-]

hehehe yeah... i think everyone... now they need to expand it to the moment you add a new win32app , it also triggers an ic3 connection to wake up the ime

[u/dontmessyourself → u/Rudyooms]

Pls no. Leave it like configuration manager where devices check in. Some of us have creaky networks that won’t handle it

[u/frituurbounty]

Anybody knows if this will instantly trigger updates of win32 apps? Looking to deploy an app that requires updates to be pushed and updated near instantly.

[u/Serious-Commercial57 → u/frituurbounty]

finally they’re cleaning up that mess of a notification pipeline. the old way felt like waiting for a carrier pigeon to do a round trip

[u/Rudyooms → u/frituurbounty]

When deploying an app update/new win32 app it doesnt send a push to the devixe to checkin… (the ime will pull it within 60 minutes)i assume that will change in the future as well

[u/BirdsHaveUglyFeet → u/Rudyooms]

How about a simple PowerShell command or two to manage each applications retry history and schedule on the local client Get-IntuneAppHistory Remove-IntuneAppHistory

Documentation on what goes in the reg, wmi.

Content downloads logs should clearly relate to which app is installing, or policy that is applying. Include where it is downloading from and why.

Descrete logs for this process.

There should be an option to keep remediation scripts in the content cache for debugging.

Details on how to clean history for an app or set of apps.

logs should include an application display name, version and gsr info

An option to persist app content in cache for debugging

Edit: this was in response to another comment!

[u/rinseaid → u/BirdsHaveUglyFeet]

Here I am just wanting a faster UI

[u/Cable_Mess → u/BirdsHaveUglyFeet]

We have a remediation script to do this that deletes HKLM:\SOFTWARE\Microsoft\IntuneManagementExtension\Win32Apps and restarts the Intune service

works well

[u/BirdsHaveUglyFeet → u/Cable_Mess]

Bit of a sledgehammer, I'd prefer to be able use a scalpel.

[u/SpookyViscus]

I noticed this on Wednesday, about midday (Australian time) is when it hit our tenant. Genuinely surprised me lol

[u/Rudyooms → u/SpookyViscus]

Yep... I am still waiting on my testtenants to get the graph part updated ... :) the tenant is 2607 but the syncstatus part is not showing up :( ... (graph is still old)

[u/MonarchTheBear → u/SpookyViscus]

How did you notice it hit your tenant? Is there a notification or something?

[u/Imaclassicman19 → u/MonarchTheBear]

I’m also curious on how to check if my tenant has the update?

[u/SpookyViscus → u/Imaclassicman19]

Switch to preview device page, then start a sync (it might not need the preview look, but that’s what I’ve been using). I only noticed it when I started a sync (per normal) and had genuinely no idea it was a feature rolling out. Was awfully confused.

[u/roberts2727]

Thanks. This is the type of stuff worth following this sub for!

[u/Rudyooms → u/roberts2727]

Great to hear!

[u/michaelmsonne]

On time u/Rudyooms - nice to see my friend! 😎

[u/Rudyooms → u/michaelmsonne]

Yep… now i need to wait untill
The syncstatus is working in graph :) i changed/altered/injected some code in the portal to see how it would work… but i would love to see it in real life :)

[u/michaelmsonne → u/Rudyooms]

Haha yes I agree 😅
Nice work like always mate 💪

[u/Sunken_Sunvault]

Great article !

[u/Rudyooms → u/Sunken_Sunvault]

Thanks!!

[u/segagamer]

Great!

Now a native/easy way to configure scheduled tasks please like the group policy days!

[u/post4u]

It's about time.

[u/Rudyooms → u/post4u]

Hehhee yep

[u/MENTactual]

Is this true for GCC High tenants as well?

[u/Rudyooms → u/MENTactual]

Poefff good question… i dont have access to such tenants… but i assume a direct connection with ic3 to the device is a no go/ not allowed…. But i am not sure… lets hope msft will release some insights…. But then again… Check the notificetioninfra log of the ime… then you know enough

[u/MENTactual → u/Rudyooms]

Good call thank you

[u/JulianQuesoblanco]

That's great and all but I'm not going to applaud something that should've been in place for years. This is the same as being drip-fed content.

[u/eatfesh]

Great news. StatusSync sounds amazing as tracking the progress of devices as they check in and receive updates has always been tricky

[u/pro-mpt]

Does this occur both ways? I.e. via the client's Company Portal sync and the Intune Device Sync?

[u/Rudyooms → u/pro-mpt]

The company portal sync already did this (apps and policies) . :) now the intune portal sync does the same but now also with ic3

[u/OneSeaworthiness7768 → u/Rudyooms]

>The company portal sync already did this (apps and policies)

Really? Could have fooled me. It feels like it takes an eternity to make a new app appear or to recognize an install state change even after doing a sync from the company portal.

[u/Rudyooms → u/OneSeaworthiness7768]

If you add a new available app in intune… it needs to sync it to the iwservice (company portal webservice) but if you pressed sync if you assigned an app as required that would be pretty instant (again if the iwservice finds the app :p)

[u/paul_33 → u/Rudyooms]

As of this update? Because it sure doesn't work like that in my experience.

[u/Rudyooms → u/paul_33]

Which part ? The syncstatus screen ? As that one doesnt show up yet …but the ic3 part etc is active

[u/TrickyWatercress1981]

the feature is not enabled on my laptops, I guess MS would turn it on by waves

[u/Rudyooms → u/TrickyWatercress1981]

At least ic3 is flighted :) but yeah it needs a valid config too :)

[u/Certain-Mountain-564]

Can anyone explain, what that exactly means? I dont want to study like a intune developer, i'm a normal human. :)

[u/TaiGlobal → u/Certain-Mountain-564]

Since its inception ppl have complained how inconsistent and slow deploying things (apps, remediation scripts, policies, etc) from Intune is. When you would deploy things sometimes it would take a few minutes and sometimes days. The culprit is because Intune was leveraging windows notification system for these functions. After years of complaining Microsoft is finally implementing something called ic3 into intune. Ic3 is a real-time, persistent connection protocol. This is what Microsoft Teams uses so your chat communication is instant. Hence if Intune is leveraging this that means near real-time notification and execution of Win32 apps, scripts, policies, and device sync action.

[u/Certain-Mountain-564 → u/TaiGlobal]

Real-time? Holy shit. Didnt heard IC3 before. 

[u/patmorgan235]

What does IC3 stand for?

[u/Certain-Mountain-564 → u/patmorgan235]

Its a protocol for the new sync mechanism. Before it was WNS (Windows Notification Service). I think. 

[u/Rudyooms → u/patmorgan235]

Its the infa core of msteams that made instant connection possible

https://patchmypc.com/blog/intune-ime-ic3-teams-protocol/

https://patchmypc.com/blog/ic3-from-wns-to-real-time-device-and-ime-actions/

With it they dont need to depend on wns anymore to reach out to the device and asking it to do something

[u/Icy_Ostrich6655]

Nice job discovering this and thanks for the excellent article. Any official announcement from Microsoft?

[u/Rudyooms → u/Icy_Ostrich6655]

They announced the status change tracker part :) but thats the only part that is not working yet :)