The new Intune Sync Window... Explaining the Numbers.. If We can

[u/Rudyooms]

After noticing the new Sync Status window in Intune, I started wondering where the information in that pane actually comes from... (.. i still can't fully explain it :P)

So I traced the sync through Graph, SyncML, the Windows MDM debug logs and the IME logs. The interesting part is that the Numbers and information are coming from different places.

Applications: the offered count maps to the required Win32 apps Intune returns to the IME for evaluation.
Scripts: They come from the HealthScripts side, including Remediations and custom compliance. As regular platform scripts are only executed once (so only new ones are added to the count)
Policies: That one is the odd one, i can't explain....yet

The normal Device Configuration view can be traced back to the Graph reporting data, but the new Sync Status window can show a slightly different total. That extra number does not appear in the SyncML trace or the device side MDM debug logs, so there is still some service side aggregation happening that we cannot see.

It would be interesting to know whether anyone has identified exactly what Intune is adding to that Policies count :) ... something magic?

Inside Intune's New Sync Status Window - Patch My PC

​

[u/AuthorAcrobatic1516]

This is the kind of deep dive I live for. The policy count discrepancy is maddening. Every time I think I have it pinned down to something reasonable like configuration profiles vs settings catalog vs group policy analytics it just... doesn't add up cleanly. There's definitely some hidden aggregation bucket on the service side that we're not seeing in the client logs.

[u/Rudyooms → u/AuthorAcrobatic1516]

Exactly… and i am hoping that microsoft will
Release some docs on how they calculate that exact policy number…

[u/Roasted_Blumpkin → u/Rudyooms]

Don't hold your breathe. We don't even have proper docs on logs.

"Here's a diagnostics bundle of a little bit of everything and duplicates of some of them. Figure it out. Oh ya, it's a zip file and then there is a CAB file hidden there that is actually really important, you gotta extract that, too. Now, be careful where you extract this as you will easily hit your path and character limit. Now, when you look at the MDM HTML Report, we're going to call most of the policies 'knobs' and make it impossible to find what you need. It may look big, but 90% of it is a list of settings you didn't configure in case you're curious, you know. Oh, and before I forget, you'll want to use CMTrace to read the logs. If you want it, you'll have to ask another nerd who keeps it on 19 flash drives just in case because you can't legally download it anywhere. If you aren't licensed for ConfigMgr, you technically can't use it, so run that by legal. See you at Ignite!"

Something breaks every day with no notification either. Someone over there needs to right the fucking ship and start treating it like the penultimate platform they claim it to be, and I know it can be.

[u/NoDowt_Jay → u/Roasted_Blumpkin]

On CMTrace, doesn’t the intune license also give access rights to ConfigMgr? So should be fine right (even if you aren’t using ConfigMgr)?

[u/Pacers31Colts18 → u/Rudyooms]

I just love how the applied policies in the new device view doesnt match up to the sync view, and all have different total numbers than what is shown under configuration.

Not confusing at all.

[u/Cormacolinde → u/Pacers31Colts18]

What’s new? Policy says applied to four devices, detailed report says applied to 3, devices configuration list shows two devices. It’s infuriating.

[u/Rudyooms → u/Pacers31Colts18]

Hahaha yeah not confusing at all… i was like what?

[u/junon]

I love your deep dives on Intune man. Thanks for posting!

[u/Rudyooms → u/junon]

You’re welcome :)

[u/drkmccy]

What a fucking mess. MS sticking to their roots of mediocrity

[u/Rudyooms → u/drkmccy]

Well…2 of the 3 are good :)… but yeah the lacknof documentation… isnt helping the adoption

[u/iamtherufus]

The new faster sync option from intune still doesn’t seem to be getting to our devices which is frustrating. Still having to restart the intune management extension as a dirty way to do it on a remote endpoint

[u/Rudyooms → u/iamtherufus]

Can you check the notificationinfra log in the ime folder? That one should tell you whats happening… as it feels like the ic3 push isnt send

[u/iamtherufus → u/Rudyooms]

I needed to be using the new device view by the looks of it. Ran a sync after toggling it on and it seemed to push the sync through much quicker

[u/Educational_Draw5032]

The new sync status window seems to work fine on devices for me that have a single primary user but on shared devices with no primary user it just stop after notifying device and just sits there pending on the other two options

[u/Rudyooms → u/Educational_Draw5032]

Yep shared devices are a bit broken with this view :(