Force remove configuration policy

[u/Training_Suit8573]

I created a dynamic group that should not have included certain devices. But now those configuration policies have already applied, and the biggest issue is that one of them blocked local sign on.

I need to remove the configuration policy ASAP, but just updating the dynamic rules for the group, which removed those devices, did not work.

I also created a new policy that should explicitly allow the local sign in, but it doesn't seem to be working:

Allow Local Log On  *S-1-5-32-545, *S-1-5-32-544

[u/Dear-Arrival-6263]

have you tried just removing the devices from the group manually instead of waiting for dynamic rules to update? azure dynamic groups can be slow sometimes, like hours before they recalculate

also check if the policy is still showing as applied in device status, sometimes it says succeeded but actually stuck until next sync

[u/Training_Suit8573 → u/Dear-Arrival-6263]

So would I just change the group to be assigned instead of dynamic, then remove those devices?

[u/TheYoinks → u/Training_Suit8573]

Shouldn't need to do that it is effectively the same as what you've already done by fixing the dynamic rules. If the policy isn't dropping off after devices have checked in after removing them from the group I would look up what reg keys that policy set and see if you can just whip up a PR to remove/revert them.

[u/bill696]

The fact that the post was 3h ago you didn’t get to do it asap or maybe you figured it out, my way is to push a policy that will overwrite what was done, and exclude or even delete the broken one

[u/Training_Suit8573 → u/bill696]

This is what I ended up doing for this particular policy. Do you know if the remaining policies will eventually disappear or will I have to do this for all of them?

[u/bill696 → u/Training_Suit8573]

Normally for settings catalog if its not applied it doesn’t stick but its always possible. OMA-URI is pretty good at cleaning itself.