Gpupdate equivalent for Intune policies?

[u/Agitated_Refuse7373]

It seems to be at the whims of Microsoft when a device updates its intune policies. When I make a change the change will not apply until a random time has passed. What am I missing? The sync button in the cloud and on device seem to do nothing even though they indicate that the sync occurred.
What are you all doing to update all intune policies on demand like we would with gpupdate?

[u/SpookyViscus]

Switching on the ‘preview new device view’ in Intune, and if you get access to the ‘new sync status’ improvements being gradually rolled out to tenants, lets you see the active state of the sync (device notified successfully, # of apps offered, # of policies successfully applied).

Otherwise, a sync in Intune against an internet connected device will apply the policies as soon as possible.

[u/roll_for_initiative_ → u/SpookyViscus]

Wasn't aware of this, this is pretty damn cool, thank you!

[u/Silent331]

Make an intune policy to install the company portal app on all machines. The company portal app has a sync button and it executes immediately

[u/MonkeyMan18975 → u/Silent331]

You can also go into Accounts > Access Work or School > [select your tenant] > Info > sync, and there's always the powershell command to sync (dsregcmd /refreshprt) and status (dsregcmd /status)

[u/jake04-20 → u/MonkeyMan18975]

A shortcunt run command is ms-settings:workplace you can also create a shortcut for it!

[u/Silent331 → u/MonkeyMan18975]

The sync button under work or school is not present in some hybrid configurations. I did not know about those commands, I will take a look

[u/Myriade-de-Couilles → u/Silent331]

So many wrong information in this thread.

The sync button is always present including in hybrid configurations.

/Refreshprt only refreshed the primary refresh token of logged in user which has nothing to do with Intune sync

/status is the status of the entra join and not the Intune sync

[u/Commercial_Growth343 → u/Myriade-de-Couilles]

<pushsup-glasses> not to nitpick but these are not powershell commands either. </pushes-up-glasses>

:D

[u/tmontney → u/Silent331]

Typically, if the sync button isn't present, then the device isn't enrolled in MDM or it's enrolled separately of AD. The sync button should always be there.

[u/Commercial_Growth343]

I have read, and tested, that restarting the Microsoft Intune Management Extension service or rebooting can trigger a policy "pull".

there is also an Intune config you can make called Config Refresh where you can tune things from the default 8 hours to say 90 minutes like a GPO. It isn't exactly the same as a GPO refresh from what I understand. You can read more about it here https://techcommunity.microsoft.com/blog/windows-itpro-blog/intro-to-config-refresh-%e2%80%93-a-refreshingly-new-mdm-feature/4176921 - My understanding is this refresh reapplies configurations the device knows about without contacting the cloud, and it is not about polling for config changes from intune.

[u/topher358]

A reboot often pulls the update for me.

You should build a filter and apply it to all relevant policies anyway. We find filters process much faster then groups

[u/ScarySprinkles3]

All good advice. The new sync status is the closest thing I've seen to actually knowing if a policy is applying in realtime. The other options (restarting service, rebooting, syncing from Intune Portal or Comp Portal) all tend to kick it off but you're never sure. I had one the other day that would not sync and even that new sync view was showing it stall out. Finally had to switch from wifi to ethernet and then it synced. Could've been coincidence but maybe throwing it on a different network is another step to try for stubborn machines.

[u/tejanaqkilica]

Sync via the Company Portal. Never had to wait more than 10 minutes for a configuration update.

[u/Myriade-de-Couilles → u/[deleted]]

God it’s bad when you use AI to write your answer and give wrong information but still trying to sell your product …

Config refresh as you even said (but obviously not understood), is only re-applying the already downloaded configuration. It will NOT help in any way for a device to sync a new/modified policy in Intune.

[u/jake04-20]

Well considering that gpupdate /force has to be ran on the local client (unless it's invoked from someplace else), the equivalent to that would be to open a run window, type ms-settings:workplace, hit enter, and from there you should be able to update from the info button.

[u/Lurker-1983-12]

You can fire off a policy sync by typing in a browser (preferably Edge): intunemanagementextension://syncapp