MDM users needs to log in?

[alyssafriesen]

I just installed the MDM application on a new machine and enrolled in device management. I can see the device in Systems Manager, but not all of the profile settings are being applied. If see that under "Profiles" there is an error message that says "The MDM user needs to log in to the device for settings to be updated". 

I'm not finding any documentation on this and I'm not sure what it wants. I am logged into the machine and Microsoft reports that the sync is working correctly, but settings like WiFi are not propagating out to the device (which is connected via ethernet at the moment).

[PhilipDAth]

Authentication when enrolling is not a hard requirement, but I find it makes many things work better so I tend to use it.

You can authenticate against Office 365, Google and Active Directory.

https://documentation.meraki.com/SM/Device_Enrollment/SM_Enrollment_Authentication

[TomBenoit]

I am currently managing machines that are not on a domain.  I am getting this error message over time i.e. the profile works for a while and then it will not accept any updates I make to the profile.  The local admin account that setup the managed profile is logged in.  Any ideas?

[thunt]

We are having the exact same issue.  It works initially and then just stops working.

[thunt]

Agent version

Current Version:

3.5.2

[PaulF]

So, windows has two modes (currently) of enrollment. MDM and agent. Because the MDM is tied to a user account on the device, it can't be updated if that user is not logged in, and that's why you are getting this message

If you use the Systems Manage agent on the device, you won't get this error.

I hope that helps

Paul

[thunt]

We do use the Systems Manager agent on the device and we are getting this message.  We enroll the device via Windows profile and then install the agent.

[PaulF]

And if the user who enrolled the device using Windows profile is not logged in, regardless of whether they have the agent or not, you'll get the message.

[jand]

Would be great if this could be fixed.

Currently I use the following procedure for Windows Devices:

- Install Systems Manager Agent

- Give the future user admin rights to enroll the device.

- Ask the user to log in once

- enroll device

- logout the user

- take back admin rights

If the device then changes the user, you can repeat the whole process 😞 

Is that the right way?

[BlakeRichardson]

I am going to be really cheeky here and its just a joke but you could buy a Mac 😜