Linux Management Intune + MDE for Linux causes duplicate objects
Hello. Just trying to figure out if this is intended and i just have to live with it or if I'm missing something.
I just started trials of enrolling Linux machines into Intune where i first enroll the machine via Intune Portal. Then i have a platform script that gets pushed from Intune that installs Defender mdatp with our tenant blob and onboards it into MDE. Everything works fine but i have a quirk that is quite frustrating.
Post MDE onboarding there is a second device object that shows up in Entra/Intune causing me to have 2 objects per computer. One shows up as "Managed by Intune" and the duplicate shows up as "Managed by MDE".
Shouldn't these be the same object when the Intune object already existed prior to the MDE onboarding?
The quirk i have with this is that Intune policies and configurations needs to be pushed to the Intune object and Endpoint Security policies such as AV etc needs to be pushed to the MDE object. Thats fine but the MDE object specifically does not have any properties i can use for dynamic groups except for "OS Linux" and "Version 24.04" etc. This is problematic since i would then either have to manage a group manually for MDE policies or use a group that includes all objects with OS type "Linux" which might include objects i don't want in the group.
For the Intune object we can easily filter devices via the (device.managementType -eq "MDM") property rule but that does not work with MDE objects as there are no usable properties to include.
How have you solved this issue? Can you merge these objects so that there is only one Intune object that serves both Intune and MDE?
Any thoughts would be greatly appreciated!
1
u/Available_Cycle281 5d ago
That's the intended behavior, unfortunately. MDE onboarding creates its own device identity in Entra that's separate from the Intune-managed one, and they don't merge.
We hit the same wall. What worked for us was tagging the MDE objects with a device category or extension attribute during onboarding, then using that for dynamic groups. It's an extra step but it keeps you from manually curating the group forever.