As you enroll a mobile device into Intune/ConfigMgr 2012 R2, inventory data will automatically be uploaded to the ConfigMgr database. One of the data being collected is the Jailbroken/rooted condition. In the below example the device is being detected as a jailbroken device.
One of the many benefits of using Intune as the MDM solution is the integration with System Center 2012 R2 Configuration Manager. Once data is in the database we can use the entire ConfigMgr engine to manage the device. MDM devices in ConfigMgr can be managed using the Application Model and the Compliance Management feature. Especially the Compliance Management feature is powerful and can be used to apply special security settings on a device or retire/wipe the device.
How to create the dynamic collection
- Create a new collection limited to All Mobile Devices
- Open the Collection Properties, select the Membership Rules tab, click Add Rule, Query Rule.
- Name the rule Jailbroken Devices and click Edit Query Statement.
- Select the Criteria tab and create a new criteria.
- Select Mobile Device Computer System as the Attribute Class and Jailbroken or rooted device as the Attribute
- Type 1 as the value and finish the collection
- With a collection it’s now up to your security policies to determine what should happen to the device. Right click the device and click Retire/Wipe to remove/wipe the device from Intune and by doing that prevent user access to data from the device.
- In the console you will also find a link to the primary user on the device. That way you can start deploying more restrictive security settings, block access to mail profiles, WIFI profiles etc.
