|
2 | 2 | # required metadata |
3 | 3 |
|
4 | 4 | title: Filter reports and troubleshooting in Microsoft Intune |
5 | | -description: Use the device and app filter reports to get more information on successfully applied filters. Learn the impact of include and exclude filters in Microsoft Intune. |
| 5 | +description: Use the device and app filter reports to get more information on successfully applied filters. Learn the effect of include and exclude filters in Microsoft Intune. |
6 | 6 | keywords: |
7 | 7 | author: MandiOhlinger |
8 | 8 | ms.author: mandia |
@@ -68,7 +68,7 @@ To see this report, use the following steps: |
68 | 68 |
|
69 | 69 | In the following example, you can see this information for the **TestDevice**: |
70 | 70 |
|
71 | | -:::image type="content" source="./media/filters-reports-troubleshoot/filter-properties-single-device.png" alt-text="Screenshot that shows how to see the date, time, evaluation results, and other device filter assignment properties in Microsoft Microsoft Intune."::: |
| 71 | +:::image type="content" source="./media/filters-reports-troubleshoot/filter-properties-single-device.png" alt-text="Screenshot that shows how to see the date, time, evaluation results, and other device filter assignment properties in Microsoft Intune."::: |
72 | 72 |
|
73 | 73 | > [!IMPORTANT] |
74 | 74 | > |
@@ -118,11 +118,20 @@ Use the following table to help understand when you include or exclude devices: |
118 | 118 | ### What you need to know |
119 | 119 |
|
120 | 120 | - A **Not evaluated** filter result may show when a policy has a conflicting assignment on the device. For more information, see [Filters and assignment conflict resolution](#filters-and-assignment-conflict-resolution) (in this article). |
121 | | -- Filters are evaluated at enrollment and device check-in. The evaluation can also run at other times, such as a compliance check. You may experience race conditions in some scenarios, for example consider this sequence of events (with T representing different points in time): |
122 | | - - T1 - You assign an App to a group of users using a filter based on the "Category" property. |
123 | | - - T2 - A targeted user enrolls a new device. The device enrolls and checks-in, evaluating the associated category filter. Since there was no category set on the device, filter evaluation is based on a null category string. In the case where a filter was working in "Exclude" mode, the app could be installed having not matched the criteria for exclusion. |
124 | | - - T3 - The user is then prompted to choose a device category in the Company Portal app but enrollment and check-in has already completed. |
125 | | - - T4 - On the next device check-in, the category property has been updated in the system and now returns a different filter evaluation result, however the app was already installed and will not be automatically removed. |
| 121 | +- Filters are evaluated at enrollment and when the device checks in with the Intune service. The evaluation can also run at other times, such as a compliance check. In some scenarios, you can experience race conditions. |
| 122 | + |
| 123 | + For example, consider the following sequence of events, where each time is a different point in time: |
| 124 | + |
| 125 | + - Time1: You assign an app to a users group. This group uses a filter based on the "Category" property. |
| 126 | + - Time2: A targeted user enrolls a new device and checks in with the Intune service. During the check-in, the category filter evaluates. Since a category isn't set on the device yet, the filter evaluates as a null category, and the app installs. |
| 127 | + |
| 128 | + If a filter was working in "Exclude" mode, then the app could be installed since it might not match the exclusion criteria. |
| 129 | + |
| 130 | + - Time3: In the Company Portal app, the user is prompted to choose a device category. Remember, enrollment and check-in is already completed. |
| 131 | + - Time4: On the next device check-in, the category property updates and now returns a different filter evaluation result. Remember, the app was already installed. And, it won't be automatically removed. |
| 132 | + |
| 133 | + For approximate check-in times, go to [How long does it take for devices to get a policy, profile, or app after they're assigned?](../configuration/device-profile-troubleshoot.md#how-long-does-it-take-for-devices-to-get-a-policy-profile-or-app-after-they-are-assigned) |
| 134 | + |
126 | 135 | - The latest filter evaluation results are stored for 30 days. If the logs are expired, you may see a **We were not able to retrieve any filter evaluation results** message. |
127 | 136 |
|
128 | 137 | ## Filters and assignment conflict resolution |
@@ -189,17 +198,17 @@ For example: |
189 | 198 |
|
190 | 199 | In this scenario, the winning app intent is **Required**. For more information, see [conflicts between app intents](../apps/apps-deploy.md#how-conflicts-between-app-intents-are-resolved). So, DeviceA must only evaluate FilterA. If DeviceA matches the rules in FilterA, DeviceA receives AppA as a required app. |
191 | 200 |
|
192 | | -Apps use special behavior when resolving conflicts between **Required** and **Available** assignments. If a user or device is targeted with both **Available** and **Required** assignments, then it receives a merged intent called **Required and Available**. The device must evaluate filters used in both assignments. When evaluating both filters, the device implements the same conflict resolution: [Filter mode](#filter-mode) and ["OR" logic when filter modes are the same](#use-or-logic-when-filter-modes-are-the-same). |
| 201 | +Apps use special behavior when resolving conflicts between **Required** and **Available** assignments. If a user or device is targeted with both **Available** and **Required** assignments, then it receives a merged intent called **Required and Available**. The device must evaluate filters used in both assignments. When it evaluates both filters, the device implements the same conflict resolution: [Filter mode](#filter-mode) and ["OR" logic when filter modes are the same](#use-or-logic-when-filter-modes-are-the-same). |
193 | 202 |
|
194 | 203 | ## Conflict resolution matrix |
195 | 204 |
|
196 | 205 | In the following example, there's a conflict between assignments because the same user/device is in both assignments: |
197 | 206 |
|
198 | 207 | :::image type="content" source="./media/filters-reports-troubleshoot/example-conflict-same-group-user-policy-assignment.png" alt-text="Screenshot that shows an example assignment conflict when using filters in Microsoft Intune."::: |
199 | 208 |
|
200 | | -The following matrix explains the impact, depending on the conflict scenario: |
| 209 | +The following matrix explains the effect, depending on the conflict scenario: |
201 | 210 |
|
202 | | -:::image type="content" source="./media/filters-reports-troubleshoot/conflict-matrix.png" alt-text="Screenshot that shows that the conflict impact depends on the setting configured when using filters in Microsoft Intune."::: |
| 211 | +:::image type="content" source="./media/filters-reports-troubleshoot/conflict-matrix.png" alt-text="Screenshot that shows that the conflict effect depends on the setting configured when using filters in Microsoft Intune."::: |
203 | 212 |
|
204 | 213 | ## Next steps |
205 | 214 |
|
|
0 commit comments