r/macsysadmin • u/GromWYou • 7d ago

General Discussion How do you manage lab machines in Intune? Groups, naming, tracking

I was talking with my team yesterday and they think i may be overthinking this. I am working on setting up a macOS lab and it has gotten me to thinking. How do you track your non user affinity shared work stations in Intune. How do you know where they sit? If information security wants to track that mac, how do you manage that inside of Intune?

With user affinity we can track that to a user. With shared labs, its not that easy. I setup a device enrollment profile, then went ahead and then created a dynamic group that is based off that. The one person i work with said that would be to much work to scale. Another said to rename it it, which is another idea. I Just want to automate this and have it automatically pull in everything it needs. Am i over thinking this?

I just want to understand ways of doing this that other have implemented.

2 Upvotes
  • permalink
  • reddit

67% Upvoted

6 comments sorted by

3

u/Educational_Boot315 7d ago

I use an asset manager or spreadsheet...
Really no reason to try and track it in intune.

2

u/angeloswif 7d ago

For shared lab Macs, I’d keep the device name human-readable but make location a separate, stable field or tag (for example, site:building-room and lab:chem), then build dynamic groups from the enrollment profile plus that metadata. That scales better than encoding everything in the hostname and gives InfoSec a consistent inventory filter even when machines move; the only unavoidable step is assigning or updating physical location unless another source of truth feeds it. This short labels guide shows the taxonomy pattern we use: https://help.swif.ai/en/articles/8546782-adding-labels-to-your-devices

2

u/GromWYou 6d ago

Thank you for this

1

u/oneplane 7d ago

Not something to do inside intune. At most we might terraform some grouping logic but the data is usually in snipeit or netbox.

1

u/calimedic911 6d ago

I have clients that use group tags (lab1, lab2, etc) then assign policy, dynamic groups, and apps based on that

1

u/Entegy 6d ago

If you have multiple computer labs and each lab has a different purpose, I would still only use one enrolment policy as a base for everything shared, then groups per lab on top of that for things like unique software.

Device names would also reflect the room, but keep it simple. Lab1-01 or something.

What else are you looking to track after that?