We investigated this for a while and I wanted to provide some notes here for others. We learned it is not possible to force machines to sync in an automated way if deploying win32 apps. We have to just wait for the IME service on the device to perform its every-hour sync for the machine to learn about the install job they shopped for.
When a device is targeted with a new deployment Intune will attempt to sync with the device automatically once the policy is created. You can see this by looking at the Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Admin event log on the machine. It takes a few minutes for Intune to create the policy (in my testing it usually took 3 minutes, although I did see 20 minuets one afternoon) and I always see the sync fail at first, and then try again 5 minutes later and it is successful.
I was refreshing the Managed Apps page for the device (available on the left side when you drill into a specific device in Intune) to monitor the policy. It seems the policy is ready to be picked up once you see the app/deployment show up.
But this sync is only an MDM sync (the sync that our machines do every 8 hours), and this does NOT force the IME to sync (the IME syncs every hour). This would be great if you are deploying LOB aps, but the IME needs to sync to process win32 apps, which is all we deploy.
I explored some creative ways to force the IME to sync but could not find a way to do this programmatically / automatically. Only thing that works is to sync manually from Company Portal.
This article was really helpful to me while trying to understand all of this -
- When does a Windows client sync with Intune? – Out of Office Hours (oofhours.com)
and I was very optimistic after reading this - Triggering Intune Management Extension (IME) Sync – Modern IT – Cloud – Workplace (oliverkieselbach.com) but the sync command here did not work for me. The IME does seem to perform some action when we run this (the IME log moves A LOT) but it does not learn about the new job. The IME has gone through many updates and the article was written a while ago. Maybe this undocumented 'feature' has changed over time?
We opened a case with MS and also talked to various people at MS and they confirmed all of this was the expected behavior. So we are stuck with our users waiting for their App Portal orders to install sometime in the next hour.
If you have been researching this as well please post your findings here! Thanks!
