Blogabout.Cloud

In this video, I run through how to connect Managed Google Play Store to Microsoft Endpoint Manager and approve applications that can be published to your Android devices.

Regards
The Author – Blogabout.Cloud

In this post, you can see all the new items that have been released in the following product areas

– Device Management
– App Management
– Device Configuration
– Device enrollment
– Monitor and Troubleshoot
– Security

Device Management

Use sync remote action in bulk for iOS

You can now use the sync remote action on up to 100 iOS devices at a time. To see this feature, go to Microsoft Endpoint Manager admin center > Devices > All devices > Bulk device actions.

Automated device sync interval down to 12 hours

For Apple’s Automated Device Enrollment, the automated device sync interval between Intune and Apple Business Manager has been reduced from 24 hours to 12 hours. For more information on sync, see Sync managed devices.

App Management

Customize self-service device actions in the Company Portal

You can customize the available self-service device actions that are shown to end-users in the Company Portal app and website. To help prevent unintended device actions, you can configure these settings for the Company Portal app by selecting Tenant Administration > Customization. The following actions are available:

• Hide Remove button on corporate Windows device.
• Hide Reset button on corporate Windows devices.
• Hide Reset button on corporate iOS devices.
• Hide Remove button on corporate iOS devices. For more information, see User self-service device actions from the Company Portal.

Auto update VPP available apps

Apps that are published as Volume Purchase Program (VPP) available apps will be automatically updated when Automatic App Updates is enabled for the VPP token. Previously, VPP available apps did not automatically update. Instead, end-users had to go to the Company Portal and reinstall the app if a newer version was available. Required apps continue to support automatic updates.

Unified delivery of Azure AD Enterprise and Office Online applications in the Company Portal

This feature has been delayed. On the Customization pane of Intune, you can select to Hide or Show both Azure AD Enterprise applications and Office Online applications in the Company Portal. Each end-user will see their entire application catalog from the chosen Microsoft service. By default, each additional app source will be set to Hide. This feature will first take effect in the Company Portal website, with support in the Windows, iOS/iPadOS, and macOS Company Portals expected to follow. In the Microsoft Endpoint Manager admin center, select Tenant administration > Customization to find this configuration setting. For related information, see How to customize the Intune Company Portal apps, Company Portal website, and Intune app.

Android Company Portal user experience

In the 2005 release of Android Company Portal, end-users of Android devices that are issued a warn, block, or wipe by an app protection policy will see a new user experience. Instead of the current dialog experience, end-users will see a full page message describing the reason for the warn, block, or wipe and the steps to remediate the issue. For more information, see App protection experience for Android devices and Android app protection policy settings in Microsoft Intune.

Support for multiple accounts in Company Portal for macOS

The Company Portal on macOS devices now caches user accounts, making sign-in easier. Users no longer need to sign into the Company Portal every time they launch the application. Additionally, the Company Portal will display an account picker if multiple user accounts are cached, so that users don’t have to enter their user name.

Newly available protected apps

The following protected apps are now available:

• Board Papers
• Breezy for Intune
• Hearsay Relate for Intune
• ISEC7 Mobile Exchange Delegate for Intune
• Lexmark for Intune
• Meetio Enterprise
• Microsoft Whiteboard
• Now® Mobile – Intune
• Qlik Sense Mobile
• ServiceNow® Agent – Intune
• ServiceNow® Onboarding – Intune
• Smartcrypt for Intune
• Tact for Intune
• Zero – email for attorneys

For more information about protected apps, see Microsoft Intune protected apps.

Search the Intune docs from the Company Portal

You can now search the Intune documentation directly from the Company Portal for macOS app. In the menu bar, select Help > Search and enter the key words of your search to quickly find answers to your questions.

Windows 32-bit (x86) apps on ARM64 devices

Windows 32-bit (x86) apps that are deployed as available to ARM64 devices will now be displayed in the Company Portal. For more information about Windows 32-bit apps, see Win32 app management.

Windows Company Portal app icon

The icon for the Windows Company Portal app has been updated. For more information about the Company Portal, see How to customize the Intune Company Portal apps, Company Portal website, and Intune app.

Update to icons in Company Portal app for iOS/iPadOS and macOS

We’ve updated the icons in Company Portal to create a more modern look and feel that’s supported on dual screen devices and aligns with the Microsoft Fluent Design System. To see the updated icons, go to UI updates for Intune end-user apps.

Device Configuration

Improvements to OEMConfig support for Zebra Technologies devices

Intune fully supports all features provided by Zebra OEMConfig. Customers managing Zebra Technologies devices with Android Enterprise and OEMConfig can deploy multiple OEMConfig profiles to one device. Customers can also view rich reporting about the status of their Zebra OEMConfig profiles.

For more information, see Deploy multiple OEMConfig profiles to Zebra devices in Microsoft Intune.

There is no change in OEMConfig behavior for other OEMs.

Applies to:

• Android Enterprise
• Zebra Technologies devices that support OEMConfig. For specific details on support, contact Zebra.

Configure system extensions on macOS devices

On macOS devices, you can create a kernel extensions profile to configure settings at the kernel-level (Devices > Configuration profiles > macOS for platform > Kernel extensions for profile). Apple is eventually deprecating kernel extensions, and replacing them with system extensions in a future release.

System extensions run in the user space, and don’t have access to the kernel. The goal is to increase security and provide more end user control, while limiting attacks at the kernel level. Both kernel extensions and system extensions allow users to install app extensions that extend the native capabilities of the operating system.

In Intune, you can configure both kernel extensions and system extensions (Devices > Configuration profiles > macOS for platform > System extensions for profile). Kernel extensions apply to 10.13.2 and newer. System extensions apply to 10.15 and newer. From macOS 10.15 to macOS 10.15.4, kernel extensions and system extensions can run side-by-side.

To learn about these extensions on macOS devices, see Add macOS extensions.

Applies to:

• macOS 10.15 and newer

Configure app and process privacy preferences on macOS devices

With the release of macOS Catalina 10.15, Apple added new security and privacy enhancements. By default, applications and processes are unable to access specific data without user consent. If users don’t provide consent, the applications and processes may fail to function. Intune is adding support for settings that enable IT administrators to allow or disallow data access consent on behalf of end-users on devices running macOS 10.14 and later. These settings will ensure that applications and processes continue to function properly, and reduce the number of prompts.

For more information on the settings you can manage, see macOS privacy preferences.

Applies to:

• macOS 10.14 and newer

Device enrollment

Company Portal for Android guides users to get apps after work profile enrollment

We’ve improved the in-app guidance in Company Portal to make it easier for users to find and install apps. After they enroll in work profile management, users will get a message explaining how to find suggested apps in the badged version of Google Play. The last step in Enroll device with Android profile has been updated to show the new message. Users will also see a new Get Apps link in the Company Portal drawer on the left. To make way for these new and improved experiences, the APPS tab was removed. To see the updated screens, go to UI updates for Intune end-user apps.

Enrollment restrictions support scope tags

You can now assign scope tags to enrollment restrictions. To do so, go to Microsoft Endpoint Manager admin center > Devices > Enrollment restrictions > Create restriction. Create either type of restriction and you’ll see the Scope tags page. For more information, see Set enrollment restrictions.

Autopilot support for Hololens 2 devices

Windows Autopilot now supports Hololens 2 devices. For more information on using Autopilot for Hololens, see Windows Autopilot for HoloLens 2.

Monitor and troubleshoot

Device reports UI update

The reports overview pane will now provide a Summary and a Reports tab. In the Microsoft Endpoint Manager admin center, select Reports, then select the Reports tab to see the available report types. For related information, see Intune reports.

Security

Derived credentials support for DISA Purebred on Android devices

You can now use DISA Purebred as a derived credentials provider on Android Enterprise fully managed devices. Support includes retrieving a derived credential for DISA Purebred. You can use a derived credential for app authentication, Wi-Fi, VPN, or S/MIME signing and/or encryption with apps that support it.

Send push notifications as an action for noncompliance

You can now configure an action for noncompliance that sends a push notification to a user when their device fails to meet conditions of a compliance policy. The new action is Send push notification to end user, and is supported on Android and iOS devices.

When users select the push notification on their device, the Company Portal or Intune app opens to display details about why they are noncompliant.

Endpoint security content and new features

The documentation for Intune Endpoint Security is now available. In the endpoint security node of the Microsoft Endpoint Manager admin center you can:

• Create and deploy focused security policies to your managed devices
• Configure integration with Microsoft Defender Advanced Threat Protection, and manage security tasks help remediate risks for at-risk devices as identified by your ATP team
• Configure security baselines
• Manage device compliance and conditional access policies
• View compliance status for all your devices from both Intune and Configuration Manager when Configuration Manager is configured for client attach.

In addition to the availability of content, the following are new for Endpoint Security this month:

• Endpoint security policies are out of preview and are now ready to use in production environments, as generally available, with two exceptions:
  • In a new public preview, you can use the Microsoft Defender Firewall rules profile for Windows 10 Firewall policy. With each instance of this profile you can configure up to 150 firewall rules to compliment your Microsoft Defender Firewall profiles.
  • Account protection security policy remains in preview.
• You can now create a duplicate of endpoint security policies. Duplicates keep the settings configuration of the original policy, but get a new name. Then new policy instance doesn’t include any assignments to groups until you edit the new policy instance to add them. You can duplicate the following policies:
  • Antivirus
  • Disk encryption
  • Firewall
  • Endpoint detection and response
  • Attack surface reduction
  • Account protection
• You can now create a duplicate of a security baseline. Duplicates keep the settings configuration of the original baseline, but get a new name. The new baseline instance doesn’t include any assignments to groups until you edit the new baseline instance to add them.
• A new report for endpoint security antivirus policy is available: Windows 10 unhealthy endpoints. This report is a new page you can select when your viewing your endpoint security antivirus policy. The report displays the antivirus status of your MDM-managed Windows 10 devices.

Support for S/MIME signing and encryption certificates with Outlook on Android

You can now use certificates for S/MIME signing and encryption with Outlook on Android. With this support, you can provision these certificates by using SCEP, PKCS, and PKCS imported certificate profiles. The following Android platforms are supported:

• Android Enterprise Work Profile
• Android Device Administrator

Support for Android Enterprise Fully Managed devices is coming soon.

For more information about this support, see Sensitivity labeling and protection in Outlook for iOS and Android in the Exchange documentation.

Use Endpoint detection and response policy to onboard devices to Defender ATP

Use endpoint security policy for Endpoint detection and response (EDR) to onboard and configure devices for your deployment of Microsoft Defender Advanced Threat Protection (Defender ATP). EDR supports policy for Windows devices managed by Intune (MDM), and a separate policy for Windows devices managed by Configuration Manager.

To use the policy for Configuration Manager devices, you must set up Configuration Manager to support the EDR policy. Set up includes:

• Configure your Configuration manager for tenant attach.
• Install an in-console update for Configuration Manager to enable support for the EDR policies. This update applies only to hierarchies that have enabled tenant attach.
• Synchronize your device collections form your hierarchy to the Microsoft Endpoint Manager admin center.

Scripting

macOS script support

Script support for macOS is now generally available. In addition, we have added support for both user assigned scripts and macOS devices that have been enrolled with Apple’s Automated Device Enrollment (formerly Device Enrollment Program). For more information, see Use shell scripts on macOS devices in Intune.

Regards
The Author – Blogabout.Cloud