Microsoft 365 Device Management Part 1 – Device Enrollment

Microsoft 365 Device Management Part 1 – Device Enrollment

Microsoft 365 Device Management otherwise known as InTune, is a very popular and command device management solution you will see in most organizations. The evolution of InTune has moved very quickly with the times and you probably have the correct licenses within your organization but are currently using something like AirWatch. This post is going to dive into my personal tenant where I have configured 365 Device Management for my Android phone. In this post I am going to run through the basics of getting Microsoft 365 Device Management up and running for mobile devices likes phones and tablets. All configuration is based on what is current set within my own environment and may not apply to your organisation.

The Dashboard

Microsoft 365 Device Management Dashboard

The Microsoft 365 Device Management dashboard is configurable to your requirements. If there is something on the dashboard you would like to see or not, you can easily edit the page and add in additional tiles as shown below.

Editing the Dashboard

You can also create your own Dashboard leaving the defaults as they are;

Customized Dashboard

All Services

This section contains all the services that available within the M365 Device Management Portal, as you can some of the options dont know contain a gold star. All this basically means is that the option is not displayed on your left hand panel which is customizable to the options you want to see.

All M365 Device Management Services

Device Enrollment

Apple enrollment

In order to support iOS device Microsoft inTune requires an Apple MDM Push Certificate to manage and support multiple enrollment methods.

Android enrollment

Microsoft Intune by default supports all Android devices. Managed Google Play enables management of Work Profile and other Android Enterprise functionality.

Android Enterprise provides 3 additional functions within this selected once Managed Google Play is configured.

Personal devices with work profiles

This options allows your corporation to manage corporate data and apps on user-owned Android device. You are able to approve applications within the Google Play Store which you organization would like to manage for example Outlook. Once the applications are approved, Enrollment Restrictions allows you to configure with greater control, which groups of users should be managed using Work Profiles.

Corporate-owned dedicated devices

This option allows your corporation to manage manage device owner enrollments for kiosk and task devices using with QR Codes or tokens.

Corporate-owned, fully managed users devices (Preview)

This option is only in Preview currently and more developments are expected. In its current state, end users are able to enroll their corporate-owned devices by sending a company token. You can also use the Zero Touch Portal for auto provisioning deployment, this features apart of the InTune portal but will be coming soon.

Windows enrollment

In this section we can configure Microsoft Intune enrollment for Windows devices.

Automatic Enrollment

This options allows your corporation to configure Automatic Enrollment when a Windows devices join or register with Azure Active Directory. You can configure user scopes for MDM and MAM.

Unsure of the the different between the two?

MDM: addresses lack of control over corporate and personal devices, and lost device security

  • Ensures device compliance through user and device registration, configuration on-premises and passcode management
  • Secures devices on the network so you can monitor, report, track and update devices – and even locate, lock and wipe devices, if lost or stolen

MAM: addresses lack of compliance with data and privacy requirements, and lost data retrieval

  • User identity policy, single sign-on and conditional access tailored by role and device (with Intune or Active Directory on premises or in the cloud)
  • Monitors and pushes app updates, including mobile document management for online or cloud-provisioned apps like SharePoint and OneDrive

Windows Hello for Business

This option allows your corporation to replace password with strong two-factor authentication. Please note: This is a default Windows Hello for Business configuration applied with the lowest priority to all users regardless of group membership. Devices must be Windows 10, Windows 10 Mobile or later to be supported.

CNAME Validation

This option is a must for all organizations as its removes the need for end user to provide the MDM server address when enrolling this devices.

Enrollment Status Page

This option allows your end user to see the status of how the enrollment process. However, you can also block devices until all apps and profiles are installed.

Deployment Profiles

Windows Autopilot deployment profiles lets you customize the out-of-box experience for your devices

Devices

Windows Autopilot lets you customize the out-of-box experience (OOBE) for your users.

Intune connector for Active Directory

This option requires your organisation to download the Intune connector for Active Directory to support the Hybrid connection for Azure AD.

Terms and conditions

This option can be configured with Intune but the look and feel is quite basic as shown below;

Intune T&Cs

However, if you configure Azure AD T&C it gives a better slicker output within your Company Portal.

Enrollment restrictions

A device must comply with the highest priority enrollment restrictions assigned to its user. You can drag a device restriction to change its priority. Default restrictions are lowest priority for all users and govern userless enrollments. Default restrictions may be edited, but not deleted.

Device categories

Create device categories from which users must choose during device enrollment. You can filter reports and create Azure Active Directory device groups based on device categories

Corporate device identifiers

This option you add devices in based on the IMEI or serial, this can be done manually or via CSV upload.

Device enrollment managers

This option allows certain users to enroll larger quantities of devices. More details can be obtained from https://docs.microsoft.com/en-us/intune/device-enrollment-manager-enroll

Monitor

This sections allows you to monitor device enrollment failures, incomplete user enrollments and audit logs.

This completes Part 1, in Part 2 I will be looking at Device Compliance.

Regards
The Author – Blogabout.Cloud

Selectively wipe data using app protection policy access actions in Intune

Selectively wipe data using app protection policy access actions in Intune

Just a bit like Thanos you can selectively wipe your corporate data if you have implemented app protection policy. This provides extra flexibility for managing your corporate data across company and non-company owned device. I am currently working on an organisation where users are nervous enrolling their personal devices via the Company Portal. As an Administrator has the ability to completely Factory Reset their devices but with selectively wiping only corporate data using a particular app like (Outlook) has calmed their woes.

Don’t get me wrong, everyone is human and mistakes can be made but educating your Service Desk or responsible parties for InTune in using selective wipe reduces the risk of the Thanos Factory Reset Button.

Image result for thanos captain america
Captain America “No you won’t Factory Reset my device”

Create an app protection policy using access actions

Launch https://devicemanagement.microsoft.com
Click Client Apps –> Click App Protection Policies

Create Policy

Create Policy

Provide Information for Name, Description and Platform Fields
Select Apps

Select all the applications you would like to manage with selective wipe
Press Select

Under Settings you can either leave the defaults or modify to your requirements.
Press Create to finish the creation of the Application Protection Policy you can repeat this process for other platform you if you require.

Wiping Applications

Under App selective wipe
Click Create wipe request

Under Users
Find a select the users who you would like to wipe
Under Device
Select the device you would like to wipe

Important Notice

Please note: It can take anywhere up to 30 minutes for this process to complete, I have seen it take up to nearly 45 minutes within my own testing.

Once the applications are listed as completed, on the select device all corporate data will be removed safety not affecting another the users normal mail accounts or applications.

Regards
The Author – Blogabout.Cloud

New functionality now in preview for Conditional Access

New functionality now in preview for Conditional Access

So I was happily minding my own business looking at the configuration of my Conditional Access and notice 3 new options have appeared;

  • Baseline policy: End user protection (Preview)
  • Baseline policy: Block legacy authentication (Preview)
  • Baseline policy: Require MFA for Service Management (Preview)

Baseline policy: End user protection (Preview)

This policy protects users by requiring multi-factor authentication (MFA) during risky sign-in attempts to all applications. Users with leaked credentials are blocked from signing in until a password reset.

Once the policy is enabled, users are required to register for MFA within 14 days of their first login attempt. The default method of MFA registration is the Microsoft Authenticator App.

This policy is either On or Off and you can also exclude users from receiving this policy

Baseline policy: Block legacy authentication (Preview)

This policy blocks all sign-ins using legacy authentication protocols that don’t support multi-factor authentication (such as IMAP, POP, SMTP). The policy does not block Exchange ActiveSync.

  • Office 2013 (without registry keys)
  • Office 2010
  • Thunderbird client
  • Legacy Skype for Business
  • Native Android mail client

This policy is either On or Off and you can also exclude users from receiving this policy. This policy is great as I have configured a custom built policy for just this but my policy also includes Exchange Active Sync.

Baseline policy: Require MFA for Service Management (Preview)

This policy requires users logging into services that rely on the Azure Resource Manager API to perform multi-factor authentication (MFA).

Services requiring MFA include:

  • Azure Portal
  • Azure Command Line Interface (CLI)
  • Azure PowerShell Module

This policy is either On or Off and you can also exclude users from receiving this policy

Its great to see some more brilliant developments in Conditional Access and really excited to see these go live with customers.

Regards
The Author – Blogabout.Cloud