Improved MDM diagnostics from Windows 10 Insider Preview #16232

Note: the content in this blog post may subject to change as it’s based on Windows 10 Insider Preview build 16232/16237.

In the early days of Windows 8.x modern management made it’s appearance but due it’s limitations at that time not widely adopted.

Traditional vs Modern

The introduction of Windows 10 as the cloud OS with tight integration of Azure AD changed this rapidly. Combined with configuration service provider (CSP) modern management provides increased capabilities and therefore closing the gap with traditional management.

Another often-heard challenge of modern management is the troubleshooting part. This can sometimes be challenging as it is experienced as a black box. Common tools  (e.g. Event Viewer, PowerShell, WMI) are sometimes cryptic and thus challenging to interpret, until today!

Troubleshooting

To illustrate the ease of troubleshooting (low entry), we configured a custom policy by Microsoft Intune which configures Windows Defender Application Guard (currently in preview) and check the process of the policy being applied on our endpoint .

Microsoft Intune Custom Policy

Once assigned the policy in Microsoft Intune we triggered a policy refresh cycle.

Updated interface

Update Management Profile GUI

In the updated GUI we can now determine which policy categories are configured, including our Windows Defender Application Guard (AppHVSI) policy. Besides the outline of the policy categories we can also determine the installed applications. 

 Improved Management Profile GUI PolicyManager MDM Category

Management Diagnostic log files

The updated GUI goes beyond just displaying what is configured/applied and provides the ability drill down to our MDM configuration. The MDM configuration can be exported in a management log file which is exported in HTML format to C:\Users\Public\Documents\MDMDiagnostics\MDMDiagReport.html

MDM Diagnostics GUI

The MDM diagnostic log file provides general information of your system. However the most interesting part is yet to come.

Base MDM Diagnostic Information

First of all it provides insights of the configuration sources and resource (CSPs) and  whether it’s a device- or user based policy. The Resource section correlates to the various policies and installed apps. I highlighted a guid which correlates to an installed application.

MDM Configuration Sources

Further it provides a detailed list of which policy categories are deployed by your MDM solution. These categories are listed in the updated interface I mentioned before. Further this section provides the detailed configuration of your policies.

In our scenario we deployed Windows Defender Application Guard policy. It shows you the policy area, default value, current value and whether it’s a device- or user based policy.  It confirms the custom Windows Defender Application Guard Policy has been landed and successfully applied.

MDM Managed Policies

When looking under the hood we’ve the confirmation here too, Windows Defender Application Guard is configured properly. And mentioned earlier you’ll find the policy categories once again.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\current\device\AppHVSI

PolicyManager MDM Registry

Complementary to the Windows Defender Application Guard CSP configuration you can keep track of the group policy (backed ADMX) equivalent.

PolicyManager MDM Group Policy

Installed Applications

As mentioned before the MDM diagnostic log file also includes the list of installed applications through MDM channel.

Managed Applications by MDM

Finally, we also have access to settings which are not set via CSP.

Unmanaged MDM Policies

Summary

The updated interface in this Windows 10 preview build is a simple as ingenious extension and help us to get useful insights to troubleshoot your modern management end-points.

Sources

Introduction to configuration service providers (CSPs) for IT pros

https://docs.microsoft.com/en-us/windows/configuration/provisioning-packages/how-it-pros-can-use-configuration-service-providers

WindowsDefenderApplicationGuard CSP

https://docs.microsoft.com/en-us/windows/client-management/mdm/windowsdefenderapplicationguard-csp

Continue reading “Improved MDM diagnostics from Windows 10 Insider Preview #16232”

Control Access to SharePoint Online/OneDrive from unmanaged devices

In a mobile-first cloud first world the need of accessing corporate resources on unmanaged devices is rising. This is the cutting edge of managing your corporate data (keeping it safe) and give your users the freedom to be productive on any device.

With Conditional Access we can control access to corporate data (such as Exchange Online, SharePoint Online, Yammer, Delve, Teams, etc.) based on a device (health) status such as being managed or complaint. These scenarios (conditions) are based on devices being managed by your company (MDM managed). With the introduction of Session Controls, organizations are enabled to grant limited access to corporate resources without losing control on unmanaged devices.

Conditional Access Session Controls

Continue reading “Control Access to SharePoint Online/OneDrive from unmanaged devices”

Secure your SaaS & On-premises applications with Azure AD Conditional Access

Last week Microsoft announced the public preview of Azure AD Conditional Access to protect Azure AD SaaS applications based on device-based policy rules. Conditional Access (CA) is already available for a quite long time for those who are using Microsoft Intune, but was scoped to Microsoft cloud services such as Dynamics CRM Online, Exchange Online, Exchange on-premises, SharePoint Online and Skype for Business Online.

With the introduction of CA for Azure AD SaaS applications it’s a great step forwards raising the security bar in a mobile first cloud first world securing your SaaS applications and how they being accessed.


In this blog I will not elaborate the detailed operation of CA but will show you how easily it is to configure and apply Azure AD Conditional Access for an on-premise web application which we have published by Azure AD Proxy. Continue reading “Secure your SaaS & On-premises applications with Azure AD Conditional Access”