With the recent release of Satya Nadella’s – Microsoft CEO – book and guide “Hit Refresh” to the future, it was a perfect occasion to deploy eBooks with Microsoft Intune. Earlier this year Microsoft introduced support for volume purchase (VPP) support for eBooks via Microsoft Intune.
Volume Purchase Program’s (e.g. Microsoft Store for Business, Apple Business Store) lets you purchase multiple licenses for a book that you want to distribute to users in your company. With Apple you can distribute books from the Business, or Education stores. Continue reading “Deploying Satya Nadella’s Guide “Hit Refresh” to the future /w Microsoft Intune eBooks”
Note: the content in this blog post may subject to change as it’s based on Windows 10 Insider Preview build 16232/16237.
In the early days of Windows 8.x modern management made it’s appearance but due it’s limitations at that time not widely adopted.
The introduction of Windows 10 as the cloud OS with tight integration of Azure AD changed this rapidly. Combined with configuration service provider (CSP) modern management provides increased capabilities and therefore closing the gap with traditional management.
Another often-heard challenge of modern management is the troubleshooting part. This can sometimes be challenging as it is experienced as a black box. Common tools (e.g. Event Viewer, PowerShell, WMI) are sometimes cryptic and thus challenging to interpret, until today!
To illustrate the ease of troubleshooting (low entry), we configured a custom policy by Microsoft Intune which configures Windows Defender Application Guard (currently in preview) and check the process of the policy being applied on our endpoint .
Once assigned the policy in Microsoft Intune we triggered a policy refresh cycle.
In the updated GUI we can now determine which policy categories are configured, including our Windows Defender Application Guard (AppHVSI) policy. Besides the outline of the policy categories we can also determine the installed applications.
Management Diagnostic log files
The updated GUI goes beyond just displaying what is configured/applied and provides the ability drill down to our MDM configuration. The MDM configuration can be exported in a management log file which is exported in HTML format to C:\Users\Public\Documents\MDMDiagnostics\MDMDiagReport.html
The MDM diagnostic log file provides general information of your system. However the most interesting part is yet to come.
First of all it provides insights of the configuration sources and resource (CSPs) and whether it’s a device- or user based policy. The Resource section correlates to the various policies and installed apps. I highlighted a guid which correlates to an installed application.
Further it provides a detailed list of which policy categories are deployed by your MDM solution. These categories are listed in the updated interface I mentioned before. Further this section provides the detailed configuration of your policies.
In our scenario we deployed Windows Defender Application Guard policy. It shows you the policy area, default value, current value and whether it’s a device- or user based policy. It confirms the custom Windows Defender Application Guard Policy has been landed and successfully applied.
When looking under the hood we’ve the confirmation here too, Windows Defender Application Guard is configured properly. And mentioned earlier you’ll find the policy categories once again.
Complementary to the Windows Defender Application Guard CSP configuration you can keep track of the group policy (backed ADMX) equivalent.
As mentioned before the MDM diagnostic log file also includes the list of installed applications through MDM channel.
The updated interface in this Windows 10 preview build is a simple as ingenious extension and help us to get useful insights to troubleshoot your modern management end-points.
Introduction to configuration service providers (CSPs) for IT pros
In a mobile-first cloud first world the need of accessing corporate resources on unmanaged devices is rising. This is the cutting edge of managing your corporate data (keeping it safe) and give your users the freedom to be productive on any device.
With Conditional Access we can control access to corporate data (such as Exchange Online, SharePoint Online, Yammer, Delve, Teams, etc.) based on a device (health) status such as being managed or complaint. These scenarios (conditions) are based on devices being managed by your company (MDM managed). With the introduction of Session Controls, organizations are enabled to grant limited access to corporate resources without losing control on unmanaged devices.
Today I was happily surprised with the announcement, as of today Microsoft Enterprise Mobility + Security E5 licenses are available through Internal Use Rights (IUR). This is great news for those who’re a Silver or Gold EMM competency partner. By this Microsoft Partners are enabled to adopt the latest security features in their own organization too. “Practice what you preach”
One of the main benefits of the Microsoft Partner program are the IUR, which allows you to use Microsoft products in your own organization for free based on your partner competence levels. This applies to traditional software, software keys and Microsoft Online Services.
With IUR Microsoft Partners are able increase productivity, business value, and savings with your internal-use rights (IUR) benefits. The Enterprise Mobility + Security E3 had been available for some quite long time however the E5 was missing here, the more we’ve an imported role as partner to enable our customers with the latest Microsoft technology.
More information regarding Internal Use Rights can be found here.
New features like Azure AD Identity Protection & Azure AD Privileged Identity Management forms important (security) components in a more than ever emerging Enterprise Mobility + Security E5 proposition.
Click here to unlock your IUR benefits today!
ps. special thanks for those who make this possible ;-)
In a diptych I’m sharing my experiences, common practices and challenges of implementing Microsoft Intune PFX connector as certificate deployment mechanism in the enterprise.
In my first blog post I covered the basics of implementing a certificate deployment infrastructure based on Microsoft Intune PFX connector. Explained the differences and considerations whether to choose SCEP or PFX as your certificate deployment solution. And explained the certificate issuing workflow. In this second post I’ll go in more detail of the anatomy of the Intune Certificate Connector, setup. Explaining the renewal and revocation process(flow) works. And lastly I give you some pointers where to start your journey, in case of troubleshooting certificate deployment issues.
Part 2 – Deploying Microsoft Intune Connector in an Enterprise world: troubleshooting
A long awaited feature became this week available in the new Azure portal: Azure AD Group Based licensing. With this we have an one-stop-shop to assign licenses on a per user- or group based.
Azure AD Group Based licensing was already available in the classic Azure portal, however it was limited to Azure AD Premium, Azure Rights Management, Microsoft Intune and Enterprise Mobility + Security licenses. For other licenses like Office 365 we were designated to the Office 365 Admin portal or custom (automated) solutions such as PowerShell or Graph API. Continue reading “One license solution rule them all: Azure AD Group Based Licensing!”
Last year I had the change to implement PFX certificate infrastructure for a large enterprise customer. Occasion of the project was a migration of Citrix XenMobile (XDM) to Microsoft Intune as strategic mobile device- and application management solution.
In a series of blogposts I’m sharing my experiences, design decisions, common practices and challenges of implementing Microsoft Intune PFX connector as certificate deployment mechanism in an enterprise environment.
- Part 1 – Deploying Microsoft Intune PFX connector in an Enterprise world: common practices
- Part 2 – Deploying Microsoft Intune PFX connector in an Enterprise world: troubleshooting Continue reading “Part 1 – Deploying Microsoft Intune PFX connector in an Enterprise world…common practices”
Recently Microsoft announced Microsoft Teams, a new chat-based platform in Office 365. For all mobile platforms (Android, iOS and Windows 10 Mobile) Microsoft released an native app, including a desktop app for Windows 10 and Mac OS X. The Microsoft Teams apps can be downloaded here. After I installed the Microsoft Teams desktop app on Windows 10 I bumped into the following funny message ‘Yikes! Looks like someone pulled the plug on the internet’.
Windows Information Protection (WIP), previously known as enterprise data protection (EDP), helps organizations to protect corporate data against potential data leakage.
The concept is fairly simple and is actually based on defining two lists:
- A corporate boundary list, which represents both on-premise & cloud network locations where managed apps can access corporate data;
- A list of managed (trusted) apps, which are allowed to open, modify & store corporate data within the corporate boundary list.
In this blog we will look at some practical examples which you have to consider for a successful implementation of Windows Information Protection including a top 4 of recommended practices.