Customize Windows 10 Start menu with Configuration Manager (MDM) or Microsoft Intune #OMA-URI

Undoubtedly you ever been asked the question to customize the Windows 10 start menu? Your response might be like “Sure, I’ll fix this by group policy, imaging (task sequence) or last resort by manually importing a .xml file.” All – almost all – valid options in a fully managed environment where your clients are domain joined (Active Directory) and/or fully managed by Configuration Manager or MDT. But hey what about your non-domain joined Windows 10 devices which are outside the company and managed by Microsoft Intune (MDM)? Well OMA-URI is your best friend! Smile

Configuration Service Provider (CSP)

In Windows 10 Enterprise and Windows 10 Education, you can use a mobile device management (MDM) policy to deploy a customized Start layout to users. No reimaging is required, and the Start layout can be updated simply by overwriting the .xml file that contains the layout. This enables you to customize Start layouts for different departments or organizations, with minimal management overhead. With Microsoft Intune (MDM), you define the Start layout using an OMA-URI setting, which is based on the Policy configuration service provider (CSP).

Continue reading “Customize Windows 10 Start menu with Configuration Manager (MDM) or Microsoft Intune #OMA-URI”

Updated Microsoft Intune On-premises Connector for On-premises or Hosted Exchange

image

For those who are using On-Premises Exchange or Hosted Exchange with Microsoft Intune (standalone) hereby a quick post to inform you the Microsoft Intune Exchange connector (5.0.6175.0) has been updated last month (March 2016). At time of writing no release notes were available what has been addressed with the updated connector.

Continue reading “Updated Microsoft Intune On-premises Connector for On-premises or Hosted Exchange”

Updated: Exchange Connector permissions changed in Configuration Manager Current Branch (1511 and higher)

Exchange Connector Current Branch

Note! Updated with additional permissions (Get-Mailbox) 04/28/2016

During a Configuration Manager Current Branch (1511) implementation I bumped into an issue configuring the Exchange Connector. After configuring the Exchange Connector, devices which are connected by Exchange were not successfully discovered and therefore not appearing in the admin console.

Continue reading “Updated: Exchange Connector permissions changed in Configuration Manager Current Branch (1511 and higher)”

Part 3 – Create & deploy Enterprise Data Protection using System Center Configuration Manager Current Branch

image

In this blog series of Enterprise Data Protection (EDP) I will provide you some more insights what EDP is, how it works and how to create & deploy EDP policies by Configuration Manager and Microsoft Intune.

In this 3rd blog post I’ll outline how to create & deploy Enterprise Data Protection policies by Configuration Manager Current Branch (1511) to Windows 10 devices.

Continue reading “Part 3 – Create & deploy Enterprise Data Protection using System Center Configuration Manager Current Branch”

Part 2 – Define Privileged Desktop & Universal Applications for Enterprise Data Protection

My very first challenge – which was in my modest opinion the hardest part – with Enterprise Data Protection (EDP) was defining protected applications in a correct way. Many of you including myself were struggling how to define restricted applications.

image

In a serie blog posts I will provide some guidance how EDP works and how to configure protected apps, Configuration Manager and Microsoft Intune.

In this blog I’ll explain how you can retrieve the mandatory information required in order to define protected applications for your Enterprise Data Protection policies.

Continue reading “Part 2 – Define Privileged Desktop & Universal Applications for Enterprise Data Protection”

Blog series: Protect your Company Data using Enterprise Data Protection (EDP)

Recently I had the chance during a technical Friday jam session to play around with Enterprise Data Protection (EDP) with some other geeks .

EDP

In short Enterprise data protection (EDP) helps to protect against potential data loss without interfering end-user experience. EDP also helps to protect enterprise apps & data against accidental data loss on enterprise-owned devices, including personal devices that end-users bring to work without requiring changes to your environment or other apps.

Although EDP is introduced with Windows 10 release, the underlying technologies are common known. EDP is primary relying on Encrypted File System (EFS) and AppLocker. In a serie blog posts I will provid some guidance how EDP works and how to configure protected apps, Configuration Manager and Microsoft Intune.

Note!

Enterprise data protection is currently being tested with a number of enterprise customers, and will become available to Windows Insiders soon.

Stay tuned!

Intune Extensions install process improved /w April Service Update

Last week Microsoft updated their Intune cloud services with the April service update. This April service update (5.0.5118.0) introduces a lot of new features which were recently announced by the Microsoft Intune team. More details on this can be found here.

image

Most of you are familiar with the fact it can take up to 24-hours until the Intune extensions finally comes down in your Configuration Manager 2012 R2 instance. Initially there is no method for forcing the extensions to come down. Especially working with customers engagements (proof of concepts) it is very annoying to have to wait a day before you can enable these extensions.

The Microsoft Intune Product Team did a great job to speed up this process, which comes with the April update. The time it takes when Intune extensions comes down into your Configuration Manager 2012 R2 instance is significantly improved. By shorten the interval at the backend new tenants should be able to see extensions within 10 mins after connector role has been setup successfully. For the extensions published after installation, it is up to 6 hours.

Continue reading “Intune Extensions install process improved /w April Service Update”

Deploy *.appx files to Windows Phone 8.1 with the upcoming Microsoft Intune March service update

The Microsoft Intune Team announced the next service update for Microsoft Intune will become available between March 4, 2015 and March 7, 2015.

With notable attention with the new service update you’re able to deploy *.appx files to Windows Phone 8.1 devices. The *.appx extension – aka as Metro App – is normally only available for the Windows 8.1 platform. By enabling *.appx support for Windows Phone 8.1 Microsoft is taking the next step into the universal app erea.

New Intune standalone (cloud only) features that will be released as part of this service update include:

  • Ability to streamline the enrollment of iOS devices purchased directly from Apple or an authorized reseller with the Device Enrollment Program (DEP). The Device Enrollment Program (DEP) provides a fast, streamlined way to deploy your corporate-owned Mac or iOS devices, whether purchased directly from Apple or through participating Apple Authorized Resellers
  • Ability to restrict access to SharePoint Online and OneDrive for Business based upon device enrollment and compliance policies
  • Management of OneDrive apps for iOS and Android devices
  • Ability to deploy .appx files to Windows Phone 8.1 devices
  • Ability to restrict the number of devices a user can enroll in Intune

Further, as part of this service update, we Microsoft will be providing hybrid customers with the ability to create custom WiFi profiles with pre-shared keys (PSK) for Android devices. This will be expected to be alvailable in the next service update for Intune standalone (cloud only).

For more detailed information see the Microsoft Intune Team Blog

KB3002291: MDM settings are not applied to cloud-managed users in Configuration Manager 2012 R2

hotfixJust drop you a quick line a new hotfix for Configuration Manager 2012 R2 is released which improves the process of getting policies applied to mobile devices. When a user becomes a cloud-managed user (CloudUserID), a settings policy may not target the assignment for the user this due to different user(s) with same clouduserID. This behavior was introduced by CU2 and CU3.

  • This problem affects only environments that use the Intune Connector together with Configuration Manager 2012 R2.
  • This problem occurs only when Cumulative Update 2 or Cumulative Update 3 for Configuration Manager is installed.

To apply this hotfix, you must have Cumulative Update 2 or Cumulative Update 3 for System Center 2012 R2 Configuration Manager installed.

For more details and download see http://support2.microsoft.com/kb/3002291

For a complete list of all available hotfixes and update please consult the List of Public Microsoft Support Knowledge Base Articles wiki page.

Troubleshooting Microsoft (Windows) Intune Extensions

Most of you are problably aware of Microsoft (Windows) Intune extensions and using them briefly without any issue(s). New extensions becomes automatically available through the Microsoft Intune connector and new updates are merged or installed to introduce new features taking benefits of the Microsoft Intune cloud services platform.

So far so good…but if you’ve bad luck extensions comes partly down or becomes not available at all to your Configuration Manager instance! Unfortunately there is no way to force a trigger of the tenant discovery process and thus the installation of Microsoft Intune extensions. In normal circumstances it will take up to 24 hours after registering your Intune subscription untill the Intune extensions comes down to your Configuration Manager instance. This pitty if you would speed up the process of installing new deployments or you’re in a disaster recovery scenario. Hereby some guidelines for troubleshooting Microsoft Intune extensions, logs locations(s), Certificate Thumbprint ID, SQL query and validating the connectivity with Microsoft Intune.

Continue reading “Troubleshooting Microsoft (Windows) Intune Extensions”