Deploy the commercial ID via Windows 10 MDM

Yeah, I had some problems this week with thinking of a title that would fit with the content. Usually I’ve got the title before I start with the content, this week not even close. The main reason for that is the fact that this weeks blog post is mainly focused on distributing the commercial ID that’s used for connecting Windows 10 devices to Windows telemetry related solutions, like Upgrade Analytics (preview) and Update Compliance (preview). As those features and terminologies are not that widely known, yet, using commercial ID in the title might not be very catchy. That being said, I used it anyway. This blog post will provide an introduction about what can be achieved by deploying the commercial ID, what the required configurations are and the current administrator experience.

Introduction

Until recently Windows telemetry data, was mainly used as vital technical data from Windows devices about the device and how Windows and related software are performing. Nowadays sharing information with Microsoft helps make Windows and other products better, but can also help making internal processes and user experiences better, as well. Microsoft is in the process of developing sets of analytics customized for internal use. The first two examples of these sets are Update Compliance (preview) and Upgrade Analytics (preview). Update Compliance (preview) can be used to verify the update compliance of Windows 10 in the organization and Upgrade Analytics (preview) can be used to plan and manage upgrade projects to the latest build of Windows 10. Even for devices managed via Windows 10 MDM. This enables organizations to simply report about upgrade and update compliance on all Windows 10 devices. To make sure that the correct information is shown with the correct with organization, the commercial ID is used.

Configuration

Now let’s have a look at the configuration requirements, from a device perspective. To enable devices to report data and make sure that the information can be used for the right purposes, there are two configurations required:

  1. Windows telemetry must be enabled;
  2. Commercial ID must be configured.

Prerequisites

Before starting with the two configurations on the Windows 10 devices, it’s good to keep in mind that the following configurations must be in-place:

  • The organization must use the Operations Management Suite (OMS);
  • The Update compliance (preview) solution must be added to OMS;
  • The Upgrade analytics (preview) solution must be added to OMS.

Step 1: Enable Windows telemetry

The first configuration that must be in-place, is that Windows telemetry must be enabled. This should be at least configured to the basic level. The different levels and the corresponding values are shown below.

Level Data gathered Value
Security Security data only 0
Basic Security data, and basic system and quality data. 1
Enhanced Security data, basic system and quality, and enhanced insights and advanced reliability data. 2
Full Security data, basic system and quality data, enhanced insights and advanced reliability data, and full diagnostics data. 3

To make sure that the Windows 10 devices all have Windows telemetry enabled, the following OMA-URI configuration can be used:

  • OMA-URI: ./Vendor/MSFT/Policy/Config/System/AllowTelemetry
  • Date type: Integer
  • Value: [At least 1]

Now let’s have a look at how these configurations come together for Microsoft Intune hybrid and Microsoft Intune standalone. It’s not a step-by-step guidance, but it should provide enough information to get the correct configurations in-place.

Environment Configuration
Microsoft Intune hybrid

SystemTelemetry_MSIhThe configuration in Microsoft Intune hybrid can be performed by starting the Create Configuration Item Wizard in the Configuration Manager administration console. Make sure to select Windows 8.1 and Windows 10 (below Settings for devices managed without the Configuration Manager client) on the General page and to select Windows 10 on the Supported Platforms page. Now select Configure additional settings that are not in the default setting groups on the Device Settings page and the configuration can begin by using the earlier mentioned OMA-URI settings.

Once the configuration are finished, the created configuration items can be added to a configuration baseline and can be deployed to Windows 10 devices.

Microsoft Intune standalone

SystemTelemetry_MSIsThe configuration in Microsoft Intune standalone can be performed by starting the Create Policy wizard for Custom Configuration (Windows 10 Desktop and Mobile and later) in the Microsoft Intune administration console. Navigate to the OMA-URI Settings section and the custom settings can be added by using the earlier mentioned OMA-URI settings.

Once the configurations are finished, the policy can be saved and can be deployed to Windows 10 devices.

Step 2: Configure commercial ID

The second configuration that must be in-place, is that the commercial ID must be configured. The commercial ID can be located and generated in the OMS portal. In the OMS portal navigate to Settings > Connected Sources > Windows Telemetry.

Note: Only regenerate a commercial ID key if the original ID key can no longer be used. Regenerating a commercial ID key resets the data in the workspace for all solutions that use the ID.

OMS_WindowsTelemetry

To make sure that the Windows 10 devices all have the correct commercial ID configured, the following OMA-URI configuration can be used:

  • OMA-URI: ./Vendor/MSFT/DMClient/Provider/ProviderID/CommercialID
  • Data type: String
  • Value: [The commercial ID]

Now let’s have a look at how these configurations come together for Microsoft Intune hybrid and Microsoft Intune standalone. It’s not a step-by-step guidance, but it should provide enough information to get the correct configurations in-place.

Environment Configuration
Microsoft Intune hybrid

DMClient_MSIhThe configuration in Microsoft Intune hybrid can be performed by starting the Create Configuration Item Wizard in the Configuration Manager administration console. Make sure to select Windows 8.1 and Windows 10 (below Settings for devices managed without the Configuration Manager client) on the General page and to select Windows 10 on the Supported Platforms page. Now select Configure additional settings that are not in the default setting groups on the Device Settings page and the configuration can begin by using the earlier mentioned OMA-URI settings.

Once the configuration are finished, the created configuration items can be added to a configuration baseline and can be deployed to Windows 10 devices.

Microsoft Intune standalone

DMClient_MSIsThe configuration in Microsoft Intune standalone can be performed by starting the Create Policy for Custom Configuration (Windows 10 Desktop and Mobile and later) in the Microsoft Intune administration console. Navigate to the OMA-URI Settings section and the custom settings can be added by using the earlier mentioned OMA-URI settings.

Once the configurations are finished, the policy can be saved and can be deployed to Windows 10 devices.

Administrator experience

Let’s end this blog post by having a look at the administrator experience. I’ll do that by providing a few status views from the OMS portal, related to the Update compliance (preview) and Upgrade analytics (preview) solutions. Before doing that, it’s good to mention that, besides the normal locations for MDM configurations, the commercial ID can be verified on a Windows 10 device in the registry, as shown below.

Reg_CommercialID

Update compliance (preview)

The Update compliance (preview) solution can be located in the overview of the OMS portal. After Windows 10 devices are reporting information, this solution can be used to get overviews about update compliance as shown below (and more).

Overall quality update status – Quality updates are cumulative and can contain both security and non-security fixes. Windows 10 devices that are up-to-date have the latest quality update installed. Besides this overall status overview, this solution provides an overview with the differentiation per OS version. These overviews are selectable and provide even more detailed information about the quality update status. OMS_QualityUpdateStatus
Overall feature update status – Windows 10 devices can be configured to be on Current Branch (CB), Current Branch for Business (CBB) or Long term Servicing Branch (LTSB). Windows 10 devices on the latest CB with the latest quality update installed are considered current. Besides this overall status overview, this solution provides an overview with the differentiation per OS version. These overviews are selectable and provide even more detailed information feature update status. OMS_FeatureUpdateStatus

Upgrade analytics (preview)

The Upgrade analytics (preview) solution can be located in the overview of the OMS portal. After Windows 10 devices are reporting information, this solution can be used to get overviews about the upgrade status, as shown below, and possible application and driver issues.

Note: The Upgrade analytics (preview) solution can also be integrated with Configuration Manager.

Upgrade overview – The Target version, for Windows 10 devices, in this solution can be configured via the Solution Settings. The configured version will impact the information shown in the overviews. Besides the upgrade overview, this solution provides overviews about discovered applications and drivers and their known issues. It does that by providing the following steps to plan an upgrade:

  • Step 1: Identify important apps;
  • Step 2: Resolve issues;
  • Step 3: Deploy;
  • Office add-ins;
  • Site discovery.
OMS_UpgradeOverview

More information

For more information about telemetry, upgrade analytics and update compliance, please refer to the following articles:

17 thoughts on “Deploy the commercial ID via Windows 10 MDM”

  1. For Intune on Azure the OMA-URI String you will want to use is:

    For PC’s: ./Vendor/MSFT/DMClient/Provider/MS DM Server/CommercialID
    For Windows Phone: ./Vendor/MSFT/DMClient/Provider/SCConfigMgr/CommercialID

    Reply
  2. Hello, just wanted to drop this here:

    ——-
    Provider/ProviderID
    Required. This node contains the URI-encoded value of the bootstrapped device management account’s Provider ID. Scope is dynamic. This value is set and controlled by the MDM server. As a best practice, use text that doesn’t require XML/URI escaping.
    For Intune, use MS DM Server for Windows desktop or SCConfigMgr for Windows mobile for the ProviderID.
    ——-

    Pasted from: https://docs.microsoft.com/en-us/windows/client-management/mdm/dmclient-csp

    It seems that Frank is correct, the article was updated in June, so this might have changed since you wrote this Peter.

    Testing it now 🙂

    Reply
  3. Any idea what OMA-URI is correct when using Intune?
    I`ve used ./Vendor/MSFT/DMClient/Provider/ProviderID/CommercialID and the first devices show under Upgrade Readiness, but still after a few days nothing under Update Compliance.

    Reply
  4. Attempting to use Upgrade Readiness solution. Created OMS workspace, linked to existing Azure Subscription, Added Upgrade Readiness solution. When I click Settings | Connected Sources | Windows Telemetry, there is no Commercial ID listed. What do I need to do to get a Commercial ID?

    Reply
  5. Can confirm what Frank said. With ./Vendor/MSFT/DMClient/Provider/ProviderID/CommercialID I get a error of “Conflicting policy” reported by Intune. No setting is set under the registrylocation.
    However using: ./Vendor/MSFT/DMClient/Provider/MS DM Server/CommercialID correctly set the CommercialID in registry.

    Windows 10 version is 1709 (patched March 2018).

    Reply
  6. Hi, Peter, as far as I can see, you now have to create a Workspace under Log Analytics. There is now a workspace ID and not a commercial ID. This could provide advantage to large orgs, as you could have more than one workspace – and each workspace could be in a different Datacentre (touché GDPR) or could contain different devices. Is it worth a new look at this doc?

    Thanks,

    Reply
  7. Hi Peter, how did you come up with the string for the OMA-URI, is there a way I can generate the correct “./Vendor/MSFT/DMClient/Provider/MS DM Server/CommercialID” to apply to other registry keys?

    Reply

Leave a Comment

This site uses Akismet to reduce spam. Learn how your comment data is processed.