This week is all about the recently introduced functionality of Microsoft Endpoint Manager tenant attach. More specifically, the device sync and the device action functionalities that become available via the Microsoft Endpoint Manager admin center for Configuration Manager managed devices. This is the first big step into creating an integrated solution for managing all devices. This brings Configuration Manager and Microsoft Intune together into a single console. In this post I’ll start with an introduction to the different cloud integration options, followed by the step for enabling the device upload. I’ll end this post by having a look at what this integration brings from an administrator perspective.
Introduction to cloud integration
Let’s start with a quick introduction to all the different cloud integration terminologies that are currently used in combination with Configuration Manager. The main reason for that is that I often hear a lot of confusion about the terminologies in regards to what it is and what it is used for and a new term – tenant attach – will not make that a lot easier.
- Co-management – Co-management (sometimes even referred to as client attach) is about enrolling Configuration Manager managed devices into Microsoft Intune for additional cloud value. In other words, managing Windows 10 devices by using both Configuration Manager and Microsoft Intune. That enables the administrator to configure specific workloads for Configuration Manager or Microsoft Intune, to enable a smooth transition to the cloud. These products balance the workloads to make sure that there are no conflicts. For a complete overview of the benefits and these workloads, please refer to this doc about what co-management is.
- Coexistence – Coexistence is about enrolling Configuration Manager managed devices into a third-party MDM solution. In other words, managing Windows 10 devices by using both Configuration Manager and a third-party MDM. That creates two management authorities on a device that don’t integrate with each other, which might create conflicts. To prevent these conflicts the Configuration Manager client detects when a third-party MDM service is also managing the device. When detected, it automatically deactivates certain workloads in Configuration Manager. For a complete list of these workloads, please refer to this doc about third-party MDM coexistence with Configuration Manager.
- Tenant attach – Tenant attach (the new kid) is about attaching a Configuration Manager environment to the Microsoft Intune tenant for instant cloud value. That will bring all devices to single console and that console is Microsoft Endpoint Manager admin center. Bringing all the devices to that single console will enable the administrator (at first mainly focussed on the helpdesk) to perform basic actions on all devices, either managed by Configuration Manager or managed by Microsoft Intune.
- Cloud hosted – Cloud hosted is about hosting Configuration Manager components in Microsoft Azure. That will bring the reliability and flexibility of Microsoft Azure to Configuration Manager for managing for example Internet clients by using a Cloud Management Gateway (CMG).
- Cloud attach – Cloud attach is about attaching different cloud components to a Configuration Manager environment. That is a more generic term that is often used when attaching any cloud functionality to a Configuration Manager environment. That can be about co-management (client attach), tenant attach, and cloud hosted. Basically any cloud service that is attached to the on-premises environment for providing more and better functionalities for managing devices by using cloud functionality.
- Hybrid MDM – Previously there was even hybrid MDM (or Microsoft Intune hybrid) that would integrate Microsoft Intune with Configuration Manager to provide cloud MDM-capabilities to Configuration Manager. That would enable customers to use Configuration Manager as a single pane of glass for managing all devices within the environment. That feature is retired as of September 1, 2019.
Note: For a nice overview see also this session about Supercharging PC and mobile device management: Attach Configuration Manager to Microsoft Intune and the Microsoft 365 cloud (starting at about 6:38) of Microsoft Ignite 2019.
Enable device upload
After processing the terminology for all the different cloud (and management) integration options for a Configuration Manager environment, it’s time to look at the new tenant attach functionality. When assuming that co-management is already being used within the environment, the following five steps will walk through also configuring the device upload functionality.
- Open the Microsoft Endpoint Configuration Manager administration console and navigate to Administration > Overview > Cloud Services > Co-management
- Select the CoMgmtSettingsProd policy and click Properties in the Home tab to open the Properties dialog box
- In the Properties dialog box, navigate to the Configure upload tab, perform the following configuration and click OK
- Select Upload to Microsoft Endpoint Manager admin center to enable this site to upload devices to Microsoft Endpoint Manager admin center
- Select All my devices managed by Microsoft Endpoint Configuration Manager (recommended) to enable this site to upload all devices to Microsoft Endpoint Manager admin center, or select A collection I select to enable this site to only upload specific devices to Microsoft Endpoint Manager admin center
- In the authentication prompt, provide credentials of a global administrator
- In the Create AAD Application dialog box, click Yes to register an application in AAD
The most interesting part of this post – in my opinion – is the administrator experience. New objects that are created and the relation between the different new objects and activities that an administrator can see. Below is an overview of a those objects and activities from a Configuration Manager perspective. Figure 2 and Figure 3 provide an overview of the new objects in the Configuration Manager administration console. The Cloud Attach Azure service and the application registration with the Azure Active Directory Tenants. Both of these objects are created when enabling device upload. The latter is a reference to the created app registration in Azure Active Directory.
Figure 4 and Figure 5 provide an overview of the objects that are being synchronized to Microsoft Endpoint Manager admin center. As I’ve selected that all device are synchronized, those figures show that my All Systems collections (9 members) relates to the number (6) found in CMGatewaySyncUploadWorker.log. That’s 9 objects minus the default objects of the unknown computer objects (2) and the provisioning device object.
Figure 6 provides an overview of the devices that are synchronized in the Microsoft Endpoint Manager admin center. In green it shows the ConfigMgr only devices (4) and in red it shows the co-managed devices (2). That brings the total the the 6 device objects that were synchronized.
Figure 7 and Figure 8 provide an overview of the device actions that become available for the synchronized devices. It shows the different locations of these actions for co-managed devices as well as for ConfigMgr only devices. At this moment the device actions of Sync machine policy, Sync user policy and App evaluation cycle are available.
Note: The user performing the actions via the Microsoft Endpoint Manager admin console need to have the appropriate permissions within Configuration Manager.
For more information about enabling device upload in Configuration Manager, please refer to the documentation about Microsoft Endpoint Manager tenant attach: Device sync and device actions.