Microsoft Endpoint Manager

Further integrating Apple Business Manager with Microsoft Intune

by

A few weeks ago I’ve discussed the integration of Apple Business Manager (ABM) with Azure AD, to provision the Managed Apple IDs and to provide a federation. That provides a very nice user experience, when used in combination with Microsoft Intune. This week I want to extend on ABM by further integrating it with Microsoft Intune. As a bare minimum for managing Apple devices it’s always required to use the Apple MDM Push certificate. I hope that every IT administrator can dream the required steps for such a certificate by now. On top of that, ABM can be used to facilitate company-owned devices and to facilitate volume purchased apps. That provides an even better experience on company-owned Apple devices. A great out-of-the-box experience together with …

Read more

Getting started with User Enrollment for iOS/iPadOS devices

by

This week is all around the User Enrollment option that was introduced with iOS 13 and iPadOS 13.1 and that is currently available as preview functionality in Microsoft Intune. User Enrollment feels similar to what already can be achieved on Android devices with Work Profiles. A separation between personal data and company data. In this post I’ll start with a short introduction about User Enrollment, followed with the steps to created an enrollment profile that will facilitate the User Enrollment. I’ll end this post by show the end-user experience during the enrollment and after the enrollment. Introduction to User Enrollment User Enrollment is created and designed by Apple to facilitate an enrollment and management scenario for Bring Your Own Devices (BYOD). That enrollment and management …

Read more

Quick tip: Manually adding devices to Apple Business Manager

by

This week a quick extra post. I noticed that there was not a lot of information available regarding manually adding devices to Apple Business Manager (ABM) for usage with Automated Device Enrollment (ADE). That makes sense, because the idea is that devices are automatically added to ABM after purchase. However, sometimes it’s useful to be able to manually add devices. Manually adding devices, can be achieved the easiest by following the two steps described below. Before starting with those steps make sure that: an enrollment program token is available and that the synchronization between ABM and Microsoft Intune is active, Find My {AppleDevice} is disabled, and that a mobile configuration is available that contains the WiFi configuration to simplify the enrollment Step 1: Create an …

Read more

Federated authentication for Managed Apple IDs

by

This week is all about federated authentication for Managed Apple IDs. When using Microsoft Intune for managing Apple devices, the use of Managed Apple IDs is adding more and more value to the solution. That value gets even more when those Managed Apple IDs are federated with Azure AD. That would provide the user with a single account to remember and to use. Together that brings a very nice experience to Apple devices that are using federated Managed Apple IDs and are managed with Microsoft Intune. In this post I’ll discuss and describe the following information regarding Managed Apple IDs: What are Managed Apple IDs and why using them? Federated authentication for Managed Apple IDs Automatically provisioned users from Azure AD Provisioned user with federated …

Read more

Easily enforcing specific Windows Sandbox configurations

by

This week is all about Windows Sandbox. About two years ago I wrote a post about simply enabling Windows Sandbox, by using a simple PowerShell script and distributing that script by using Microsoft Intune. Windows Sandbox is a really nice feature for running applications in an isolated environment. That isolated environment supports simple configuration files, which provide a minimal set of customization parameters. With the latest version of Windows 10, the administrator receives some controls for enforcing specific customization parameters. That won’t prevent the user from creating a configuration file, but that does prevent specific customization parameters from applying to the Windows Sandbox. In this post I’ll briefly go through the currently available policies, followed with the steps of configuring those policies. I’ll end this …

Read more

Quick tip: Enable browser access on Android Enterprise corporate-owned devices

by

This week a quick tip about enabling browser access on Android Enterprise Corporate-Owned Fully Managed devices and Android Enterprise Corporate-Owned devices with Work Profile, to work with device-based Conditional Access. That will enable the user to eventually use different apps for accessing company data. That includes for example using the Chrome browser app for accessing SharePoint Online or Exchange Online. On the Android Enterprise devices, this requires a configuration in the Microsoft Authenticator app. In this post I’ll simply provide the steps that are required within the Microsoft Authenticator app. Note: Before providing the mentioned steps, a big thank you to Pat Freeman for pointing me in the right direction. Enable browser access in the Microsoft Authenticator app When knowing the availability of the setting, …

Read more

Using a custom connector for device management actions in Microsoft Intune

by

This week is again all about the powerful combination of Microsoft Power Apps and Microsoft Power Automate with Microsoft Intune (and Microsoft Graph). In my previous post about introducing a mobile device manager app for Microsoft Intune, I relied on the standard available functionalities within the different products to show how easy it is to get started and to create your own app in Power Apps. Because of that starting point, I relied on providing application API permissions when accessing the Graph API. In that post, I also mentioned that there is another method available by using delegated API permissions when accessing the Graph API. Also, to be really honest, when an app in Power Apps is working with a signed-in user, it also makes …

Read more

Introducing a simple remote device manager app for Microsoft Intune

by

This new year starts with something completely new. That means, some technology that hasn’t been part of any of the posts on my blog before. Inspired by some posts of Courtenay Bernier, I took some time to dive into the world of Microsoft Power Apps and Microsoft Power Automate, in combination with Microsoft Intune (and Microsoft Graph). This post will cover how I’ve used those technologies – with almost no custom code – to create a simple remote device manager app for Microsoft Intune. I’ll also hope that this post will show the power of this combination and inspire more readers to dive into that world. Basic knowledge of the mentioned technologies is required, as this post won’t be completely step-by-step and won’t provide a …

Read more

Easier managing local administrators via Windows 10 MDM on Windows 10 20H2 and later

by

This week back to the Windows platform. This week is again about managing local administrators on Windows 10 devices. Even in a modern world, there can still be a need for managing the local administrators on a Windows 10 devices and often that still requires more flexibility than provided with the default Azure AD functionality. I’ve also discussed managing local administrators already multiple times – either by using a Windows 10 MDM policy setting or by using proactive remediations – and this time it’s about a new method that became available in Windows 10, version 20H2 and later. That method is a new Windows 10 MDM policy setting. In this post, I’ll provide an introduction to that new policy setting and I’ll show how to …

Read more

Getting started with Microsoft Defender for Endpoint for iOS

by

Microsoft recently declared Microsoft Defender for Endpoint (MDE) for iOS – previously known as Microsoft Defender ATP for iOS – general available. That’s really good news and also a really good trigger for a new blog post. This post will be similar to my post earlier about MDE for Android. MDE for iOS provides protection against phishing and unsafe network connections. All events and alerts around those subjects will be available in the Microsoft Defender Security Center and will be used to determine the risk level of the device. To add-on to that, through the connection with Microsoft Intune that risk information can be used to determine the compliance of the device with the company policies and to determine the eventual access of the device …

Read more