Scenario: Using both Intune Device and App Based Conditional Access – Part 1

Standard

With this blogpost I want to look into Conditional Access and the possibilities we have in combining both Device Conditional Access and App Conditional Access. I’ve seen this requirement at multiple customers when doing EM+S deployments. With Device Based Conditional Access we can enforce the device to be compliant before services can be used. With App Conditional Access we can enforce App restrictions on the applications used for services. Device Based Conditional Access can be done for almost all applications in AzureAD. App Based Conditional Access can be configured for Exchange and SharePoint Online. In this blogpost I will focus on a scenario for Exchange Online.
Continue reading

Configure Endpoint Protection (Bitlocker) with Intune on Windows 10

Standard

In this blogpost I want show you how to use the Endpoint Protection (Bitlocker) policy within Intune to configure Bitlocker on Windows 10. With Endpoint Protection policies you can configure and enforce Bitlocker on your Windows 10 devices. With the old policies we could already enforce Bitlocker but not enforce the settings of Bitlocker. With Windows 10 1703 the user interface for the end user was already improved but still the user needs to select the Bitlocker settings themselves. There are some settings where the user need to make the right decision and probably not all users know the consequences of some of the settings. The setting about saving the recovery key is for me to most important one. In a MDM scenario I want to enforce that the key will be saved in AzureAD an not locally on a USB drive. So most of the time I want to enforce this setting and more ideal I just want to enable it for the user without disturbing the user.
Continue reading

Users cannot join Windows 10 devices to AzureAD

Standard

The last couple of days I’m working on a issue with a customer related to joining Windows 10 workstations to AzureAD. This customer is using Dell Hardware and Windows 10 1703 (Creator’s Update) and a federated Azure AD with Intune MDM. When the failing workstations have installed Windows 10 and the user tries to add the device to AzureAD the user cannot login to ADFS. In the OOBE stage of the deployment the user enters his username and based on that it’s redirected tot the customers ADFS environment. The login form of ADFS loads and after entering the users credentials the login page returns. So the user stays in the ADFS login page (looping). Both on the Windows 10 client and the ADFS environment no errors are logged in the event logs.

Continue reading

Deploy MSI apps through the new Intune Portal

Standard

With Microsoft Intune we can deploy MSI applications to MDM enrolled Windows 10 devices. This functionality is already available within the ‘old’ Microsoft Intune portal. In the early days of the new portal (https://portal.azure.com) it was not possible to add the MSI applications through the new portal. Microsoft has now added this functionality to the new portal. This blogpost shows how you can easily add the application through the new portal. Based on my experience the process is improved and the whole experience is much better than the old portal infrastructure.

Continue reading

How to change the ADFS Farm WID Sync Port

Standard

The last couple of weeks I was involved in deploying a new Active Directory Federation Services (ADFS) 2016 at a customer. This customer had planned to use a ADFS farm of 4 hosts ADFS servers and 4 ADFS proxy nodes, The ADFS servers were using the Windows Internal Database synchronization between the ADFS nodes to sync the configuration. This synchronization sends unencrypted traffic over port 80 to the other ADFS nodes. The information which is send is only configuration data of the ADFS environment and not usernames and passwords. Bit still the information is send over HTTP to the other ADFS nodes. Since this configuration was not acceptable for the customer we needed to change the configuration. In this blogpost I want to share what actions we performed to change the ADFS configuration. Since this information is not completely documented at this moment I tried to share this information.
Continue reading

Configure Trusted Sites in Internet Explorer Through a MDM Deployed GPO

Standard

With Windows 10 1703 (Creators Update) we now have the possibility to configure settings through a MDM deployed Group Policy Object. In this blogpost I explained how to configure the App-V client with these new capabilities. Within this blogpost you can also find the basics about deploying a GPO through a MDM solution. Since my preffered MDM solution is Microsoft Intune my blogposts will only cover the steps needed to configure these settings through Microsoft Intune. In this blogpost I want to cover the scenario to configure the Trusted Sites on a Windows 10 1703 machine through a MDM deployed GPO.

Continue reading

Using AzureAD Conditional Access to block a Native App

Standard

Last week I was asked to research a scenario where the customer wants to block the use of a native app and only want to allow the browser experience from compliant devices. My first answer was that this was difficult to implement. But after looking into AzureAD Conditional Access it was relative easy to configure. In this series of blogposts I’m using Microsoft Teams as an example. I’m focusing on these scenario’s: The first scenario is blocking the Microsoft Teams Native App and only allow browser access to Microsoft Teams and the second scenario is to only allow the Microsoft Teams app and blocking the browser access.

Continue reading

App-V 5.1 Note-to-self’s

Standard

Last week I installed a fresh new App-V environment. With this short blogpost I want to share 2 configuration ‘note-to-selfs’ which I encountered during the installation and configuration. Both are really obvious configurations but it took me some time to discover the solution. So also for my own reference I want to describe them on my blog.
Continue reading

Configure the App-V client through a MDM Deployed GPO

Standard

In this blogpost, I want to describe how the new MDM Group Policy functionality can be used to configure your Windows 10 workstation. With the Windows 10 Creators Update we’ve the possibility to deploy and apply Group Policy objects through the MDM channel. This means that the policy configuration support in Windows 10 will be expanded to allow access of select Group Policy administrative templates (ADMX-backed policies) for Windows PCs via the Policy configuration service provider (CSP). In this blogpost, I want to use this new functionality to activate and configure the App-V client on a Windows 10 MDM Managed workstation.

Continue reading

Prevent a Azure AD MFA User Lockout

Standard

Within Azure Multi-Factor authentication, a user can configure multiple options for the 2nd factor authentication. Beside those options the user can also configure multiple numbers within Azure Multi-Factor authentication which can be used when doing the 2nd factor authentication. But in practice most users will only configure one phone number. When the user than loses his phone or access to his number the user cannot use Azure MFA anymore. The user cannot change his phone number because a 2nd factor authentication is needed to access this information. So, this means that the user is locked out of Azure MFA and the only solution in this scenario is to call the Helpdesk and change the phone number. But there is a solution which prevents a user MFA lockout. This can be achieved by simply configuring a phone number in the user his account in your Active Directory or Azure Active Directory.
Continue reading