Windows 10 AlwaysOn Conditional Access Connection Fix

Last year I wrote a couple of blogposts about the Windows 10 AlwaysOn VPN solution with AzureAD Conditional Access. You can find the blogposts here:

After testing this solution more and more I had a strange issue where the user was able to set-up a AlwaysOn VPN connection even when the conditional access conditions were not met. So if my conditional access policy was requiring a compliant device I was able to connect with a non compliant device. I could do this by clicking on the X (Close) icon when I was in the Conditional Access flow. Together with Microsoft I’ve investigated this and a solution has been found.

Intune Policy conflicts caused by ‘hidden’ setting

This week I was looking into an issue with Intune and conflicting policies. In our case the Device Restriction and the Software updates policy were in conflict. In this blogpost I want to share you how I did some troubleshooting and how I solved the conflicting policies.My first step was trying to look into the configured policies and looking for the policies which have a high percentage of error deployments.
Continue reading

Windows 10 AlwaysOn VPN with Conditional Access – Part 3

This is the last part of the blogpost series about Windows 10 AlwaysOn VPN with AzureAD Conditional Access. In the first part I described what infrastructure is needed to get up and running with the Windows 10 AlwaysOn VPN. The second part was about the configuration which was needed to add AzureAD Conditional Access to the configuration. In the second post I also showed how MFA can be enforced on AlwaysOn VPN connections with AzureAD Conditional Access. In this last part I want to show you that AzureAD can also enforce a compliant device and I want to describe the scenario of blocking access to the AlwaysOn VPN.
Continue reading

Windows 10 AlwaysOn VPN with Conditional Access – Part 2

This is the second part of the series about the Windows 10 AlwaysOn VPN solution. In the first part, which you can find here, I described how to set up the infrastructure for the AlwaysOn VPN solution. The infrastructure which is described in that blogpost is a prerequisite for this blogpost. This blogpost will focus on the configuration needed to add AzureAD Conditional Access to the solution. With AzureAD Conditional Access we add a great set of capabilities to control who can connect to the VPN solution and which conditions the user must meet before the connection can be made. In this blogpost I configure the first scenario and that is enforcing a Multi-Factor authentication request before the VPN connection can be activated.
Continue reading

Windows 10 AlwaysOn VPN with Conditional Access – Part 1

In this series of blogposts I want to show you how you can use AzureAD Conditional Access to protect your Windows 10 / Server 2016 AlwaysOn VPN solution (deployed with Intune). This first part of the series will describe the initial requirements and setup of the infrastructure which is needed for the AlwaysOn VPN solution. The second part will focus on the configuration needed to add AzureAD Conditional Access for VPN connections to the flow and the last part of the series will focus on testing the Conditional Access features against AlwaysOn VPN connections. But let’s start with the description of the needed components and the initial configuration of those components.

Office365 ProPlus can’t open files on SMB Share protected by WIP

The last 2 weeks I was working on an issue where users were unable to open Office files with Office365 ProPlus on SMB shares protected by Windows Information Protection. If the SMB share was part of the enterprise context the user was not able to open or change files with Office applications. Other applications which were part of the WIP configuration were able to open the same files without any issues. Together with Microsoft Support and the PG we’ve found a solution and a workaround (which I will describe in this blogpost). Unfortunately the root cause of the issue is not known at this moment. Not all of the users have this issue but the majority of the customers user population had the issue.
Continue reading

Windows Store Apps as available App in Company Portal

This week a short blogpost about a recent change in Intune and the Company Portal. In the July What’s new documentation I found the following new feature: ‘With this release, admins can now assign the Microsoft Store for Business as available. When set as available, end-users can install the app from the Company Portal app or website without being redirected to the Microsoft Store.’ It looks like a tiny small feature but it has a great user experience improvement. Before this feature a user had two software portals: In the Company Portal were the applications visible from Intune and in the Windows Store for Business were the application visible from private business store. With this change we can combine those two and make the Company Portal the one-stop-shop for software on a Windows 10 MDM managed workstation.

Allow or Block Windows 10 versions accessing corporate data

With this blogpost I want to focus on controlling which Windows 10 versions can access corporate date and which versions will be blocked when accessing corporate date. To achieve this I’m using AzureAD Conditional Access together with Compliance Policies configured in Microsoft Intune. In this blogpost I want to focus on the scenario to only allow Windows 10 versions which are receiving updates and are supported by Microsoft. The second scenario is about allowing your users to run Insider Builds for testing purposes but block them to connect to corporate services and data.

Controlling Office365 ProPlus channels during Installation with Intune

A couple of weeks ago Microsoft added a new app type in Intune. With this new App type we can deploy Office365 ProPlus very easy to our MDM Managed workstations. My colleague Peter van der Woude has written a great blogpost about how you can configure this new App type and how this works for the admin and the user. You can find his blogpost here. With this blogpost I want to focus on controlling the Office365 channels with this new app type. I’ve multiple customers where we want to configure and have control over the Office365 ProPlus update channels during the installation of Office365 ProPlus.
Continue reading

Scenario: Using both Intune Device and App Based Conditional Access – Part 1

With this blogpost I want to look into Conditional Access and the possibilities we have in combining both Device Conditional Access and App Conditional Access. I’ve seen this requirement at multiple customers when doing EM+S deployments. With Device Based Conditional Access we can enforce the device to be compliant before services can be used. With App Conditional Access we can enforce App restrictions on the applications used for services. Device Based Conditional Access can be done for almost all applications in AzureAD. App Based Conditional Access can be configured for Exchange and SharePoint Online. In this blogpost I will focus on a scenario for Exchange Online.
Continue reading

The Microsoft Workplace Blog

Blog about the Microsoft Modern Workplace

Windows 10