Azure AD Application Proxy, Single Sign-On and Conditional Access

Introduction

As the topic suggests, the following post will be about the Azure AD Application Proxy feature – a feature within Azure Active Directory. I haven’t blogged specifically about this feature before, but I do think it deserves a mention here as well.

I will go into details on how to provide secure remote access to an internal IIS website, and give an example on how to add single sign-on to that experience while protecting everything with Conditional Access.

This post will be followed up with a continuation, where everything will be put to use on a mobile device with a Microsoft Intune managed Edge browser. Curious? Read on and stay tuned 🙂

The end result where an internal IIS is reachable from www

Read more…

How to automatically join Windows AutoPilot devices to On-Premises AD (Hybrid Azure AD Join)

Introduction

Good news everyone! The feature was introduced at Ignite earlier this year and now it’s finally here. Windows AutoPilot now allows you to join your Windows 10 v1809 devices to your on-premises Active Directory (Hybrid Azure AD Join). All the magic lies in a new Intune connector for Active Directory. Sounds exciting, right? This will be everything you need to know, on how to get started with this new amazing feature.

The new Intune Connector for Active Directory (Preview)

Read more…

Remove built-in apps for Windows 10 using SCCM and Microsoft Store for Business

Introduction

Removing the built-in apps in Windows 10 is often a hot topic and in same regard, it’s often discussed if and how they are removed. There are several excellent Powershell scripts for the same purpose made by the community, and they possibly satisfy most needs already.

But maybe you don’t fancy maintaining a Powershell script and maybe you don’t want to deal with specific apps coming back after an in-place upgrade. Or perhaps you just want an alternative. Then this might be of interest. This is solely based on using Microsoft Store for Business integrated with SCCM (System Center Configuration Manager), to uninstall some of the unwanted built-in apps in Windows 10 (and keep them uninstalled shall they ever return)

Some of the apps I tend to remove and keep removed using this method 🙂

Read more…

Deploy the SCCM Client using Microsoft Intune and the Cloud Management Gateway (CMG without PKI certificates)

Introduction

Last week I blogged about how to get properly started with Windows AutoPilot. This week I’m continuing on the topic, and going into details on how you can deploy the SCCM (System Center Configuration Manager) client as a part of the Windows AutoPilot enrollment and thus achieve Co-management with SCCM and Microsoft Intune.

I have previously blogged a lot about Co-management. Focus here has been enrolling devices already managed by SCCM into Intune MDM.

This post is the opposite. This time we are deploying a device through Windows AutoPilot, enrolling it into Microsoft Intune and then deploying the SCCM client through the Cloud Management Gateway. Sounds interesting? Read on 🙂

  • Find all my Co-management posts here: https://www.imab.dk/category/co-mgmt/
    • My post about setting up the Cloud Management Gateway without PKI certificates is especially of interest if pursuing Co-management

Read more…

How to get properly started with Windows AutoPilot: Everything you initially need to know!

Introduction

It’s time for me to take on a new topic on the blog. I have been experimenting, working and blogging a lot about SCCM, Intune and Co-management, but never really touched base with Windows AutoPilot. Time is due and this will be the first in a series of posts about Windows AutoPilot and how to eventually reach Co-management with SCCM and Microsoft Intune through Windows AutoPilot.

First things first though. This post will give you everything you need to know on how to properly get started with Windows AutoPilot. Curious? Read on 🙂

A peek into my AutoPilot devices in my test tenant 🙂

Read more…

Deploy Outlook for iOS with a Managed Exchange Account using Microsoft Intune

Introduction

More good news! Microsoft Intune now provides us with an even easier way to pre-configure an e-mail account for Outlook on iOS (and android). This is done with the use of an App Configuration Policy and the additions to the configuration designer when configuring the Outlook app. Let’s walk through the process.

A peek into the Microsoft 365 device management portal

Read more…

Block access to company resources if running an out-of-date iOS version using Microsoft Intune and Conditional Access

Introduction

Do you need a simple, but yet effective way of forcing people into updating iOS on their company enrolled Apple devices? Simply block access to company resources if iOS is not up to date. Here is how you can do that using Microsoft Intune and Conditional Access in Microsoft Azure.

Peek into Microsoft Intune and the device compliance policies

Read more…

Enable UE-V (User Experience Virtualization) during OSD with SCCM and use OneDrive as storage path

Introduction

UE-V is not something new, but when combined with OneDrive Known Folder Move, Enterprise State Roaming in Azure and OneDrive as the storage path for UE-V, you will find yourself with a very solid solution ensuring roaming of end users data and settings.

I have previously shown you how you can enable OneDrive KFM with SCCM. This time, I’m going to show you how you can enable UE-V during OSD with Configuration Manager, and how you make sure those settings are stored in OneDrive. I hope you can see the pattern here: No on-premise file share for UE-V settings – everything stored in the users OneDrive.

A peek at the UE-V configuration when OneDrive is set as storage path

Read more…

Setting up Cloud Management Gateway (CMG) in SCCM 1806 (HTTP mode without trusted root certificates)

Introduction

More Configuration Manager 1806 and more awesomeness. 1806 gives us additional improvements to the Cloud Management Gateway and removes the need for PKI in your environment. With these improvements, it has never been easier to setup the CMG. In this post I will walk you through the exact steps I went through in order to successfully deploy the CMG in a HTTP only environment.

A ready Cloud Management Gateway displayed in the console

Read more…

Receive an e-mail alert if an Office 365 Administrator repeatedly fails to provide correct credentials

Introduction

Users with Office 365 administrator roles are very much sensitive users, and besides protecting them with various features such as Conditional Access and MFA, it might be interesting to know if someone tries to brute force or guess their credentials.

In this post I will walk you through how you can setup a policy in Cloud App Security, that automatically sends you an e-mail, if someone fails to provide the correct credentials for users with any Office 365 administrator role assigned.

Sneak peek at the Cloud App Security portal displaying the alert created during this guide

Read more…