diff --git a/.github/workflows/Stale.yml b/.github/workflows/Stale.yml new file mode 100644 index 00000000000..dec280f7764 --- /dev/null +++ b/.github/workflows/Stale.yml @@ -0,0 +1,19 @@ +name: (Scheduled) Mark stale pull requests + +permissions: + issues: write + pull-requests: write + +on: + schedule: + - cron: "0 */6 * * *" + workflow_dispatch: + +jobs: + stale: + uses: MicrosoftDocs/microsoft-365-docs/.github/workflows/Shared-Stale.yml@workflows-prod + with: + RunDebug: false + RepoVisibility: ${{ github.repository_visibility }} + secrets: + AccessToken: ${{ secrets.GITHUB_TOKEN }} \ No newline at end of file diff --git a/.openpublishing.redirection.json b/.openpublishing.redirection.json index 5ceee9a62a5..8e7a98563f0 100644 --- a/.openpublishing.redirection.json +++ b/.openpublishing.redirection.json @@ -1,5 +1,55 @@ { "redirections": [ + { + "source_path": "memdocs/intune/enrollment/chrome-enterprise-device-details.md", + "redirect_url": "/mem/intune/remote-actions/chrome-enterprise-device-details", + "redirect_document_id": true + }, + { + "source_path": "memdocs/intune/enrollment/chrome-enterprise-remote-actions.md", + "redirect_url": "/mem/intune/remote-actions/chrome-enterprise-remote-actions", + "redirect_document_id": true + }, + { + "source_path": "memdocs/intune/user-help/you-need-to-resolve-a-threat-found-by-zips-android.md", + "redirect_url": "/mem/intune/user-help/set-up-mobile-threat-defense", + "redirect_document_id": false + }, + { + "source_path": "memdocs/intune/user-help/you-need-to-resolve-a-threat-found-by-checkpoint-android.md", + "redirect_url": "/mem/intune/user-help/set-up-mobile-threat-defense", + "redirect_document_id": false + }, + { + "source_path": "memdocs/intune/user-help/you-need-to-resolve-a-threat-found-by-skycure-android.md", + "redirect_url": "/mem/intune/user-help/set-up-mobile-threat-defense", + "redirect_document_id": false + }, + { + "source_path": "memdocs/intune/user-help/you-need-to-resolve-a-threat-found-by-lookout-for-work-android.md", + "redirect_url": "/mem/intune/user-help/set-up-mobile-threat-defense", + "redirect_document_id": false + }, + { + "source_path": "memdocs/intune/user-help/you-need-to-resolve-a-threat-found-by-zips-ios.md", + "redirect_url": "/mem/intune/user-help/set-up-mobile-threat-defense", + "redirect_document_id": false + }, + { + "source_path": "memdocs/intune/user-help/you-need-to-resolve-a-threat-found-by-checkpoint-ios.md", + "redirect_url": "/mem/intune/user-help/set-up-mobile-threat-defense", + "redirect_document_id": false + }, + { + "source_path": "memdocs/intune/user-help/you-need-to-resolve-a-threat-found-by-skycure-ios.md", + "redirect_url": "/mem/intune/user-help/set-up-mobile-threat-defense", + "redirect_document_id": false + }, + { + "source_path": "memdocs/intune/user-help/you-need-to-resolve-a-threat-found-by-lookout-for-work-ios.md", + "redirect_url": "/mem/intune/user-help/set-up-mobile-threat-defense", + "redirect_document_id": false + }, { "source_path": "memdocs/intune/remote-actions/organizational-messages-reporting.md", "redirect_url": "/microsoft-365/admin/misc/organizational-messages-microsoft-365", diff --git a/autopilot/add-devices.md b/autopilot/add-devices.md index 6f5fbdb68cd..7cc18aad5d3 100644 --- a/autopilot/add-devices.md +++ b/autopilot/add-devices.md @@ -8,7 +8,7 @@ author: frankroj ms.author: frankroj ms.reviewer: jubaptis manager: aaroncz -ms.date: 06/28/2024 +ms.date: 09/13/2024 ms.topic: how-to ms.collection: - M365-modern-desktop @@ -42,7 +42,7 @@ This article provides step-by-step guidance for manual registration. For more in - [Manual registration overview](manual-registration.md). - [Windows Autopilot for HoloLens 2](/hololens/hololens2-autopilot#2-register-devices-in-windows-autopilot). -## Prerequisites +## Requirements - [Intune subscription](/mem/intune/fundamentals/licenses). - [Windows automatic enrollment enabled](/mem/intune/enrollment/windows-enroll#enable-windows-automatic-enrollment). diff --git a/autopilot/device-preparation/known-issues.md b/autopilot/device-preparation/known-issues.md index d34731b0cce..0b8f77b53bb 100644 --- a/autopilot/device-preparation/known-issues.md +++ b/autopilot/device-preparation/known-issues.md @@ -8,7 +8,7 @@ author: frankroj ms.author: frankroj ms.reviewer: jubaptis manager: aaroncz -ms.date: 08/07/2024 +ms.date: 10/18/2024 ms.collection: - M365-modern-desktop - highpri @@ -40,6 +40,46 @@ This article describes known issues that can often be resolved with: ## Known issues +## Deployments fail when Managed installer policy is enabled for the tenant + +Date added: *October 10, 2024*
+Date updated: *October 18, 2024* + +When the [Managed installer policy](/mem/intune/protect/endpoint-security-app-control-policy#managed-installer) is **Active** for a tenant and Win32 apps are selected in the Windows Autopilot device preparation policy, Windows Autopilot device preparation deployments fails. The issue is being investigated. + +As a workaround, remove Win32 applications from the list of selected apps in all device preparation policies. + +For more information, see [Known issue: Windows Autopilot device preparation with Win32 apps and managed installer policy](https://techcommunity.microsoft.com/t5/intune-customer-success/known-issue-windows-autopilot-device-preparation-with-win32-apps/ba-p/4273286). + +## Security group membership update failures might lead to non-compliant devices + +Date added: *September 27, 2024* + +If security groups aren't properly configured in Microsoft Intune, devices might lose compliance and be left in an unsecured state. The following are potential reasons for security group membership failures: + +- **Retry failures**: Security group membership updates might not succeed during retry windows, leading to delays in group updates. + +- **Static to dynamic group changes**: After the Windows Autopilot device preparation profiles are configured, changing a security group from static to dynamic could cause failures. + +- **Owner removal**: If the **Intune Provisioning Client** service principal is removed as an owner of a configured security group, updates might fail. + +- **Group deletion**: If a configured security group is deleted and devices are deployed before Microsoft Intune detects the deletion, security configurations might fail to apply. + +To mitigate the issue, follow these steps: + +1. **Validate security group configuration before provisioning**: + + - Ensure the correct security group is selected within the Microsoft Intune admin center or the Microsoft Entra admin center. + - The security group should be configured within the Windows Autopilot device preparation profile. + - The group shouldn't be assignable to other groups. + - The **Intune Provisioning Client** service principal should be an owner of the group. + +1. **Manually fix the provisioned devices**: + + - If devices are already deployed or the security group isn't applicable, manually add the affected devices to the correct security group. + +Security group membership failures can be prevented by following these steps, ensuring devices remain compliant and secure. + ## Deployment fails for devices not in the Coordinated Universal Time (UTC) time zone Date added: *July 8, 2024*
@@ -92,9 +132,7 @@ The issue is being investigated. As a workaround, add the following additional r For more information, see [Required RBAC permissions](requirements.md?tabs=rbac#required-rbac-permissions). > [!NOTE] -> > The [Required RBAC permissions](requirements.md?tabs=rbac#required-rbac-permissions) article doesn't list the **Device configurations** - **Assign** permission. This permission requirement is only temporary until the issue is resolved. However, the article can be used as a guide on how to properly add this permission. - **This issue was resolved in July 2024.** ### Device is stuck at 100% during the out-of-box experience (OOBE) diff --git a/autopilot/device-preparation/requirements.md b/autopilot/device-preparation/requirements.md index 8cc436909f8..5c8ed256946 100644 --- a/autopilot/device-preparation/requirements.md +++ b/autopilot/device-preparation/requirements.md @@ -8,7 +8,7 @@ author: frankroj ms.author: frankroj ms.reviewer: jubaptis manager: aaroncz -ms.date: 06/28/2024 +ms.date: 09/05/2024 ms.collection: - M365-modern-desktop - highpri @@ -67,7 +67,7 @@ The following editions are supported: - Windows 11 Pro. - Windows 11 Pro Education. - Windows 11 Pro for Workstations. -- Windows 11 Enterprise/[Windows 11 IoT Eneterprise](/windows/iot/iot-enterprise/overview). +- Windows 11 Enterprise. - Windows 11 Education. ## [:::image type="icon" source="../images/icons/wifi-ethernet-18.svg"::: **Networking**](#tab/networking) @@ -200,7 +200,7 @@ To provide needed Microsoft Entra ID and MDM functionality, including automatic > [!NOTE] > -> When a Microsoft 365 subscription is used, licenses still need to be assigned to users so they can enroll device in Intune. For more information, see [assign licenses to users so they can enroll devices in Intune](/intune/fundamentals/licenses-assign). +> When a Microsoft 365 subscription is used, licenses still need to be assigned to users so they can enroll device in Intune. For more information, see [assign licenses to users so they can enroll devices in Intune](/mem/intune/fundamentals/licenses-assign). Additionally, the following are also recommended, but not required: diff --git a/autopilot/device-preparation/tutorial/user-driven/entra-join-workflow.md b/autopilot/device-preparation/tutorial/user-driven/entra-join-workflow.md index 101329db4d6..5a895179283 100644 --- a/autopilot/device-preparation/tutorial/user-driven/entra-join-workflow.md +++ b/autopilot/device-preparation/tutorial/user-driven/entra-join-workflow.md @@ -7,7 +7,7 @@ author: frankroj ms.author: frankroj ms.reviewer: jubaptis manager: aaroncz -ms.date: 06/19/2024 +ms.date: 09/13/2024 ms.topic: tutorial ms.collection: - tier1 @@ -23,7 +23,7 @@ This step by step tutorial guides through using Intune to perform a Windows Auto The purpose of this tutorial is a step by step guide for all the configuration steps required for a successful Windows Autopilot device preparation user-driven Microsoft Entra join deployment using Intune. The tutorial is also designed as a walkthrough in a lab or testing scenario, but can be expanded for use in a production environment. -Before beginning, refer to the [How to: Plan your Microsoft Entra join implementation](/azure/active-directory/devices/azureadjoin-plan) to make sure all prerequisites are met for joining devices to Microsoft Entra ID. +Before beginning, refer to the [How to: Plan your Microsoft Entra join implementation](/azure/active-directory/devices/azureadjoin-plan) to make sure all requirements are met for joining devices to Microsoft Entra ID. ## Windows Autopilot device preparation user-driven Microsoft Entra join overview diff --git a/autopilot/device-preparation/whats-new.md b/autopilot/device-preparation/whats-new.md index ba8714bec7d..e07f50c4d4d 100644 --- a/autopilot/device-preparation/whats-new.md +++ b/autopilot/device-preparation/whats-new.md @@ -8,7 +8,7 @@ author: frankroj ms.author: frankroj manager: aaroncz ms.reviewer: jubaptis -ms.date: 08/21/2024 +ms.date: 10/15/2024 ms.collection: - M365-modern-desktop - tier2 @@ -31,6 +31,26 @@ appliesto: > > For more information on using RSS for notifications, see [How to use the docs](/mem/use-docs#notifications) in the Intune documentation. +## Diagnostics logs automatically available in Windows Autopilot device preparation deployment status report + +Date added: *October 9, 2024* + +Admins can now download diagnostics logs for failed Autopilot device preparation deployments directly from the **Windows Autopilot device preparation deployment status** report. Logs are available for download in the **Device deployment details** when you select a failed deployment under the **Device** tab. Logs are automatically collected when an error occurs during deployment. + +## Windows Autopilot Device Preparation Support in Intune operated by 21Vianet in China + +Date added: *September 18, 2024* + +As part of the 2409 Intune release, we're announcing support for Windows Autopilot Device Preparation policy in [Intune operated by 21Vianet in China](/mem/intune/fundamentals/china) cloud. Customers with tenants located in China can now provision devices and manage through Microsoft Intune. For an overview, see [Overview of Windows Autopilot device preparation](overview.md). For a tutorial on how to set up Windows Autopilot device preparation, see [Windows Autopilot device preparation scenarios](tutorial/scenarios.md). + + + +## enrollmentProfileName property is now populated with the Device preparation policy name + +Date added: *September 13, 2024* + +As part of the 2409 Intune release, the **enrollmentProfileName** property is now populated with the Device preparation policy name during Autopilot device preparation deployments. The Enrollment profile property of Intune and Microsoft Entra device objects are automatically populated with the name of the Device preparation policy that was applied to the device during provisioning. The **enrollmentProfileName** property enables admins to configure assignment filters and dynamic groups based on the **enrollmentProfileName** property for configurations post-enrollment. + ## Windows Autopilot device preparation deployment status report available in the Monitor tab under Enrollment diff --git a/autopilot/dfci-management.md b/autopilot/dfci-management.md index 7df516a9369..361abc4aa14 100644 --- a/autopilot/dfci-management.md +++ b/autopilot/dfci-management.md @@ -8,7 +8,7 @@ author: frankroj ms.author: frankroj ms.reviewer: jubaptis manager: aaroncz -ms.date: 06/11/2024 +ms.date: 10/09/2024 ms.collection: - M365-modern-desktop - tier2 @@ -24,7 +24,7 @@ With Windows Autopilot Deployment and Intune, Unified Extensible Firmware Interf If a user reinstalls a previous Windows version, installs a separate OS, or formats the hard drive, they can't override DFCI management. This feature can also prevent malware from communicating with OS processes, including elevated OS processes. DFCI's trust chain uses public key cryptography, and doesn't depend on local UEFI password security. This layer of security blocks local users from accessing managed settings from the device's UEFI menus. -For an overview of DFCI benefits, scenarios, and prerequisites, see [Device Firmware Configuration Interface (DFCI) Introduction](https://microsoft.github.io/mu/dyn/mu_feature_dfci/DfciPkg/Docs/Dfci_Feature/). +For an overview of DFCI benefits, scenarios, and requirements, see [Device Firmware Configuration Interface (DFCI) Introduction](https://microsoft.github.io/mu/dyn/mu_feature_dfci/DfciPkg/Docs/Dfci_Feature/). > [!IMPORTANT] > @@ -55,12 +55,12 @@ See the following figure: - A currently supported version of Windows and a supported UEFI is required. - The device manufacturer must have DFCI added to their UEFI firmware in the manufacturing process, or as a firmware update that can be installed. Work with the device vendors to determine the [manufacturers that support DFCI](#oems-that-support-dfci), or the firmware version needed to use DFCI. -- The device must be managed with Microsoft Intune. For more information, see [Enroll Windows devices in Intune using Windows Autopilot](/intune/enrollment/enrollment-autopilot). +- The device must be managed with Microsoft Intune. For more information, see [Enroll Windows devices in Intune using Windows Autopilot](/mem/intune/enrollment/enrollment-autopilot). - The device must be registered for Windows Autopilot by a [Microsoft Cloud Solution Provider (CSP) partner](https://partner.microsoft.com/membership/cloud-solution-provider), or registered directly by the OEM. For Surface devices, Microsoft registration support is available at [Microsoft Devices Autopilot Support](https://prod.support.services.microsoft.com/supportrequestform/0d8bf192-cab7-6d39-143d-5a17840b9f5f). > [!IMPORTANT] > -> Devices manually registered for Autopilot (such as by [importing from a CSV file](/intune/enrollment/enrollment-autopilot#add-devices)) aren't allowed to use DFCI. By design, DFCI management requires external attestation of the device's commercial acquisition through an OEM or a Microsoft CSP partner registration to Windows Autopilot. When the device is registered, its serial number is displayed in the list of Windows Autopilot devices. +> Devices manually registered for Autopilot (such as by [importing from a CSV file](/mem/intune/enrollment/enrollment-autopilot#add-devices)) aren't allowed to use DFCI. By design, DFCI management requires external attestation of the device's commercial acquisition through an OEM or a Microsoft CSP partner registration to Windows Autopilot. When the device is registered, its serial number is displayed in the list of Windows Autopilot devices. ## Managing DFCI profile with Windows Autopilot @@ -71,9 +71,9 @@ There are four basic steps in managing DFCI profile with Windows Autopilot: 1. Create a DFCI profile 1. Assign the profiles -See [Create the profiles](/intune/configuration/device-firmware-configuration-interface-windows#create-the-profiles) and [Assign the profiles, and reboot](/intune/configuration/device-firmware-configuration-interface-windows#assign-the-profiles-and-reboot) for details. +See [Create the profiles](/mem/intune/configuration/device-firmware-configuration-interface-windows#create-the-profiles) and [Assign the profiles, and reboot](/mem/intune/configuration/device-firmware-configuration-interface-windows#assign-the-profiles-and-reboot) for details. -The existing [DFCI settings](/intune/configuration/device-firmware-configuration-interface-windows#update-existing-dfci-settings) can also be changed on devices that are in use. In the existing DFCI profile, change the settings and save the changes. Since the profile is already assigned, the new DFCI settings take effect when next time the device syncs or the device reboots. +The existing [DFCI settings](/mem/intune/configuration/device-firmware-configuration-interface-windows#update-existing-dfci-settings) can also be changed on devices that are in use. In the existing DFCI profile, change the settings and save the changes. Since the profile is already assigned, the new DFCI settings take effect when next time the device syncs or the device reboots. To identify whether a device is DFCI ready, the following Intune Graph API call can be used: @@ -89,9 +89,18 @@ For more information, see [Intune devices and apps API overview](/graph/intune-c - Fujitsu. - [Microsoft Surface](/surface/surface-manage-dfci-guide). - Panasonic. +- VAIO. Other OEMs are pending. +## Known issues + +### DFCI enrollment fails for Professional editions of Windows 11, version 24H2 + +Date added: *October 9, 2024* + +DFCI can't currently be used on devices with Professional editions of Windows 11, version 24H2. The issue is being investigated. As a workaround, ensure the device is upgraded to the Enterprise edition of Windows 11, version 24H2 during or after OOBE onboarding. After upgrading to the Enterprise edition of Windows 11, version 24H2, sync the device. Once the device is synced, reboot it to get it enrolled in DFCI. + ## Related content - [Microsoft DFCI Scenarios](https://microsoft.github.io/mu/dyn/mu_feature_dfci/DfciPkg/Docs/Scenarios/DfciScenarios/). diff --git a/autopilot/enrollment-autopilot.md b/autopilot/enrollment-autopilot.md index fb809bf38ad..11f3cd1a9d3 100644 --- a/autopilot/enrollment-autopilot.md +++ b/autopilot/enrollment-autopilot.md @@ -5,7 +5,7 @@ author: frankroj ms.author: frankroj ms.reviewer: jubaptis manager: aaroncz -ms.date: 06/28/2024 +ms.date: 09/13/2024 ms.topic: how-to ms.localizationpriority: high ms.service: windows-client @@ -93,10 +93,6 @@ For more information including a list of supported OEMs, see [Return of key func > > Assigning a licensed user to a specific Autopilot device only affects pre-populating the UPN and setting of a custom greeting name. It doesn't affect assigned policies and applications that are deployed to the device or to the user. The assigned policies and applications are still deployed regardless of the OEM. For more information, see [Windows Autopilot for pre-provisioned deployment](pre-provision.md#preparation). -Prerequisites: - -- Microsoft Entra ID [Company Branding](/azure/active-directory/fundamentals/customize-branding) is configured. - > [!IMPORTANT] > > Assigning a user to a specific Autopilot device doesn't work if using Active Directory Federation Services (ADFS). diff --git a/autopilot/enrollment-status.md b/autopilot/enrollment-status.md index 15012e20f0b..241dbb64c51 100644 --- a/autopilot/enrollment-status.md +++ b/autopilot/enrollment-status.md @@ -33,7 +33,7 @@ An administrator can deploy ESP profiles to a licensed Intune user and configure - Allow users to collect troubleshooting logs. - Specify what a user can do if device setup fails. -For more information, see [Set up the Enrollment Status Page](/intune/windows-enrollment-status). +For more information, see [Set up the Enrollment Status Page](/mem/intune/enrollment/windows-enrollment-status). :::image type="content" source="images/enrollment-status-page.png" alt-text="Screenshot that shows Enrollment Status Page"::: diff --git a/autopilot/existing-devices.md b/autopilot/existing-devices.md index 681d63e2d80..b34fa55e092 100644 --- a/autopilot/existing-devices.md +++ b/autopilot/existing-devices.md @@ -8,7 +8,7 @@ author: frankroj ms.author: frankroj ms.reviewer: jubaptis manager: aaroncz -ms.date: 06/27/2024 +ms.date: 09/13/2024 ms.collection: - M365-modern-desktop - highpri @@ -40,7 +40,7 @@ Modern desktop deployment with Windows Autopilot helps easily deploy the latest > > Using Autopilot for existing devices could be used as a method to convert existing hybrid Microsoft Entra devices into Microsoft Entra devices. Using the setting **Convert all targeted devices to Autopilot** in the Autopilot profile doesn't automatically convert existing hybrid Microsoft Entra device in the assigned groups into a Microsoft Entra device. The setting only registers the devices in the assigned groups for the Autopilot service. -## Prerequisites +## Requirements - A currently supported version of Microsoft Configuration Manager current branch. diff --git a/autopilot/known-issues.md b/autopilot/known-issues.md index 9966c4e2d99..1729c254487 100644 --- a/autopilot/known-issues.md +++ b/autopilot/known-issues.md @@ -8,7 +8,7 @@ author: frankroj ms.author: frankroj ms.reviewer: jubaptis manager: aaroncz -ms.date: 08/29/2024 +ms.date: 10/09/2024 ms.collection: - M365-modern-desktop - highpri @@ -41,6 +41,12 @@ This article describes known issues that can often be resolved with configuratio ## Known issues +### DFCI enrollment fails for Professional editions of Windows 11, version 24H2 + +Date added: *October 9, 2024* + +DFCI can't currently be used on devices with Professional editions of Windows 11, version 24H2. The issue is being investigated. As a workaround, ensure the device is upgraded to the Enterprise edition of Windows 11, version 24H2 during or after OOBE onboarding. After upgrading to the Enterprise edition of Windows 11, version 24H2, sync the device. Once the device is synced, reboot it to get it enrolled in DFCI. + ### Autopilot deployment report doesn't support sorting Date added: *August 29, 2024* diff --git a/autopilot/overview.md b/autopilot/overview.md index d32eecce349..5b056827606 100644 --- a/autopilot/overview.md +++ b/autopilot/overview.md @@ -84,5 +84,5 @@ For a tutorial with detailed instructions on configuring Windows Autopilot, see ## Related content -- [Enroll Windows devices in Intune by using Windows Autopilot](/intune/enrollment-autopilot). +- [Enroll Windows devices in Intune by using Windows Autopilot](enrollment-autopilot.md). - [Windows Autopilot scenarios and capabilities](windows-autopilot-scenarios.md). diff --git a/autopilot/pre-provision.md b/autopilot/pre-provision.md index 67958993f67..7dc18be31e4 100644 --- a/autopilot/pre-provision.md +++ b/autopilot/pre-provision.md @@ -8,7 +8,7 @@ ms.reviewer: jubaptis manager: aaroncz author: frankroj ms.author: frankroj -ms.date: 07/23/2024 +ms.date: 09/13/2024 ms.collection: - M365-modern-desktop - highpri @@ -33,7 +33,11 @@ With **Windows Autopilot for pre-provisioned deployment**, the provisioning proc Pre-provisioned deployments use Microsoft Intune in currently supported versions of Windows. Such deployments build on existing Windows Autopilot [user-driven scenarios](user-driven.md) and support user-driven mode scenarios for both Microsoft Entra joined and Microsoft Entra hybrid joined devices. -## Prerequisites +## Requirements + +> [!IMPORTANT] +> +> A device can't automatically re-enroll through Windows Autopilot after an initial deployment with pre-provisioning mode. Instead, delete the device record in the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431). From the Microsoft Intune admin center, select **Devices** > **All devices** > select the devices to delete > **Delete**. For more information, see [Updates to the Windows Autopilot sign-in and deployment experience](https://techcommunity.microsoft.com/t5/intune-customer-success/updates-to-the-windows-autopilot-sign-in-and-deployment/ba-p/2848452). In addition to [Windows Autopilot requirements](requirements.md), Windows Autopilot for pre-provisioned deployment also requires: diff --git a/autopilot/profiles.md b/autopilot/profiles.md index 944fbc34c41..d9cf02b074c 100644 --- a/autopilot/profiles.md +++ b/autopilot/profiles.md @@ -8,7 +8,7 @@ author: frankroj ms.author: frankroj ms.reviewer: jubaptis manager: aaroncz -ms.date: 06/28/2024 +ms.date: 09/13/2024 ms.collection: - M365-modern-desktop - highpri @@ -87,7 +87,7 @@ Autopilot deployment profiles are used to configure the Autopilot devices. Up to - **User account type**: Select the user's account type (**Administrator** or **Standard** user). We allow the user joining the device to be a local Administrator by adding them to the local Admin group. We don't enable the user as the default administrator on the device. - - **Allow pre-provisioned deployment** ([Prerequisites](pre-provision.md#prerequisites)): Select **Yes** to allow pre-provisioning support. + - **Allow pre-provisioned deployment** ([Requirements](pre-provision.md#requirements)): Select **Yes** to allow pre-provisioning support. > [!NOTE] > diff --git a/autopilot/requirements.md b/autopilot/requirements.md index caaf3c887f8..3e3e435c697 100644 --- a/autopilot/requirements.md +++ b/autopilot/requirements.md @@ -8,7 +8,7 @@ author: frankroj ms.author: frankroj ms.reviewer: jubaptis manager: aaroncz -ms.date: 06/28/2024 +ms.date: 09/06/2024 ms.collection: - M365-modern-desktop - highpri @@ -65,7 +65,7 @@ The following editions of Windows 11 are supported: - Windows 11 Pro. - Windows 11 Pro Education. - Windows 11 Pro for Workstations. -- Windows 11 Enterprise/[Windows 11 IoT Eneterprise](/windows/iot/iot-enterprise/overview). +- Windows 11 Enterprise. - Windows 11 Education. #### Windows 10 @@ -77,7 +77,7 @@ The following editions of Windows 10 are supported: - Windows 10 Pro. - Windows 10 Pro Education. - Windows 10 Pro for Workstations. -- Windows 10 Enterprise/[Windows 10 IoT Eneterprise](/windows/iot/iot-enterprise/overview). +- Windows 10 Enterprise. - Windows 10 Education. - [Windows 10 Enterprise LTSC](/windows/whats-new/ltsc/overview). @@ -239,7 +239,7 @@ To provide needed Microsoft Entra ID and MDM functionality, including automatic > [!NOTE] > -> When a Microsoft 365 subscription is used, licenses still need to be assigned to users so they can enroll device in Intune. For more information, see [assign licenses to users so they can enroll devices in Intune](/intune/fundamentals/licenses-assign). +> When a Microsoft 365 subscription is used, licenses still need to be assigned to users so they can enroll device in Intune. For more information, see [assign licenses to users so they can enroll devices in Intune](/mem/intune/fundamentals/licenses-assign). Additionally, the following are also recommended (but not required): diff --git a/autopilot/self-deploying.md b/autopilot/self-deploying.md index a3cc171e358..669dc63fb1f 100644 --- a/autopilot/self-deploying.md +++ b/autopilot/self-deploying.md @@ -8,7 +8,7 @@ author: frankroj ms.author: frankroj ms.reviewer: jubaptis manager: aaroncz -ms.date: 06/11/2024 +ms.date: 09/13/2024 ms.collection: - M365-modern-desktop - highpri @@ -69,7 +69,7 @@ Optionally, a [device-only subscription](https://techcommunity.microsoft.com/t5/ > [!IMPORTANT] > -> A device can't automatically re-enroll through Autopilot after an initial deployment in self-deploying mode. Instead, delete the device record in the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431). From the admin center, select **Devices** > **All devices** > select the devices to delete > **Delete**. For more information, see [Updates to the Windows Autopilot sign-in and deployment experience](https://techcommunity.microsoft.com/t5/intune-customer-success/updates-to-the-windows-autopilot-sign-in-and-deployment/ba-p/2848452). +> A device can't automatically re-enroll through Windows Autopilot after an initial deployment with self-deploying mode. Instead, delete the device record in the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431). From the Microsoft Intune admin center, select **Devices** > **All devices** > select the devices to delete > **Delete**. For more information, see [Updates to the Windows Autopilot sign-in and deployment experience](https://techcommunity.microsoft.com/t5/intune-customer-success/updates-to-the-windows-autopilot-sign-in-and-deployment/ba-p/2848452). Self-deploying mode uses a device's Trusted Platform Module (TPM) 2.0 hardware to authenticate the device into an organization's Microsoft Entra tenant. Therefore, devices without TPM 2.0 can't be used with this mode. Devices must also support TPM device attestation. All new Windows devices should meet these requirements. The TPM attestation process also requires access to a set of HTTPS URLs that are unique for each TPM provider. For more information, see the entry for Autopilot self-Deploying mode and Autopilot pre-provisioning in [Networking requirements](requirements.md?tabs=networking#autopilot-self-deploying-mode-and-autopilot-pre-provisioning). For Windows Autopilot software requirements, see [Windows Autopilot software requirements](./requirements.md?tabs=software). diff --git a/autopilot/tutorial/pre-provisioning/azure-ad-join-workflow.md b/autopilot/tutorial/pre-provisioning/azure-ad-join-workflow.md index f7c88ea8768..5c34ed83fae 100644 --- a/autopilot/tutorial/pre-provisioning/azure-ad-join-workflow.md +++ b/autopilot/tutorial/pre-provisioning/azure-ad-join-workflow.md @@ -7,7 +7,7 @@ author: frankroj ms.author: frankroj ms.reviewer: jubaptis manager: aaroncz -ms.date: 06/19/2024 +ms.date: 09/13/2024 ms.topic: tutorial ms.collection: - tier1 @@ -24,7 +24,7 @@ This step by step tutorial guides through using Intune to perform a Windows Auto The purpose of this tutorial is a step by step guide for all the configuration steps required for a successful Autopilot for pre-provisioned deployment Microsoft Entra join deployment using Intune. The tutorial is also designed as a walkthrough in a lab or testing scenario, but can be expanded for use in a production environment. -Before beginning, refer to the [How to: Plan your Microsoft Entra join implementation](/azure/active-directory/devices/azureadjoin-plan) to make sure all prerequisites are met for joining devices to Microsoft Entra ID. +Before beginning, refer to the [How to: Plan your Microsoft Entra join implementation](/azure/active-directory/devices/azureadjoin-plan) to make sure all requirements are met for joining devices to Microsoft Entra ID. > [!NOTE] > diff --git a/autopilot/tutorial/pre-provisioning/hybrid-azure-ad-join-autopilot-profile.md b/autopilot/tutorial/pre-provisioning/hybrid-azure-ad-join-autopilot-profile.md index 27bdc807fed..aa21ff2118e 100644 --- a/autopilot/tutorial/pre-provisioning/hybrid-azure-ad-join-autopilot-profile.md +++ b/autopilot/tutorial/pre-provisioning/hybrid-azure-ad-join-autopilot-profile.md @@ -7,7 +7,7 @@ author: frankroj ms.author: frankroj ms.reviewer: jubaptis manager: aaroncz -ms.date: 06/28/2024 +ms.date: 09/13/2024 ms.topic: tutorial ms.collection: - tier1 @@ -98,7 +98,7 @@ Windows Autopilot for pre-provisioned Microsoft Entra hybrid join supports off-p For off-premises/Internet scenarios requiring VPN connectivity, the only change in the Autopilot profile would be in the setting **Skip AD connectivity check**. In the [Create and assign pre-provisioned Microsoft Entra hybrid join Autopilot profile](#create-and-assign-a-pre-provisioned-microsoft-entra-hybrid-join-autopilot-profile) section, the **Skip AD connectivity check** setting should be set to **Yes** instead of to **No**. Setting this option to **Yes** prevents the deployment from failing since there's no direct connectivity to Active Directory and domain controllers until the VPN connection is established. -In addition to changing the **Skip AD connectivity check** setting to **Yes** in the Autopilot profile, VPN support also relies on the following prerequisites: +In addition to changing the **Skip AD connectivity check** setting to **Yes** in the Autopilot profile, VPN support also relies on the following requirements: - The VPN solution can be deployed and installed with Intune. - The VPN solution needs to support one of the following options: diff --git a/autopilot/tutorial/pre-provisioning/hybrid-azure-ad-join-workflow.md b/autopilot/tutorial/pre-provisioning/hybrid-azure-ad-join-workflow.md index 6d9b1140576..a65aa345137 100644 --- a/autopilot/tutorial/pre-provisioning/hybrid-azure-ad-join-workflow.md +++ b/autopilot/tutorial/pre-provisioning/hybrid-azure-ad-join-workflow.md @@ -7,7 +7,7 @@ author: frankroj ms.author: frankroj ms.reviewer: jubaptis manager: aaroncz -ms.date: 06/19/2024 +ms.date: 09/13/2024 ms.topic: tutorial ms.collection: - tier1 @@ -28,7 +28,7 @@ This step by step tutorial guides through using Intune to perform a Windows Auto The purpose of this tutorial is a step by step guide for all the configuration steps required for a successful Autopilot for pre-provisioned deployment Microsoft Entra hybrid join deployment using Intune. The tutorial is also designed as a walkthrough in a lab or testing scenario, but can be expanded for use in a production environment. -Before beginning, refer to the [Plan your Microsoft Entra hybrid join implementation](/azure/active-directory/devices/hybrid-azuread-join-plan) to make sure all prerequisites are met for joining on-premises AD devices to Microsoft Entra ID. +Before beginning, refer to the [Plan your Microsoft Entra hybrid join implementation](/azure/active-directory/devices/hybrid-azuread-join-plan) to make sure all requirements are met for joining on-premises AD devices to Microsoft Entra ID. > [!NOTE] > diff --git a/autopilot/tutorial/reset/autopilot-reset-overview.md b/autopilot/tutorial/reset/autopilot-reset-overview.md index 6fdd9904fe6..9e1d8a09d4d 100644 --- a/autopilot/tutorial/reset/autopilot-reset-overview.md +++ b/autopilot/tutorial/reset/autopilot-reset-overview.md @@ -7,7 +7,7 @@ author: frankroj ms.author: frankroj ms.reviewer: jubaptis manager: aaroncz -ms.date: 06/19/2024 +ms.date: 10/08/2024 ms.topic: tutorial ms.collection: - tier1 @@ -30,7 +30,8 @@ Windows Autopilot Reset takes the device back to a business-ready state, allowin The Windows Autopilot Reset process removes or resets the following information from the existing device: -- The device's primary user is removed. The next user who signs in after the Windows Autopilot Reset will be set as the primary user. +- The device's primary user is removed when a remote Windows Autopilot Reset is used. The next user who signs in after the Windows Autopilot Reset will be set as the primary user. Shared devices will remain shared after the remote Autopilot Reset. +- The device's owner in Microsoft Entra is removed when a remote Windows Autopilot Reset is used. The next user who signs in after the Windows Autopilot Reset will be set as the owner. - Removes personal files, apps, and settings. - Reapplies a device's original settings. - Sets the region, language, and keyboard to the original values. @@ -46,6 +47,7 @@ The Windows Autopilot Reset process automatically keeps the following informatio - A provisioning package present on a USB drive when the reset process is started. - Microsoft Entra device membership and Intune enrollment information. - System Center Endpoint Protection (SCEP) certificates. +- The device's primary user and owner in Microsoft Entra aren't updated when a local Windows Autopilot Reset is used. ## Windows Autopilot Reset requirements diff --git a/autopilot/tutorial/self-deploying/self-deploying-workflow.md b/autopilot/tutorial/self-deploying/self-deploying-workflow.md index bc658e23b6c..20f4c218800 100644 --- a/autopilot/tutorial/self-deploying/self-deploying-workflow.md +++ b/autopilot/tutorial/self-deploying/self-deploying-workflow.md @@ -7,7 +7,7 @@ author: frankroj ms.author: frankroj ms.reviewer: jubaptis manager: aaroncz -ms.date: 06/19/2024 +ms.date: 09/13/2024 ms.topic: tutorial ms.collection: - tier1 @@ -24,7 +24,7 @@ This step by step tutorial guides through using Intune to perform a Windows Auto The purpose of this tutorial is a step by step guide for all the configuration steps required for a successful Autopilot self-deploying mode deployment using Intune. The tutorial is also designed as a walkthrough in a lab or testing scenario, but can be expanded for use in a production environment. -Before beginning, refer to the [How to: Plan your Microsoft Entra join implementation](/azure/active-directory/devices/azureadjoin-plan) to make sure all prerequisites are met for joining devices to Microsoft Entra ID. +Before beginning, refer to the [How to: Plan your Microsoft Entra join implementation](/azure/active-directory/devices/azureadjoin-plan) to make sure all requirements are met for joining devices to Microsoft Entra ID. ## Windows Autopilot self-deploying mode overview diff --git a/autopilot/tutorial/user-driven/azure-ad-join-workflow.md b/autopilot/tutorial/user-driven/azure-ad-join-workflow.md index 68731176313..1f207b3a489 100644 --- a/autopilot/tutorial/user-driven/azure-ad-join-workflow.md +++ b/autopilot/tutorial/user-driven/azure-ad-join-workflow.md @@ -7,7 +7,7 @@ author: frankroj ms.author: frankroj ms.reviewer: jubaptis manager: aaroncz -ms.date: 06/19/2024 +ms.date: 09/13/2024 ms.topic: tutorial ms.collection: - tier1 @@ -24,7 +24,7 @@ This step by step tutorial guides through using Intune to perform a Windows Auto The purpose of this tutorial is a step by step guide for all the configuration steps required for a successful Autopilot user-driven Microsoft Entra join deployment using Intune. The tutorial is also designed as a walkthrough in a lab or testing scenario, but can be expanded for use in a production environment. -Before beginning, refer to the [How to: Plan your Microsoft Entra join implementation](/azure/active-directory/devices/azureadjoin-plan) to make sure all prerequisites are met for joining devices to Microsoft Entra ID. +Before beginning, refer to the [How to: Plan your Microsoft Entra join implementation](/azure/active-directory/devices/azureadjoin-plan) to make sure all requirements are met for joining devices to Microsoft Entra ID. ## Windows Autopilot user-driven Microsoft Entra join overview diff --git a/autopilot/tutorial/user-driven/hybrid-azure-ad-join-autopilot-profile.md b/autopilot/tutorial/user-driven/hybrid-azure-ad-join-autopilot-profile.md index f13778c7514..4c65a847938 100644 --- a/autopilot/tutorial/user-driven/hybrid-azure-ad-join-autopilot-profile.md +++ b/autopilot/tutorial/user-driven/hybrid-azure-ad-join-autopilot-profile.md @@ -7,7 +7,7 @@ author: frankroj ms.author: frankroj ms.reviewer: jubaptis manager: aaroncz -ms.date: 06/28/2024 +ms.date: 09/13/2024 ms.topic: tutorial ms.collection: - tier1 @@ -103,7 +103,7 @@ Windows Autopilot user-driven Microsoft Entra hybrid join supports off-premises/ For off-premises/Internet scenarios requiring VPN connectivity, the only change in the Autopilot profile would be in the setting **Skip AD connectivity check**. In the [Create and assign user-driven Microsoft Entra hybrid join Autopilot profile](#create-and-assign-user-driven-microsoft-entra-hybrid-join-autopilot-profile) section, the **Skip AD connectivity check** setting should be set to **Yes** instead of to **No**. Setting this option to **Yes** prevents the deployment from failing since there's no direct connectivity to Active Directory and domain controllers until the VPN connection is established. -In addition to changing the **Skip AD connectivity check** setting to **Yes** in the Autopilot profile, VPN support also relies on the following prerequisites: +In addition to changing the **Skip AD connectivity check** setting to **Yes** in the Autopilot profile, VPN support also relies on the following requirements: - The VPN solution can be deployed and installed with Intune. - The VPN solution needs to support one of the following options: diff --git a/autopilot/tutorial/user-driven/hybrid-azure-ad-join-workflow.md b/autopilot/tutorial/user-driven/hybrid-azure-ad-join-workflow.md index 62dbc18b1bd..23be770a105 100644 --- a/autopilot/tutorial/user-driven/hybrid-azure-ad-join-workflow.md +++ b/autopilot/tutorial/user-driven/hybrid-azure-ad-join-workflow.md @@ -7,7 +7,7 @@ author: frankroj ms.author: frankroj ms.reviewer: jubaptis manager: aaroncz -ms.date: 06/19/2024 +ms.date: 09/13/2024 ms.topic: tutorial ms.collection: - tier1 @@ -28,7 +28,7 @@ This step by step tutorial guides through using Intune to perform a Windows Auto The purpose of this tutorial is a step by step guide for all the configuration steps required for a successful Autopilot user-driven Microsoft Entra hybrid join deployment using Intune. The tutorial is also designed as a walkthrough in a lab or testing scenario, but can be expanded for use in a production environment. -Before beginning, refer to the [Plan your Microsoft Entra hybrid join implementation](/azure/active-directory/devices/hybrid-azuread-join-plan) to make sure all prerequisites are met for joining on-premises AD devices to Microsoft Entra ID. +Before beginning, refer to the [Plan your Microsoft Entra hybrid join implementation](/azure/active-directory/devices/hybrid-azuread-join-plan) to make sure all requirements are met for joining on-premises AD devices to Microsoft Entra ID. ## Windows Autopilot user-driven Microsoft Entra hybrid join overview diff --git a/autopilot/windows-autopilot-hybrid.md b/autopilot/windows-autopilot-hybrid.md index 8f097b831b2..40d9e6ccf06 100644 --- a/autopilot/windows-autopilot-hybrid.md +++ b/autopilot/windows-autopilot-hybrid.md @@ -6,7 +6,7 @@ author: frankroj ms.author: frankroj manager: aaroncz ms.reviewer: jubaptis -ms.date: 09/04/2024 +ms.date: 09/13/2024 ms.topic: how-to ms.service: windows-client ms.subservice: autopilot @@ -28,12 +28,12 @@ appliesto: Intune and Windows Autopilot can be used to set up Microsoft Entra hybrid joined devices. To do so, follow the steps in this article. For more information about Microsoft Entra hybrid join, see [Understanding Microsoft Entra hybrid join and co-management](https://techcommunity.microsoft.com/t5/microsoft-endpoint-manager-blog/understanding-hybrid-azure-ad-join-and-co-management/ba-p/2221201). -## Prerequisites +## Requirements - Successfully configured the [Microsoft Entra hybrid joined devices](/azure/active-directory/devices/hybrid-azuread-join-plan). Be sure to [verify the device registration](/azure/active-directory/devices/howto-hybrid-join-verify) by using the [Get-MgDevice](/powershell/module/microsoft.graph.identity.directorymanagement/get-mgdevice) cmdlet. - If [Domain and OU-based filtering](/azure/active-directory/hybrid/how-to-connect-install-custom#domain-and-ou-filtering) is configured as part of Microsoft Entra Connect, ensure that the default organizational unit (OU) or container intended for the Autopilot devices is included in the sync scope. -### Device enrollment prerequisites +### Device enrollment requirements The device to be enrolled must follow these requirements: @@ -47,7 +47,7 @@ The device to be enrolled must follow these requirements: Although not required, configuring Microsoft Entra hybrid join for Active Directory Federated Services (ADFS) enables a faster Windows Autopilot Microsoft Entra registration process during deployments. Federated customers that aren't supporting the use of passwords and using AD FS need to follow the steps in the article [Active Directory Federation Services prompt=login parameter support](/windows-server/identity/ad-fs/operations/ad-fs-prompt-login) to properly configure the authentication experience. -### Intune connector server prerequisites +### Intune connector server requirements - The Intune Connector for Active Directory must be installed on a computer that's running Windows Server 2016 or later with .NET Framework version 4.7.2 or later. @@ -126,7 +126,7 @@ The organizational unit that has the rights to create computers must match: ## Install the Intune Connector -Before beginning the installation, make sure that all of the [Intune connector server prerequisites](#intune-connector-server-prerequisites) are met. +Before beginning the installation, make sure that all of the [Intune connector server requirements](#intune-connector-server-requirements) are met. ### Install steps diff --git a/autopilot/windows-autopilot-reset.md b/autopilot/windows-autopilot-reset.md index a4c332f4405..f30f991d4a5 100644 --- a/autopilot/windows-autopilot-reset.md +++ b/autopilot/windows-autopilot-reset.md @@ -8,7 +8,7 @@ author: frankroj ms.author: frankroj ms.reviewer: jubaptis manager: aaroncz -ms.date: 08/22/2024 +ms.date: 10/09/2024 ms.collection: - M365-modern-desktop - highpri @@ -38,7 +38,7 @@ The Windows Autopilot Reset process automatically keeps information from the exi - Microsoft Entra device membership and mobile device management (MDM) enrollment information. - Simple Certificate Enrollment Protocol (SCEP) certificates. -Windows Autopilot Reset blocks the user from accessing the desktop until this information is restored, including reapplying any provisioning packages. For devices enrolled in an MDM service, Windows Autopilot Reset also blocks until an MDM sync is completed. When Autopilot reset is used on a device, the device's primary user is removed. The next user who signs in after the reset will be set as the primary user. +Windows Autopilot Reset blocks the user from accessing the desktop until this information is restored, including reapplying any provisioning packages. For devices enrolled in an MDM service, Windows Autopilot Reset also blocks until an MDM sync is completed. > [!NOTE] > @@ -119,11 +119,15 @@ On the device where the local Windows Autopilot reset is being performed: Once the local Autopilot Reset is triggered, the reset process starts. Once provisioning is complete, the device is again ready for use. +> [!NOTE] +> +> When local Autopilot Reset is used on a device, the device's primary user and the Microsoft Entra device owner aren't updated. Admins can update them manually after the Autopilot Reset completes. + ## Reset devices with remote Windows Autopilot Reset An MDM service such a Microsoft Intune can be used to start the remote Windows Autopilot reset process. Resetting in this way avoids the need for IT staff to visit each machine to start the process. -To enable a device for a remote Windows Autopilot Reset, the device must be MDM managed and joined to Microsoft Entra ID. Additionally, for Intune, the Intune Service Administrator role is required for remote Windows Autopilot Reset. For more information, see [Add users and grant administrative permission to Intune](/intune/users-add). +To enable a device for a remote Windows Autopilot Reset, the device must be MDM managed and joined to Microsoft Entra ID. Additionally, for Intune, the Intune Service Administrator role is required for remote Windows Autopilot Reset. For more information, see [Add users and grant administrative permission to Intune](/mem/intune/fundamentals/users-add). ### Triggering a remote Windows Autopilot Reset @@ -135,6 +139,10 @@ To trigger a remote Windows Autopilot Reset via Intune, follow these steps: Once the reset is complete, the device is again ready for use. +> [!NOTE] +> +> When remote Autopilot Reset is used on a device, the device's primary user and the Microsoft Entra device owner is removed. The next user who signs in after the reset will be set as the primary user and Microsoft Entra device owner. Shared devices will remain shared after the Autopilot Reset. + ## Troubleshooting Windows Autopilot Reset requires that the [Windows Recovery Environment (WinRE)](/windows-hardware/manufacture/desktop/windows-recovery-environment--windows-re--technical-reference) is correctly configured and enabled on the device. Before the Windows Autopilot Reset is started, it checks if WinRE is configured and enabled. If WinRE isn't configured and enabled, then the Windows Autopilot reset fails immediately on the device and an error such as `Error code: ERROR_NOT_SUPPORTED (0x80070032)` is reported in the logs. diff --git a/memdocs/analytics/device-query.md b/memdocs/analytics/device-query.md index 71074425429..c288c73daef 100644 --- a/memdocs/analytics/device-query.md +++ b/memdocs/analytics/device-query.md @@ -48,9 +48,6 @@ For a user to use Device query, you must assign the **Managed Devices** - **Quer To use Device query, devices must be Intune managed and corporate owned. -> [!NOTE] -> -> Device query is currently not supported in U.S. Government Community Cloud (GCC) High, or U.S. Department of Defense (DoD) environments. ## Supported platforms diff --git a/memdocs/analytics/overview.md b/memdocs/analytics/overview.md index bf1fae0b7e4..2a49553a890 100644 --- a/memdocs/analytics/overview.md +++ b/memdocs/analytics/overview.md @@ -45,7 +45,7 @@ You can enroll devices via Configuration Manager or Microsoft Intune. - Pro, Pro Education, Enterprise, or Education. Home and long-term servicing channel (LTSC) aren't supported. - Windows devices must be Microsoft Entra joined or Microsoft Entra hybrid joined. Workplace joined or Microsoft Entra registered devices aren't supported. - Network connectivity from devices to the Microsoft public cloud. For more information, see [endpoints](troubleshoot.md#bkmk_endpoints). -- The [Intune Service Administrator role](/intune/fundamentals/role-based-access-control) is required to [start gathering data](enroll-intune.md#bkmk_onboard). +- The [Intune Service Administrator role](/mem/intune/fundamentals/role-based-access-control) is required to [start gathering data](enroll-intune.md#bkmk_onboard). - After the administrator selects **Start** for gathering data, other read-only roles can view the data. ### How to enroll devices via Configuration Manager diff --git a/memdocs/configmgr/apps/deploy-use/link-users-and-devices-with-user-device-affinity.md b/memdocs/configmgr/apps/deploy-use/link-users-and-devices-with-user-device-affinity.md index 75c7318b729..b8a335fcc29 100644 --- a/memdocs/configmgr/apps/deploy-use/link-users-and-devices-with-user-device-affinity.md +++ b/memdocs/configmgr/apps/deploy-use/link-users-and-devices-with-user-device-affinity.md @@ -140,4 +140,4 @@ When you disable the client setting to **Automatically configure user device aff ## Next steps -You can also use Microsoft Intune to find the primary use of an enrolled device. For more information, see [Find the primary user of an Intune device](/intune/find-primary-user) in the Intune documentation. +You can also use Microsoft Intune to find the primary use of an enrolled device. For more information, see [Find the primary user of an Intune device](/mem/intune/remote-actions/find-primary-user) in the Intune documentation. diff --git a/memdocs/configmgr/apps/deploy-use/manage-apps-from-the-windows-store-for-business.md b/memdocs/configmgr/apps/deploy-use/manage-apps-from-the-windows-store-for-business.md index 898039c0d9d..fe05e7e7a5a 100644 --- a/memdocs/configmgr/apps/deploy-use/manage-apps-from-the-windows-store-for-business.md +++ b/memdocs/configmgr/apps/deploy-use/manage-apps-from-the-windows-store-for-business.md @@ -29,7 +29,7 @@ The Microsoft Store for Business and Education supports two types of app: - **Offline**: This type lets you cache apps and licenses to deploy directly within your on-premises network. Devices don't need to connect to the store or have a connection to the internet. -For more information, see the [Microsoft Store for Business and Education overview](/microsoft-store/microsoft-store-for-business-overview). +For more information, see the [Microsoft Store for Business and Education overview](/mem/configmgr/apps/deploy-use/manage-apps-from-the-windows-store-for-business). ### Summary of capabilities @@ -64,7 +64,7 @@ Before deploying Microsoft Store for Business and Education apps to devices that - When the local Administrator account signs in on the device, it can't access Microsoft Store for Business and Education apps. -- Devices need a live internet connection to the Microsoft Store for Business and Education. For more information including proxy configuration, see [Prerequisites](/microsoft-store/prerequisites-microsoft-store-for-business). +- Devices need a live internet connection to the Microsoft Store for Business and Education. For more information including proxy configuration, see [Prerequisites](/mem/intune/apps/store-apps-microsoft). ## Set up synchronization @@ -72,13 +72,13 @@ When you synchronize the list of Microsoft Store for Business and Education apps Connect your Configuration Manager site to Microsoft Entra ID and the Microsoft Store for Business and Education. For more information and details of this process, see [Configure Azure services](../../core/servers/deploy/configure/azure-services-wizard.md). Create a connection to the **Microsoft Store for Business** service. -Make sure the service connection point and targeted devices can access the cloud service. For more information, see [Prerequisites for Microsoft Store for Business and Education - Proxy configuration](/microsoft-store/prerequisites-microsoft-store-for-business#proxy-configuration). +Make sure the service connection point and targeted devices can access the cloud service. For more information, see [Prerequisites for Microsoft Store for Business and Education - Proxy configuration](/mem/intune/apps/store-apps-microsoft). ### Supplemental information and configuration On the **App** page of the Azure Services Wizard, first configure the **Azure environment** and **Web app**. Then read the **More Information** section at the bottom of the page. This information includes the following other actions in the Microsoft Store for Business and Education portal: -- Configure Configuration Manager as the store management tool. For more information, see [Configure management provider](/microsoft-store/configure-mdm-provider-microsoft-store-for-business). +- Configure Configuration Manager as the store management tool. For more information, see [Configure management provider](/windows/client-management/azure-active-directory-integration-with-mdm). - Enable support for offline licensed apps. For more information, see [Distribute offline apps](/microsoft-store/distribute-offline-apps). diff --git a/memdocs/configmgr/comanage/autopilot-enrollment.md b/memdocs/configmgr/comanage/autopilot-enrollment.md index 37bcd03bce7..f8b1cd070a8 100644 --- a/memdocs/configmgr/comanage/autopilot-enrollment.md +++ b/memdocs/configmgr/comanage/autopilot-enrollment.md @@ -9,7 +9,7 @@ ms.topic: how-to ms.localizationpriority: medium author: gowdhamankarthikeyan ms.author: gokarthi -ms.reviewer: mstewart,aaroncz +ms.reviewer: mstewart,aaroncz,frankroj manager: apoorvseth ms.collection: tier3 --- @@ -83,12 +83,16 @@ The following components are required to support Autopilot into co-management: - Windows devices running one of the following versions: - - Windows 11 + - Windows 11 -> [!NOTE] - > For Windows 11 devices, if a device has not been targeted with a co-management settings policy, the management authority will be set to Intune, during the Autopilot process. Installing Configuration Manager client as Win32 app does not change management authority to Configuration Manager and thus Intune will continue to manage all the co-management workloads. To mitigate this, you must create a co-management settings policy and set **automatically install the Configuration Manager client** to **No** and in Advanced settings, keep default settings for **Override co-management policy and use Intune for all workloads.** + For Windows 11 devices, if a device has not been targeted with a co-management settings policy, the management authority will be set to Microsoft Intune during the Autopilot process. Installing the Configuration Manager client as Win32 app doesn't change management authority to Configuration Manager and Microsoft Intune will continue to manage all the co-management workloads. To set the management authority to Configuration Manager, create a co-management settings policy with the following Advanced settings:
+
+ - **Automatically install the Configuration Manager client.**: **No** + - **Override co-management policy and use Intune for all workloads.**: **No** + + For additional information, see [Co-management settings: Windows Autopilot with co-management](https://techcommunity.microsoft.com/t5/microsoft-intune-blog/co-management-settings-windows-autopilot-with-co-management/ba-p/3638500). - - At least Windows 10, version 20H2, with the latest cumulative update + - A [currently supported](/windows/release-health/supported-versions-windows-client#windows-10-supported-versions-by-servicing-option) version of Windows 10. - Register the device for Autopilot. For more information, see [Windows Autopilot registration overview](/autopilot/registration-overview). @@ -127,19 +131,27 @@ Use these recommendations for a more successful deployment: ## Limitations -Autopilot into co-management currently doesn't support the following functionality: +- [Windows Autopilot device preparation](/autopilot/device-preparation/overview) policy doesn't support Autopilot into co-management. As a result, attempting to install co-management during the device preparation flow might result in failed deployments. + + - For Windows 11 devices in Microsoft Entra hybrid joined scenario, the management authority will be set to Microsoft Intune during the Windows Autopilot process. Installing Configuration Manager client as Win32 app does not change management authority to Configuration Manager and Microsoft Intune will continue to manage all the co-management workloads. -- Microsoft Entra hybrid joined devices - If the device is targeted with co-management settings policy, in Microsoft Entra hybrid join scenario, the autopilot provisioning times out during ESP phase. + To change the management authority to Configuration Manager, set the following registry key value:
+
+ - Path: **HKLM\SOFTWARE\Microsoft\DeviceManageabilityCSP\Provider\MS DM Server** + - Value: **ConfigInfo** + - REG_SZ: **2** + + For more information, see [Co-management settings: Windows Autopilot with co-management](https://techcommunity.microsoft.com/t5/microsoft-intune-blog/co-management-settings-windows-autopilot-with-co-management/ba-p/3638500). -> [!NOTE] -> -> For Windows 11 devices in Microsoft Entra hybrid joined scenario, the management authority will be set to Intune, during the Autopilot process. Installing Configuration Manager client as Win32 app does not change management authority to Configuration Manager and thus Intune will continue to manage all the co-management workloads. To mitigate this, along with Configuration Manager client installation, registry value **ConfigInfo** in registry path **HKLM\SOFTWARE\Microsoft\DeviceManageabilityCSP\Provider\MS DM Server** must be set to **2** which will set the management authority as Configuration Manager. +- Autopilot into co-management currently doesn't support the following functionality: + + - Microsoft Entra hybrid joined devices - If the device is targeted with co-management settings policy, in Microsoft Entra hybrid join scenario, the autopilot provisioning times out during ESP phase. -- Autopilot pre-provisioning. + - Autopilot pre-provisioning. -- Workloads switched to **Pilot Intune** with pilot collections. This functionality is dependent upon collection evaluation, which doesn't happen until after the client is installed and registered. Since the client won't get the correct policy until later in the Autopilot process, it can cause indeterminate behaviors. + - Workloads switched to **Pilot Intune** with pilot collections. This functionality is dependent upon collection evaluation, which doesn't happen until after the client is installed and registered. Since the client won't get the correct policy until later in the Autopilot process, it can cause indeterminate behaviors. -- Clients that authenticate with PKI certificates. You can't provision the certificate on the device before the Configuration Manager client installs and needs to authenticate to the CMG. Microsoft Entra ID is recommended for client authentication. For more information, see [Plan for CMG client authentication: Microsoft Entra ID](../core/clients/manage/cmg/plan-client-authentication.md#azure-ad). + - Clients that authenticate with PKI certificates. You can't provision the certificate on the device before the Configuration Manager client installs and needs to authenticate to the CMG. Microsoft Entra ID is recommended for client authentication. For more information, see [Plan for CMG client authentication: Microsoft Entra ID](../core/clients/manage/cmg/plan-client-authentication.md#azure-ad). ## Configure diff --git a/memdocs/configmgr/comanage/company-portal.md b/memdocs/configmgr/comanage/company-portal.md index 1009028794b..ee7cd4cfd49 100644 --- a/memdocs/configmgr/comanage/company-portal.md +++ b/memdocs/configmgr/comanage/company-portal.md @@ -83,7 +83,7 @@ For more information on client settings, see the following articles: - To require the app on co-managed devices, the deployment process depends upon the state of the [Client apps](workloads.md#client-apps) co-management workload: - - If the client apps workload is with Configuration Manager, [create and deploy an application with Configuration Manager](../apps/get-started/create-and-deploy-an-application.md). Download the offline Company Portal app from the [Microsoft Store for Business](https://www.microsoft.com/business-store). + - If the client apps workload is with Configuration Manager, [create and deploy an application with Configuration Manager](../apps/get-started/create-and-deploy-an-application.md). - If the client apps workload is with Intune, you can deploy it via Configuration Manager or [add the Company Portal app by using Microsoft Intune](../../intune/apps/store-apps-company-portal-app.md). diff --git a/memdocs/configmgr/comanage/how-to-monitor.md b/memdocs/configmgr/comanage/how-to-monitor.md index 0f9d1e3d73a..a05fb2ac81b 100644 --- a/memdocs/configmgr/comanage/how-to-monitor.md +++ b/memdocs/configmgr/comanage/how-to-monitor.md @@ -93,8 +93,8 @@ There are hundreds of possible errors. The following table lists the most common | Error | Description | |---------|---------| -| 2147549183 (0x8000FFFF) | MDM enrollment hasn't been configured yet on Microsoft Entra ID, or the enrollment URL isn't expected.

[Enable automatic enrollment](/intune/windows-enroll#enable-windows-automatic-enrollment) | -| 2149056536 (0x80180018)
MENROLL_E_USERLICENSE | License of user is in bad state blocking enrollment

[Assign licenses to users](/intune/licenses-assign) | +| 2147549183 (0x8000FFFF) | MDM enrollment hasn't been configured yet on Microsoft Entra ID, or the enrollment URL isn't expected.

[Enable automatic enrollment](/mem/intune/enrollment/windows-enroll#enable-windows-automatic-enrollment) | +| 2149056536 (0x80180018)
MENROLL_E_USERLICENSE | License of user is in bad state blocking enrollment

[Assign licenses to users](/mem/intune/fundamentals/licenses-assign) | | 2149056555 (0x8018002B)
MENROLL_E_MDM_NOT_CONFIGURED | When trying to automatically enroll to Intune, but the Microsoft Entra configuration isn't fully applied. This issue should be transient, as the device retries after a short time. | | 2149056554 (0x‭8018002A‬)
  | The user canceled the operation

If MDM enrollment requires multi-factor authentication, and the user hasn't signed in with a supported second factor, Windows displays a toast notification to the user to enroll. If the user doesn't respond to toast notification, this error occurs. This issue should be transient, as Configuration Manager will retry and prompt the user. Users should use multi-factor authentication when they sign in to Windows. Also educate them to expect this behavior, and if prompted, take action. | | 2149056532 (0x80180014)
MENROLL_E_DEVICENOTSUPPORTED | Mobile device management isn't supported. Check device restrictions. | diff --git a/memdocs/configmgr/comanage/tutorial-co-manage-clients.md b/memdocs/configmgr/comanage/tutorial-co-manage-clients.md index 7a4c3e8cd52..bfc44265277 100644 --- a/memdocs/configmgr/comanage/tutorial-co-manage-clients.md +++ b/memdocs/configmgr/comanage/tutorial-co-manage-clients.md @@ -2,7 +2,7 @@ title: Tutorial: Enable co-management for existing clients titleSuffix: Configuration Manager description: Configure co-management with Microsoft Intune when you already manage Windows devices with Configuration Manager. -ms.date: 03/21/2022 +ms.date: 10/18/2024 ms.subservice: co-management ms.service: configuration-manager ms.topic: tutorial diff --git a/memdocs/configmgr/compliance/deploy-use/create-configuration-baselines.md b/memdocs/configmgr/compliance/deploy-use/create-configuration-baselines.md index f47a5af6545..e7eb3ae1dd2 100644 --- a/memdocs/configmgr/compliance/deploy-use/create-configuration-baselines.md +++ b/memdocs/configmgr/compliance/deploy-use/create-configuration-baselines.md @@ -115,7 +115,7 @@ When `User1` uses `Device2`, only `Configuration Baseline 2` gets evaluated when ### Create and deploy a compliance policy with a rule for baseline compliance policy assessment -1. In the **Assets and Compliance** workspace, expand **Compliance Settings**, then select the **Compliance Polices** node. +1. In the **Assets and Compliance** workspace, expand **Compliance Settings**, then select the **Compliance Policies** node. 1. Click **Create Compliance Policy** in the ribbon to bring up the **Create Compliance Policy Wizard**. 1. On the **General** page, select **Compliance rules for devices managed with the Configuration Manager client**. - Devices must be managed with the Configuration Manager client to include custom configuration baselines as part of compliance policy assessment. @@ -126,7 +126,7 @@ When `User1` uses `Device2`, only `Configuration Baseline 2` gets evaluated when 1. Click **OK**, then **Next** to get to the **Summary** page. 1. Verify your selections and click **Next** then **Close**. -1. In the **Compliance Polices** node, right-click on the policy you created, and select **Deploy**. +1. In the **Compliance Policies** node, right-click on the policy you created, and select **Deploy**. 1. Choose your collection, alert generation settings, and your compliance evaluation schedule for the policy. 1. Click **OK** to deploy the compliance policy. diff --git a/memdocs/configmgr/compliance/deploy-use/upgrade-windows-version.md b/memdocs/configmgr/compliance/deploy-use/upgrade-windows-version.md index 100d34eeeca..a278c47cd5e 100644 --- a/memdocs/configmgr/compliance/deploy-use/upgrade-windows-version.md +++ b/memdocs/configmgr/compliance/deploy-use/upgrade-windows-version.md @@ -102,4 +102,4 @@ If the following error appears in **DcmWmiProvider.log** on the client, check th - [Windows 10 edition upgrade](/windows/deployment/upgrade/windows-10-edition-upgrades) -- [Upgrade Windows 10 editions or switch out of S mode on devices using Microsoft Intune](/intune/edition-upgrade-configure-windows-10) +- [Upgrade Windows 10 editions or switch out of S mode on devices using Microsoft Intune](/mem/intune/configuration/edition-upgrade-configure-windows-10) diff --git a/memdocs/configmgr/core/clients/deploy/plan/client-installation-methods.md b/memdocs/configmgr/core/clients/deploy/plan/client-installation-methods.md index 2a015382e60..007f17f5d9c 100644 --- a/memdocs/configmgr/core/clients/deploy/plan/client-installation-methods.md +++ b/memdocs/configmgr/core/clients/deploy/plan/client-installation-methods.md @@ -2,7 +2,7 @@ title: Client installation methods titleSuffix: Configuration Manager description: Learn about the methods of installing the Configuration Manager client. -ms.date: 10/01/2021 +ms.date: 10/18/2024 ms.subservice: client-mgt ms.service: configuration-manager ms.topic: conceptual diff --git a/memdocs/configmgr/core/clients/manage/upgrade-readiness.md b/memdocs/configmgr/core/clients/manage/upgrade-readiness.md index 7eb9e4fa05c..73df06bf2ed 100644 --- a/memdocs/configmgr/core/clients/manage/upgrade-readiness.md +++ b/memdocs/configmgr/core/clients/manage/upgrade-readiness.md @@ -52,7 +52,7 @@ If you don't want your devices to continue sending diagnostic data: Set these values using one of the following methods: - Group policy, in **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Data Collection and Preview Builds** -- Mobile device management (MDM), such as [Microsoft Intune](/intune/device-restrictions-windows-10#reporting-and-telemetry) +- Mobile device management (MDM), such as [Microsoft Intune](/mem/intune/configuration/device-restrictions-windows-10#reporting-and-telemetry) For more information, see [Configure Windows diagnostic data in your organization](/windows/privacy/configure-windows-diagnostic-data-in-your-organization). diff --git a/memdocs/configmgr/core/get-started/2019/includes/1910/3608345.md b/memdocs/configmgr/core/get-started/2019/includes/1910/3608345.md index c9c8d39955a..726485c018b 100644 --- a/memdocs/configmgr/core/get-started/2019/includes/1910/3608345.md +++ b/memdocs/configmgr/core/get-started/2019/includes/1910/3608345.md @@ -47,11 +47,11 @@ Try to complete the tasks. Then send [Feedback](../../../../understand/product-f #### Prerequisites when the devices are co-managed - Make sure the [Compliance policies workload](../../../../../comanage/workloads.md#compliance-policies) is moved to either Pilot or Intune. -- From Intune's Windows 10 compliance policy, make sure that **Require** is set for [**Configuration Manager Compliance**](/intune/protect/compliance-policy-create-windows#configuration-manager-compliance). +- From Intune's Windows 10 compliance policy, make sure that **Require** is set for [**Configuration Manager Compliance**](/mem/intune/protect/compliance-policy-create-windows#configuration-manager-compliance). #### Create and deploy a compliance policy with a rule for baseline compliance policy assessment -1. In the **Assets and Compliance** workspace, expand **Compliance Settings**, then select the **Compliance Polices** node. +1. In the **Assets and Compliance** workspace, expand **Compliance Settings**, then select the **Compliance Policies** node. 1. Click **Create Compliance Policy** in the ribbon to bring up the **Create Compliance Policy Wizard**. 1. On the **General** page, select **Compliance rules for devices managed with the Configuration Manager client**. - Devices must be managed with the Configuration Manager client to include custom configuration baselines as part of compliance policy assessment. @@ -62,7 +62,7 @@ Try to complete the tasks. Then send [Feedback](../../../../understand/product-f 1. Click **OK**, then **Next** to get to the **Summary** page. 1. Verify your selections and click **Next** then **Close**. -1. In the **Compliance Polices** node, right-click on the policy you created, and select **Deploy**. +1. In the **Compliance Policies** node, right-click on the policy you created, and select **Deploy**. 1. Choose your collection, alert generation settings, and your compliance evaluation schedule for the policy. 1. Click **OK** to deploy the compliance policy. diff --git a/memdocs/configmgr/core/get-started/2019/includes/1911/4960084.md b/memdocs/configmgr/core/get-started/2019/includes/1911/4960084.md index 0c266983e01..a91f7004d4e 100644 --- a/memdocs/configmgr/core/get-started/2019/includes/1911/4960084.md +++ b/memdocs/configmgr/core/get-started/2019/includes/1911/4960084.md @@ -24,7 +24,7 @@ The following Microsoft management solutions are all now part of the **Microsoft - [Configuration Manager](/configmgr) - [Intune](/mem/intune/fundamentals/account-sign-up) - [Desktop Analytics](../../../../../desktop-analytics/overview.md) -- [Autopilot](/intune/enrollment/enrollment-autopilot) +- [Autopilot](/autopilot/enrollment-autopilot) - Other features in the [Device Management Admin Console](https://techcommunity.microsoft.com/t5/enterprise-mobility-security/microsoft-intune-rolls-out-an-improved-streamlined-endpoint/ba-p/937760) For more information, see the following posts from Brad Anderson, Microsoft corporate vice president for Microsoft 365: diff --git a/memdocs/configmgr/core/get-started/2019/includes/1911/5032900.md b/memdocs/configmgr/core/get-started/2019/includes/1911/5032900.md index 013110bd594..75387712f8b 100644 --- a/memdocs/configmgr/core/get-started/2019/includes/1911/5032900.md +++ b/memdocs/configmgr/core/get-started/2019/includes/1911/5032900.md @@ -56,7 +56,7 @@ When you enable Microsoft Connected Cache on your Configuration Manager distribu - This feature only supports the Intune Win32 app type. - - Create and assign (deploy) a new app in Intune for this purpose. (Apps created before Intune version 1811 don't work.) For more information, see [Intune Win32 app management](/intune/apps/apps-win32-app-management). + - Create and assign (deploy) a new app in Intune for this purpose. (Apps created before Intune version 1811 don't work.) For more information, see [Intune Win32 app management](/mem/intune/apps/apps-win32-app-management). - The app needs to be at least 100 MB in size. diff --git a/memdocs/configmgr/core/get-started/2020/includes/2001/3721603.md b/memdocs/configmgr/core/get-started/2020/includes/2001/3721603.md index f32a6bb64c2..6214a4a8f95 100644 --- a/memdocs/configmgr/core/get-started/2020/includes/2001/3721603.md +++ b/memdocs/configmgr/core/get-started/2020/includes/2001/3721603.md @@ -19,7 +19,7 @@ Save Power BI Desktop report files (.PBIX) and deploy them to the Power BI Repor - Power BI Report Server license. For more information, see [Licensing Power BI Report Server](/power-bi/report-server/get-started#licensing-power-bi-report-server). -- Download [Microsoft Power BI Report Server-September 2019](https://www.microsoft.com/download/details.aspx?id=57270). +- Download [Microsoft Power BI Report Server-September 2024](https://www.microsoft.com/download/details.aspx?id=105945). - Download [Microsoft Power BI Desktop (Optimized for Power BI Report Server - September 2019)](https://www.microsoft.com/download/details.aspx?id=58494). diff --git a/memdocs/configmgr/core/get-started/2020/includes/2010/7752243.md b/memdocs/configmgr/core/get-started/2020/includes/2010/7752243.md index 8ac75c4ca11..fae4c202b12 100644 --- a/memdocs/configmgr/core/get-started/2020/includes/2010/7752243.md +++ b/memdocs/configmgr/core/get-started/2020/includes/2010/7752243.md @@ -34,6 +34,6 @@ Try to complete the tasks. Then send [Feedback](../../technical-preview-2003.md# 1. Select **OK** to deploy the policy. > [!Tip] -> Create new policies to target Windows Server operating systems. Existing Windows Defender Application Control polices won't work with Windows Server operating systems. +> Create new policies to target Windows Server operating systems. Existing Windows Defender Application Control policies won't work with Windows Server operating systems. diff --git a/memdocs/configmgr/core/get-started/capabilities-in-technical-preview-1604.md b/memdocs/configmgr/core/get-started/capabilities-in-technical-preview-1604.md index 85dfae9bfc4..eb0ad42ba58 100644 --- a/memdocs/configmgr/core/get-started/capabilities-in-technical-preview-1604.md +++ b/memdocs/configmgr/core/get-started/capabilities-in-technical-preview-1604.md @@ -23,7 +23,7 @@ This article introduces the features that are available in the Technical Preview The following are new features you can try out with this version. ## Manage volume-purchased apps from the Windows Store for Business - The [Windows Store for Business](https://www.microsoft.com/business-store) is where you can find and purchase apps for your organization, individually or in volume. By connecting the store to Configuration Manager, you can manage volume-purchased apps from the Configuration Manager console, for example: + The Windows Store for Business is where you can find and purchase apps for your organization, individually or in volume. By connecting the store to Configuration Manager, you can manage volume-purchased apps from the Configuration Manager console, for example: - You can synchronize the list of purchased apps with Configuration Manager @@ -35,7 +35,7 @@ This article introduces the features that are available in the Technical Preview ##### Scenario 1: Set up Windows Store for Business synchronization -1. In Microsoft Entra ID, register Configuration Manager as a "Web Application and/or Web API" management tool. This will give you a client ID that you will need later. +1. In Microsoft Entra ID, register Configuration Manager as a "Web Application and/or Web API" management tool. This will give you a client ID that you'll need later. 1. In the **Active Directory** node of [https://portal.azure.com](https://portal.azure.com), select your Microsoft Entra ID, then click **Applications** > **Add**. @@ -43,7 +43,7 @@ This article introduces the features that are available in the Technical Preview 3. Enter a name for the application, select **Web application** and/or **Web API**, then click the Next arrow. - 4. Enter the same URL for both the **Sign-on URL** and **App ID URI**. The URL can be anything and does not need to resolve to a real address. For example, you can enter **https://<yourdomain\>/sccm**. + 4. Enter the same URL for both the **Sign-on URL** and **App ID URI**. The URL can be anything and doesn't need to resolve to a real address. For example, you can enter **https://<yourdomain\>/sccm**. 5. Complete the wizard. @@ -51,11 +51,11 @@ This article introduces the features that are available in the Technical Preview 1. Highlight the application you just created and click **Configure**. - 2. Under **Keys**, select a duration from the list, and click **Save**. This will create a new client key. Do not navigate away from this page until you have successfully onboarded Windows Store for Business to Configuration Manager. + 2. Under **Keys**, select a duration from the list, and click **Save**. This will create a new client key. Don't navigate away from this page until you have successfully onboarded Windows Store for Business to Configuration Manager. 3. In the Windows Store for Business, configure Configuration Manager as the store management tool. - 1. Open [https://businessstore.microsoft.com/en-us/managementtools](https://businessstore.microsoft.com/en-us/managementtools) and sign-in if prompted. + 1. Open Windows Store for Business and sign-in if prompted. 2. Accept the terms of use if required. @@ -73,9 +73,9 @@ This article introduces the features that are available in the Technical Preview 6. On the **Home** tab, in the **Create** group, click **Add Windows Store for Business Account**. -7. Add your tenant ID, client id, and client key from Microsoft Entra ID, then complete the wizard. +7. Add your tenant ID, client ID, and client key from Microsoft Entra ID, then complete the wizard. -8. Once you are done, you will see the account you configured in the **Windows Store for Business Accounts** list in the Configuration Manager console. +8. Once you're done, you'll see the account you configured in the **Windows Store for Business Accounts** list in the Configuration Manager console. ##### Scenario 2: Create and deploy a Configuration Manager application from a Windows Store for Business offline licensed app @@ -103,7 +103,7 @@ This article introduces the features that are available in the Technical Preview ## Client settings to manage Client Cache Settings and client Peer Cache Technical preview version 1604 introduces two new device client settings that affect the use of a client's cache. Both can be used individually but are configured on the same property sheet for client settings and combine to help you manage deployment of content to your clients in remote locations. -- First is **client Peer Cache**, a built-in Configuration Manager solution for clients to share content with other clients directly from their local cache. For Peer Cache clients to share content, they must be members of the same boundary group. Peer Cache does not replace the use of other solutions like BracnchCache but instead works side-by-side to give you more options to extend traditional content deployment solutions like distribution points. +- First is **client Peer Cache**, a built-in Configuration Manager solution for clients to share content with other clients directly from their local cache. For Peer Cache clients to share content, they must be members of the same boundary group. Peer Cache doesn't replace the use of other solutions like BracnchCache but instead works side-by-side to give you more options to extend traditional content deployment solutions like distribution points. After you deploy client settings that enable Peer Cache to a collection, members of that collection can act as a peer content source for other clients in its boundary group. The client that operates as a peer content source will submit a list of available content it has cached to its management point. Then, when the next client in that boundary group requests that content, the peer cache source is offered as a potential content source along with all distribution points that are configured to be fast. The client selects a random content source from this combined pool of content sources. Clients will only seek content from a distribution point that is configured to be slow when no fast distribution points or peer cache sources are present in the boundary group. @@ -116,7 +116,7 @@ To help you understand the use of client Peer Cache, you can view the **Client D - You must configure your site with a **Network Access Account** that has **Full Control** to the cache folder on each client. By default, this is **%windir%\ccmcache** -- Clients can only transfer content using Peer Cache when they are members of the same boundary group. +- Clients can only transfer content using Peer Cache when they're members of the same boundary group. #### To configure Client Peer Cache client settings @@ -142,9 +142,9 @@ To help you understand the use of client Peer Cache, you can view the **Client D ## Support for Passport for Work as a KSP Configuration Manager lets you integrate with Microsoft Passport for Work which is an alternative sign-in method that uses Active Directory, or a Microsoft Entra account to replace a password, smart card, or virtual smart card. -Passport lets you use a user gesture to login, instead of a password. A user gesture might be a simple PIN, biometric authentication such as Windows Hello, or an external device such as a fingerprint reader. +Passport lets you use a user gesture to log in, instead of a password. A user gesture might be a simple PIN, biometric authentication such as Windows Hello, or an external device such as a fingerprint reader. -- You can use Configuration Manager to control which gestures users can and cannot use to login, and to configure PIN complexity requirements. +- You can use Configuration Manager to control which gestures users can and can't use to log in, and to configure PIN complexity requirements. - You can store authentication certificates in the Passport for Work key storage provider (KSP). @@ -162,4 +162,4 @@ When a user creates a Passport PIN, Windows sends a notification which Configura To try it out, configure on-premises Health Attestation Service using client agent settings. ## SmartLock setting for Android devices - A new setting, **Allow SmartLock and other trust agents** has been added to the **Android and Samsung KNOX** configuration item that lets you control the SmartLock feature on compatible Android devices. This phone capability, sometimes known as trust agents lets you disable or bypass the device lock screen password if the device is in a trusted location such as when it is connected to a specific Bluetooth device, or when it is near to an NFC tag. You can use this setting to prevent end users from configuring SmartLock. + A new setting, **Allow SmartLock and other trust agents** has been added to the **Android and Samsung KNOX** configuration item that lets you control the SmartLock feature on compatible Android devices. This phone capability, sometimes known as trust agents lets you disable or bypass the device lock screen password if the device is in a trusted location such as when it's connected to a specific Bluetooth device, or when it's near to an NFC tag. You can use this setting to prevent end users from configuring SmartLock. diff --git a/memdocs/configmgr/core/get-started/capabilities-in-technical-preview-1605.md b/memdocs/configmgr/core/get-started/capabilities-in-technical-preview-1605.md index ae2b899814a..5288d9918e5 100644 --- a/memdocs/configmgr/core/get-started/capabilities-in-technical-preview-1605.md +++ b/memdocs/configmgr/core/get-started/capabilities-in-technical-preview-1605.md @@ -48,7 +48,7 @@ This article introduces the features that are available in the Technical Preview The Prepare ConfigMgr Client step will now completely remove the Configuration Manager client, instead of only removing key information. When the task sequence deploys the captured operating system image it will install a new Configuration Manager client each time. ## Grace period for required application deployments - In some cases, you might want give users more time to install required application deployments beyond any deadlines you configured. For example, if an end user has just returned from vacation, they might have to wait for a long while as overdue application deployments are installed. However, they can still immediately install the application at any time they want. + In some cases, you might want to give users more time to install required application deployments beyond any deadlines you configured. For example, if an end user has just returned from vacation, they might have to wait for a long while as overdue application deployments are installed. However, they can still immediately install the application at any time they want. To help solve this problem, you can now define a **grace period** by deploying Configuration Manager client settings to a collection. @@ -79,7 +79,7 @@ Common actions such as **Retire/Wipe**, **Reset Passcode**, **Remote Lock**, and - On the main page of the **Devices** node (not all columns might be visible by default). ## Windows Store for Business apps - The [Windows Store for Business](https://www.microsoft.com/business-store) is where you can find and purchase apps for your organization, individually or in volume. By connecting the store to Configuration Manager, you can manage volume-purchased apps from the Configuration Manager console, for example: + The Windows Store for Business is where you can find and purchase apps for your organization, individually or in volume. By connecting the store to Configuration Manager, you can manage volume-purchased apps from the Configuration Manager console, for example: - You can synchronize the list of purchased apps with Configuration Manager @@ -111,7 +111,7 @@ Common actions such as **Retire/Wipe**, **Reset Passcode**, **Remote Lock**, and 3. In the Windows Store for Business, configure Configuration Manager as the store management tool. - 1. Open [https://businessstore.microsoft.com](https://businessstore.microsoft.com/) and sign-in if prompted. + 1. Open Windows Store for Business and sign-in if prompted. 2. Accept the terms of use if necessary. diff --git a/memdocs/configmgr/core/get-started/capabilities-in-technical-preview-1606.md b/memdocs/configmgr/core/get-started/capabilities-in-technical-preview-1606.md index ee3fcbdb05c..95b83dddb66 100644 --- a/memdocs/configmgr/core/get-started/capabilities-in-technical-preview-1606.md +++ b/memdocs/configmgr/core/get-started/capabilities-in-technical-preview-1606.md @@ -57,7 +57,7 @@ When you associate a collection with a device category, all devices in the categ ## Enforcement grace period for required application and software update deployments -In some cases, you might want give users more time to install required application deployments or software updates beyond any deadlines you configured. This might typically be required when a computer has been turned off for an extended period of time and needs to install a large number of application or update deployments. +In some cases, you might want to give users more time to install required application deployments or software updates beyond any deadlines you configured. This might typically be required when a computer has been turned off for an extended period of time and needs to install a large number of application or update deployments. For example, if an end user has just returned from vacation, they might have to wait for a long while as overdue application deployments are installed. To help solve this problem, you can now define an enforcement grace period by deploying Configuration Manager client settings to a collection. @@ -76,7 +76,7 @@ Similar options have been added to the software updates deployment wizard, autom Device Guard is a Windows 10 feature that uses hardware and software features to strictly control what is allowed to run on the device. -For more information, see [Introduction to Device Guard](/windows/security/threat-protection/device-guard/introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control). +For more information, see [Introduction to Device Guard](/windows-server/security/security-and-assurance). In this release, Configuration Manager can interoperate with Device Guard and [Windows AppLocker](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/dd723678(v=ws.10)) so that executable and DLL files that are deployed with Configuration Manager are automatically trusted as they come from a Managed Installer, meaning that they will be allowed to run on the target device and other software will not be allowed to run unless explicitly allowed to run by other AppLocker rules. @@ -91,12 +91,12 @@ Like all AppLocker policies, policies with Managed Installer rules can run in tw For more information, see the following articles: -- [Device Guard introduction](/windows/security/threat-protection/device-guard/introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control) +- [Device Guard introduction](/windows-server/security/security-and-assurance) - [Planning and getting started on the Windows Defender Application Control deployment process](/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control-deployment-guide) ## Multiple device management points for On-premises Mobile Device Management - With Technical Preview 1606, On\-premises Mobile Device Management (MDM) supports a new capability in Windows 10 Anniversary Update that automatically configures an enrolled device to have more than one device management point available for use. This capability allows the device to fallback to another device management point when the one it normal uses is not available. This capability only works for PCs with Windows 10 Anniversary Update installed. + With Technical Preview 1606, On\-premises Mobile Device Management (MDM) supports a new capability in Windows 10 Anniversary Update that automatically configures an enrolled device to have more than one device management point available for use. This capability allows the device to fall back to another device management point when the one it normal uses is not available. This capability only works for PCs with Windows 10 Anniversary Update installed. ### Try it out! @@ -150,7 +150,7 @@ You can create a custom SSL certificate for Cloud Proxy Service in the same way #### Export the client certificate's root -The easiest way to get export the root of the client certificates used on the network, is to open a client certificate on one of the domain-joined machines that has one and copy it. +The easiest way to get export the root of the client certificates used on the network is to open a client certificate on one of the domain-joined machines that has one and copy it. >[!NOTE] >Client certificates are required on any computer you want to manage with Cloud Proxy Service and on the site system server hosting the cloud proxy connector point. If you need to add a client certificate to any of these machines, see [Deploying the Client Certificate for Windows Computers](../plan-design/network/example-deployment-of-pki-certificates.md#BKMK_clouddp2008_cm2012). @@ -257,4 +257,4 @@ With Technical Preview 1606 several changes have been introduced that apply to U - **Renamed option for pre-production:** - In the Updates and Servicing node, the button what was named **Client options** is now renamed to **Promote Pre-production Client**. \ No newline at end of file + In the Updates and Servicing node, the button what was named **Client options** is now renamed to **Promote Pre-production Client**. diff --git a/memdocs/configmgr/core/get-started/capabilities-in-technical-preview-1709.md b/memdocs/configmgr/core/get-started/capabilities-in-technical-preview-1709.md index 6811f8770a6..73875c80b30 100644 --- a/memdocs/configmgr/core/get-started/capabilities-in-technical-preview-1709.md +++ b/memdocs/configmgr/core/get-started/capabilities-in-technical-preview-1709.md @@ -106,25 +106,25 @@ The following are general prerequisites for you to enable co-management: After you enable co-management, Configuration Manager continues to manage all workloads. When you decide that you are ready, you can have Intune start managing available workloads. In this release, you can have Intune manage the following workloads. #### Compliance policies -Compliance policies define the rules and settings that a device must comply with to be considered compliant by conditional access polices. You can also use compliance policies to monitor and remediate compliance issues with devices independently of conditional access. +Compliance policies define the rules and settings that a device must comply with to be considered compliant by conditional access policies. You can also use compliance policies to monitor and remediate compliance issues with devices independently of conditional access. #### Windows Update for Business policies Windows Update for Business policies let you configure deferral policies for Windows 10 feature updates or quality updates for Windows 10 devices managed directly by Windows Update for Business. For details, see [Configure Windows Update for Business deferral policies](/sccm/sum/deploy-use/integrate-windows-update-for-business-windows-10#configure-windows-update-for-business-deferral-policies). ### Remote actions available in Intune on Azure for co-managed devices When a Windows 10 device is enabled for co-management, you have the following remote actions available to you from Intune on Azure: -- [Factory reset](/intune/devices-wipe#wipe) -- [Selective wipe](/intune/apps-selective-wipe) -- [Delete devices](/intune/devices-wipe#delete-devices-from-the-azure-active-directory-portal) -- [Restart device](/intune/device-restart) -- [Fresh start](/intune/device-fresh-start) +- [Factory reset](/mem/intune/remote-actions/devices-wipe#wipe) +- [Selective wipe](/mem/intune/apps/apps-selective-wipe) +- [Delete devices](/mem/intune/remote-actions/devices-wipe#delete-devices-from-the-azure-active-directory-portal) +- [Restart device](/mem/intune/remote-actions/device-restart) +- [Fresh start](/mem/intune/remote-actions/device-fresh-start) ### Prepare Intune for co-management Before you switch workloads from Configuration Manager to Intune, create the profiles and policies you need in Intune to ensure your devices continue to be protected. You can create objects in Intune based on the objects that you have in Configuration Manager. Or, if your current strategy is based on legacy or traditional management, you might want to take a step back to rethink what policies and profiles you need for modern management. Use the following resources to create the policies and profiles. - -- [Windows Update for Business policies](/intune/windows-update-for-business-configure) -- [Device configuration profiles](/intune/device-profile-create) + +- [Windows Update for Business policies](/mem/intune/protect/windows-update-for-business-configure) +- [Device configuration profiles](/mem/intune/configuration/device-profile-create) ### Architectural overview for co-management The following diagram provides an architectural overview of co-management and how it fits into existing Configuration and Intune infrastructures. @@ -182,16 +182,16 @@ ccmsetup.msi CCMSETUPCMD="/mp:https://contoso.cloudapp.net/CCM_Proxy_MutualA #### New Windows 10 devices For new Windows 10 devices, you can use the Autopilot service to configure the out of box experience, which includes joining the device to AD and Microsoft Entra ID, as well as enrolling the device in Intune. Then, create an app in Intune to deploy the Configuration Manager client. 1. Enable Autopilot for the new Windows 10 devices. For details, see [Overview of Windows Autopilot](/windows/deployment/windows-10-auto-pilot). -2. Configure automatic enrollment in Microsoft Entra ID for your devices to be automatically enrolled into Intune. For details, see [Enroll Windows devices for Microsoft Intune](/intune/windows-enroll). +2. Configure automatic enrollment in Microsoft Entra ID for your devices to be automatically enrolled into Intune. For details, see [Enroll Windows devices for Microsoft Intune](/mem/intune/enrollment/windows-enroll). 3. Create an app in Intune with the Configuration Manager client package and deploy the app to Windows 10 devices that you want to co-manage. Use the [command line to install Configuration Manager client](#command-line-to-install-configuration-manager-client) when you go through the steps to [install clients from the internet using Microsoft Entra ID](/sccm/core/clients/deploy/deploy-clients-cmg-azure). #### Windows 10 devices not enrolled in Intune or a Configuration Manager client For Windows 10 devices that are not enrolled in Intune or have the Configuration Manager client, you can use automatic enrollment to enroll the device in Intune. Then, create an app in Intune to deploy the Configuration Manager client. -1. Configure automatic enrollment in Microsoft Entra ID for your devices to be automatically enrolled into Intune. For details, see [Enroll Windows devices for Microsoft Intune](/intune/windows-enroll). +1. Configure automatic enrollment in Microsoft Entra ID for your devices to be automatically enrolled into Intune. For details, see [Enroll Windows devices for Microsoft Intune](/mem/intune/enrollment/windows-enroll). 2. Create an app in Intune with the Configuration Manager client package and deploy the app to Windows 10 devices that you want to co-manage. Use the [command line to install Configuration Manager client](#command-line-to-install-configuration-manager-client) when you go through the steps to [install clients from the internet using Microsoft Entra ID](/sccm/core/clients/deploy/deploy-clients-cmg-azure). #### Windows 10 devices enrolled in Intune -For Windows 10 devices that are already enrolled in Intune, create an app in Intune to deploy the Configuration Manager client. Use the [command line to install Configuration Manager client](#command-line-to-install-configuration-manager-client) when you go through the steps to [install clients from the internet using Microsoft Entra ID](/sccm/core/clients/deploy/deploy-clients-cmg-azure). +For Windows 10 devices that are already enrolled in Intune, create an app in Intune to deploy the Configuration Manager client. Use the [command line to install Configuration Manager client](#command-line-to-install-configuration-manager-client) when you go through the steps to [install clients from the internet using Microsoft Entra ID](/configmgr/core/clients/deploy/deploy-clients-cmg-azure). ### Switch Configuration Manager workloads to Intune In the previous section, you prepared Windows 10 devices for co-management. These devices are now joined to AD and Microsoft Entra ID, and they are enrolled in Intune and have the Configuration Manager client. You likely still have Windows 10 devices that are joined to AD and have the Configuration Manager client, but not joined to Microsoft Entra ID or enrolled in Intune. The following procedure provides the steps to enable co-management, prepare the rest of your Windows 10 devices (Configuration Manager clients without Intune enrollment) for co-management, and allows you to start switching specific Configuration Manager workloads to Intune. diff --git a/memdocs/configmgr/core/get-started/capabilities-in-technical-preview-1805.md b/memdocs/configmgr/core/get-started/capabilities-in-technical-preview-1805.md index 78778665cb2..5c9df06f66b 100644 --- a/memdocs/configmgr/core/get-started/capabilities-in-technical-preview-1805.md +++ b/memdocs/configmgr/core/get-started/capabilities-in-technical-preview-1805.md @@ -145,7 +145,7 @@ The following management insight rules have actions in this release: ## Transition device configuration workload to Intune using co-management -You can now transition the device configuration workload from Configuration Manager to Intune after enabling co-management. Transitioning this workload lets you use Intune to deploy MDM polices, while continuing to use Configuration Manager for deploying applications. +You can now transition the device configuration workload from Configuration Manager to Intune after enabling co-management. Transitioning this workload lets you use Intune to deploy MDM policies, while continuing to use Configuration Manager for deploying applications. To transition this workload, go to the co-management properties page and move the slider bar from Configuration Manager to **Pilot** or **All**. For more information, see [Co-management for Windows 10 devices](../../comanage/overview.md). diff --git a/memdocs/configmgr/core/get-started/capabilities-in-technical-preview-1806-2.md b/memdocs/configmgr/core/get-started/capabilities-in-technical-preview-1806-2.md index 5d9e913f319..9a0ac2034d6 100644 --- a/memdocs/configmgr/core/get-started/capabilities-in-technical-preview-1806-2.md +++ b/memdocs/configmgr/core/get-started/capabilities-in-technical-preview-1806-2.md @@ -215,7 +215,7 @@ For more information, see the following articles: - [Co-management for Windows 10 devices](../../comanage/overview.md) -- [What is Microsoft Intune app management?](/intune/app-management) +- [What is Microsoft Intune app management?](/mem/intune/apps/app-management) diff --git a/memdocs/configmgr/core/get-started/capabilities-in-technical-preview-1807.md b/memdocs/configmgr/core/get-started/capabilities-in-technical-preview-1807.md index 0b343014333..39ad1562a6d 100644 --- a/memdocs/configmgr/core/get-started/capabilities-in-technical-preview-1807.md +++ b/memdocs/configmgr/core/get-started/capabilities-in-technical-preview-1807.md @@ -118,7 +118,7 @@ Review the **OfflineServicingMgr.log** log file. ## Co-managed device sync activity from Intune -Display in the Configuration Manager console whether a co-managed device is active with Microsoft Intune. This state is based on data from the [Intune Data Warehouse](/intune/reports-nav-create-intune-reports). The **Client Status** dashboard in the Configuration Manager console shows **Inactive clients using Intune**. This new category is for co-managed devices that are inactive with Configuration Manager, but have synchronized with the Intune service in the past week. +Display in the Configuration Manager console whether a co-managed device is active with Microsoft Intune. This state is based on data from the [Intune Data Warehouse](/mem/intune/developer/reports-nav-create-intune-reports). The **Client Status** dashboard in the Configuration Manager console shows **Inactive clients using Intune**. This new category is for co-managed devices that are inactive with Configuration Manager, but have synchronized with the Intune service in the past week. ### Try it out! diff --git a/memdocs/configmgr/core/plan-design/changes/whats-new-in-version-1606.md b/memdocs/configmgr/core/plan-design/changes/whats-new-in-version-1606.md index e0252ae279b..c42b62a9600 100644 --- a/memdocs/configmgr/core/plan-design/changes/whats-new-in-version-1606.md +++ b/memdocs/configmgr/core/plan-design/changes/whats-new-in-version-1606.md @@ -47,7 +47,7 @@ The following are changes to the Updates and Servicing node in the Configuration - **Prerequisites Check** - **Installation** - Additionally, there is now more detailed information for each step, including which log file you can view for more information. + Additionally, there's now more detailed information for each step, including which log file you can view for more information. - **New option to retry prerequisite failures:** In both the **Administration** and **Monitoring** workspaces, the **Updates and Servicing** node includes a new button on the ribbon called **Ignore prerequisite warnings**. @@ -71,7 +71,7 @@ Beginning with 1606, you must give consent to use pre-release features in Config ### New distribution point update behavior Update 1606 introduces changes that improve the availability of distribution points when you install future updates. -After update 1606 is installed, when you next install an update at that site that requires the automatic reinstallation of standard and pull-distribution point site system roles, all distribution points no longer go offline to update at the same time. Instead, the site server uses the site's content distribution settings to distribute the update to a subset of distribution points at any given time. The result is that only some distribution points go offline to install the update. This allows distribution points that have not yet begun to update, or that have completed the update, to remain online and able to provide content to clients. +After update 1606 is installed, when you next install an update at that site that requires the automatic reinstallation of standard and pull-distribution point site system roles, all distribution points no longer go offline to update at the same time. Instead, the site server uses the site's content distribution settings to distribute the update to a subset of distribution points at any given time. The result is that only some distribution points go offline to install the update. This allows distribution points that haven't yet begun to update, or that have completed the update, to remain online and able to provide content to clients. @@ -94,14 +94,14 @@ You can now configure the size of the cache folder on client computers with **Cl ### Support for multiple device management points -On-premises mobile device management (MDM) now supports a new capability in Windows 10 Anniversary Update that automatically configures an enrolled device to have more than one device management point available for use. This capability allows the device to fall back to another device management point, when the one it normally uses is not available. This capability only works for PCs and devices with the Windows 10 Anniversary Update installed. +On-premises mobile device management (MDM) now supports a new capability in Windows 10 Anniversary Update that automatically configures an enrolled device to have more than one device management point available for use. This capability allows the device to fall back to another device management point, when the one it normally uses isn't available. This capability only works for PCs and devices with the Windows 10 Anniversary Update installed. ## Application management ### Manage apps from the Windows Store for Business -The [Windows Store for Business](https://businessstore.microsoft.com/store/private-store) is where you can find and purchase Windows apps for your organization, either individually or in volume. By connecting the store to Configuration Manager, you can synchronize the list of apps you've purchased with Configuration Manager, view these in the Configuration Manager console, and deploy them like you would any other app. +The Windows Store for Business is where you can find and purchase Windows apps for your organization, either individually or in volume. By connecting the store to Configuration Manager, you can synchronize the list of apps you've purchased with Configuration Manager, view these in the Configuration Manager console, and deploy them like you would any other app. For details, see [Manage apps from the Windows Store for Business with Configuration Manager](../../../apps/deploy-use/manage-apps-from-the-windows-store-for-business.md). @@ -118,7 +118,7 @@ The Software Center user interface has been streamlined for easier discovery. * Multiple updates can now be selected for installation at once, or all updates can be installed at once by clicking **Install All**. ### Content status links -On the properties of an application or package, there is now a link that takes you to the status for that object. +On the properties of an application or package, there's now a link that takes you to the status for that object. ## Software updates @@ -133,7 +133,7 @@ You can now enable an option that lets Configuration Manager clients switch to a For details, see [Plan for software updates in Configuration Manager](../../../sum/plan-design/plan-for-software-updates.md#BKMK_ManuallySwitchSUPs). ### Restart options for Windows 10 clients after software update installation -When a software update that requires a restart is deployed by using Configuration Manager and is installed on a computer, a pending restart is scheduled. A restart dialog box is also displayed. Beginning in Configuration Manager version 1606, the options **Update and Restart** and **Update and Shutdown** are available whenever there is a pending restart for a Configuration Manager software update. These are available in the Windows power options of Windows 10 computers. After using one of these options, the restart dialog box will not display after the computer restarts. +When a software update that requires a restart is deployed by using Configuration Manager and is installed on a computer, a pending restart is scheduled. A restart dialog box is also displayed. Beginning in Configuration Manager version 1606, the options **Update and Restart** and **Update and Shutdown** are available whenever there's a pending restart for a Configuration Manager software update. These are available in the Windows power options of Windows 10 computers. After using one of these options, the restart dialog box won't display after the computer restarts. For details, see [Plan for software updates](../../../sum/plan-design/plan-for-software-updates.md#BKMK_RestartOptions). @@ -153,7 +153,7 @@ The OSDPreserveDriveLetter task sequence variable has been deprecated. Starting For details, see [Task sequence built-in variables](../../../osd/understand/task-sequence-variables.md). ### Customize the RamDisk TFTP window size for PXE-enabled distribution points -You can now customize the RamDisk window size for PXE-enabled distribution points. If you have customized your network, it could cause the boot image download to fail with a time-out error, because the window size is too large. The RamDisk Trivial File Transfer Protocol (TFTP) window size customization lets you optimize TFTP traffic when you are using PXE to meet your specific network requirements. +You can now customize the RamDisk window size for PXE-enabled distribution points. If you have customized your network, it could cause the boot image download to fail with a time-out error, because the window size is too large. The RamDisk Trivial File Transfer Protocol (TFTP) window size customization lets you optimize TFTP traffic when you're using PXE to meet your specific network requirements. For details, see [Prepare site system roles for operating system deployments with Configuration Manager](../../../osd/get-started/prepare-site-system-roles-for-operating-system-deployments.md#customize-the-ramdisk-tftp-block-and-window-sizes-on-pxe-enabled-distribution-points). @@ -162,7 +162,7 @@ For details, see [Prepare site system roles for operating system deployments wit ### Smart Lock setting for Android devices A new setting, **Allow Smart Lock and other trust agents**, has been added to the Android and Samsung KNOX Standard configuration item. -This setting lets you control the Smart Lock feature on compatible Android devices. This phone capability, sometimes known as "trust agents," lets you disable or bypass the device lock screen password if the device is in a trusted location. For example, a trusted location could be when it is connected to a specific Bluetooth device, or when it is near to an NFC tag. You can use this setting to prevent users from configuring Smart Lock. +This setting lets you control the Smart Lock feature on compatible Android devices. This phone capability, sometimes known as "trust agents," lets you disable or bypass the device lock screen password if the device is in a trusted location. For example, a trusted location could be when it's connected to a specific Bluetooth device, or when it's near to an NFC tag. You can use this setting to prevent users from configuring Smart Lock. ## Device configuration and protection @@ -197,7 +197,7 @@ Endpoint Protection can help manage and monitor Microsoft Defender for Endpoint. For details, see [Microsoft Defender for Endpoint](../../../protect/deploy-use/defender-advanced-threat-protection.md). ### Device categories -You can create device categories, which can be used to place devices in device collections automatically when you are using Configuration Manager with Microsoft Intune. Users are then required to choose a device category when they enroll a device in Intune. Additionally, you can change the category of a device from the Configuration Manager console. +You can create device categories, which can be used to place devices in device collections automatically when you're using Configuration Manager with Microsoft Intune. Users are then required to choose a device category when they enroll a device in Intune. Additionally, you can change the category of a device from the Configuration Manager console. ### Predeclare devices with IMEI or iOS serial numbers @@ -210,4 +210,4 @@ You can now enable Health Attestation services monitoring for Windows 10 PCs by For details, see [Health attestation for Configuration Manager](../../../core/servers/manage/health-attestation.md#how-to-enable-health-attestation-service-communication-on-configuration-manager-client-computers). ## Remote control -Allow your users the opportunity to accept or deny file transfers before transferring content from the shared clipboard in a remote control session. Users only need to grant permission once per session, and the viewer does not have the ability to give themselves permission to proceed with the file transfer. You can find this new setting in the **Administration** workspace. Go to **Client Settings**, and then in **Default Settings**, open the **Remote Tools** panel. +Allow your users the opportunity to accept or deny file transfers before transferring content from the shared clipboard in a remote control session. Users only need to grant permission once per session, and the viewer doesn't have the ability to give themselves permission to proceed with the file transfer. You can find this new setting in the **Administration** workspace. Go to **Client Settings**, and then in **Default Settings**, open the **Remote Tools** panel. diff --git a/memdocs/configmgr/core/plan-design/changes/whats-new-in-version-1910.md b/memdocs/configmgr/core/plan-design/changes/whats-new-in-version-1910.md index a19c65d8522..8428390d250 100644 --- a/memdocs/configmgr/core/plan-design/changes/whats-new-in-version-1910.md +++ b/memdocs/configmgr/core/plan-design/changes/whats-new-in-version-1910.md @@ -40,7 +40,7 @@ The following Microsoft management solutions are all now part of the Microsoft I - [Configuration Manager](/configmgr) - [Intune](/mem/intune/fundamentals/account-sign-up) - [Desktop Analytics](../../../desktop-analytics/overview.md) -- [Autopilot](/intune/enrollment/enrollment-autopilot) +- [Autopilot](/autopilot/enrollment-autopilot) - Other features in the [Device Management Admin Console](https://techcommunity.microsoft.com/t5/enterprise-mobility-security/microsoft-intune-rolls-out-an-improved-streamlined-endpoint/ba-p/937760) For more information, see the following posts from Brad Anderson, Microsoft corporate vice president for Microsoft 365: diff --git a/memdocs/configmgr/core/plan-design/choose-a-device-management-solution.md b/memdocs/configmgr/core/plan-design/choose-a-device-management-solution.md index 5f50d50ec63..60b10385a09 100644 --- a/memdocs/configmgr/core/plan-design/choose-a-device-management-solution.md +++ b/memdocs/configmgr/core/plan-design/choose-a-device-management-solution.md @@ -106,9 +106,9 @@ For more information, see [Manage mobile devices with Configuration Manager and For a complete list of supported platforms, see the following articles: - [Supported operating systems for clients and devices for Configuration Manager](configs/supported-operating-systems-for-clients-and-devices.md) -- [Intune supported configurations](/intune/supported-devices-browsers) +- [Intune supported configurations](/mem/intune/fundamentals/supported-devices-browsers) -Microsoft recommends using Intune to manage Android, iOS, and Windows 10/11 mobile devices. For more information, see [What is Microsoft Intune?](/intune/what-is-intune). +Microsoft recommends using Intune to manage Android, iOS, and Windows 10/11 mobile devices. For more information, see [What is Microsoft Intune?](/mem/intune/fundamentals/what-is-intune). ### Compare solutions by management functionality diff --git a/memdocs/configmgr/core/plan-design/diagnostics/frequently-asked-questions.yml b/memdocs/configmgr/core/plan-design/diagnostics/frequently-asked-questions.yml index a4855b2ec26..5a07e36c4c3 100644 --- a/memdocs/configmgr/core/plan-design/diagnostics/frequently-asked-questions.yml +++ b/memdocs/configmgr/core/plan-design/diagnostics/frequently-asked-questions.yml @@ -80,7 +80,7 @@ sections: - [Tenant attach data collection](../../../tenant-attach/data-collection.md) - [Endpoint analytics data collection](../../../../analytics/data-collection.md) - - [Privacy and personal data in Intune](/intune/protect/privacy-personal-data) + - [Privacy and personal data in Intune](/mem/intune/protect/privacy-personal-data) - [Windows Autopilot requirements](/windows/deployment/windows-autopilot/windows-autopilot-requirements) - question: | diff --git a/memdocs/configmgr/core/plan-design/hierarchy/accounts.md b/memdocs/configmgr/core/plan-design/hierarchy/accounts.md index bd3e33d9388..f04f3119a8e 100644 --- a/memdocs/configmgr/core/plan-design/hierarchy/accounts.md +++ b/memdocs/configmgr/core/plan-design/hierarchy/accounts.md @@ -364,12 +364,12 @@ The site server uses the **Exchange Server connection account** to connect to th ### Management point connection account -The management point uses the **Management point connection account** to connect to the Configuration Manager site database. It uses this connection to send and retrieve information for clients. The management point uses its computer account by default, but you can configure an alternate account instead. When the management point is in an untrusted domain from the site server, you must specify a alternate user account. +The management point uses the **Management point connection account** to connect to the Configuration Manager site database. It uses this connection to send and retrieve information for clients. The management point uses its computer account by default, but you can configure an alternate service account instead. When the management point is in an untrusted domain from the site server, you must specify a alternate service account. > [!NOTE] - > For enhanced security posture it is recommended to leverage alternate account rather than Computer account for ‘Management point connection account’. + > For enhanced security posture it is recommended to leverage alternate service account rather than Computer account for ‘Management point connection account’. -Create the account as a low-right local account on the computer that runs Microsoft SQL Server. +Create the account as a low-right service account on the computer that runs Microsoft SQL Server. > [!IMPORTANT] > - Don't grant interactive sign-in rights to this account. @@ -377,12 +377,15 @@ Create the account as a low-right local account on the computer that runs Micros ### Multicast connection account -Multicast-enabled distribution points use the **Multicast connection account** to read information from the site database. The server uses its computer account by default, but you can configure a user account instead. When the site database is in an untrusted forest, you must specify a user account. For example, if your data center has a perimeter network in a forest other than the site server and site database, use this account to read the multicast information from the site database. +Multicast-enabled distribution points use the **Multicast connection account** to read information from the site database. The server uses its computer account by default, but you can configure a service account instead. When the site database is in an untrusted forest, you must specify a service account. For example, if your data center has a perimeter network in a forest other than the site server and site database, use this account to read the multicast information from the site database. -If you need this account, create it as a low-right local account on the computer that runs Microsoft SQL Server. +If you need this account, create it as a low-right service account on the computer that runs Microsoft SQL Server. + +> [!NOTE] + > For enhanced security posture it is recommended to leverage service account rather than Computer account for ‘Multicast connection account’. > [!IMPORTANT] -> Don't grant interactive sign-in rights to this account. +> Don't grant interactive sign-in rights to this service account. For more information, see [Use multicast to deploy Windows over the network](../../../osd/deploy-use/use-multicast-to-deploy-windows-over-the-network.md). @@ -526,7 +529,7 @@ This account requires local administrative permissions on the target site system > [!TIP] > If you have many domain controllers and these accounts are used across domains, before you set up the site system, check that Active Directory has replicated these accounts. > -> When you specify a local account on each site system to be managed, this configuration is more secure than using domain accounts. It limits the damage that attackers can do if the account is compromised. However, domain accounts are easier to manage. Consider the trade-off between security and effective administration. +> When you specify a service account on each site system to be managed, this configuration is more secure. It limits the damage that attackers can do. However, domain accounts are easier to manage. Consider the trade-off between security and effective administration. ### Site system proxy server account diff --git a/memdocs/configmgr/core/plan-design/network/internet-endpoints.md b/memdocs/configmgr/core/plan-design/network/internet-endpoints.md index b4a491ea843..18c020c93f2 100644 --- a/memdocs/configmgr/core/plan-design/network/internet-endpoints.md +++ b/memdocs/configmgr/core/plan-design/network/internet-endpoints.md @@ -102,11 +102,11 @@ For more information, see [Configure Azure services for use with Configuration M ## Co-management -If you enroll Windows devices to Microsoft Intune for co-management, make sure those devices can access the endpoints required by Intune. For more information, see [Network endpoints for Microsoft Intune](/intune/intune-endpoints). +If you enroll Windows devices to Microsoft Intune for co-management, make sure those devices can access the endpoints required by Intune. For more information, see [Network endpoints for Microsoft Intune](/mem/intune/fundamentals/intune-endpoints). ## Microsoft Store for Business -If you integrate Configuration Manager with the [Microsoft Store for Business](../../../apps/deploy-use/manage-apps-from-the-windows-store-for-business.md), make sure the service connection point and targeted devices can access the cloud service. For more information, see [Microsoft Store for Business proxy configuration](/microsoft-store/prerequisites-microsoft-store-for-business#proxy-configuration). +If you integrate Configuration Manager with the [Microsoft Store for Business](../../../apps/deploy-use/manage-apps-from-the-windows-store-for-business.md), make sure the service connection point and targeted devices can access the cloud service. For more information, see [Microsoft Store for Business proxy configuration](/mem/intune/fundamentals/intune-endpoints). ## Delivery optimization diff --git a/memdocs/configmgr/core/plan-design/security/cryptographic-controls-technical-reference.md b/memdocs/configmgr/core/plan-design/security/cryptographic-controls-technical-reference.md index 7e3795176a8..d83e1824406 100644 --- a/memdocs/configmgr/core/plan-design/security/cryptographic-controls-technical-reference.md +++ b/memdocs/configmgr/core/plan-design/security/cryptographic-controls-technical-reference.md @@ -2,12 +2,12 @@ title: Cryptographic controls technical reference titleSuffix: Configuration Manager description: Learn how signing and encryption can help protect attacks from reading data in Configuration Manager. -ms.date: 12/01/2021 +ms.date: 10/15/2024 ms.subservice: core-infra ms.service: configuration-manager ms.topic: reference -author: Banreet -ms.author: banreetkaur +author: Baladelli +ms.author: baladell manager: apoorvseth ms.localizationpriority: medium ms.collection: tier3 @@ -28,14 +28,13 @@ Starting in version 2107, the primary encryption algorithm that Configuration Ma - When the client downloads secret policies, the management point always encrypts these policies. For example, an OS deployment task sequence that includes passwords. -For clients on version 2103 and earlier, the primary encryption algorithm is **3DES**. > [!NOTE] -> If you configure HTTPS communication, these messages are encrypted twice. The message is encrypted with AES, then the HTTPS transport is encrypted with AES. +> If you configure HTTPS communication, these messages are encrypted twice. The message is encrypted with AES, then the HTTPS transport is encrypted with AES-256. When you use client communication over HTTPS, configure your public key infrastructure (PKI) to use certificates with the maximum hashing algorithms and key lengths. When using CNG v3 certificates, Configuration Manager clients only support certificates that use the RSA cryptographic algorithm. For more information, see [PKI certificate requirements](../network/pki-certificate-requirements.md) and [CNG v3 certificates overview](../network/cng-certificates-overview.md). -For transport security, anything that uses TLS supports AES. This support includes when you configure the site for [enhanced HTTP](../hierarchy/enhanced-http.md) or HTTPS. For on-premises site systems, you can control the TLS cipher suites. For cloud-based roles like the cloud management gateway (CMG), if you enable TLS 1.2, Configuration Manager configures the cipher suites. +For transport security, anything that uses TLS supports AES-256. This support includes when you configure the site for [enhanced HTTP (E-HTTP)](../hierarchy/enhanced-http.md) or HTTPS. For on-premises site systems, you can control the TLS cipher suites. For cloud-based roles like the cloud management gateway (CMG), if you enable TLS 1.2, Configuration Manager configures the cipher suites. For most cryptographic operations with Windows-based operating systems, Configuration Manager uses these algorithms from the Windows CryptoAPI library rsaenh.dll. @@ -49,7 +48,7 @@ Information in Configuration Manager can be signed and encrypted. It supports th The site signs client policy assignments with its self-signed certificate. This behavior helps prevent the security risk of a compromised management point from sending tampered policies. If you use [internet-based client management](../../clients/manage/plan-internet-based-client-management.md), this behavior is important because it requires an internet-facing management point. -When policy contains sensitive data, starting in version 2107, the management point encrypts it with AES-256. In version 2103 and earlier, it uses 3DES. Policy that contains sensitive data is only sent to authorized clients. The site doesn't encrypt policy that doesn't have sensitive data. +When policy contains sensitive data, starting in version 2107, the management point encrypts it with AES-256. Policy that contains sensitive data is only sent to authorized clients. The site doesn't encrypt policy that doesn't have sensitive data. When a client stores policy, it encrypts the policy using the Windows data protection application programming interface (DPAPI). @@ -69,21 +68,19 @@ Not all devices can support content hashing. The exceptions include: - Windows clients when they stream App-V content. -- Windows Mobile clients, though these clients verify the signature of an application that's signed by a trusted source. - ### Inventory signing and encryption -When a client sends hardware or software inventory to a management point, it always signs the inventory. It doesn't matter if the client communicates with the management point over HTTP or HTTPS. If they use HTTP, you can also choose to encrypt this data, which is recommended. +When a client sends hardware or software inventory to a management point, it always signs the inventory. It doesn't matter if the client communicates with the management point over E-HTTP or HTTPS. If they use E-HTTP, you can also choose to encrypt this data, which is recommended. ### State migration encryption -When a task sequence captures data from a client for OS deployment, it always encrypts the data. In version 2103 and later, the task sequence runs the User State Migration Tool (USMT) with the **AES-256** encryption algorithm. In version 2010 and earlier, it uses **3DES**. +When a task sequence captures data from a client for OS deployment, it always encrypts the data. In version 2103 and later, the task sequence runs the User State Migration Tool (USMT) with the **AES-256** encryption algorithm. ### Encryption for multicast packages -For every OS deployment package, you can enable encryption when you use multicast. This encryption uses the **AES** algorithm. If you enable encryption, no other certificate configuration is required. The multicast-enabled distribution point automatically generates symmetric keys to encrypt the package. Each package has a different encryption key. The key is stored on the multicast-enabled distribution point by using standard Windows APIs. +For every OS deployment package, you can enable encryption when you use multicast. This encryption uses the **AES-256** algorithm. If you enable encryption, no other certificate configuration is required. The multicast-enabled distribution point automatically generates symmetric keys to encrypt the package. Each package has a different encryption key. The key is stored on the multicast-enabled distribution point by using standard Windows APIs. -When the client connects to the multicast session, the key exchange occurs over an encrypted channel. If the client uses HTTPS, it uses the PKI-issued client authentication certificate. If the client uses HTTP, it uses the self-signed certificate. The client only stores the encryption key in memory during the multicast session. +When the client connects to the multicast session, the key exchange occurs over an encrypted channel. If the client uses HTTPS, it uses the PKI-issued client authentication certificate. If the client uses E-HTTP, it uses the self-signed certificate. The client only stores the encryption key in memory during the multicast session. ### Encryption for OS deployment media @@ -105,7 +102,7 @@ When you import configuration data, Configuration Manager verifies the file's di ### Encryption and hashing for client notification -If you use client notification, all communication uses TLS and the highest algorithms that the server and client can negotiate. For example, all supported Windows OS versions can use at least **AES-128** encryption. The same negotiation occurs for hashing the packets that are transferred during client notification, which uses **SHA-2**. +If you use client notification, all communication uses TLS and the highest algorithms that the server and client can negotiate. The same negotiation occurs for hashing the packets that are transferred during client notification, which uses **SHA-2**. ## Certificates @@ -120,21 +117,15 @@ Configuration Manager requires PKI certificates for the following scenarios: - When you manage Configuration Manager clients on the internet -- When you manage Configuration Manager clients on mobile devices - -- When you manage macOS computers - - When you use a cloud management gateway (CMG) For most other communication that requires certificates for authentication, signing, or encryption, Configuration Manager automatically uses PKI certificates if available. If they aren't available, Configuration Manager generates self-signed certificates. -Configuration Manager doesn't use PKI certificates when it manages mobile devices by using the Exchange Server connector. ### Mobile device management and PKI certificates -If the mobile device isn't locked by the mobile operator, you can use Configuration Manager to request and install a client certificate. This certificate provides mutual authentication between the client on the mobile device and Configuration Manager site systems. If the mobile device is locked, you can't use Configuration Manager to deploy certificates. - -If you enable hardware inventory for mobile devices, Configuration Manager also inventories the certificates that are installed on the mobile device. +> [!NOTE] +> Since Nov 2021 we have deprecated Mobile device management and we recommend customers to uninstall this role. ### OS deployment and PKI certificates @@ -150,7 +141,7 @@ After Configuration Manager deploys the OS installs the client, the client requi ### ISV proxy solutions and PKI certificates -Independent Software Vendors (ISVs) can create applications that extend Configuration Manager. For example, an ISV could create extensions to support non-Windows client platforms such as macOS. However, if the site systems require HTTPS client connections, these clients must also use PKI certificates for communication with the site. Configuration Manager includes the ability to assign a certificate to the ISV proxy that enables communications between the ISV proxy clients and the management point. If you use extensions that require ISV proxy certificates, consult the documentation for that product. +Independent Software Vendors (ISVs) can create applications that extend Configuration Manager. For example, an ISV could create extensions to support non-Windows client platforms. However, if the site systems require HTTPS client connections, these clients must also use PKI certificates for communication with the site. Configuration Manager includes the ability to assign a certificate to the ISV proxy that enables communications between the ISV proxy clients and the management point. If you use extensions that require ISV proxy certificates, consult the documentation for that product. If the ISV certificate is compromised, block the certificate in the **Certificates** node in the **Administration** workspace, **Security** node. @@ -174,9 +165,10 @@ This action copies this certificate's GUID, for example: `aa05bf38-5cd6-43ea-ac6 ### Asset Intelligence and certificates -Configuration Manager installs with an X.509 certificate that the Asset Intelligence synchronization point uses to connect to Microsoft. Configuration Manager uses this certificate to request a client authentication certificate from the Microsoft certificate service. The client authentication certificate is installed on the Asset Intelligence synchronization point and it's used to authenticate the server to Microsoft. Configuration Manager uses the client authentication certificate to download the Asset Intelligence catalog and to upload software titles. +> [!NOTE] + +> Since Nov 2021 we have deprecated Asset Intelligence and we recommend customers to uninstall this role. -This certificate has a key length of 1024 bits. ### Azure services and certificates @@ -192,14 +184,12 @@ A PKI certificate revocation list (CRL) increases overall security, but does req IIS enables CRL checking by default. If you use a CRL with your PKI deployment, you don't need to configure most site systems that run IIS. The exception is for software updates, which requires a manual step to enable CRL checking to verify the signatures on software update files. -When a client uses HTTPS, it enables CRL checking by default. For macOS clients, you can't disable CRL checking. +When a client uses HTTPS, it enables CRL checking by default. The following connections don't support CRL checking in Configuration Manager: - Server-to-server connections -- Mobile devices that are enrolled by Configuration Manager. - ## Server communication Configuration Manager uses the following cryptographic controls for server communication. @@ -214,12 +204,8 @@ In addition to this certificate for each site system server, Configuration Manag - Asset Intelligence synchronization point -- Certificate registration point - - Endpoint Protection point -- Enrollment point - - Fallback status point - Management point @@ -234,7 +220,7 @@ In addition to this certificate for each site system server, Configuration Manag Configuration Manager automatically generates and manages these certificates. -To send status messages from the distribution point to the management point, Configuration Manager uses a client authentication certificate. When you configure the management point for HTTPS, it requires a PKI certificate. If the management point accepts HTTP connections, you can use a PKI certificate. It can also use a self-signed certificate with client authentication capability, uses SHA-256, and has a key length of 2048 bits. +To send status messages from the distribution point to the management point, Configuration Manager uses a client authentication certificate. When you configure the management point for HTTPS, it requires a PKI certificate. If the management point accepts E-HTTP connections, you can use a PKI certificate. It can also use a self-signed certificate with client authentication capability, uses SHA-256, and has a key length of 2048 bits. ### Server communication between sites @@ -277,17 +263,17 @@ When clients communicate with site systems over HTTPS, most traffic is encrypted You configure reporting services points to use HTTP or HTTPS independently from the client communication mode. -## Clients that use HTTP +## Clients that use E-HTTP -When clients use HTTP communication to site system roles, they can use PKI certificates for client authentication, or self-signed certificates that Configuration Manager generates. When Configuration Manager generates self-signed certificates, they have a custom object identifier for signing and encryption. These certificates are used to uniquely identify the client. These self-signed certificates use **SHA-256**, and have a key length of 2048 bits. +When clients use E-HTTP communication to site system roles, they can use PKI certificates for client authentication, or self-signed certificates that Configuration Manager generates. When Configuration Manager generates self-signed certificates, they have a custom object identifier for signing and encryption. These certificates are used to uniquely identify the client. These self-signed certificates use **SHA-256**, and have a key length of 2048 bits. ### OS deployment and self-signed certificates -When you use Configuration Manager to deploy operating systems with self-signed certificates, the client must also have a certificate to communicate with the management point. This requirement is even if the computer is in a transitional phase such as booting from task sequence media or a PXE-enabled distribution point. To support this scenario for HTTP client connections, Configuration Manager generates self-signed certificates that have a custom object identifier for signing and encryption. These certificates are used to uniquely identify the client. These self-signed certificates use **SHA-256**, and have a key length of 2048 bits. If these self-signed certificates are compromised, prevent attackers from using them to impersonate trusted clients. Block the certificates in the **Certificates** node in the **Administration** workspace, **Security** node. +When you use Configuration Manager to deploy operating systems with self-signed certificates, the client must also have a certificate to communicate with the management point. This requirement is even if the computer is in a transitional phase such as booting from task sequence media or a PXE-enabled distribution point. To support this scenario for E-HTTP client connections, Configuration Manager generates self-signed certificates that have a custom object identifier for signing and encryption. These certificates are used to uniquely identify the client. These self-signed certificates use **SHA-256**, and have a key length of 2048 bits. If these self-signed certificates are compromised, prevent attackers from using them to impersonate trusted clients. Block the certificates in the **Certificates** node in the **Administration** workspace, **Security** node. ### Client and server authentication -When clients connect over HTTP, they authenticate the management points by using either Active Directory Domain Services or by using the Configuration Manager trusted root key. Clients don't authenticate other site system roles, such as state migration points or software update points. +When clients connect over E-HTTP, they authenticate the management points by using either Active Directory Domain Services or by using the Configuration Manager trusted root key. Clients don't authenticate other site system roles, such as state migration points or software update points. When a management point first authenticates a client by using the self-signed client certificate, this mechanism provides minimal security because any computer can generate a self-signed certificate. Use client approval to enhance this process. Only approve trusted computers, either automatically by Configuration Manager, or manually by an administrative user. For more information, see [Manage clients](../../clients/manage/manage-clients.md#approve). diff --git a/memdocs/configmgr/core/plan-design/security/enable-tls-1-2-client.md b/memdocs/configmgr/core/plan-design/security/enable-tls-1-2-client.md index 5499e152180..5c94bf4e342 100644 --- a/memdocs/configmgr/core/plan-design/security/enable-tls-1-2-client.md +++ b/memdocs/configmgr/core/plan-design/security/enable-tls-1-2-client.md @@ -2,7 +2,7 @@ title: How to enable Transport Layer Security (TLS) 1.2 on clients titleSuffix: Configuration Manager description: Information about how to enable TLS 1.2 for Configuration Manager clients. -ms.date: 05/04/2021 +ms.date: 10/18/2024 ms.subservice: core-infra ms.service: configuration-manager ms.topic: how-to diff --git a/memdocs/configmgr/core/plan-design/security/enable-tls-1-2.md b/memdocs/configmgr/core/plan-design/security/enable-tls-1-2.md index 85aba618035..5ed1658d4b4 100644 --- a/memdocs/configmgr/core/plan-design/security/enable-tls-1-2.md +++ b/memdocs/configmgr/core/plan-design/security/enable-tls-1-2.md @@ -2,7 +2,7 @@ title: Enable Transport Layer Security (TLS) 1.2 overview titleSuffix: Configuration Manager description: Overview of how to enable TLS 1.2 for Configuration Manager. -ms.date: 05/04/2021 +ms.date: 10/18/2024 ms.subservice: core-infra ms.service: configuration-manager ms.topic: conceptual diff --git a/memdocs/configmgr/core/servers/deploy/install/install-consoles.md b/memdocs/configmgr/core/servers/deploy/install/install-consoles.md index 70bf3d9455a..5dbdbf22f68 100644 --- a/memdocs/configmgr/core/servers/deploy/install/install-consoles.md +++ b/memdocs/configmgr/core/servers/deploy/install/install-consoles.md @@ -2,7 +2,7 @@ title: Install console titleSuffix: Configuration Manager description: Install the Configuration Manager console to connect to a central administration site or primary site. -ms.date: 04/12/2022 +ms.date: 10/18/2022 ms.subservice: core-infra ms.service: configuration-manager ms.topic: how-to diff --git a/memdocs/configmgr/core/servers/deploy/install/release-notes.md b/memdocs/configmgr/core/servers/deploy/install/release-notes.md index 6e5a751829a..b368139d173 100644 --- a/memdocs/configmgr/core/servers/deploy/install/release-notes.md +++ b/memdocs/configmgr/core/servers/deploy/install/release-notes.md @@ -2,7 +2,7 @@ title: Release notes titleSuffix: Configuration Manager description: Learn about urgent issues that aren't yet fixed in the product or covered in a Microsoft Support knowledge base article. -ms.date: 03/28/2024 +ms.date: 10/04/2024 ms.subservice: core-infra ms.service: configuration-manager ms.topic: conceptual @@ -39,7 +39,22 @@ For information about the new features introduced with different versions, see t - +## Client management + +### Clients are not able download content from CMG when branch cache is enabled +_Applies to: version 2403_ + +After enabling Branch Cache on primary sites, clients are unable to download apps and packages from the CMG. They typically manage to download only 20-30% of the content before the process gets stuck. In some cases, after downloading certain blocks of packages from the CMG, clients look for Branch Cache to retrieve the remaining content. However, none of the clients are able to download the complete content from the CMG, which prevents others from using Branch Cache to access it. The **CTM.log** on the client includes entries similar to the following: + +```log +(CTM.log - CTMJob({63B4C4CE-2DC4-4062-93C7-E5019B3B6CE1}): CCTMJob::Start - State=DownloadingContentFromPeers) +CTM.log _- CTMJob({D21758B0-D895-474E-9695-1023A25A1770}): CCTMJob::_PerformDownloadWithOutBranchCache - Download failure using branchcache, fallback to regular download +``` +To work around this issue, disable branch cache. + +> [!NOTE] +> Clients are able to download content from the on-premise DP when Branch Cache is enabled. + ## Endpoint Protection ### Security configurations removed from Intune @@ -78,7 +93,18 @@ This failure happens because the service connection point can't communicate with For more information, see [internet access requirements](../../../plan-design/network/internet-endpoints.md#service-connection-point) for the service connection point. - +## OS deployment + +### PXE Responder is not installed correctly after upgrading to 2403 in untrusted domain +_Applies to: version 2403_ + +After upgrading to 2403, site servers serving as a PXE responder might see failures due to incorrect configuration of the registry keys. We can observe the below failures in **distmgr.log** indicating that the registry keys were not configured correctly. + +```log +Failed to get OS platform for server DP2.CONTOSO2.COM.Either a permissions issue or the server is not supported OS SMS_DISTRIBUTION_MANAGER +CDistributionManager::SetDpRegistry failed; 0x80070005 SMS_DISTRIBUTION_MANAGER +``` +This happened due to currently unexplained failures in platform architecture identification that were introduced during the addition of support for arm64 machines to serve as remote distribution points. ## Software updates diff --git a/memdocs/configmgr/core/servers/manage/configuring-reporting.md b/memdocs/configmgr/core/servers/manage/configuring-reporting.md index abb8f3ce477..92fe0a54e8a 100644 --- a/memdocs/configmgr/core/servers/manage/configuring-reporting.md +++ b/memdocs/configmgr/core/servers/manage/configuring-reporting.md @@ -92,6 +92,8 @@ Before you can view or manage reports in the Configuration Manager console, you If you need to change the report server URL, first remove the existing reporting services point. Change the URL, and then reinstall the reporting services point. - When you install a reporting services point, specify a [Reporting services point account](../../plan-design/hierarchy/accounts.md#reporting-services-point-account). For users from a different domain to run a report, create a two-way trust between domains. Otherwise the report fails to run. + +- The account that runs Reporting Services service must belong to the domain local security group **Windows Authorization Access Group**. This grants the account **Allow Read** permissions on the **tokenGroupsGlobalAndUniversal** attribute for all user objects within the domain. Users in a different domain than the reporting services point account need a two-way trust between the domains to successfully run reports. ### Install the reporting services point on a site system @@ -125,11 +127,7 @@ For more information about configuring site systems, see [Install site system ro > [!IMPORTANT] > Configuration Manager makes a connection in the context of the current user to WMI on the selected site system. It uses this connection to retrieve the instance of SQL Server for Reporting Services. The current user must have **Read** access to WMI on the site system, or the wizard can't get the Reporting Services instances. - - **Reporting services point account**: Select **Set**, and then select an account to use. SQL Server Reporting Services on the reporting services point uses this account to connect to the Configuration Manager site database. This connection is to retrieve the data for a report. Select **Existing account** to specify a Windows user account that you previously configured as a Configuration Manager account. Select **New account** to specify a Windows user account that's not currently configured for use. Configuration Manager automatically grants the specified user access to the site database. - - The account that runs Reporting Services must belong to the domain local security group **Windows Authorization Access Group**. This grants the account **Allow Read** permissions on the **tokenGroupsGlobalAndUniversal** attribute for all user objects within the domain. Users in a different domain than the reporting services point account need a two-way trust between the domains to successfully run reports. - - The specified Windows user account and password are encrypted and stored in the Reporting Services database. Reporting Services retrieves the data for reports from the site database by using this account and password. + - **Reporting services point account**: Select **Set**, and then select an account to use. SQL Server Reporting Services on the reporting services point uses this account to connect to the Configuration Manager site database. This connection is to retrieve the data for a report. Select **Existing account** to specify a Windows user account that you previously configured as a Configuration Manager account. Select **New account** to specify a Windows user account that's not currently configured for use. Configuration Manager automatically grants the specified user access to the site database. The specified Windows user account and password are encrypted and stored in the Reporting Services database. Reporting Services retrieves the data for reports from the site database by using this account and password. > [!IMPORTANT] > The account that you specify must have the **Log on locally** permission on the server that hosts the Reporting Services database. diff --git a/memdocs/configmgr/core/servers/manage/powerbi-report-server.md b/memdocs/configmgr/core/servers/manage/powerbi-report-server.md index 4b562ad8ae9..fa82eadb48b 100644 --- a/memdocs/configmgr/core/servers/manage/powerbi-report-server.md +++ b/memdocs/configmgr/core/servers/manage/powerbi-report-server.md @@ -28,7 +28,7 @@ Save Power BI Desktop report files (.PBIX) and deploy them to the Power BI Repor - Power BI Report Server license. For more information, see [Licensing Power BI Report Server](/power-bi/report-server/get-started#licensing-power-bi-report-server). -- Download [Microsoft Power BI Report Server-September 2019](https://www.microsoft.com/download/details.aspx?id=57270), or later. +- Download [Microsoft Power BI Report Server-September 2024](https://www.microsoft.com/download/details.aspx?id=105945), or later. - Don't install Power BI Report Server right away. For the proper process based on your environment, see [Configure the reporting services point](#configure-the-reporting-services-point). - It's recommended that you use a [supported version of Power BI Report Server](/power-bi/report-server/support-timeline). For versioning information, see the [Change log for Power BI Report Server](/power-bi/report-server/changelog). diff --git a/memdocs/configmgr/core/servers/manage/updates.md b/memdocs/configmgr/core/servers/manage/updates.md index 16b889671c6..1c1dd2d2e12 100644 --- a/memdocs/configmgr/core/servers/manage/updates.md +++ b/memdocs/configmgr/core/servers/manage/updates.md @@ -59,7 +59,6 @@ The following supported versions`*`, of Configuration Manager are cur |-------------|-----------|------------|--------------|------------------------| | [**2403**](../../plan-design/changes/whats-new-in-version-2403.md)
(5.00.9128) | April 22, 2024 | October 22, 2025 | Yes[Note 1](#bkmk_note1) | Yes | | [**2309**](../../plan-design/changes/whats-new-in-version-2309.md)
(5.00.9122) | October 9, 2023 | April 9, 2025 | No | Yes | -| [**2303**](../../plan-design/changes/whats-new-in-version-2303.md)
(5.00.9106) | April 10, 2023 | October 10, 2024 | Yes[Note 1](#bkmk_note1) | Yes | > [!NOTE] > The **Availability date** in this table is when the [early update ring](checklist-for-installing-update-2403.md#early-update-ring) was released. Baseline media will be available on the VLSC soon after the update is globally available. @@ -87,8 +86,9 @@ The following table lists historical versions of Configuration Manager current b | Version | Availability date | Support end date | Baseline | In-console update | |----------------------------------|-------------------|--------------------|----------|-------------------| -| **2211**
(5.00.9096)) | December 5, 2022 | June 5, 2024 | No | Yes | -| **2207**
(5.00.9088)) | August 12, 2022 | February 12, 2024 | No | Yes | +| **2303**
(5.00.9106) | April 10, 2023 | October 10, 2024 | Yes | Yes | +| **2211**
(5.00.9096) | December 5, 2022 | June 5, 2024 | No | Yes | +| **2207**
(5.00.9088) | August 12, 2022 | February 12, 2024 | No | Yes | | **2203**
(5.00.9078) | April 6, 2022 | October 6, 2023 | Yes | Yes | | **2111**
(5.00.9068) | December 1, 2021 | June 1, 2023 | No | Yes | | **2107**
(5.00.9058) | August 2, 2021 | February 2, 2023 | No | Yes | diff --git a/memdocs/configmgr/core/understand/software-center.md b/memdocs/configmgr/core/understand/software-center.md index 00449b0a66d..33d354626a3 100644 --- a/memdocs/configmgr/core/understand/software-center.md +++ b/memdocs/configmgr/core/understand/software-center.md @@ -5,7 +5,7 @@ description: Learn about the features and functionality of Software Center ms.author: baladell author: BalaDelli manager: apoorvseth -ms.date: 06/10/2020 +ms.date: 10/18/2024 ms.topic: end-user-help ms.subservice: core-infra ms.service: configuration-manager diff --git a/memdocs/configmgr/hotfix/2303/29166583.md b/memdocs/configmgr/hotfix/2303/29166583.md index a5acc4c26d3..3a8beeb9d48 100644 --- a/memdocs/configmgr/hotfix/2303/29166583.md +++ b/memdocs/configmgr/hotfix/2303/29166583.md @@ -2,14 +2,14 @@ title: Management point security update for Microsoft Configuration Manager version 2303 titleSuffix: Configuration Manager description: Management point security update for Configuration Manager 2303 -ms.date: 09/04/2024 +ms.date: 09/18/2024 ms.subservice: core-infra ms.service: configuration-manager ms.topic: reference ms.assetid: b8cb0347-a26c-46e2-8ddd-8ddd61cd89a4 -author: bhuney -ms.author: brianhun -manager: dougeby +author: baladelli +ms.author: baladell +manager: apoorvseth --- # Management point security update for Configuration Manager 2303 @@ -21,12 +21,20 @@ manager: dougeby An update is available to harden the security of Configuration Manager environment. The update improves the security of connections between the management point and site server database. > [!NOTE] - > For enhanced security posture it is recommended to leverage alternate account rather than Computer account for ‘Management point connection account’. + > For enhanced security posture it is recommended to leverage alternate service account rather than Computer account for ‘Management point connection account’. -Installation of this update resolves the following security issue: +### Known issues -• CVE-2024-43468 +• Sep 05, 2024 +We identified an issue after installing the hotfix. Hence this KB is no longer applicable to install and we republish this once a fix has been identified. + +• Sep 18, 2024 + +A revised version of the hotfix is released to address the earlier issue. + +The revision appears in the console as KB 29166583 for customers using Configuration Manager version 2303. +For customers who has already installed earlier release KB 29166583 they see two instances of the same KB 29166583, one installed and another one as ready to install. ### Update information for Microsoft Configuration Manager current branch, version 2303 @@ -53,6 +61,8 @@ File information is available in the downloadable [KB29166583_FileList.txt](http ## Release history - September 4, 2024: Initial hotfix release +- September 5, 2024: Hotfix revoked +- September 18, 2024: Hotfix republished ## References [Updates and servicing for Configuration Manager](../../core/servers/manage/updates.md) diff --git a/memdocs/configmgr/hotfix/2309/29166583.md b/memdocs/configmgr/hotfix/2309/29166583.md index 03f2a01586f..8f3ed42c38c 100644 --- a/memdocs/configmgr/hotfix/2309/29166583.md +++ b/memdocs/configmgr/hotfix/2309/29166583.md @@ -2,14 +2,14 @@ title: Management point security update for Microsoft Configuration Manager version 2309 titleSuffix: Configuration Manager description: Management point security update for Configuration Manager 2309 -ms.date: 09/04/2024 +ms.date: 09/18/2024 ms.subservice: core-infra ms.service: configuration-manager ms.topic: reference ms.assetid: 19d171f9-e4fd-4d75-925c-2205be90d76c -author: bhuney -ms.author: brianhun -manager: dougeby +author: Baladelli +ms.author: baladell +manager: apoorvseth --- # Management point security update for Configuration Manager 2309 @@ -21,12 +21,20 @@ manager: dougeby An update is available to harden the security of Configuration Manager environment. The update improves the security of connections between the management point and site server database. > [!NOTE] - > For enhanced security posture it is recommended to leverage alternate account rather than Computer account for ‘Management point connection account’. + > For enhanced security posture it is recommended to leverage alternate service account rather than Computer account for ‘Management point connection account’. -Installation of this update resolves the following security issue: +### Known issues -• CVE-2024-43468 +• Sep 05, 2024 +We identified an issue after installing the hotfix. Hence this KB is no longer applicable to install and we republish this once a fix has been identified. + +• Sep 18, 2024 + +A revised version of the hotfix is released to address the earlier issue. + +The revision appears in the console as KB 29166583 for customers using Configuration Manager version 2309. +For customers who has already installed earlier release KB 29166583 they see two instances of the same KB 29166583, one installed and another one as ready to install. ### Update information for Microsoft Configuration Manager current branch, version 2309 @@ -53,6 +61,8 @@ File information is available in the downloadable [KB29166583_FileList.txt](http ## Release history - September 4, 2024: Initial hotfix release +- September 5, 2024: Hotfix revoked +- September 18, 2024: Hotfix republished ## References [Updates and servicing for Configuration Manager](../../core/servers/manage/updates.md) diff --git a/memdocs/configmgr/hotfix/2403/29166583.md b/memdocs/configmgr/hotfix/2403/29166583.md index 20e7c5461e8..021b6db030c 100644 --- a/memdocs/configmgr/hotfix/2403/29166583.md +++ b/memdocs/configmgr/hotfix/2403/29166583.md @@ -2,14 +2,14 @@ title: Management point security update for Microsoft Configuration Manager version 2403 titleSuffix: Configuration Manager description: Management point security update for Configuration Manager 2403 -ms.date: 09/04/2024 +ms.date: 09/18/2024 ms.subservice: core-infra ms.service: configuration-manager ms.topic: reference ms.assetid: f558a961-40c8-447b-b25c-f8f2b663cb90 -author: bhuney -ms.author: brianhun -manager: dougeby +author: Baladelli +ms.author: baladell +manager: Apoorvseth --- # Management point security update for Configuration Manager 2403 @@ -23,10 +23,18 @@ An update is available to harden the security of Configuration Manager environme > [!NOTE] > For enhanced security posture it is recommended to leverage alternate account rather than Computer account for ‘Management point connection account’. -Installation of this update resolves the following security issue: +### Known issues -• CVE-2024-43468 +• Sep 05, 2024 +We identified an issue after installing the hotfix. Hence this KB is no longer applicable to install and we republish this once a fix has been identified. + +• Sep 18, 2024 + +A revised version of the hotfix is released to address the earlier issue. + +The revision appears in the console as KB 29166583 for customers using Configuration Manager version 2403. +For customers who has already installed original release KB 29166583 they see two instances of the same KB 29166583, one installed and another one as ready to install. ### Update information for Microsoft Configuration Manager current branch, version 2403 @@ -53,6 +61,8 @@ File information is available in the downloadable [KB29166583_FileList.txt](http ## Release history - September 4, 2024: Initial hotfix release +- September 5, 2024: Hotfix revoked +- September 18, 2024: Hotfix republished ## References [Updates and servicing for Configuration Manager](../../core/servers/manage/updates.md) diff --git a/memdocs/configmgr/mdm/index.yml b/memdocs/configmgr/mdm/index.yml index 936153795d7..7ab7e18e6c2 100644 --- a/memdocs/configmgr/mdm/index.yml +++ b/memdocs/configmgr/mdm/index.yml @@ -50,10 +50,10 @@ landingContent: - linkListType: overview links: - text: What is Intune? - url: /intune/fundamentals/what-is-intune + url: /mem/intune/fundamentals/what-is-intune - text: Device management overview - url: /intune/fundamentals/what-is-device-management + url: /mem/intune/fundamentals/what-is-device-management - linkListType: tutorial links: - text: Walkthrough the Microsoft Intune admin center - url: /intune/fundamentals/tutorial-walkthrough-endpoint-manager \ No newline at end of file + url: /mem/intune/fundamentals/tutorial-walkthrough-endpoint-manager \ No newline at end of file diff --git a/memdocs/configmgr/mdm/plan-design/plan-on-premises-mdm.md b/memdocs/configmgr/mdm/plan-design/plan-on-premises-mdm.md index 692d4b1770b..0fde971daf6 100644 --- a/memdocs/configmgr/mdm/plan-design/plan-on-premises-mdm.md +++ b/memdocs/configmgr/mdm/plan-design/plan-on-premises-mdm.md @@ -26,7 +26,7 @@ There are several key areas to review when you're planning to implement on-premi - Device enrollment > [!IMPORTANT] -> While the site or any mobile device doesn't connect to Microsoft Intune, your organization still requires Intune licenses to use this feature. For more information, see [Microsoft Intune licensing](/intune/fundamentals/licenses). +> While the site or any mobile device doesn't connect to Microsoft Intune, your organization still requires Intune licenses to use this feature. For more information, see [Microsoft Intune licensing](/mem/intune/fundamentals/licenses). Consider the following requirements before preparing the Configuration Manager infrastructure to handle on-premises MDM. diff --git a/memdocs/configmgr/mdm/understand/what-happened-to-hybrid.md b/memdocs/configmgr/mdm/understand/what-happened-to-hybrid.md index 6bd426e5cca..11f5aaf8d30 100644 --- a/memdocs/configmgr/mdm/understand/what-happened-to-hybrid.md +++ b/memdocs/configmgr/mdm/understand/what-happened-to-hybrid.md @@ -77,6 +77,6 @@ The following note is the original deprecation announcement: For more information on supported features for managing MDM devices, see the following articles: -- [What is Microsoft Intune?](/intune/what-is-intune) +- [What is Microsoft Intune?](/mem/intune/fundamentals/what-is-intune) - [What is on-premises MDM?](manage-mobile-devices-with-on-premises-infrastructure.md) - [Device management with Exchange](../deploy-use/manage-mobile-devices-with-exchange-activesync.md) \ No newline at end of file diff --git a/memdocs/configmgr/protect/deploy-use/defender-advanced-threat-protection.md b/memdocs/configmgr/protect/deploy-use/defender-advanced-threat-protection.md index 5eb49af297b..d5f7d55d351 100644 --- a/memdocs/configmgr/protect/deploy-use/defender-advanced-threat-protection.md +++ b/memdocs/configmgr/protect/deploy-use/defender-advanced-threat-protection.md @@ -19,7 +19,7 @@ ms.collection: tier3 Endpoint Protection can help manage and monitor [Microsoft Defender for Endpoint](/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-advanced-threat-protection). Microsoft Defender for Endpoint helps enterprises detect, investigate, and respond to advanced attacks on their networks. Configuration Manager policies can help you onboard and monitor Windows 10 or later clients. -Microsoft Defender for Endpoint's cloud-based portal is [Microsoft Defender Security Center](https://securitycenter.windows.com). By adding and deploying a client onboarding configuration file, Configuration Manager can monitor deployment status and Microsoft Defender for Endpoint agent health. Microsoft Defender for Endpoint is supported on PCs running the Configuration Manager client or [managed by Microsoft Intune](/intune/protect/advanced-threat-protection). +Microsoft Defender for Endpoint's cloud-based portal is [Microsoft Defender Security Center](https://securitycenter.windows.com). By adding and deploying a client onboarding configuration file, Configuration Manager can monitor deployment status and Microsoft Defender for Endpoint agent health. Microsoft Defender for Endpoint is supported on PCs running the Configuration Manager client or [managed by Microsoft Intune](/mem/intune/protect/advanced-threat-protection). ## Prerequisites diff --git a/memdocs/configmgr/protect/deploy-use/use-device-guard-with-configuration-manager.md b/memdocs/configmgr/protect/deploy-use/use-device-guard-with-configuration-manager.md index 160fb98e04a..f3c4ce07522 100644 --- a/memdocs/configmgr/protect/deploy-use/use-device-guard-with-configuration-manager.md +++ b/memdocs/configmgr/protect/deploy-use/use-device-guard-with-configuration-manager.md @@ -66,7 +66,7 @@ To use Application Control with Configuration Manager, devices must be running s - Windows Server 2019 or later > [!TIP] -> Existing Application Control polices created with Configuration Manager version 2006 or earlier won't work with Windows Server. To support Windows Server, create new Application Control policies. +> Existing Application Control policies created with Configuration Manager version 2006 or earlier won't work with Windows Server. To support Windows Server, create new Application Control policies. ## Before you start diff --git a/memdocs/configmgr/protect/plan-design/bitlocker-management.md b/memdocs/configmgr/protect/plan-design/bitlocker-management.md index dbfea1b8465..ce6d16ddee9 100644 --- a/memdocs/configmgr/protect/plan-design/bitlocker-management.md +++ b/memdocs/configmgr/protect/plan-design/bitlocker-management.md @@ -28,7 +28,7 @@ Use Configuration Manager to manage BitLocker Drive Encryption (BDE) for on-prem For more general information about BitLocker, see [BitLocker overview](/windows/security/information-protection/bitlocker/bitlocker-overview). For a comparison of BitLocker deployments and requirements, see the [BitLocker deployment comparison chart](/windows/security/information-protection/bitlocker/bitlocker-deployment-comparison). > [!TIP] -> To manage encryption on co-managed Windows 10 or later devices using the Microsoft Intune cloud service, switch the [**Endpoint Protection** workload](../../comanage/workloads.md#endpoint-protection) to Intune. For more information on using Intune, see [Windows Encryption](/intune/protect/endpoint-protection-windows-10#windows-encryption). +> To manage encryption on co-managed Windows 10 or later devices using the Microsoft Intune cloud service, switch the [**Endpoint Protection** workload](../../comanage/workloads.md#endpoint-protection) to Intune. For more information on using Intune, see [Windows Encryption](/mem/intune/protect/endpoint-protection-windows-10#windows-encryption). ## Features diff --git a/memdocs/configmgr/protect/plan-design/resource-access-deprecation-faq.yml b/memdocs/configmgr/protect/plan-design/resource-access-deprecation-faq.yml index 99530884ffc..a2d76c54a8e 100644 --- a/memdocs/configmgr/protect/plan-design/resource-access-deprecation-faq.yml +++ b/memdocs/configmgr/protect/plan-design/resource-access-deprecation-faq.yml @@ -26,6 +26,10 @@ summary: | - Email profiles - The co-management resource access workload + > [!IMPORTANT] + > If above mentioned resource access profiles are configured in Intune, but the applicability to co-managed devices are controlled through the co-management Resource Access workload setting in Configuration Manager, post 2403 upgrade, the Resource Access workload is moved to Intune and hence all resource access profiles + configured in Intune are now applicable and enforced to co-managed devices. + This article answers your frequently asked questions about these deprecated features. sections: @@ -81,8 +85,6 @@ sections: Starting in version 2211, the prerequisite checker will display a warning for co-managed clients if the resource access workload is on Configuration Manager. If the resource access slider is towards Configuration Manager, they aren't tested or supported in version 2203. Co-management behavior is the same as if you used Configuration Manager 2111 or earlier to switch the resource access workload to Intune. This Workload slider will be disabled, and you can only use Microsoft Intune to deploy resource access profiles in upcoming Configuration Manager versions. - - - question: | What alternative options are available? answer: | diff --git a/memdocs/configmgr/protect/understand/protect-data-and-site-infrastructure.md b/memdocs/configmgr/protect/understand/protect-data-and-site-infrastructure.md index 060fea1686a..53bab106492 100644 --- a/memdocs/configmgr/protect/understand/protect-data-and-site-infrastructure.md +++ b/memdocs/configmgr/protect/understand/protect-data-and-site-infrastructure.md @@ -30,7 +30,7 @@ You want your users to securely access your organization's resources. Protect bo - Microsoft Defender Application Control > [!TIP] - > To manage endpoint protection on co-managed Windows 10 or later devices using the Microsoft Intune cloud service, switch the [**Endpoint Protection** workload](../../comanage/workloads.md#endpoint-protection) to Intune. For more information, see [Endpoint protection for Microsoft Intune](/intune/endpoint-protection-windows-10). + > To manage endpoint protection on co-managed Windows 10 or later devices using the Microsoft Intune cloud service, switch the [**Endpoint Protection** workload](../../comanage/workloads.md#endpoint-protection) to Intune. For more information, see [Endpoint protection for Microsoft Intune](/mem/intune/protect/endpoint-protection-windows-10). - Protect data stored on on-premises Windows clients with BitLocker Drive Encryption (BDE). Configuration Manager provides full BitLocker lifecycle management that can replace the use of Microsoft BitLocker Administration and Monitoring (MBAM). For more information, see [Plan for BitLocker management](../plan-design/bitlocker-management.md). diff --git a/memdocs/configmgr/sum/deploy-use/integrate-windows-update-for-business-windows-10.md b/memdocs/configmgr/sum/deploy-use/integrate-windows-update-for-business-windows-10.md index d26c6c7a6aa..7322ad9ed64 100644 --- a/memdocs/configmgr/sum/deploy-use/integrate-windows-update-for-business-windows-10.md +++ b/memdocs/configmgr/sum/deploy-use/integrate-windows-update-for-business-windows-10.md @@ -21,7 +21,7 @@ ms.collection: tier3 Windows Update for Business (WUfB) allows you to keep Windows 10 or later devices in your organization always up-to-date with the latest security defenses and Windows features when these devices connect directly to the Windows Update (WU) service. Configuration Manager can differentiate between Windows computers that use WUfB and WSUS for getting software updates. > [!WARNING] -> If you are using co-management for your devices and you have moved the [Windows Update policies](../../comanage/workloads.md#windows-update-policies) to Intune, then your devices will get their [Windows Update for Business policies from Intune](/intune/windows-update-for-business-configure). +> If you are using co-management for your devices and you have moved the [Windows Update policies](../../comanage/workloads.md#windows-update-policies) to Intune, then your devices will get their [Windows Update for Business policies from Intune](/mem/intune/protect/windows-update-for-business-configure). > - If the Configuration Manager client is still installed on the co-managed device then settings for Cumulative Updates and Feature Updates are managed by Intune. However, third-party patching, if enabled in [**Client Settings**](../../core/clients/deploy/about-client-settings.md#enable-third-party-software-updates), is still managed by Configuration Manager. Some Configuration Manager features are no longer available when Configuration Manager clients are configured to receive updates from WU, which includes WUfB or Windows Insiders: diff --git a/memdocs/configmgr/sum/deploy-use/third-party-software-updates.md b/memdocs/configmgr/sum/deploy-use/third-party-software-updates.md index e04703b5ea6..a3a68244a22 100644 --- a/memdocs/configmgr/sum/deploy-use/third-party-software-updates.md +++ b/memdocs/configmgr/sum/deploy-use/third-party-software-updates.md @@ -2,7 +2,7 @@ title: Enable third-party updates titleSuffix: Configuration Manager description: Enable third-party updates in Configuration Manager -ms.date: 08/02/2021 +ms.date: 10/08/2024 ms.service: configuration-manager ms.subservice: software-updates ms.topic: conceptual @@ -14,14 +14,16 @@ ms.reviewer: mstewart,aaroncz ms.collection: tier3 --- + # Enable third-party updates *Applies to: Configuration Manager (current branch)* The **Third-Party Software Update Catalogs** node in the Configuration Manager console allows you to subscribe to third-party catalogs, publish their updates to your software update point (SUP), and then deploy them to clients. -> [!Note] -> In version 2006 and earlier, Configuration Manager doesn't enable this feature by default. Before using it, enable the optional feature **Enable third party update support on clients**. For more information, see [Enable optional features from updates](../../core/servers/manage/optional-features.md). +> [!Note] +> - Microsoft does not test or verify third party update catalogs or their contents in any way. Before deploying you should verify that any updates downloaded from third party update catalogs are free from malicious software and verify them in a testing environment prior to deploying them in your environment. +> - In version 2006 and earlier, Configuration Manager doesn't enable this feature by default. Before using it, enable the optional feature **Enable third party update support on clients**. For more information, see [Enable optional features from updates](../../core/servers/manage/optional-features.md). ## Prerequisites diff --git a/memdocs/intune/apps/android-deployment-scenarios-app-protection-work-profiles.md b/memdocs/intune/apps/android-deployment-scenarios-app-protection-work-profiles.md index 8ab6d41d3db..8e61348e8fe 100644 --- a/memdocs/intune/apps/android-deployment-scenarios-app-protection-work-profiles.md +++ b/memdocs/intune/apps/android-deployment-scenarios-app-protection-work-profiles.md @@ -61,7 +61,7 @@ Individual Android apps are enabled for APP in a few ways: For more information on this tool, see [prepare line-of-business apps for app protection policies](../developer/apps-prepare-mobile-application-management.md). -To see a list of apps enabled with APP, see [managed apps with a rich set of mobile application protection policies](https://www.microsoft.com/cloud-platform/microsoft-intune-apps). +To see a list of apps enabled with APP, see [managed apps with a rich set of mobile application protection policies](/mem/intune/apps/apps-supported-intune-apps). ## Deployment scenarios diff --git a/memdocs/intune/apps/app-configuration-managed-home-screen-app.md b/memdocs/intune/apps/app-configuration-managed-home-screen-app.md index d60d1c4389c..9339cde7335 100644 --- a/memdocs/intune/apps/app-configuration-managed-home-screen-app.md +++ b/memdocs/intune/apps/app-configuration-managed-home-screen-app.md @@ -80,10 +80,9 @@ The following table lists the Managed Home Screen available configuration keys, | Set device wall paper | string | Default | Allows you to set a wallpaper of your choice. Enter the URL of the image that you want to set as a wallpaper. | ✔️ | | Define theme color | string | light | Specify if you want Managed Home Screen to run in "light" or "dark" mode. | ❌ | | Block pinning browser web pages to MHS | bool | FALSE | Set this restriction to `true` to block users from pinning web pages from any browser onto Managed Home Screen. | ❌ | -| Enable updated user experience | bool | FALSE | Set to **true** to display the updated app design, with improvements to user workflows for usability and supportability, for MHS. If **false**, user will continue to see previous workflows on the app.

**NOTE**: Starting in August 2024, previous Managed Home Screen workflows will be removed and all devices will be required to use the updated app design. | ❌ | -| Top Bar Primary Element | choice | | Use this key to select whether the primary element of the top bar will be the device Serial Number, Device Name, or Tenant Name. This setting can only be used if **Enable sign in** key is set to **false**. If the **Enable sign in** key is set to **true**, the user's name will be shown as the primary element. **Enable updated user experience** must be set to **true** to make the top bar visible on users devices. If you select serial number, **Show serial number for all supported OS versions on MHS** must be set to `{{SerialNumber}}`. If you select device name, **Show device name for all supported OS version on MHS** must be set to `{{DeviceName}}`. | ❌ | -| Top Bar Secondary Element | choice | | Use this key to select whether the secondary element of the top bar will be the device Serial Number, Device Name, or Tenant Name. **Enable updated user experience** must be set to **true** to make the top bar visible on users devices. If you select serial number, **Show serial number for all supported OS versions on MHS** must be set to `{{SerialNumber}}`. If you select device name, **Show device name for all supported OS version on MHS** must be set to `{{DeviceName}}`. | ❌ | -| Top Bar User Name Style | choice | | Use this setting to select the style of the user's name in the top bar based on the following list:


This setting can only be used if the **Enable sign in** key is set to **true**. **Enable updated user experience** must be set to **true** to make the top bar visible on users devices. | ❌ | +| Top Bar Primary Element | choice | | Use this key to select whether the primary element of the top bar will be the device Serial Number, Device Name, or Tenant Name. This setting can only be used if **Enable sign in** key is set to **false**. If the **Enable sign in** key is set to **true**, the user's name will be shown as the primary element. If you select serial number, **Show serial number for all supported OS versions on MHS** must be set to `{{SerialNumber}}`. If you select device name, **Show device name for all supported OS version on MHS** must be set to `{{DeviceName}}`. | ❌ | +| Top Bar Secondary Element | choice | | Use this key to select whether the secondary element of the top bar will be the device Serial Number, Device Name, or Tenant Name. If you select serial number, **Show serial number for all supported OS versions on MHS** must be set to `{{SerialNumber}}`. If you select device name, **Show device name for all supported OS version on MHS** must be set to `{{DeviceName}}`. | ❌ | +| Top Bar User Name Style | choice | | Use this setting to select the style of the user's name in the top bar based on the following list:
This setting can only be used if the **Enable sign in** key is set to **true**. | ❌ | **Configurations for device peripherals and Managed Home Screen settings**: @@ -96,9 +95,9 @@ The following table lists the Managed Home Screen available configuration keys, | Show Bluetooth setting | bool | FALSE | Turning this setting to True allows the end user to turn on or off Bluetooth and to connect to different Bluetooth-capable devices. | ✔️ | | Show volume setting | bool | FALSE | Turning this setting to True allows the end user to access a volume slider to adjust media volume. | ✔️ | | Show flashlight setting | bool | FALSE | Turning this setting to True allows the end user to on or off the device's flashlight. If the device doesn't support a flashlight, then this setting won't appear, even if configured to True. | ✔️ | -| Show brightness slider | bool | FALSE | Turn this setting to TRUE to allow end users to access a brightness slider to adjust the device screen brightness. This configuration is only available when **Enable updated user experience** is set to TRUE. | ❌ | -| Show adaptive brightness toggle | bool | FALSE | Turn this setting to TRUE to allow end users to turn adaptive brightness on and off on the device. Adaptive brightness allows the device to select an optimal brightness based on ambient lighting. This configuration is only available when **Enable updated user experience** is set to TRUE. | ❌ | -| Show autorotate toggle | bool | FALSE | Turn this setting to TRUE to allow end users to access a toggle to turn on and off the device's auto-rotation setting. This configuration is only available when **Enable updated user experience** is set to TRUE.| ❌ | +| Show brightness slider | bool | FALSE | Turn this setting to TRUE to allow end users to access a brightness slider to adjust the device screen brightness. | ❌ | +| Show adaptive brightness toggle | bool | FALSE | Turn this setting to TRUE to allow end users to turn adaptive brightness on and off on the device. Adaptive brightness allows the device to select an optimal brightness based on ambient lighting. | ❌ | +| Show autorotate toggle | bool | FALSE | Turn this setting to TRUE to allow end users to access a toggle to turn on and off the device's auto-rotation setting. | ❌ | | Show device info setting | bool | FALSE | True allows end users to access quick info about the device from the Managed Setting menu. Accessible information includes device's make, model, serial number, and IPv4 and IPv6 details. On OS version 9 and newer, to let users see the device's serial number, ensure that **Show serial number for all supported OS version on MHS** is configured to display `{{SerialNumber}}`. MAC address details are available from the **Device Information** page of the Managed Home Screen (MHS) app. Use the MAC address when troubleshooting device connectivity issues. | ✔️ | | Show device's name on MHS | bool | FALSE | Turn this setting to True to easily view the device's Intune admin center "device name" property from the Managed Settings menu when **Show device info setting** is set to True. Make sure to also include the string property "Device's name," which is auto-populated by Intune with the correct value. | ❌ | | Show serial number for all supported OS version on MHS | choice | {{SerialNumber}} | Ensure that in-app config device_serial_number is configured to display {{SerialNumber}} when **Show device info setting** is set to True. This value is auto-populated by Intune with the correct value. | ❌ | @@ -106,7 +105,7 @@ The following table lists the Managed Home Screen available configuration keys, | Enable virtual home button | bool | FALSE | True allows end users to have access to a Managed Home Screen home button that will return the user to the Managed Home Screen from the current task they are in. | ✔️ | | Type of virtual home button | string | swipe_up | Use swipe_up to access home button with a swipe up gesture. Use float to access a sticky, persistent home button that can be moved around the screen by the end user. | ✔️ | | Enable notifications badge | bool | FALSE | Enables the notification badge for app icons that shows the number of new notifications on the app. If you enable this setting, end users will see notification badges on apps that have unread notifications. If you keep this configuration key disabled, the end user won't see any notification badged to apps that might have unread notifications. | ✔️ | -| Battery and Signal Strength indicator bar | bool | TRUE | Turning this setting to True shows the battery and signal strength indicator bar. | ❌ | +| Battery and Signal Strength indicator bar | bool | FALSE | Turning this setting to True shows the battery and signal strength indicator bar. | ❌ | | Type of virtual app switcher button | string | | The configuration key is `virtual_app_switcher_type` and the possible values are `none`, `float`, and `swipe_up`. Use `swipe_up` to access app switcher button with a swipe up gesture. Use `float` to access a sticky, persistent app switcher button that can be moved around the screen by the end user. | ❌ | > [!IMPORTANT] @@ -118,6 +117,9 @@ The following table lists the Managed Home Screen available configuration keys, > > On Android devices running OS 10, when an end-user tries to connect to a network via the Managed Home Screen app, they will get prompted with a consent via notifications. Because of this prompt, users on OS 10 will need to have access to the status bar and notifications in order to complete the consent step. Use the [General settings for fully managed and dedicated devices](../configuration/device-restrictions-android-for-work.md#dedicated-devices) to make status bar and notifications available to your end-users, if appropriate. Additionally, when an end-user tries to connect to a password protected network via the Managed Home Screen app, they will be asked to input the password. Even if the password is correct, the network will only change if the device is not already connected to a stable network. +> [!IMPORTANT] +> End users cannot automatically connect to Enterprise Wi-Fi networks they select from the MHS settings menu, even if that network has been pre-configured using either Intune or another external source. While managed devices can still reliably utilize these networks, end users cannot initialize a connection from within MHS to the preconfigured networks. + > [!IMPORTANT] > For devices running on Android 10+ and using Managed Home Screen, for Bluetooth pairing to successfully work on devices that require a pairing key, admins must enable the following Android system apps: > - Android System Bluetooth @@ -165,10 +167,10 @@ The following table lists the Managed Home Screen available configuration keys, | Configuration Key | Value Type | Default Value | Description | Available in device configuration profile | |-|-|-|-|-| -| Enable sign in | bool | FALSE | Turn this setting to True to enable end-users to sign into Managed Home Screen. When used with Microsoft Entra shared device mode, users who sign in to Managed Home Screen will get automatically signed in to all other apps on the device that have participated with Microsoft Entra shared device mode. By default this setting is off. | ✔️

NOTE: On devices that have a device configuration profile with the [**Enabled System Navigation Features** setting](../configuration/device-restrictions-android-for-work.md#dedicated-devices) set to **Home and Overview buttons**, end users can ignore and skip the sign in screen. | +| Enable sign in | bool | FALSE | Turn this setting to True to enable end-users to sign into Managed Home Screen. When used with Microsoft Entra shared device mode, users who sign in to Managed Home Screen will get automatically signed in to all other apps on the device that have participated with Microsoft Entra shared device mode. By default this setting is off.

NOTE: After rebooting the device, end users must reauthenticate by signing in to Managed Home Screen. | ✔️

NOTE: On devices that have a device configuration profile with the [**Enabled System Navigation Features** setting](../configuration/device-restrictions-android-for-work.md#dedicated-devices) set to **Home and Overview buttons**, end users can ignore and skip the sign in screen. | | Sign in type | string | Microsoft Entra ID | Set this configuration to "AAD" to sign in with a Microsoft Entra account. Otherwise, set this configuration to "Other". Users who sign in with a non-AAD account won't get single sign-on to all apps that have integrated with Microsoft Entra shared device mode, but will still get signed in to Managed Home Screen. By default, this setting uses "AAD" user accounts. This setting can only be used if **Enable sign in** has been set to True. | ✔️ | -| Domain name | string | | Set a domain name to be appended to usernames for sign in. If this is not set, users will need to enter the domain name. To allow users to select between multiple domain name options, add semicolon delimited strings. Enable sign in must be set to TRUE to use this configuration. This configuration is only available when **Enable updated user experience** is set to TRUE.

**NOTE**: This setting does not prevent users from inputting alternative domain names. | ❌ | -| Login hint text | string | | Set a custom login hint string by entering a string. If no string is set, the default string "Enter email or phone number" will be displayed. Enable sign in must be set to TRUE to use this configuration. This configuration is only available when **Enable updated user experience** is set to TRUE. | ❌ | +| Domain name | string | | Set a domain name to be appended to usernames for sign in. If this is not set, users will need to enter the domain name. To allow users to select between multiple domain name options, add semicolon delimited strings. Enable sign in must be set to TRUE to use this configuration.

**NOTE**: This setting does not prevent users from inputting alternative domain names. | ❌ | +| Login hint text | string | | Set a custom login hint string by entering a string. If no string is set, the default string "Enter email or phone number" will be displayed. Enable sign in must be set to TRUE to use this configuration. | ❌ | | Set to the url of wallpaper | string | | Allows you to set a wallpaper of your choice for the sign in screen. To use this setting, enter the URL of the image that you want set for the sign-in screen wallpaper. This image can be different than the Managed Home Screen wallpaper that is configured with **Set device wallpaper**. This setting can only be used if **Enable sign in** has been set to True. | ✔️ | | Enable show organization logo on sign in page | bool | TRUE | Turn this setting to True to use a company logo that will appear on the sign-in screen. This setting is used with **Organization logo on sign in page** and can only be used if **Enable sign in** has been set to TRUE. | ✔️ | | Organization logo on sign in page | string | | Allows you to brand your device with a logo of your choice on the Managed Home Screen sign-in screen. To use this setting, enter the URL of the image that you want set for the logo. This setting can only be used if **Enable show organization logo on sign in page** and **Enable sign in** have been set to True. | ✔️ | @@ -178,7 +180,7 @@ The following table lists the Managed Home Screen available configuration keys, | Maximum number of attempts for session PIN | string | | Define the maximum number of times a user can attempt to enter their session PIN before getting automatically logged out from Managed Home Screen. The default value is zero (0), where zero (0) means the user gets infinite tries. This can be used with any of the complexity values for session PIN. This setting can only be used if **Enable session PIN** and **Enable sign in** have been set to True. | ❌ | | Customer facing folder | Bool | FALSE | Use this specification with **Create Managed Folder for grouping apps** to create a folder that can't be exited without a user entering their Session PIN. This setting can only be used if **Enable session PIN** and **Enable sign in** have been set to True. | ❌ | | Require PIN code after returning from screensaver | bool | FALSE | Turn this setting True if you want to require end-users to enter their Session PIN to resume activity on Managed Home Screen after the screensaver has appeared. This setting can only be used if **Enable sign in** has been set to True. | ✔️ | -| Minimum inactive time before session PIN is required | int | | The number of seconds the device is inactive before end-user input of session PIN is required. If set to 0, the device will always require PIN after screen saver, regardless of the inactive time. This configuration is only available when **Require PIN code after returning from screensaver** and **Enable updated user experience** are set to TRUE. | ✔️ | +| Minimum inactive time before session PIN is required | int | | The number of seconds the device is inactive before end-user input of session PIN is required. If set to 0, the device will always require PIN after screen saver, regardless of the inactive time. This configuration is only available when **Require PIN code after returning from screensaver** is set to TRUE. | ✔️ | | Enable auto sign-out | bool | FALSE | Turn this setting to True to automatically sign current user out of Managed Home Screen after a specified period of inactivity. When used with Microsoft Entra shared device mode, users will also get signed out of all apps on the device that participate with Microsoft Entra shared device mode. By default, this setting is turned off. This setting can only be used if **Enable sign in** has been set to True. | ✔️ | | Auto sign-out time | integer | 300 | Set a period of inactivity, in seconds, that can pass before user gets automatically signed out of Managed Home Screen. This setting can only be used if **Enable auto sign-out** and **Enable sign in** have been set to True. | ✔️ | | Count down time on auto sign-out dialog | integer | 60 | The amount of time, in seconds, to give notice to user before signing them out of Managed Home Screen. This setting can only be used if **Enable auto sign-out** and **Enable sign in** have been set to True. | ✔️ | @@ -348,10 +350,6 @@ The following syntax is an example JSON script with all the available configurat "key": "device_name", "valueString": "{{DeviceName}}" }, - { - "key": "enable_updated_user_experience", - "valueBool": false - }, { "key": "header_primary_element", "valueString": "Tenant Name" diff --git a/memdocs/intune/apps/app-configuration-policies-use-android.md b/memdocs/intune/apps/app-configuration-policies-use-android.md index f033814e503..92bec816946 100644 --- a/memdocs/intune/apps/app-configuration-policies-use-android.md +++ b/memdocs/intune/apps/app-configuration-policies-use-android.md @@ -8,7 +8,7 @@ keywords: author: Erikre ms.author: erikre manager: dougeby -ms.date: 08/08/2024 +ms.date: 10/09/2024 ms.topic: how-to ms.service: microsoft-intune ms.subservice: apps @@ -76,6 +76,7 @@ Android Enterprise has several enrollment methods. The enrollment type depends o > * Camera > * Record audio > * Allow body sensor data + > * Background location 11. If the managed app supports configuration settings, the **Configuration settings format** dropdown box is visible. Select one of the following methods to add configuration information: - **Use configuration designer** @@ -127,7 +128,7 @@ You can use the configuration designer for Managed Google Play apps when the app 2. For each key and value in the configuration, set: - - **Value type**: The data type of the configuration value. For String value types, you can optionally choose a variable or certificate profile as the value type. + - **Value type**: The data type of the configuration value. For string value types, you can optionally choose a variable or certificate profile as the value type. Note that once the policy is created, these value types will show as string. - **Configuration value**: The value for the configuration. If you select variable or certificate for the **Value type**, choose from a list of variables or certificate profiles. If you choose a certificate, then the certificate alias of the certificate deployed to the device is populated at runtime. ### Supported variables for configuration values diff --git a/memdocs/intune/apps/app-protection-framework.md b/memdocs/intune/apps/app-protection-framework.md index 2bed001a63f..8b029770123 100644 --- a/memdocs/intune/apps/app-protection-framework.md +++ b/memdocs/intune/apps/app-protection-framework.md @@ -75,7 +75,7 @@ Administrators can incorporate the below configuration levels within their ring ### Conditional Access Policies -To ensure that only apps supporting App Protection Polices access work or school account data, Microsoft Entra Conditional Access policies are required. These policies are described in [Conditional Access: Require approved client apps or app protection policy](/azure/active-directory/conditional-access/howto-policy-approved-app-or-app-protection). +To ensure that only apps supporting App Protection Poliies access work or school account data, Microsoft Entra Conditional Access policies are required. These policies are described in [Conditional Access: Require approved client apps or app protection policy](/azure/active-directory/conditional-access/howto-policy-approved-app-or-app-protection). See **Require approved client apps or app protection policy with mobile devices** in [Conditional Access: Require approved client apps or app protection policy](/azure/active-directory/conditional-access/howto-policy-approved-app-or-app-protection) for steps to implement the specific policies. Finally, implement the steps in [Block legacy authentication](/azure/active-directory/conditional-access/block-legacy-authentication) to block legacy authentication capable iOS and Android apps. diff --git a/memdocs/intune/apps/app-protection-policies-monitor.md b/memdocs/intune/apps/app-protection-policies-monitor.md index 8b65cb1eda1..ba8a35c1186 100644 --- a/memdocs/intune/apps/app-protection-policies-monitor.md +++ b/memdocs/intune/apps/app-protection-policies-monitor.md @@ -68,7 +68,7 @@ App protection data is retained for a minimum of 90 days. Any app instances that - **Compliance State**: The app meets compliance if it is targeted with MAM policy. >[!NOTE] -> The **Last Sync** column represents the same value in both the in-console User status report and the App Protection Policy [exportable .csv report](/intune/app-protection-policies-monitor#export-app-protection-activities). The difference is a small delay in synchronization between the value in the two reports. +> The **Last Sync** column represents the same value in both the in-console User status report and the App Protection Policy [exportable .csv report](/mem/intune/apps/app-protection-policies-monitor#export-app-protection-activities). The difference is a small delay in synchronization between the value in the two reports. > > The time referenced in Last Sync is when Intune last saw the app instance. When a user launches an app, it might notify the Intune App Protection service at that launch time, depending on when it last checked in. See [the retry interval times for App Protection Policy check-in](app-protection-policy-delivery.md). If a user hasn't used that particular app in the last check-in interval (which is usually 30 minutes for active usage), and they launch the app, then: > diff --git a/memdocs/intune/apps/app-protection-policy-settings-android.md b/memdocs/intune/apps/app-protection-policy-settings-android.md index 59c72dcf829..64d73ce8164 100644 --- a/memdocs/intune/apps/app-protection-policy-settings-android.md +++ b/memdocs/intune/apps/app-protection-policy-settings-android.md @@ -8,7 +8,7 @@ keywords: author: Erikre ms.author: erikre manager: dougeby -ms.date: 06/14/2024 +ms.date: 09/23/2024 ms.topic: conceptual ms.service: microsoft-intune ms.subservice: apps @@ -153,6 +153,7 @@ By default, several settings are provided with pre-configured values and actions |**Offline grace period** |The number of minutes that managed apps can run offline. Specify the time (in minutes) before the access requirements for the app are rechecked.

*Actions* include:

This entry can appear multiple times, with each instance supporting a different action. | |**Min app version** |Specify a value for the minimum application version value.

*Actions* include:

As apps often have distinct versioning schemes between them, create a policy with one minimum app version targeting one app (for example, *Outlook version policy*).

This entry can appear multiple times, with each instance supporting a different action.

This policy setting format supports either major.minor, major.minor.build, major.minor.build.revision.

Additionally, you can configure **where** your end users can get an updated version of a line-of-business (LOB) app. End users will see this in the **min app version** conditional launch dialog, which will prompt end users to update to a minimum version of the LOB app. On Android, this feature uses the Company Portal. To configure where an end user should update a LOB app, the app needs a managed [app configuration policy](app-configuration-policies-managed-app.md) sent to it with the key, `com.microsoft.intune.myappstore`. The value sent will define which store the end user will download the app from. If the app is deployed via the Company Portal, the value must be `CompanyPortal`. For any other store, you must enter a complete URL. | |**Disabled account** |There is no value to set for this setting.

*Actions* include:

| +|**Non-working time** |There is no value to set for this setting.

*Actions* include:

**Note**: This setting must only be configured if the tenant has been integrated with the **Working Time API**. For more information about integrating this setting with the **Working Time API**, see [Limit access to Microsoft Teams when frontline workers are off shift](/microsoft-365/frontline/flw-working-time). Configuring this setting without integrating with the Working Time API could result in accounts getting blocked due to missing working time status for the managed account associated with the application.

The following apps support this feature with Company Portal v5.0.5849.0 or later:

| ### Device conditions diff --git a/memdocs/intune/apps/app-protection-policy-settings-ios.md b/memdocs/intune/apps/app-protection-policy-settings-ios.md index cb9d5c63d24..b7ef9f6a44c 100644 --- a/memdocs/intune/apps/app-protection-policy-settings-ios.md +++ b/memdocs/intune/apps/app-protection-policy-settings-ios.md @@ -8,7 +8,7 @@ keywords: author: Erikre ms.author: erikre manager: dougeby -ms.date: 01/30/2024 +ms.date: 09/23/2024 ms.topic: conceptual ms.service: microsoft-intune ms.subservice: apps @@ -185,6 +185,8 @@ By default, several settings are provided with pre-configured values and actions | **Device model(s)** | Specify a semi-colon separated list of model identifier(s). These values aren't case sensitive.

*Actions* include:

For more information on using this setting, see [Conditional Launch actions](app-protection-policies-access-actions.md#ios-policy-settings). | | **Max allowed device threat level** | App protection policies can take advantage of the Intune-MTD connector. Specify a maximum threat level acceptable to use this app. Threats are determined by your chosen Mobile Threat Defense (MTD) vendor app on the end user device. Specify either *Secured*, *Low*, *Medium*, or *High*. *Secured* requires no threats on the device and is the most restrictive configurable value, while *High* essentially requires an active Intune-to-MTD connection.

*Actions* include:

**Note:** *Requires app to have Intune SDK version 12.0.15 or above.*

For more information on using this setting, see [Enable MTD for unenrolled devices](../protect/mtd-enable-unenrolled-devices.md). | |**Primary MTD service** |If you have configured multiple Intune-MTD connectors, specify the primary MTD vendor app that should be used on the end user device.

**Values** include:

You must configure the setting “Max allowed device threat level” to use this setting.

There are no **Actions** for this setting.| +|**Non-working time** |There is no value to set for this setting.

*Actions* include:

**Note**: This setting must only be configured if the tenant has been integrated with the **Working Time API**. For more information about integrating this setting with the **Working Time API**, see [Limit access to Microsoft Teams when frontline workers are off shift](/microsoft-365/frontline/flw-working-time). Configuring this setting without integrating with the Working Time API could result in accounts getting blocked due to missing working time status for the managed account associated with the application.

The following apps support this feature:

| + ### Learn more - Learn about [LinkedIn information and features in your Microsoft apps](https://go.microsoft.com/fwlink/?linkid=850740). diff --git a/memdocs/intune/apps/apps-add-enterprise-app.md b/memdocs/intune/apps/apps-add-enterprise-app.md index 58e10838215..0eeaafcc34c 100644 --- a/memdocs/intune/apps/apps-add-enterprise-app.md +++ b/memdocs/intune/apps/apps-add-enterprise-app.md @@ -6,7 +6,7 @@ keywords: author: Erikre ms.author: erikre manager: dougeby -ms.date: 01/08/2024 +ms.date: 09/16/2024 ms.topic: how-to ms.service: microsoft-intune ms.subservice: apps @@ -33,9 +33,9 @@ The Enterprise App Catalog is a collection of prepackaged [Win32 apps](../apps/a When you add an app to Intune, you'll commonly want to use default installation, requirements, and detection settings. For apps within the Enterprise App Catalog, these default settings have been configured and confirmed by Microsoft. You must be careful if you modify the application properties as unexpected or harmful commands could be passed via the **Install command** and **Uninstall command** fields. In addition, changing the install commands might cause installation to fail. > [!IMPORTANT] -> Microsoft does not assert compliance or authorizations for non-Microsoft apps. Customers are responsible for ensuring that apps meet their requirements. +> Microsoft does not assert compliance or authorizations for apps distributed via Intune. Customers are responsible for ensuring that apps meet their requirements. -Once you add an Enterprise App Catalog app to Intune, you can assign that app to end-users or devices. Intune silently adds the app to your tenant. +Once you add an Enterprise App Catalog app to Intune, you can assign that app to end-users or devices. ## Add a Windows catalog app (Win32) to Intune @@ -208,7 +208,7 @@ The **Rules format** provides the following options: The Intune agent checks the results from the script. It reads the values written by the script to the STDOUT stream, the standard error (STDERR) stream, and the exit code. If the script exits with a nonzero value, the script fails and the application detection status isn't installed. If the exit code is zero and STDOUT has data, the application detection status is installed. > [!NOTE] - > We recommend encoding your script as UTF-8. When the script exits with the value of **0**, the script execution was successful. The second output channel indicates that the app was detected. STDOUT data indicates that the app was found on the client. We don't look for a particular string from STDOUT. + > We recommend encoding your script as UTF-8 BOM. When the script exits with the value of **0**, the script execution was successful. The second output channel indicates that the app was detected. STDOUT data indicates that the app was found on the client. We don't look for a particular string from STDOUT. When you add the app to Intune, the version of your Windows catalog app (Win32) is displayed in the Microsoft Intune admin center. The app version is provided in the **All apps** list, where you can filter by Windows catalog app (Win32) and select the optional **version** column. In the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431), select **Apps** > **All apps** > **Columns** > **Version** to display the app version in the app list. @@ -219,14 +219,33 @@ You can use scope tags to determine who can see client app information in Intune Click **Select scope tags** to optionally add scope tags for the app. Then select **Next** to display the **Review + create** step. -## Step 6: Review and create +## Step 6: Assignments + +You can select the **Required**, **Available for enrolled devices**, or **Uninstall** group assignments for the app. For more information, see [Add groups to organize users and devices](../fundamentals/groups-add.md) and [Assign apps to groups with Microsoft Intune](apps-deploy.md). + +> [!IMPORTANT] +> For the scenario when a Win32 app is deployed and assigned based on user targeting, if the Win32 app requires device admin privileges or any other permissions that the standard user of the device doesn't have, the app will fail to install. + +1. For the specific app, select an assignment type: + - **Required**: The app is installed on devices in the selected groups. + - **Available for enrolled devices**: Users install the app from the company portal app or the company portal website. + - **Uninstall**: The app is uninstalled from devices in the selected groups. +2. Select **Add group** and assign the groups that will use this app. +3. On the **Select groups** pane, select groups to assign based on users or devices. +4. After you select your groups, you can also set **End user notifications**, **Availability**, and **Installation deadline**. For more information, see [Set Win32 app availability and notifications](apps-win32-app-management.md#set-win32-app-availability-and-notifications). +5. If you don't want this app assignment to affect groups of users, select **Included** under the **MODE** column. In the **Edit assignment** pane, change the **mode** value from **Included** to **Excluded**. Select **OK** to close the **Edit assignment** pane. +6. In the **App settings** section, select the **Delivery optimization priority** value for the app. This setting will determine how the app content will be downloaded. You can choose to download the app content in background mode or foreground mode based on assignment. + +After you finish setting the assignments for the apps, select **Next** to display the **Review + create** page. + +## Step 7: Review and create 1. Review the values and settings that you entered for the app. Verify that you configured the app information correctly. 2. Select **Create** to add the app to Intune. The **Overview** pane for the LOB app appears. -At this point, you've completed steps to add a Windows catalog app (Win32) to Intune. The next step is to assign the app and set the installation properties, such as end-user notifications, restart grace periods, and delivery optimization priority. For information about app assignment and monitoring, see [Assign apps to groups with Microsoft Intune](apps-deploy.md) and [Monitor app information and assignments with Microsoft Intune](apps-monitor.md). +At this point, you've completed steps to add a Windows catalog app (Win32) to Intune. ## Next steps diff --git a/memdocs/intune/apps/apps-add-office365.md b/memdocs/intune/apps/apps-add-office365.md index 337e52c0f83..4a7528319cb 100644 --- a/memdocs/intune/apps/apps-add-office365.md +++ b/memdocs/intune/apps/apps-add-office365.md @@ -195,7 +195,7 @@ When you're unable to install the Microsoft 365 apps to a device, you must ident - There's an active network connection on the device. If the device is in airplane mode, is turned off, or is in a location with no service, the policy won't apply until network connectivity is established. - Both Intune and Microsoft 365 network requirements are met and the related IP ranges are accessible based on the following articles: - - [Intune network configuration requirements and bandwidth](/intune/network-bandwidth-use) + - [Intune network configuration requirements and bandwidth](/mem/intune/fundamentals/network-bandwidth-use) - [Office 365 URLs and IP address ranges](/office365/enterprise/urls-and-ip-address-ranges) - The correct groups have been assigned the Microsoft 365 app suite. diff --git a/memdocs/intune/apps/apps-eam-supersedence.md b/memdocs/intune/apps/apps-eam-supersedence.md new file mode 100644 index 00000000000..d1f0454b26f --- /dev/null +++ b/memdocs/intune/apps/apps-eam-supersedence.md @@ -0,0 +1,66 @@ +--- +title: Guided update supersedence for Enterprise App Management +titleSuffix: Microsoft Intune +description: Learn how to update an Enterprise App Catalog app using supersedence with Microsoft Intune. +keywords: +author: Erikre +ms.author: erikre +manager: dougeby +ms.date: 09/17/2024 +ms.topic: how-to +ms.service: microsoft-intune +ms.subservice: apps +ms.localizationpriority: medium +ms.assetid: + +ms.reviewer: nicolezhao +ms.suite: ems +search.appverid: MET150 +ms.custom: +ms.collection: +- tier1 +- M365-identity-device-management +- FocusArea_Apps_EAM +--- + +# Guided update supersedence for Enterprise App Management + +Guided update supersedence for Enterprise App Management allows you to check for updates of Windows (Win32) Enterprise App Catalog apps. You can view an available update for the app and select the option to create a new app with a supersedence relationship for the app it’s updating. Prepopulated attributes are provided when creating the new app. + +## View available updates + +In the **Overview** pane for a selected Enterprise App Catalog app, you can view the available updates by selecting the tile **Enterprise App Catalog apps with available updates**. + +:::image type="content" alt-text="Screenshot the app's Overview pane with the tile 'Enterprise App Catalog apps with available updates'." source="./media/apps-eam-supersedence/apps-eam-supersedence-01.png" lightbox="./media/apps-eam-supersedence/apps-eam-supersedence-01.png" ::: + +The **Enterprise App Catalog apps with updates** pane provides a list of Enterprise App Catalog apps that can be updated. This list provides the following app details: +- **App name**: - The name of the app. +- **Publisher**: - The publisher of the app. +- **Provisioned version**: - The currently installed app version. +- **Latest available version**: - The new version that is available. + +:::image type="content" alt-text="Screenshot the Enterprise App Catalog app list with available updates." source="./media/apps-eam-supersedence/apps-eam-supersedence-02.png" lightbox="./media/apps-eam-supersedence/apps-eam-supersedence-02.png" ::: + +## Update an Enterprise App Catalog app + +1. To update an Enterprise App Catalog app, select the *app name* to display additional options. + + You can update a specific app. This option allows you to update the app with a newer app version. Intune uses information from the Enterprise App Catalog to define properties and settings. You can review and define custom settings as needed. You should consider downloading and exporting the properties of the app before updated. + + Superseding an app creates a new app with the latest app package and sets up the supersedence relationship. Some settings, such as scope tags and assignments won't be copied to the new app. + +2. Select the **Update** option for the specific app. + The **Update application** pane is displayed. + + :::image type="content" alt-text="Screenshot an Enterprise App Catalog app list the supersedence option." source="./media/apps-eam-supersedence/apps-eam-supersedence-04.png" lightbox="./media/apps-eam-supersedence/apps-eam-supersedence-04.png" ::: + +3. Select **Supersede app**. + +4. Select your app **Assignments**, then **Review + create** the superseded app. + +## Next steps + +- [Microsoft Intune Enterprise Application Management](../apps/apps-enterprise-app-management.md) +- [Add an Enterprise App Catalog app to Microsoft Intune](../apps/apps-add-enterprise-app.md) +- [Troubleshoot Win32 app issues](apps-win32-troubleshoot.md) +- [Monitor app information and assignments with Microsoft Intune](apps-monitor.md) diff --git a/memdocs/intune/apps/apps-enterprise-app-management.md b/memdocs/intune/apps/apps-enterprise-app-management.md index b7dcfad5d1f..99b0c836698 100644 --- a/memdocs/intune/apps/apps-enterprise-app-management.md +++ b/memdocs/intune/apps/apps-enterprise-app-management.md @@ -35,7 +35,7 @@ Microsoft Intune Enterprise App Management enables you to easily discover and de The Enterprise App Management provides the following benefits: - **Streamlined app management**: You can save time and reduce complexity by streamlining the app management process. Discover and add apps directly from the Intune console. -- **Stay current with updates**: You're able to keep apps up-to-date by easily creating apps for the new versions of products as they're available in the catalog. +- **Stay current with updates**: You're able to keep apps up-to-date by easily creating apps for the new versions of products as they're available in the catalog. Use the **Enterprise App Catalog apps with updates** report. When you add an Enterprise App Catalog app, Intune prefills the following installation details: @@ -92,11 +92,11 @@ You can also upvote an application previously submitted by someone else. Applica ### Where are the devices downloading the app content from? -Microsoft hosts the applications in Microsoft storage. +Microsoft hosts the applications in Microsoft storage accessible through `*.manage.microsoft.com`. For the full list of network requirements, see [Network endpoints for Microsoft Intune](../fundamentals/intune-endpoints.md?tabs=north-america). ### Is Microsoft providing security around any of the content provided in the Enterprise App Catalog? -No. Microsoft makes no guarantee, express or implied, with respect to the security and compliance of the applications provided in the Enterprise App Catalog. +Microsoft does not assert compliance or authorizations for apps distributed via Intune. Customers are responsible for ensuring that apps meet their requirements. ### What app installer types are in the Enterprise App Catalog? @@ -116,11 +116,11 @@ The catalog has over 400+ available applications in the Enterprise App Catalog. ### How can working with the applications in Enterprise App Catalog be automated? -Graph API will be available soon after general availability. +Graph API is planned to be available soon. ### Will Enterprise catalog apps automatically update to a new version when a new version is available in the Enterprise app catalog? -No, the created app remains at the version it was created at so the IT Pro can have full control over the experience. +Updates are shown in Monitor report under Enterprise App Catalog apps with updates. The updates won't be applied automatically. You still need to go in and create a new app with supersedence relationship. ### Can you get licensed applications from this catalog? @@ -140,7 +140,7 @@ No. Enterprise App Catalog apps are directly installed by the Intune management ### How do I update my Enterprise App Catalog app? -You can configure what experience you want related to uninstalling the previous version, however the behavior of the application upgrade is controlled by the vendor. +For applications that don’t update themselves, you can view the upgrades that are available for the EAM app via supersedence. ### After several hours, what can I do if my app continues to show that it isn't ready and that the requested content is still being prepared? diff --git a/memdocs/intune/apps/apps-inc-exl-assignments.md b/memdocs/intune/apps/apps-inc-exl-assignments.md index 2c0b7af8c95..af4796d552a 100644 --- a/memdocs/intune/apps/apps-inc-exl-assignments.md +++ b/memdocs/intune/apps/apps-inc-exl-assignments.md @@ -85,7 +85,7 @@ To assign an app to groups by using the include and exclude assignment: > [!NOTE] > When you add a group, if any other group has already been included for a specific assignment type, the app is preselected and can't be modified for other include assignment types. The group that has been used can't be used as an included group. -When you make group assignments, groups that have already been assigned aren't available to be modified. If you want to select a group that currently isn't available, first remove the app from the app's assigned list. +When you make group assignments, groups that have already been assigned aren't available to be modified. If you want to select a group that currently isn't available, first remove the group from the app's assigned list. To edit assignments, in the app **Assignments** pane, select the row that contains the specific assignment that you want to change. You can also remove an assignment by selecting the ellipse (**…**) at the end of a row, and then selecting **Remove**. diff --git a/memdocs/intune/apps/apps-monitor.md b/memdocs/intune/apps/apps-monitor.md index 6025ed0a3f7..89ea6267ae6 100644 --- a/memdocs/intune/apps/apps-monitor.md +++ b/memdocs/intune/apps/apps-monitor.md @@ -8,7 +8,7 @@ keywords: author: Erikre ms.author: erikre manager: dougeby -ms.date: 12/01/2023 +ms.date: 09/17/2024 ms.topic: how-to ms.service: microsoft-intune ms.subservice: apps @@ -52,14 +52,18 @@ Intune provides several ways to monitor the properties of apps that you manage a In the app pane, you can review details about the status of an app in your environment. ### Essentials -The **Essentials** section contains the following information about the app: +The **Essentials** section provides the following information about the app if applicable: | **App details** | **Description** | |------------------------|------------------------------------------------------------------| | **Publisher** | The publisher of the app | | **Operating system** | The app operating system (Windows, iOS/iPadOS, Android, and so on) | +| **Version** | If applicable, the version number of the app | +| **MAM SDK enabled** | If applicable, whether the app uses the Intune MAM SDK (**Yes** or **No**) | | **Created** | The date and time when this revision was created **Note**: This date value is updated when an IT admin changes app metadata, such as changing the app category or app description. | -| **Assigned** | Whether the app has been assigned (**Yes** or **No**) | +| **Assigned** | Whether the app has been assigned (**Yes** or **No**) +| **App package file** | If applicable, the app package file name | + ### Device and user status graphs The graphs show the number of apps for the following status: diff --git a/memdocs/intune/apps/apps-quiet-time-policies.md b/memdocs/intune/apps/apps-quiet-time-policies.md index fdbe50505d0..9cd7d2fcb11 100644 --- a/memdocs/intune/apps/apps-quiet-time-policies.md +++ b/memdocs/intune/apps/apps-quiet-time-policies.md @@ -6,7 +6,7 @@ keywords: author: Erikre ms.author: erikre manager: dougeby -ms.date: 05/16/2024 +ms.date: 09/23/2024 ms.topic: overview ms.service: microsoft-intune ms.subservice: apps @@ -29,12 +29,13 @@ The global quiet time settings allow you to create policies to schedule quiet ti ## Quiet time policy types -There are two quiet time policy types available. The following table describes each policy type. +There are three quiet time policy types available. The following table describes each policy type. | Policy Type | Description | |---|---| | Date Range | Select this option to automatically mute Microsoft Outlook email and Teams notifications on iOS/iPadOS and Android platforms during the specified range. | | Days of the week | Select this option to automatically mute Microsoft Outlook email and Teams notifications on iOS/iPadOS and Android platforms during certain hours or all day on selected days of the week. | +| Non-working time | Select this option to automatically mute Microsoft Teams notifications on iOS/iPadOS and Android platforms when the managed account is in non-working time.

**Note**: This setting must only be configured if the tenant has been integrated with the **Working Time API**. For more information on integrating with the **Working Time API**, see [Limit access to Microsoft Teams when frontline workers are off shift](/microsoft-365/frontline/flw-working-time). Configuring this setting without integrating with the Working Time API could result in accounts missing Teams app notifications due to missing working time status for the managed account. | ## Create an iOS/iPadOS and Android quiet time policy diff --git a/memdocs/intune/apps/apps-supported-intune-apps.md b/memdocs/intune/apps/apps-supported-intune-apps.md index bda7aa933b8..2329ae3d9b3 100644 --- a/memdocs/intune/apps/apps-supported-intune-apps.md +++ b/memdocs/intune/apps/apps-supported-intune-apps.md @@ -6,7 +6,7 @@ keywords: author: Erikre ms.author: erikre manager: dougeby -ms.date: 07/29/2024 +ms.date: 10/08/2024 ms.topic: conceptual ms.service: microsoft-intune ms.subservice: apps @@ -60,47 +60,47 @@ In addition to supporting the core App Protection Policy settings, apps are also The below apps support the Core Intune App Protection Policy settings and are also capable of supporting advanced App Protection Policy and App Configuration Policy settings: -|App|Platform|[Core App Protection Policy settings](apps-supported-intune-apps.md#core-app-settings)|[App configuration](app-configuration-policies-overview.md)|Org allowed accounts ([iOS](app-configuration-policies-use-ios.md#allow-only-configured-organization-accounts-in-apps), [Android](app-configuration-policies-use-android.md#allow-only-configured-organization-accounts-in-apps))|Sync policy managed app data with native apps ([iOS](app-protection-policy-settings-ios.md#functionality), [Android](app-protection-policy-settings-android.md#functionality))|Org data notifications ([iOS](app-protection-policy-settings-ios.md#functionality), [Android](app-protection-policy-settings-android.md#functionality))|Open data into Org documents ([iOS](app-protection-policy-settings-ios.md#data-transfer), [Android](app-protection-policy-settings-android.md#data-transfer))|Save copies of org data ([iOS](app-protection-policy-settings-ios.md#data-transfer), [Android](app-protection-policy-settings-android.md#data-transfer))| +|App|Platform|[Core App Protection Policy settings](apps-supported-intune-apps.md#core-app-settings)|[App configuration](app-configuration-policies-overview.md)|Org allowed accounts ([iOS](app-configuration-policies-use-ios.md#allow-only-configured-organization-accounts-in-apps), [Android](app-configuration-policies-use-android.md#allow-only-configured-organization-accounts-in-apps))|Sync policy managed app data with native apps ([iOS](app-protection-policy-settings-ios.md#functionality), [Android](app-protection-policy-settings-android.md#functionality))|Org data notifications ([iOS](app-protection-policy-settings-ios.md#functionality), [Android](app-protection-policy-settings-android.md#functionality))|Open data into Org documents ([iOS](app-protection-policy-settings-ios.md#data-transfer), [Android](app-protection-policy-settings-android.md#data-transfer))|Save copies of org data ([iOS](app-protection-policy-settings-ios.md#data-transfer), [Android](app-protection-policy-settings-android.md#data-transfer))|Non-working time ([iOS](app-protection-policy-settings-ios.md#conditional-launch), [Android](app-protection-policy-settings-android.md#conditional-launch))| |--- |--- |:-: |--- |:-: |:-: |:-: |:-: |:-: | -|Microsoft Azure|[Android](https://play.google.com/store/apps/details?id=com.microsoft.azure&pcampaignid=web_share)|✔|No settings|✖|N/A|✖|✖|N/A| -|Microsoft Azure|[iOS](https://apps.apple.com/app/microsoft-azure/id1219013620)|✔|No settings|✖|N/A|✖|✖|N/A| -|Microsoft Copilot|[Android](https://play.google.com/store/apps/details?id=com.microsoft.copilot)|✔|No settings|✖|N/A|✖|✖|N/A| -|Microsoft Copilot|[iOS](https://apps.apple.com/us/app/microsoft-copilot/id6472538445)|✔|No settings|✔ Supported for v28.1.420324001 or later|N/A|✖|✖|N/A| -|Microsoft Edge|[Android](https://play.google.com/store/apps/details?id=com.microsoft.emmx)|✔|✔ see [Edge app config](manage-microsoft-edge.md)|✔|N/A|N/A|N/A|✔| -|Microsoft Edge|[iOS](https://apps.apple.com/us/app/microsoft-edge/id1288723196)|✔|✔ see [Edge app config](manage-microsoft-edge.md)|✔|N/A|N/A|N/A|✔| -|Microsoft Excel|[Android](https://play.google.com/store/apps/details?id=com.microsoft.office.excel)|✔|No settings|✔|N/A|✖|✖|✔| -|Microsoft Excel|[iOS](https://apps.apple.com/us/app/microsoft-excel/id586683407)|✔|No settings|✔|N/A|✖|✖|✔| -|Microsoft Launcher|[Android](https://play.google.com/store/apps/details?id=com.microsoft.launcher)|✔|✔ see [Launcher app config](configure-microsoft-launcher.md)|✖|N/A|✖|✖|N/A| -|Microsoft Lens - PDF Scanner|[Android](https://play.google.com/store/apps/details?id=com.microsoft.office.officelens)|✖|No settings|✖|N/A|✖|✖|N/A| -|Microsoft Lens - PDF Scanner|[iOS](https://apps.apple.com/us/app/microsoft-lens-pdf-scanner/id975925059)|✖|No settings|✖|N/A|✖|✖|N/A| -|Microsoft Lists|[iOS](https://apps.apple.com/us/app/microsoft-lists/id1530637363)|✔|No settings|✔|N/A|N/A|✔|✔| -|Microsoft Lists|[Android](https://play.google.com/store/apps/details?id=com.microsoft.lists.public&gl=US)|✔|No settings|✖|N/A|N/A|✖|✖| -|Microsoft Loop|[iOS](https://apps.apple.com/us/app/microsoft-loop/id1637682491)|✔|No settings|✔|N/A|✖|N/A|N/A| -|Microsoft Loop|[Android](https://play.google.com/store/apps/details?id=com.microsoft.loop)|✔|No settings|✔|N/A|✖|N/A|N/A| -|Office (Microsoft 365)|[Android](https://play.google.com/store/apps/details?id=com.microsoft.office.officehubrow)|✔|✔ see [Office app config](manage-microsoft-office.md)|✔|N/A|✖|✖|✔| -|Microsoft 365 (Office)|[iOS](https://apps.apple.com/app/microsoft-office/id541164041)|✔|✔ see [Office app config](manage-microsoft-office.md)|✔|N/A|✔ Supported for v2.72 or later|✖|✔| -|Microsoft OneDrive|[Android](https://play.google.com/store/apps/details?id=com.microsoft.skydrive)|✔|No settings|✔|N/A|✖|✔|N/A| -|Microsoft OneDrive|[iOS](https://apps.apple.com/us/app/onedrive-cloud-storage-for/id477537958)|✔|No settings|✔|N/A|✖|✔|N/A| -|Microsoft OneNote|[Android](https://play.google.com/store/apps/details?id=com.microsoft.office.onenote)|✔|No settings|✔|N/A|✖|✖|N/A| -|Microsoft OneNote|[iOS](https://apps.apple.com/us/app/microsoft-onenote-for-iphone/id410395246)|✔|No settings|✔|N/A|✖|✖|N/A| -|Microsoft Outlook|[Android](https://play.google.com/store/apps/details?id=com.microsoft.office.outlook)|✔|✔ see [Outlook app config](/exchange/clients-and-mobile-in-exchange-online/outlook-for-ios-and-android/outlook-for-ios-and-android-configuration-with-microsoft-intune)|✔|✔|✔|✔|✖| -|Microsoft Outlook|[iOS](https://apps.apple.com/us/app/microsoft-outlook/id951937596)|✔|✔ see [Outlook app config](/exchange/clients-and-mobile-in-exchange-online/outlook-for-ios-and-android/outlook-for-ios-and-android-configuration-with-microsoft-intune)|✔|✔|✔ Supports "Block org data" for v4.34.0 or later|✔|✔| -|Microsoft Planner|[Android](https://play.google.com/store/apps/details?id=com.microsoft.planner)|✔|No settings|✖|N/A|✖|✖|N/A| -|Microsoft Planner|[iOS](https://apps.apple.com/us/app/microsoft-planner/id1219301037)|✔|No settings|✖|N/A|✖|✖|N/A| -|Microsoft PowerPoint|[Android](https://play.google.com/store/apps/details?id=com.microsoft.office.powerpoint)|✔|No settings|✔|N/A|✖|✖|✔| -|Microsoft PowerPoint|[iOS](https://apps.apple.com/us/app/microsoft-powerpoint/id586449534)|✔|No settings|✔|N/A|✖|✖|✔| -|Microsoft Remote Desktop|[Android](https://play.google.com/store/apps/details?id=com.microsoft.rdc.androidx)|✔|✔|✖|N/A|N/A|N/A|N/A| -|Microsoft Remote Desktop|[iOS](https://apps.apple.com/us/app/remote-desktop-mobile/id714464092)|✔|✔|✖|N/A|N/A|N/A|N/A| -|Microsoft SharePoint|[Android](https://play.google.com/store/apps/details?id=com.microsoft.sharepoint)|✔|No settings|✖|N/A|✖|✖|N/A| -|Microsoft SharePoint|[iOS](https://apps.apple.com/us/app/microsoft-sharepoint/id1091505266)|✔|No settings|✖|N/A|✖|✖|N/A| -|Microsoft Teams|[Android](https://play.google.com/store/apps/details?id=com.microsoft.teams)|✔|No settings|✔|N/A|✔|✔|✔| -|Microsoft Teams|[iOS](https://apps.apple.com/us/app/microsoft-teams/id1113153706)|✔|No settings|✔|N/A|✔ Supported for v2.0.22 or later|✔|✔| -|Microsoft To-Do|[Android](https://play.google.com/store/apps/details?id=com.microsoft.todos)|✔|No settings|✖|N/A|✖|✖|N/A| -|Microsoft To-Do|[iOS](https://apps.apple.com/us/app/microsoft-to-do/id1212616790)|✔|No settings|✖|N/A|✖|✖|N/A| -|Microsoft Word|[Android](https://play.google.com/store/apps/details?id=com.microsoft.office.word)|✔|No settings|✔|N/A|✖|✖|✔| -|Microsoft Word|[iOS](https://apps.apple.com/us/app/microsoft-word/id586447913)|✔|No settings|✔|N/A|✖|✖|✔| -|Microsoft Viva Engage|[Android](https://play.google.com/store/apps/details?id=com.yammer.v1)|✔|No settings|✔|N/A|✖|✖|N/A| -|Microsoft Viva Engage|[iOS](https://apps.apple.com/us/app/yammer/id289559439)|✔|No settings|✔|N/A|✖|✖|N/A| +|Microsoft Azure|[Android](https://play.google.com/store/apps/details?id=com.microsoft.azure&pcampaignid=web_share)|✔|No settings|✖|N/A|✖|✖|N/A|✖| +|Microsoft Azure|[iOS](https://apps.apple.com/app/microsoft-azure/id1219013620)|✔|No settings|✖|N/A|✖|✖|N/A|✖| +|Microsoft Copilot|[Android](https://play.google.com/store/apps/details?id=com.microsoft.copilot)|✔|No settings|✖|N/A|✖|✖|N/A|✖| +|Microsoft Copilot|[iOS](https://apps.apple.com/us/app/microsoft-copilot/id6472538445)|✔|No settings|✔ Supported for v28.1.420324001 or later|N/A|✖|✖|N/A|✖| +|Microsoft Edge|[Android](https://play.google.com/store/apps/details?id=com.microsoft.emmx)|✔|✔ see [Edge app config](manage-microsoft-edge.md)|✔|N/A|N/A|N/A|✔|✔ Supported for v125.0.2535.96 or later| +|Microsoft Edge|[iOS](https://apps.apple.com/us/app/microsoft-edge/id1288723196)|✔|✔ see [Edge app config](manage-microsoft-edge.md)|✔|N/A|N/A|N/A|✔|✔ Supported for v126.2592.56 or later| +|Microsoft Excel|[Android](https://play.google.com/store/apps/details?id=com.microsoft.office.excel)|✔|No settings|✔|N/A|✖|✖|✔|✖| +|Microsoft Excel|[iOS](https://apps.apple.com/us/app/microsoft-excel/id586683407)|✔|No settings|✔|N/A|✖|✖|✔|✖| +|Microsoft Launcher|[Android](https://play.google.com/store/apps/details?id=com.microsoft.launcher)|✔|✔ see [Launcher app config](configure-microsoft-launcher.md)|✖|N/A|✖|✖|N/A|✖| +|Microsoft Lens - PDF Scanner|[Android](https://play.google.com/store/apps/details?id=com.microsoft.office.officelens)|✔|No settings|✖|N/A|✖|✖|N/A|✖| +|Microsoft Lens - PDF Scanner|[iOS](https://apps.apple.com/us/app/microsoft-lens-pdf-scanner/id975925059)|✔|No settings|✖|N/A|✖|✖|N/A|✖| +|Microsoft Lists|[iOS](https://apps.apple.com/us/app/microsoft-lists/id1530637363)|✔|No settings|✔|N/A|N/A|✔|✔|✖| +|Microsoft Lists|[Android](https://play.google.com/store/apps/details?id=com.microsoft.lists.public&gl=US)|✔|No settings|✖|N/A|N/A|✖|✖|✖| +|Microsoft Loop|[iOS](https://apps.apple.com/us/app/microsoft-loop/id1637682491)|✔|No settings|✔|N/A|✖|N/A|N/A|✖| +|Microsoft Loop|[Android](https://play.google.com/store/apps/details?id=com.microsoft.loop)|✔|No settings|✔|N/A|✖|N/A|N/A|✖| +|Office (Microsoft 365)|[Android](https://play.google.com/store/apps/details?id=com.microsoft.office.officehubrow)|✔|✔ see [Office app config](manage-microsoft-office.md)|✔|N/A|✖|✖|✔|✖| +|Microsoft 365 (Office)|[iOS](https://apps.apple.com/app/microsoft-office/id541164041)|✔|✔ see [Office app config](manage-microsoft-office.md)|✔|N/A|✔ Supported for v2.72 or later|✖|✔|✖| +|Microsoft OneDrive|[Android](https://play.google.com/store/apps/details?id=com.microsoft.skydrive)|✔|No settings|✔|N/A|✖|✔|N/A|✖| +|Microsoft OneDrive|[iOS](https://apps.apple.com/us/app/onedrive-cloud-storage-for/id477537958)|✔|No settings|✔|N/A|✖|✔|N/A|✖| +|Microsoft OneNote|[Android](https://play.google.com/store/apps/details?id=com.microsoft.office.onenote)|✔|No settings|✔|N/A|✖|✖|N/A|✖| +|Microsoft OneNote|[iOS](https://apps.apple.com/us/app/microsoft-onenote-for-iphone/id410395246)|✔|No settings|✔|N/A|✖|✖|N/A|✖| +|Microsoft Outlook|[Android](https://play.google.com/store/apps/details?id=com.microsoft.office.outlook)|✔|✔ see [Outlook app config](/exchange/clients-and-mobile-in-exchange-online/outlook-for-ios-and-android/outlook-for-ios-and-android-configuration-with-microsoft-intune)|✔|✔|✔|✔|✖|✖| +|Microsoft Outlook|[iOS](https://apps.apple.com/us/app/microsoft-outlook/id951937596)|✔|✔ see [Outlook app config](/exchange/clients-and-mobile-in-exchange-online/outlook-for-ios-and-android/outlook-for-ios-and-android-configuration-with-microsoft-intune)|✔|✔|✔ Supports "Block org data" for v4.34.0 or later|✔|✔|✖| +|Microsoft Planner|[Android](https://play.google.com/store/apps/details?id=com.microsoft.planner)|✔|No settings|✖|N/A|✖|✖|N/A|✖| +|Microsoft Planner|[iOS](https://apps.apple.com/us/app/microsoft-planner/id1219301037)|✔|No settings|✖|N/A|✖|✖|N/A|✖| +|Microsoft PowerPoint|[Android](https://play.google.com/store/apps/details?id=com.microsoft.office.powerpoint)|✔|No settings|✔|N/A|✖|✖|✔|✖| +|Microsoft PowerPoint|[iOS](https://apps.apple.com/us/app/microsoft-powerpoint/id586449534)|✔|No settings|✔|N/A|✖|✖|✔|✖| +|Microsoft Remote Desktop|[Android](https://play.google.com/store/apps/details?id=com.microsoft.rdc.androidx)|✔|✔|✖|N/A|N/A|N/A|N/A|✖| +|Microsoft Windows App|[iOS](https://apps.apple.com/us/app/remote-desktop-mobile/id714464092)|✔|✔ see [Configure device redirection](/azure/virtual-desktop/client-device-redirection-intune).|✖|N/A|N/A|N/A|N/A|✖| +|Microsoft SharePoint|[Android](https://play.google.com/store/apps/details?id=com.microsoft.sharepoint)|✔|No settings|✖|N/A|✖|✖|N/A|✖| +|Microsoft SharePoint|[iOS](https://apps.apple.com/us/app/microsoft-sharepoint/id1091505266)|✔|No settings|✖|N/A|✖|✖|N/A|✖| +|Microsoft Teams|[Android](https://play.google.com/store/apps/details?id=com.microsoft.teams)|✔|No settings|✔|N/A|✔|✔|✔|✔ Supported for v1416/1.0.0.2023226005 (2023226050) or later| +|Microsoft Teams|[iOS](https://apps.apple.com/us/app/microsoft-teams/id1113153706)|✔|No settings|✔|N/A|✔ Supported for v2.0.22 or later|✔|✔|✔ Supported for v6.9.2 or later| +|Microsoft To-Do|[Android](https://play.google.com/store/apps/details?id=com.microsoft.todos)|✔|No settings|✖|N/A|✖|✖|N/A|✖| +|Microsoft To-Do|[iOS](https://apps.apple.com/us/app/microsoft-to-do/id1212616790)|✔|No settings|✖|N/A|✖|✖|N/A|✖| +|Microsoft Word|[Android](https://play.google.com/store/apps/details?id=com.microsoft.office.word)|✔|No settings|✔|N/A|✖|✖|✔|✖| +|Microsoft Word|[iOS](https://apps.apple.com/us/app/microsoft-word/id586447913)|✔|No settings|✔|N/A|✖|✖|✔|✖| +|Microsoft Viva Engage|[Android](https://play.google.com/store/apps/details?id=com.yammer.v1)|✔|No settings|✔|N/A|✖|✖|N/A|✖| +|Microsoft Viva Engage|[iOS](https://apps.apple.com/us/app/yammer/id289559439)|✔|No settings|✔|N/A|✖|✖|N/A|✖| The below apps support the core Intune App Protection Policy settings. @@ -180,7 +180,7 @@ The following apps support the core Intune App Protection Policy settings. Apps | :::no-loc text="Dooray! for Intune":::

Partner app - Dooray! for Intune icon | Dooray! is the all-in-one collaboration solution including Task management, Messenger, Mail, Meeting, Calendar, Drive, Wiki, Workflow, Board, and more. Admins can manage policies to protect corporate data while keeping employees connected through the Microsoft Intune admin center for Dooray! for Intune.

Dooray! for Intune includes the following:

| [Google Play link (Android)](https://play.google.com/store/apps/details?id=com.dooray.intune),
[App Store link (iOS)](https://apps.apple.com/app/6448622191) | | :::no-loc text="Egnyte for Intune":::

Partner app - Egnyte for Intune icon | The Egnyte mobile app allows you to extend the office by working from anywhere with ease. You can securely access data, preview files, upload new content, collaborate on folders and file links, and edit and co-edit files in popular formats. You can also set up permissions for authorized access, create link expirations, and receive notifications when files are accessed.

Egnyte for Intune works with workspaces and devices managed by Microsoft Intune. Intune enables companies to control how the organization’s devices are used and also to configure specific policies. | [App Store link (iOS)](https://apps.apple.com/us/app/egnyte-for-intune/id1596098287) | | :::no-loc text="Egress Secure Mail for Intune":::

Partner app - Egress Secure Mail icon | Send and receive encrypted emails and files from your mobile device. Egress Secure Email provides user-friendly tools to secure sensitive data, with end-to-end encryption, access revocation and message restrictions to empower users to stay in control of the information they share.

The Egress Secure Email app requires you to be a licensed user of the Egress platform, with a valid subscription and appropriate infrastructure. | [Google Play link (Android)](https://play.google.com/store/apps/details?id=com.egress.switchdroid.intune) | -| :::no-loc text="Enterprise Files for Intune":::

Partner app - Enterprise Files for Intune icon | Integrated with Intune Mobile Application Management, the Enterprise Files for Intune app provides safe document access to multiple back-end file stores. You can provide secure access to cloud and on-premises storage with enforceable MAM Protection Polices for your data. Users can have as much control over file actions as your business needs dictate, from viewing only to edit, copy, move and delete. Whether it’s PDF annotation, video, audio or image presentations, folder management, or document review and edit, Enterprise Files for Intune is an ideal tool for the task. | [App Store link (iOS)](https://apps.apple.com/app/id6443992292) | +| :::no-loc text="Enterprise Files for Intune":::

Partner app - Enterprise Files for Intune icon | Integrated with Intune Mobile Application Management, the Enterprise Files for Intune app provides safe document access to multiple back-end file stores. You can provide secure access to cloud and on-premises storage with enforceable MAM Protection Policies for your data. Users can have as much control over file actions as your business needs dictate, from viewing only to edit, copy, move and delete. Whether it’s PDF annotation, video, audio or image presentations, folder management, or document review and edit, Enterprise Files for Intune is an ideal tool for the task. | [App Store link (iOS)](https://apps.apple.com/app/id6443992292) | | :::no-loc text="ePRINTit SaaS":::

Partner app - ePRINTit SaaS icon | ePRINTit SaaS is a mobile printing platform connecting people who need to print with print locations. Offering print services for public and corporate printing, ePRINTit’s robust offerings are convenient and accessible for customers alike. For more information, visit [www.eprintit.com](https://www.eprintit.com). | [Google Play link (Android)](https://play.google.com/store/apps/details?id=com.eprintitsaas.mobile&pli=1),
[App Store link (iOS)](https://apps.apple.com/us/app/eprintit-saas/id6443684419) | | :::no-loc text="EVALARM":::

Partner app - EVALARM icon | EVALARM is a mobile crisis communication system that automatically informs the right group of people about a crisis and provides them with individual instructions and contact lists.

This application supports crisis communication processes as part of hazard prevention management in companies, authorities, universities, schools, kindergartens, hospitals and public institutions.

To configure the EVALARM platform, you define your individual crisis scenarios, determine which people or groups of people are alerted, and determine which instructions and contact lists are to be transmitted. | [App Store link (iOS)](https://apps.apple.com/app/evalarm/id966258645) | | :::no-loc text="F2 Manager Intune":::

Partner app - F2 Manager Intune icon | F2 Manager offers a combined calender and list view to view meetings and their related items. F2 Manager supports inline annotation and submittal handling (approval process).

**Note:** To use the F2 Manager app with your business data, you must be a user of the F2 eGovernment platform, with mobile services enabled by your IT department. | [App Store link (iOS)](https://apps.apple.com/app/f2-manager-intune/id1587696871) | @@ -229,7 +229,7 @@ The following apps support the core Intune App Protection Policy settings. Apps | :::no-loc text="MyQ Roger: OCR scanner PDF":::

Partner app - MyQ Roger: OCR scanner PDF icon. | Scan all your documents with a few clicks using a smartphone, save them in your device or to your favorite cloud services (OneDrive, iCloud, Google Drive, Dropbox, or Box), and carry them wherever you go. MyQ Roger is your digital workplace assistant, allowing you to have the office in your pocket. This free app simplifies your life: at work, during studies, and on daily personal activities. Download MyQ Roger now and scan your own way. | [Google Play link (Android)](https://play.google.com/store/apps/details?id=cloud.myq.roger&hl=en&gl=US),
[App Store link (iOS)](https://apps.apple.com/us/app/myq-roger-ocr-scanner-pdf/id1543934608) | | :::no-loc text="Nexis Newsdesk™ Mobile":::

Partner app - Nexis Newsdesk Mobile icon | Newsdesk delivers relevant news from all media types – online, print, social, and broadcast – in a single destination. With the Newsdesk mobile app you will:

| [Google Play link (Android)](https://play.google.com/store/apps/details?id=com.lexisnexis.newsdesk),
[App Store link (iOS)](https://apps.apple.com/us/app/nexis-newsdesk-mobile/id1567099763) | | :::no-loc text="Nine Work for Intune":::

Partner app - Nine Work for Intune icon | Nine is a full-fledged email application for Android based on Direct Push technology to synchronize with Microsoft Exchange Server using Microsoft Exchange ActiveSync, and also designed for entrepreneurs or ordinary people who want to have efficient communication with their colleagues, friends, and family members at any time, anywhere. | [Google Play link (Android)](https://play.google.com/store/apps/details?id=com.ninefolders.hd3.work.intune) | -| :::no-loc text="Notate for Intune":::

Partner app - Notate for Microsoft Intune icon | Notate is the ultimate Exchange Information Manager. Go paperless and improve collaboration. Let Notate advance your digital transformation. | [App Store link (iOS)](https://apps.apple.com/app/notate-for-microsoft-intune/id1511979523) | +| :::no-loc text="Notate for Intune":::

Partner app - Notate for Microsoft Intune icon | Notate is the ultimate Exchange Information Manager. Go paperless and improve collaboration. Let Notate advance your digital transformation. | [Google Play link (Android)](https://play.google.com/store/apps/details?id=com.shafersystems.notate.intune&hl=en_US),
[App Store link (iOS)](https://apps.apple.com/app/notate-for-microsoft-intune/id1511979523) | | :::no-loc text="Now Mobile - Intune":::

Partner app - Now Mobile for Intune icon | Now employees can find answers and get work done across IT, HR, Facilities, Finance, Legal and other departments, all from a modern mobile app powered by the Now Platform®.

The Now Platform® delivers employee experiences and productivity through digital workflows across departments, systems and people.

Examples of things you can do in the app:

Now® Mobile powered by the Now Platform® - finally work life can be as great as real life | [Google Play link (Android)](https://play.google.com/store/apps/details?id=com.servicenow.requestor.mam.intune),
[App Store link (iOS)](https://apps.apple.com/app/now-mobile-intune/id1494183300) | | :::no-loc text="OfficeMail Go":::

Partner app - OfficeMail Go icon |OfficeMail Go is an email client app that uses ActiveSync and is integrated with Microsoft Intune. It is not only a secure and safe email client, but also an app that helps reinforce various convenience aspects. The app implements several features, including a shared mailbox and calendars for collaborating with your colleagues. Additionally, OfficeMail Go provides secure email for business use and powerful functions that support Microsoft Exchange Server and Microsoft 365. It also provides internal apps such as email, calendar, contacts, tasks, and notes in Microsoft Exchange.

OfficeMail Go is compatible with MDM solutions such as Microsoft Intune, AirWatch, Citrix, and MobileIron based on Android Enterprise. Additionally, the Intune SDK is integrated into the app, and it supports Intune app protection policies. | [Google Play link (Android)](https://play.google.com/store/apps/details?id=app.officemail.go) | | :::no-loc text="Omnipresence Go":::

Partner app - Omnipresence Go icon | Omnipresence is a Customer Experience Management platform for Life Sciences companies. You can use Omnipresence CXM to engage with customers and patients of Life Sciences companies.

Omnipresence is built by life sciences experts who understand pharma, biotech, and med-device business needs and compliance requirements. As a unified platform, functional teams can work together using a shared view of their customers and plans across devices, online and offline, in harmony with their Microsoft applications. By using Omnipresence, you can focus on enabling great customer experiences based on advanced analytics and AI that deliver insights to enrich every stage of the customer journey.| [Google Play link (Android)](https://play.google.com/store/apps/details?id=com.omnipresence.live),
[App Store link (iOS)](https://apps.apple.com/in/app/omnipresence-technologies/id1504126395#?platform=iphone) | diff --git a/memdocs/intune/apps/apps-win32-add.md b/memdocs/intune/apps/apps-win32-add.md index dc417c9304d..e2cb2c9d59c 100644 --- a/memdocs/intune/apps/apps-win32-add.md +++ b/memdocs/intune/apps/apps-win32-add.md @@ -6,7 +6,7 @@ keywords: author: Erikre ms.author: erikre manager: dougeby -ms.date: 08/08/2024 +ms.date: 09/11/2024 ms.topic: how-to ms.service: microsoft-intune ms.subservice: apps @@ -247,7 +247,7 @@ On the **Detection rules** pane, configure the rules to detect the presence of t The Intune agent checks the results from the script. It reads the values written by the script to the STDOUT stream, the standard error (STDERR) stream, and the exit code. If the script exits with a nonzero value, the script fails and the application detection status isn't installed. If the exit code is zero and STDOUT has data, the application detection status is installed. > [!NOTE] - > We recommend encoding your script as UTF-8. When the script exits with the value of **0**, the script execution was successful. The second output channel indicates that the app was detected. STDOUT data indicates that the app was found on the client. We don't look for a particular string from STDOUT. + > We recommend encoding your script as UTF-8 BOM. When the script exits with the value of **0**, the script execution was successful. The second output channel indicates that the app was detected. STDOUT data indicates that the app was found on the client. We don't look for a particular string from STDOUT. The version of your Win32 app is displayed in the Microsoft Intune admin center. The app version is provided in the **All apps** list, where you can filter by Win32 apps and select the optional **version** column. In the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431), select **Apps** > **All apps** > **Columns** > **Version** to display the app version in the app list. diff --git a/memdocs/intune/apps/apps-win32-troubleshoot.md b/memdocs/intune/apps/apps-win32-troubleshoot.md index 14737350498..291e3dfa616 100644 --- a/memdocs/intune/apps/apps-win32-troubleshoot.md +++ b/memdocs/intune/apps/apps-win32-troubleshoot.md @@ -6,7 +6,7 @@ keywords: author: Erikre ms.author: erikre manager: dougeby -ms.date: 05/13/2024 +ms.date: 09/17/2024 ms.topic: troubleshooting ms.service: microsoft-intune ms.subservice: apps @@ -114,4 +114,4 @@ For more information about troubleshooting Win32 apps, see [Win32 app installati ## Next steps -- [Troubleshoot app installation issues](/troubleshoot/mem/intune/troubleshoot-app-install) +- [Troubleshoot app installation issues](/troubleshoot/mem/intune/app-management/troubleshoot-win32-app-install) diff --git a/memdocs/intune/apps/mam-faq.yml b/memdocs/intune/apps/mam-faq.yml index e382cc3c825..5b20f335105 100644 --- a/memdocs/intune/apps/mam-faq.yml +++ b/memdocs/intune/apps/mam-faq.yml @@ -59,7 +59,7 @@ sections: questions: - question: Which apps can be managed by app protection policies? answer: | - Any app that has been integrated with the [Intune App SDK](../developer/app-sdk.md) or wrapped by the [Intune App Wrapping Tool](../developer/apps-prepare-mobile-application-management.md) can be managed using Intune app protection policies. See the official list of [Intune-managed apps](https://www.microsoft.com/cloud-platform/microsoft-intune-apps) available for public use. + Any app that has been integrated with the [Intune App SDK](../developer/app-sdk.md) or wrapped by the [Intune App Wrapping Tool](../developer/apps-prepare-mobile-application-management.md) can be managed using Intune app protection policies. See the official list of [Intune-managed apps](/mem/intune/apps/apps-supported-intune-apps) available for public use. - question: What are the baseline requirements to use app protection policies on an Intune-managed app? answer: | diff --git a/memdocs/intune/apps/mamedge-1-mamca.md b/memdocs/intune/apps/mamedge-1-mamca.md index 622ace2452c..084bbfad370 100644 --- a/memdocs/intune/apps/mamedge-1-mamca.md +++ b/memdocs/intune/apps/mamedge-1-mamca.md @@ -102,7 +102,7 @@ In the previous steps, you implemented conditional access as a required app prot :::image type="content" alt-text="Device Platform - Conditional Access policy - Microsoft Intune admin center." source="./media/securing-data-edge-for-business/securing-data-edge-for-business59.png" lightbox="./media/securing-data-edge-for-business/securing-data-edge-for-business59.png"::: -7. Select **Grant** and select **Require device to be market as compliant.** This will provide access through desktop apps only for enrolled and compliant devices. +7. Select **Grant** and select **Require device to be marked as compliant.** This will provide access through desktop apps only for enrolled and compliant devices. :::image type="content" alt-text="Grant - Conditional Access policy - Microsoft Intune admin center." source="./media/securing-data-edge-for-business/securing-data-edge-for-business60.png" lightbox="./media/securing-data-edge-for-business/securing-data-edge-for-business60.png"::: diff --git a/memdocs/intune/apps/manage-microsoft-edge.md b/memdocs/intune/apps/manage-microsoft-edge.md index 60e22aa76da..e1477d4fce6 100644 --- a/memdocs/intune/apps/manage-microsoft-edge.md +++ b/memdocs/intune/apps/manage-microsoft-edge.md @@ -8,7 +8,7 @@ keywords: author: Erikre ms.author: erikre manager: dougeby -ms.date: 02/27/2024 +ms.date: 10/24/2024 ms.topic: how-to ms.service: microsoft-intune ms.subservice: apps @@ -150,17 +150,19 @@ Edge supports the following settings for configuration: These settings can be deployed to the app regardless of device enrollment status. ### New Tab Page layout -The **Custom** layout is the default one for the new tab page. It shows top site shortcuts and news feed without wallpaper. Users can change the layout according to their preferences. Organizations can also manage the layout settings. +The **inspirational** layout is the default one for the new tab page. It shows top site shortcuts, wallpaper and news feed. Users can change the layout according to their preferences. Organizations can also manage the layout settings. |Key |Value | |:-----------|:-------------| -|com.microsoft.intune.mam.managedbrowser.NewTabPageLayout |**focused** Focused is selected
**inspirational** Inspirational is selected
**informational** (iPad/Tablet only) Informational is selected
**custom** (Default) Custom is selected, top site shortcuts toggle is on, wallpaper toggle is off, and news feed toggle is on| -|com.microsoft.intune.mam.managedbrowser.NewTabPageLayout.Custom |**topsites** Turn on top site shortcuts
**wallpaper** Turn on wallpaper
**newsfeed** Turn on news feed
In order for this policy to take effect, com.microsoft.intune.mam.managedbrowser.NewTabPageLayout must be set to **custom**

The default value is `topsites|newsfeed` | +|com.microsoft.intune.mam.managedbrowser.NewTabPageLayout |**focused** Focused is selected
**inspirational** (Default) Inspirational is selected
**informational** Informational is selected
**custom** Custom is selected, top site shortcuts toggle is on, wallpaper toggle is on, and news feed toggle is on| +|com.microsoft.intune.mam.managedbrowser.NewTabPageLayout.Custom |**topsites** Turn on top site shortcuts
**wallpaper** Turn on wallpaper
**newsfeed** Turn on news feed
In order for this policy to take effect, com.microsoft.intune.mam.managedbrowser.NewTabPageLayout must be set to **custom**

The default value is `topsites|wallpaper|newsfeed|` | |com.microsoft.intune.mam.managedbrowser.NewTabPageLayout.UserSelectable |**true** (Default) Users can change the page layout settings
**false** Users cannot change the page layout settings. The page layout is determined by the values specified via the policy or default values will be used | -> [!NOTE] +> [!IMPORTANT] > **NewTabPageLayout** policy is intended to set the initial layout. Users can change page layout settings based on their reference. Therefore, **NewTabPageLayout** policy only takes effect if users do not change layout settings. You can enforce **NewTabPageLayout** policy by configuring **UserSelectable**=false. +> [!NOTE] +> As of version 129.0.2792.84, the default page layout is changed to **inspirational**. An example of turning off the news feeds - com.microsoft.intune.mam.managedbrowser.NewTabPageLayout=**custom** @@ -188,7 +190,7 @@ This setting allows you to configure a homepage shortcut for Edge for iOS and An |Key |Value | |:-----------|:-------------| -|com.microsoft.intune.mam.managedbrowser.homepage |Specify a valid URL. Incorrect URLs are blocked as a security measure.
For example: `https://www.bing.com` | +|com.microsoft.intune.mam.managedbrowser.homepage

This policy name has been replaced by the UI of **Homepage shortcut URL** under Edge Configuration settings |Specify a valid URL. Incorrect URLs are blocked as a security measure.
For example: `https://www.bing.com` | #### Multiple top site shortcuts @@ -230,7 +232,7 @@ For ease of access, you can configure bookmarks that you'd like your users to ha |Key |Value | |:-----------|:-------------| -|com.microsoft.intune.mam.managedbrowser.bookmarks |The value for this configuration is a list of bookmarks. Each bookmark consists of the bookmark title and the bookmark URL. Separate the title and URL with the `|` character.
For example: `Microsoft Bing|https://www.bing.com`

To configure multiple bookmarks, separate each pair with the double character `||`.
For example: `Microsoft Bing|https://www.bing.com||Contoso|https://www.contoso.com`| +|com.microsoft.intune.mam.managedbrowser.bookmarks

This policy name has been replaced by the UI of **Managed bookmarks** under Edge Configuration settings |The value for this configuration is a list of bookmarks. Each bookmark consists of the bookmark title and the bookmark URL. Separate the title and URL with the `|` character.
For example: `Microsoft Bing|https://www.bing.com`

To configure multiple bookmarks, separate each pair with the double character `||`.
For example: `Microsoft Bing|https://www.bing.com||Contoso|https://www.contoso.com`| #### My Apps bookmark @@ -280,7 +282,7 @@ Edge for iOS and Android allows organizations to disable certain features that a |Key |Value | |:-----------|:-------------| -|com.microsoft.intune.mam.managedbrowser.disabledFeatures|**password** disables prompts that offer to save passwords for the end user
**inprivate** disables InPrivate browsing
**autofill** disables "Save and Fill Addresses" and "Save and Fill Payment info". Autofill will be disabled even for previously saved information
**translator** disables translator
**readaloud** disables read aloud
**drop** disables drop
**coupons** disables coupons
**extensions** disables extensions (Edge for Android only)
**developertools** grays out the build version numbers to prevent users from accessing Developer options (Edge for Android only)
**UIRAlert** suppress re-verify account popups in new tab page screen

To disable multiple features, separate values with `|`. For example, `inprivate|password` disables both InPrivate and password storage. | +|com.microsoft.intune.mam.managedbrowser.disabledFeatures|**password** disables prompts that offer to save passwords for the end user
**inprivate** disables InPrivate browsing
**autofill** disables "Save and Fill Addresses" and "Save and Fill Payment info". Autofill will be disabled even for previously saved information
**translator** disables translator
**readaloud** disables read aloud
**drop** disables drop
**coupons** disables coupons
**extensions** disables extensions (Edge for Android only)
**developertools** grays out the build version numbers to prevent users from accessing Developer options (Edge for Android only)
**UIRAlert** suppress re-verify account popups in new tab page screen
**share** disables Share under menu
**sendtodevices** disables Send to devices under menu
**weather** disables weather in NTP (New Tab Page)

To disable multiple features, separate values with `|`. For example, `inprivate|password` disables both InPrivate and password storage. | #### Disable import passwords feature @@ -314,9 +316,12 @@ Edge for Android can be enabled as a kiosk app with the following settings: |com.microsoft.intune.mam.managedbrowser.showAddressBarInKioskMode |**true** shows the address bar in kiosk mode
**false** (default) hides the address bar when kiosk mode is enabled| |com.microsoft.intune.mam.managedbrowser.showBottomBarInKioskMode |**true** shows the bottom action bar in kiosk mode
**false** (default) hides the bottom bar when kiosk mode is enabled | +> [!NOTE] +> Kiosk mode is not supported on iOS devices. However, you may want to use Locked View Mode (MDM policy only) to achieve a similar user experience, where users are unable to navigate to other websites, as the URL address bar becomes read-only in Locked View Mode. + ### Locked view mode -Edge for iOS and Android can be enabled as locked view mode with MDM policy EdgeLockedViewModeEnabled. +Edge for iOS and Android can be enabled as locked view mode with MDM policy **[EdgeLockedViewModeEnabled](/deployedge/microsoft-edge-mobile-policies#edgelockedviewmodeenabled)**. |Key |Value | |:---------|:---------| @@ -483,20 +488,11 @@ Organizations can configure a search provider for users. To configure a search p |com.microsoft.intune.mam.managedbrowser.DefaultSearchProviderName | The corresponding value is a string
**Example** `My Intranet Search` | |com.microsoft.intune.mam.managedbrowser.DefaultSearchProviderSearchURL | The corresponding value is a string
**Example** `https://search.my.company/search?q={searchTerms}`| -### Open external apps -When a web page requests to open an external app, users will see a pop-up asking them to open the external app or not. Organizations can manage the behavior. - -|Key |Value | -|:-----------|:-------------| -|com.microsoft.intune.mam.managedbrowser.OpeningExternalApps |**0** (default) Show the pop-up for users to choose stay in Edge or open by external apps.
**1** Always open within Edge without showing the pop-up.
**2** Always open with external apps without showing the pop-up. If external apps aren't installed, the behavior will be the same as value 1| - -> [!NOTE] -> As of version 120.2210.99, the app jump blocker feature is removed. External apps will be opened from Edge by default. Therefore, this policy is no longer valid from version 120.2210.99. - ### Copilot > [!NOTE] -> As of version 128, Copilot for work or school accounts has been deprecated. Therefore, the following policies will no longer be valid in version 128 +> As of version 128, Copilot for work or school accounts has been deprecated. Therefore, the following policies will no longer be valid in version 128. +> If you want to block access to the web version of Copilot, copilot.microsoft.com, you can use policy AllowListURLs or BlockListURLs. Copilot is available on Microsoft Edge for iOS and Android. Users can start Copilot by clicking on Copilot button in bottom bar. @@ -546,6 +542,16 @@ Organizations can define which sites users can access within the work or school Organizations also define what happens when a user attempts to navigate to a restricted web site. By default, transitions are allowed. If the organization allows it, restricted web sites can be opened in the personal account context, the Microsoft Entra account’s InPrivate context, or whether the site is blocked entirely. For more information on the various scenarios that are supported, see [Restricted website transitions in Microsoft Edge mobile](https://techcommunity.microsoft.com/t5/intune-customer-success/restricted-website-transitions-in-microsoft-edge-mobile/ba-p/1381333). By allowing transitioning experiences, the organization's users stay protected, while keeping corporate resources safe. +To enhance the profile-switching experience by reducing the need for users to manually switch to personal profiles or InPrivate mode to open blocked URLs, we’ve introduced two new policies: +- `com.microsoft.intune.mam.managedbrowser.AutoTransitionModeOnBlock` +- `com.microsoft.intune.mam.managedbrowser.ProfileAutoSwitchToWork` + +Since these policies bring different results based on their configurations and combinations, we recommend trying our policy suggestions below for a quick evaluation to see if the profile-switching experience aligns well with your organization’s needs before exploring detailed documentation. Suggested profile-switching configuration settings include the following values: +- `com.microsoft.intune.mam.managedbrowser.AllowTransitionOnBlock=true` +- `com.microsoft.intune.mam.managedbrowser.openInPrivateIfBlocked=true` +- `com.microsoft.intune.mam.managedbrowser.AutoTransitionModeOnBlock=1` +- `com.microsoft.intune.mam.managedbrowser.ProfileAutoSwitchToWork=2` + > [!NOTE] > Edge for iOS and Android can block access to sites only when they're accessed directly. It doesn't block access when users use intermediate services (such as a translation service) to access the site. URLs that start with **Edge**, such as `Edge://*`, `Edge://flags`, and `Edge://net-export`, aren't supported in app configuration policy **AllowListURLs** or **BlockListURLs** for managed apps. You can disable these URLs with **com.microsoft.intune.mam.managedbrowser.InternalPagesBlockList**.

If your devices are managed, you can also use app configuration policy [URLAllowList](/deployedge/microsoft-edge-mobile-policies#urlallowlist) or [URLBlocklist](/deployedge/microsoft-edge-mobile-policies#urlblocklist) for managed devices. For related information, see [Microsoft Edge mobile policies](/deployedge/microsoft-edge-mobile-policies). @@ -553,13 +559,13 @@ Use the following key/value pairs to configure either an allowed or blocked site |Key |Value | |:--|:----| -|com.microsoft.intune.mam.managedbrowser.AllowListURLs |The corresponding value for the key is a list of URLs. You enter all the URLs you want to allow as a single value, separated by a pipe `|` character.

**Examples:**
`URL1|URL2|URL3`
`http://www.contoso.com/|https://www.bing.com/|https://expenses.contoso.com` | -|com.microsoft.intune.mam.managedbrowser.BlockListURLs |The corresponding value for the key is a list of URLs. You enter all the URLs you want to block as a single value, separated by a pipe `|` character.

**Examples:**
`URL1|URL2|URL3`
`http://www.contoso.com/|https://www.bing.com/|https://expenses.contoso.com` | +|com.microsoft.intune.mam.managedbrowser.AllowListURLs

This policy name has been replaced by the UI of **Allowed URLs** under Edge Configuration settings|The corresponding value for the key is a list of URLs. You enter all the URLs you want to allow as a single value, separated by a pipe `|` character.

**Examples:**
`URL1|URL2|URL3`
`http://www.contoso.com/|https://www.bing.com/|https://expenses.contoso.com` | +|com.microsoft.intune.mam.managedbrowser.BlockListURLs

This policy name has been replaced by the UI of **Blocked URLs** under Edge Configuration settings|The corresponding value for the key is a list of URLs. You enter all the URLs you want to block as a single value, separated by a pipe `|` character.

**Examples:**
`URL1|URL2|URL3`
`http://www.contoso.com/|https://www.bing.com/|https://expenses.contoso.com` | |com.microsoft.intune.mam.managedbrowser.AllowTransitionOnBlock |**true** (default) allows Edge for iOS and Android to transition restricted sites. When personal accounts aren't disabled, users are prompted to either switch to the personal context to open the restricted site, or to add a personal account. If com.microsoft.intune.mam.managedbrowser.openInPrivateIfBlocked is set to true, users have the capability of opening the restricted site in the InPrivate context.
**false** prevents Edge for iOS and Android from transitioning users. Users are simply shown a message stating that the site they are trying to access is blocked. | -|com.microsoft.intune.mam.managedbrowser.openInPrivateIfBlocked |**true** allows restricted sites to be opened in the Microsoft Entra account's InPrivate context. If the Microsoft Entra account is the only account configured in Edge for iOS and Android, the restricted site is opened automatically in the InPrivate context. If the user has a personal account configured, the user is prompted to choose between opening InPrivate or switch to the personal account.
**false** (default) requires the restricted site to be opened in the user's personal account. If personal accounts are disabled, then the site is blocked.
In order for this setting to take effect, com.microsoft.intune.mam.managedbrowser.AllowTransitionOnBlock must be set to true. | +|com.microsoft.intune.mam.managedbrowser.openInPrivateIfBlocked

This policy name has been replaced by the UI of **Redirect restricted sites to personal context** under Edge Configuration settings |**true** allows restricted sites to be opened in the Microsoft Entra account's InPrivate context. If the Microsoft Entra account is the only account configured in Edge for iOS and Android, the restricted site is opened automatically in the InPrivate context. If the user has a personal account configured, the user is prompted to choose between opening InPrivate or switch to the personal account.
**false** (default) requires the restricted site to be opened in the user's personal account. If personal accounts are disabled, then the site is blocked.
In order for this setting to take effect, com.microsoft.intune.mam.managedbrowser.AllowTransitionOnBlock must be set to true. | |com.microsoft.intune.mam.managedbrowser.durationOfOpenInPrivateSnackBar | Enter the number of seconds that users will see the snack bar notification "Access to this site is blocked by your organization. We’ve opened it in InPrivate mode for you to access the site." By default, the snack bar notification is shown for 7 seconds.| -The following sites are always allowed regardless of the defined allow list or block list settings: +The following sites except copilot.microsoft.com are always allowed regardless of the defined allow list or block list settings: - `https://*.microsoft.com/*` - `http://*.microsoft.com/*` - `https://microsoft.com/*` @@ -568,6 +574,22 @@ The following sites are always allowed regardless of the defined allow list or b - `https://*.microsoftonline.com/*` - `https://*.microsoftonline-p.com/*` +### Control the behavior of the Site Blocked popup +When attempting to access blocked websites, users will be prompted to use either switch to InPrivate or personal account to open the blocked websites. You can choose preferences between InPrivate and personal account. + +|Key |Value | +|:--|:----| +|com.microsoft.intune.mam.managedbrowser.AutoTransitionModeOnBlock |**0**: (Default) Always show the popup window for user to choose.
**1**: Automatically switch to personal account when personal account is signed in.If personal account is not signed in, the behavior will be changed to value 2.
**2**:Automatically switch to InPrivate if InPrivate switch is allowed by com.microsoft.intune.mam.managedbrowser.openInPrivateIfBlocked=true. | + +### Control the behavior of switching personal profile to work profile +When Edge is under the personal profile and users are attempting to open a link from Outlook or Microsoft Teams which are under the work profile, by default, Intune will use the Edge work profile to open the link because both Edge, Outlook, and Microsoft Teams are managed by Intune. However, when the link is blocked, the user will be switched to the the personal profile. This causes a friction experience for users + +You can configure a policy to enhance users' experience. This policy is recommended to be used together with AutoTransitionModeOnBlock as it may switch users to the personal profile according to the policy value you configured. + +|Key |Value | +|:--|:----| +|com.microsoft.intune.mam.managedbrowser.ProfileAutoSwitchToWork |**1**: (Default) Switch to work profile even if the URL is blocked by Edge policy.
**2**: The blocked URLs will open under personal profile if personal profile is signed in. If personal profile is not signed in, the blocked URL will opened in InPrivate mode. | + #### URL formats for allowed and blocked site list You can use various URL formats to build your allowed/blocked sites lists. These permitted patterns are detailed in the following table. @@ -611,13 +633,6 @@ You can disable Edge internal pages such as `Edge://flags` and `Edge://net-expor |:--|:----| |com.microsoft.intune.mam.managedbrowser.InternalPagesBlockList | The corresponding value for the key is a list of page names. You can enter the internal pages you want to block as a single value, separated by a pipe `|` character.

**Examples:**
`flags|net-export`| -### Control the behavior of the Site Blocked popup -When attempting to access blocked websites, users will be prompted to use either switch to InPrivate or personal account to open the blocked websites. You can choose preferences between InPrivate and personal account. - -|Key |Value | -|:--|:----| -|com.microsoft.intune.mam.managedbrowser.AutoTransitionModeOnBlock |**0**: (Default) Always show the popup window for user to choose.
**1**: Automatically switch to personal account when personal account is signed in.If personal account is not signed in, the behavior will be changed to value 2.
**2**:Automatically switch to InPrivate if InPrivate switch is allowed by com.microsoft.intune.mam.managedbrowser.openInPrivateIfBlocked=true. | - ### Manage websites to allow upload files There may be scenarios where users are only allowed to view websites, without the ability to upload files. Organizations have the option to designate which websites can receive file uploads. @@ -660,7 +675,7 @@ Target Edge for iOS and Android with the following key/value pair, to enable App |Key |Value| |:-------------|:-------------| -|com.microsoft.intune.mam.managedbrowser.AppProxyRedirection |**true** enables Microsoft Entra application proxy redirection scenarios
**false** (default) prevents Microsoft Entra application proxy scenarios | +|com.microsoft.intune.mam.managedbrowser.AppProxyRedirection

This policy name has been replaced by the UI of **Application proxy redirection** under Edge Configuration settings |**true** enables Microsoft Entra application proxy redirection scenarios
**false** (default) prevents Microsoft Entra application proxy scenarios | For more information about how to use Edge for iOS and Android and Microsoft Entra application proxy in tandem for seamless (and protected) access to on-premises web apps, see [Better together: Intune and Microsoft Entra team up to improve user access](https://techcommunity.microsoft.com/t5/enterprise-mobility-security/better-together-intune-and-azure-active-directory-team-up-to/ba-p/250254). This blog post references the Intune Managed Browser, but the content applies to Edge for iOS and Android as well. @@ -670,6 +685,14 @@ Organizations may require users to authenticate with NTLM to access intranet web Organizations can enable NTLM credential caching for particular web sites. For these sites, after the user enters credentials and successfully authenticates, the credentials are cached by default for 30 days. +> [!NOTE] +> If you're using a proxy server, ensure that it's configured using the NTLMSSOURLs policy where you specifically specify both **https** and **http** as part of the key value. +> +> Currently, both **https** and **http** schemes need to be specified in the NTLMSSOURLs key value. For example, you need to configure both `https://your-proxy-server:8080` +> and `http://your-proxy-server:8080`. Currently, specifying the format as host:port (such as `your-proxy-server:8080`) is not sufficient. +> +> In addition, the wildcard symbol (*) is not supported when configuring proxy servers in the NTLMSSOURLs policy. + |Key |Value | |:---------|:---------| |com.microsoft.intune.mam.managedbrowser.NTLMSSOURLs |The corresponding value for the key is a list of URLs. You enter all the URLs you want to allow as a single value, separated by a pipe `|` character.

**Examples:**
`URL1|URL2`
`http://app.contoso.com/|https://expenses.contoso.com`

For more information on the types of URL formats that are supported, see [URL formats for allowed and blocked site list](#url-formats-for-allowed-and-blocked-site-list). | diff --git a/memdocs/intune/apps/manage-microsoft-office.md b/memdocs/intune/apps/manage-microsoft-office.md index d7e8ccd0c00..757629b2953 100644 --- a/memdocs/intune/apps/manage-microsoft-office.md +++ b/memdocs/intune/apps/manage-microsoft-office.md @@ -8,7 +8,7 @@ keywords: author: Erikre ms.author: erikre manager: dougeby -ms.date: 03/25/2024 +ms.date: 09/18/2024 ms.topic: conceptual ms.service: microsoft-intune ms.subservice: apps @@ -192,7 +192,7 @@ To manage the Microsoft 365 Feed, you can use the following key: This key can be used by managed devices and managed apps. -### Copilot with commercial data protection +### Copilot with enterprise data protection Admins can now enable or disable Copilot in Microsoft 365 app by configuring the following setting in the Intune admin center. To deploy this app setting, use an [app configuration policy](app-configuration-policies-overview.md) in Intune. diff --git a/memdocs/intune/apps/manage-without-gms.md b/memdocs/intune/apps/manage-without-gms.md index 909d0dba6fc..06790467988 100644 --- a/memdocs/intune/apps/manage-without-gms.md +++ b/memdocs/intune/apps/manage-without-gms.md @@ -38,10 +38,9 @@ Microsoft Intune uses Google Mobile Services (GMS) to communicate with the Micro > These GMS related limitations also apply to Device Administrator management and Android (AOSP) Management. > [!NOTE] -> Microsoft Intune is ending support for [Android device administrator management](../enrollment/android-enroll-device-administrator.md) on devices with access to Google Mobile Services (GMS) on August 30, 2024. After that date, device enrollment, technical support, bug fixes, and security fixes will be unavailable. +> Microsoft Intune is ending support for [Android device administrator management](../enrollment/android-enroll-device-administrator.md) on devices with access to Google Mobile Services (GMS) on December 31, 2024. After that date, device enrollment, technical support, bug fixes, and security fixes will be unavailable. > For devices running Android 15 or earlier that don't have access GMS (excluding Microsoft Teams certified Android devices), Intune will continue allowing device administrator enrollment and will maintain limited support, since Android Enterprise management is unavailable to these devices. However, device administrator use on these devices is still not recommended, since Google's device administrator deprecation means there could be future functionality impact outside Intune's ability to mitigate. -> For more information, see [Ending support for Android device administrator on GMS devices](https://techcommunity.microsoft.com/t5/intune-customer-success/microsoft-intune-ending-support-for-android-device-administrator/ba-p/3915443). - +> For more information, and to learn about alternatives to device administrator, see [Ending support for Android device administrator on GMS devices](https://techcommunity.microsoft.com/t5/intune-customer-success/microsoft-intune-ending-support-for-android-device-administrator/ba-p/3915443). ## Install the Intune Company Portal app without access to the Google Play Store ### For users outside of People's Republic of China diff --git a/memdocs/intune/apps/media/apps-eam-supersedence/apps-eam-supersedence-01.png b/memdocs/intune/apps/media/apps-eam-supersedence/apps-eam-supersedence-01.png new file mode 100644 index 00000000000..4da1ade4346 Binary files /dev/null and b/memdocs/intune/apps/media/apps-eam-supersedence/apps-eam-supersedence-01.png differ diff --git a/memdocs/intune/apps/media/apps-eam-supersedence/apps-eam-supersedence-02.png b/memdocs/intune/apps/media/apps-eam-supersedence/apps-eam-supersedence-02.png new file mode 100644 index 00000000000..1a033a93db6 Binary files /dev/null and b/memdocs/intune/apps/media/apps-eam-supersedence/apps-eam-supersedence-02.png differ diff --git a/memdocs/intune/apps/media/apps-eam-supersedence/apps-eam-supersedence-03.png b/memdocs/intune/apps/media/apps-eam-supersedence/apps-eam-supersedence-03.png new file mode 100644 index 00000000000..5a946c997e8 Binary files /dev/null and b/memdocs/intune/apps/media/apps-eam-supersedence/apps-eam-supersedence-03.png differ diff --git a/memdocs/intune/apps/media/apps-eam-supersedence/apps-eam-supersedence-04.png b/memdocs/intune/apps/media/apps-eam-supersedence/apps-eam-supersedence-04.png new file mode 100644 index 00000000000..975dcbb794e Binary files /dev/null and b/memdocs/intune/apps/media/apps-eam-supersedence/apps-eam-supersedence-04.png differ diff --git a/memdocs/intune/apps/media/apps-eam-supersedence/apps-eam-supersedence-05.png b/memdocs/intune/apps/media/apps-eam-supersedence/apps-eam-supersedence-05.png new file mode 100644 index 00000000000..dad1145306f Binary files /dev/null and b/memdocs/intune/apps/media/apps-eam-supersedence/apps-eam-supersedence-05.png differ diff --git a/memdocs/intune/apps/protect-mam-windows.md b/memdocs/intune/apps/protect-mam-windows.md index 2c42cc79503..667771bb9c6 100644 --- a/memdocs/intune/apps/protect-mam-windows.md +++ b/memdocs/intune/apps/protect-mam-windows.md @@ -49,7 +49,7 @@ You can enable protected Mobile Application Management (MAM) access to org data > For more information about MAM, see [Mobile Application Management (MAM) basics](../apps/app-management.md#mobile-application-management-mam-basics). > [!NOTE] -> The Mobile Threat Defense (MTD) Connector for the Windows Security Center (WSC) component is only supported on Windows 11. +> The Mobile Threat Defense (MTD) Connector for the Windows Security Center (WSC) component is only supported on Windows 11 version 22631 (23H2) or later. Both end-users and organizations need to have protected organizational access from personal devices. Organizations need to ensure that corporate data is protected on personal, unmanaged devices. As an Intune admin, you have the responsibility to determine how members (end-users) of your organization access corporate resources in a protected way from an unmanaged device. You need to ensure when accessing organizational data, that the unmanaged devices are healthy, the applications adhere to your organization data's protection policies, and that the end-user’s unmanaged assets on their device aren't impacted by your organization's policies. diff --git a/memdocs/intune/apps/store-apps-microsoft.md b/memdocs/intune/apps/store-apps-microsoft.md index 1179b58d2e3..a4958e2dfbb 100644 --- a/memdocs/intune/apps/store-apps-microsoft.md +++ b/memdocs/intune/apps/store-apps-microsoft.md @@ -77,6 +77,9 @@ An [Intune administrator](../fundamentals/users-add.md#types-of-administrators) The Microsoft Store provides a large variety of apps designed to work on your Microsoft devices. Within Intune, you can search and add the apps you want to assign to your workforce at your organization. +> [!IMPORTANT] +> There is no age restriction when searching for apps in the Microsoft Store. + 1. Select **Search the Microsoft Store app** to display the search panel which features a search bar and includes the following columns: - **Name** – The name of the app. @@ -90,9 +93,8 @@ The Microsoft Store provides a large variety of apps designed to work on your Mi > Specific Microsoft Store apps may not be displayed and available in Intune. Common reasons an app doesn't appear when searching within Intune include the following: > > - The app is not available in US region. - > - The app is not available if there is an age restriction. > - The app is a paid app, which is not supported. - > - The app is an Android app. + > - The app platform isn't supported in the Microsoft Store. 3. Choose the app that you want to deploy and choose **Select**. @@ -124,7 +126,7 @@ The Microsoft Store provides a large variety of apps designed to work on your Mi You can choose how you want to assign Microsoft Store apps to users and devices. > [!NOTE] -> If you assign an app to a device that is located in a region where that app is not supported or where that app does not meet the age restrictions, the app will not install on the device. However, if the device is moved to a region that supports the app, the app will install on the device. +> If you assign an app to a device that is located in a region where that app is not supported, the app will not install on the device. However, if the device is moved to a region that supports the app, the app will install on the device. The following table provides assignment type details: diff --git a/memdocs/intune/configuration/bundle-ids-built-in-ios-apps.md b/memdocs/intune/configuration/bundle-ids-built-in-ios-apps.md index abdaa073463..edf468b3732 100644 --- a/memdocs/intune/configuration/bundle-ids-built-in-ios-apps.md +++ b/memdocs/intune/configuration/bundle-ids-built-in-ios-apps.md @@ -78,6 +78,7 @@ This feature applies to: | com.apple.mobilenotes | Notes | Apple | | com.apple.Numbers | Numbers | Apple | | com.apple.Pages | Pages | Apple | +| com.apple.Passwords | Passwords | Apple | | com.apple.mobilephone | Phone | Apple | | com.apple.Photo-Booth | Photo Booth | Apple | | com.apple.mobileslideshow | Photos | Apple | diff --git a/memdocs/intune/configuration/custom-settings-android.md b/memdocs/intune/configuration/custom-settings-android.md index 20173f1fabf..57a7e577a63 100644 --- a/memdocs/intune/configuration/custom-settings-android.md +++ b/memdocs/intune/configuration/custom-settings-android.md @@ -41,9 +41,9 @@ Android custom profiles use Open Mobile Alliance Uniform Resource Identifier (OM Using a custom profile, you can configure and assign the following Android settings. The following settings aren't built in to Intune: -- [Create a Wi-Fi profile with a pre-shared key](/intune/wi-fi-profile-shared-key) -- [Create a per-app VPN profile](/intune/android-pulse-secure-per-app-vpn) -- [Allow and block apps for Samsung Knox Standard devices](/intune/samsung-knox-apps-allow-block) +- [Create a Wi-Fi profile with a pre-shared key](/mem/intune/configuration/wi-fi-profile-shared-key) +- [Create a per-app VPN profile](/mem/intune/configuration/android-pulse-secure-per-app-vpn) +- [Allow and block apps for Samsung Knox Standard devices](/mem/intune/configuration/samsung-knox-apps-allow-block) - [Configure web protection in Microsoft Defender for Endpoint for Android](../protect/advanced-threat-protection-manage-android.md) > [!IMPORTANT] diff --git a/memdocs/intune/configuration/device-profiles.md b/memdocs/intune/configuration/device-profiles.md index b32b193043a..ace0952e590 100644 --- a/memdocs/intune/configuration/device-profiles.md +++ b/memdocs/intune/configuration/device-profiles.md @@ -8,7 +8,7 @@ author: MandiOhlinger ms.author: mandia manager: dougeby -ms.date: 07/18/2024 +ms.date: 09/23/2024 ms.topic: overview ms.service: microsoft-intune ms.subservice: configuration @@ -207,6 +207,11 @@ This feature supports: ## Endpoint protection +> [!IMPORTANT] +> This template is deprecated in the August 2024 service release (2408). Existing policies continue to work. But, you can't create new policies using this template. +> +> Instead, use the settings catalog to create new policies that configure the FileVault, Firewall, and System Policy Control (Gatekeeper) payloads. To learn more, go to [macOS settings catalog](settings-catalog.md). + [Endpoint protection](../protect/endpoint-protection-configure.md) configures BitLocker and Microsoft Defender settings for Windows client devices. On macOS devices, you can also configure the firewall, gateway, and other resources. To onboard Microsoft Defender for Endpoint with Microsoft Intune, see [Configure endpoints using Mobile Device Management (MDM) tools](/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-mdm). @@ -228,6 +233,11 @@ This feature supports: ## Extensions +> [!IMPORTANT] +> This template is deprecated in the August 2024 service release (2408). Existing policies continue to work. But, you can't create new policies using this template. +> +> Instead, use the settings catalog to create new policies that configure the System Extensions payload. To learn more, go to [macOS settings catalog](settings-catalog.md). + [macOS system extensions and kernel extensions](kernel-extensions-overview-macos.md) allows administrators to add features or programs that extend the native capabilities of the operating system. Configure these settings to trust all extensions from a specific developer or partner, or allow specific extensions. This feature supports: diff --git a/memdocs/intune/configuration/device-restrictions-android-for-work.md b/memdocs/intune/configuration/device-restrictions-android-for-work.md index 92d15f11299..17ce9a929b3 100644 --- a/memdocs/intune/configuration/device-restrictions-android-for-work.md +++ b/memdocs/intune/configuration/device-restrictions-android-for-work.md @@ -360,11 +360,11 @@ Use these settings to configure a kiosk-style experience on your dedicated or fu > > Modern displays have higher pixel densities and can display equivalent 2K/4K definition images. - - **Shortcut to settings menu**: **Disable** hides the Managed Settings shortcut on the Managed Home Screen. Users can still swipe down to access the settings. On the updated Managed Home Screen workflow, the **Managed Settings** menu is available from the top bar. When set to **Not configured** (default), Intune doesn't change or update this setting. By default, the Managed Settings shortcut is shown on devices. Users can also swipe down to access these settings. On the updated Managed Home Screen workflow, users can select the settings icon to access settings. + - **Shortcut to settings menu**: **Disable** hides the Managed Settings shortcut on the Managed Home Screen. Users can still access the **Managed Settings** menu from the top bar. When set to **Not configured** (default), Intune doesn't change or update this setting. By default, the Managed Settings shortcut is shown on devices. Users can select the settings icon to access settings. - **Quick access to debug menu**: This setting controls how users access the debug menu. Your options: - - **Enable**: Users can access the debug menu easier. Specifically, they can swipe down, or use the Managed Settings shortcut or Managed Settings menu on the updated Managed Home Screen workflow. As always, they can continue to select the back button 15 times. + - **Enable**: Users can access the debug menu easier. Specifically, they can access it from the Managed Settings menu. As always, they can continue to select the back button 15 times. - **Not configured** (default): Intune doesn't change or update this setting. By default, easy access to the debug menu is turned off. Users must select the back button 15 times to open the debug menu. In the debug menu, users can: diff --git a/memdocs/intune/configuration/device-restrictions-android.md b/memdocs/intune/configuration/device-restrictions-android.md index 95beb899c40..c1bb4752902 100644 --- a/memdocs/intune/configuration/device-restrictions-android.md +++ b/memdocs/intune/configuration/device-restrictions-android.md @@ -7,7 +7,7 @@ keywords: author: MandiOhlinger ms.author: mandia manager: dougeby -ms.date: 10/23/2023 +ms.date: 09/23/2024 ms.topic: reference ms.service: microsoft-intune ms.subservice: configuration @@ -36,8 +36,7 @@ This feature applies to: - Android device administrator (DA) - - [!INCLUDE [android_device_administrator_support](../includes/android-device-administrator-support.md)] + [!INCLUDE [android_device_administrator_support](../includes/android-device-administrator-support.md)] >[!TIP] >If the settings you want are not available, you might be able to configure your devices using a [custom profile](custom-settings-android.md). @@ -48,25 +47,25 @@ Create an [Android device administrator device restrictions configuration profil ## General -- **Camera**: **Block** prevents access to the device camera. When set to **Not configured** (default), Intune doesn't change or update this setting. By default, the OS might allow access to the device camera. +- **Camera (Android 9 and earlier, Samsung KNOX Android 15 and earlier only)**: **Block** prevents access to the device camera. When set to **Not configured** (default), Intune doesn't change or update this setting. By default, the OS might allow access to the device camera. Intune only manages access to the device camera. It doesn't have access to pictures or videos. - **Copy and paste (Samsung Knox only)**: **Block** prevents copy-and-paste. **Not configured** allows copy and paste functions on devices. - **Clipboard sharing between apps (Samsung Knox only)**: **Block** prevents using the clipboard to copy-and-paste between apps. When set to **Not configured** (default), Intune doesn't change or update this setting. By default, the OS might allow copy and paste functions on devices. - **Diagnostic data submission (Samsung Knox only)**: **Block** stops users from submitting bug reports from devices. When set to **Not configured** (default), Intune doesn't change or update this setting. By default, the OS might allow users to submit the data. -- **Wipe (Samsung Knox only)**: Allows users to run a [wipe](../remote-actions/devices-wipe.md) action on devices. When set to **Not configured** (default), Intune doesn't change or update this setting. +- **Factory reset (Samsung KNOX Android 15 and earlier only)**: **Block** prevents users from factory resetting the device. When set to **Not configured** (default), Intune doesn't change or update this setting. - **Geolocation (Samsung Knox only)**: **Block** disables devices from using location information. When set to **Not configured** (default), Intune doesn't change or update this setting. By default, the OS might allow devices to use the location information. - **Power off (Samsung Knox only)**: **Block** prevents users from powering off device. It also prevents the **Number of sign-in failures before wiping device** setting from being configured, and from working. When set to **Not configured** (default), Intune doesn't change or update this setting. By default, the OS might allow users to power off devices. -- **Screen capture (Samsung Knox only)**: **Block** prevents screenshots. When set to **Not configured** (default), Intune doesn't change or update this setting. By default, the OS might let users capture the screen contents as an image. -- **Voice assistant (Samsung Knox only)**: **Block** disables the S Voice service. When set to **Not configured** (default), Intune doesn't change or update this setting. By default, the OS might allow using the S Voice service and app on devices. This setting doesn't apply to Bixby or the voice assistant for accessibility that reads the screen content aloud. +- **Screen capture (Samsung KNOX Android 15 and earlier only)**: **Block** prevents screenshots. When set to **Not configured** (default), Intune doesn't change or update this setting. By default, the OS might let users capture the screen contents as an image. +- **Voice assistant (Samsung KNOX Android 15 and earlier only)**: **Block** disables the S Voice service. When set to **Not configured** (default), Intune doesn't change or update this setting. By default, the OS might allow using the S Voice service and app on devices. This setting doesn't apply to Bixby or the voice assistant for accessibility that reads the screen content aloud. - **YouTube (Samsung Knox only)**: **Block** prevents users from using the YouTube app. When set to **Not configured** (default), Intune doesn't change or update this setting. By default, the OS might allow using the YouTube app on devices. - **Shared devices (Samsung Knox only)**: Configure a managed Samsung Knox Standard device as shared. **Allow** lets users sign in and out of devices with their Microsoft Entra credentials. Devices stay managed, whether they're in use or not. When used in with a SCEP certificate profile, this feature allows users to share a device with the same apps for all users. But, each user has their own SCEP user certificate. When users sign out, all app data is cleared. This feature is limited to LOB apps only. When set to **Not configured** (default), Intune doesn't change or update this setting. By default, the OS might prevent multiple users from signing in to the Company Portal app on devices using their Microsoft Entra credentials. -- **Block date and time changes (Samsung Knox)**: **Block** prevents users from changing the date and time settings on devices. When set to **Not configured** (default), Intune doesn't change or update this setting. By default, the OS might allow users to change the date and time settings. +- **Block date and time changes (Samsung KNOX Android 15 and earlier only)**: **Block** prevents users from changing the date and time settings on devices. When set to **Not configured** (default), Intune doesn't change or update this setting. By default, the OS might allow users to change the date and time settings. ## Password @@ -80,13 +79,13 @@ Create an [Android device administrator device restrictions configuration profil ### All Android devices -These settings apply to Android 4.0 and newer, and Knox 4.0 and newer. +These settings apply to all Android OS versions and manufacturers, except where specified. - **Maximum minutes of inactivity until screen locks**: Enter the length of time a device must be idle before the screen is automatically locked. For example, enter `5` to lock devices after 5 minutes of being idle. When the value is blank or set to **Not configured**, Intune doesn't change or update this setting. On a device, users can't set a time value greater than the configured time in the profile. Users can set a lower time value. For example, if the profile is set to `15` minutes, users can set the value to 5 minutes. Users can't set the value to 30 minutes. -- **Number of sign-in failures before wiping device**: Enter the number of wrong passwords allowed before devices are wiped, from 4-11. `0` (zero) might disable device wipe functionality. When the value is blank, Intune doesn't change or update this setting. +- **Number of sign-in failures before wiping device (Samsung KNOX Android 15 and earlier only)**: Enter the number of wrong passwords allowed before devices are wiped, from 4-11. `0` (zero) might disable device wipe functionality. When the value is blank, Intune doesn't change or update this setting. - **Password**: **Require** users to enter a password to access devices. When set to **Not configured** (default), Intune doesn't change or update this setting. By default, the OS might allow users to access devices without entering a password. @@ -118,7 +117,9 @@ These settings apply to Android 4.0 and newer, and Knox 4.0 and newer. > > If you set **Password complexity** to something other than **None**, then also set the **Password** setting to **Require**, which is found under the *All Android devices* section. Users with passwords that don't meet your complexity requirements receive a warning to update their password. If you don't set the **Password** setting to **Require**, users with weak passwords won't receive the warning. -### Android 9 and earlier, or Samsung Knox (any version) +### Android 9 and earlier, or Samsung Knox Android 15 and earlier + +These settings apply to devices running Android 9 or earlier, and all Samsung Knox devices running any Android OS version 15 and earlier. - **Minimum password length**: Enter the minimum number of characters required, from 4-16. For example, enter `6` to require at least six numbers or characters in the password length. @@ -127,8 +128,8 @@ These settings apply to Android 4.0 and newer, and Knox 4.0 and newer. - **Required password type**: Enter the required password complexity level, and whether biometric devices can be used. Your options: - **Device default** - **Low security biometric**: [Strong vs. weak biometrics](https://android-developers.googleblog.com/2018/06/better-biometrics-in-android-p.html) (opens Android's web site) - - **At least numeric**: Includes numeric characters, such as `123456789`. - - **Numeric complex**: Repeated or consecutive numbers, such as "1111" or "1234", aren't allowed. Before you assign this setting to devices, be sure to update the Company Portal app to the latest version on those devices. + - **At least numeric**: Includes numeric characters, like `123456789`. + - **Numeric complex**: Repeated or consecutive numbers, like "1111" or "1234", aren't allowed. Before you assign this setting to devices, be sure to update the Company Portal app to the latest version on those devices. When set to **Numeric complex**, and you assign the setting to devices running an Android version earlier than 5.0, then the following behavior applies: @@ -161,8 +162,8 @@ This feature is supported on Android and Samsung Knox Standard devices. - **Type of restricted apps list**: Create a list of apps to allow or block on devices. This feature is supported on Android and Samsung Knox Standard devices. Your options: - **Not configured** (default): Intune doesn't change or update this setting. - - **Prohibited apps**: List the apps (not managed by Intune) that users aren't allowed to install and run. If a user installs an app from this list, you're notified by Intune. - - **Approved apps**: List the apps that users are allowed to install. To stay compliant, users must not install other apps. Apps that are managed by Intune are automatically allowed, including the Company Portal app. + - **Prohibited apps**: List the apps (not managed by Intune) that users aren't allowed to install and run. If a user installs an app from this list, Intune notifies you. + - **Approved apps**: List the apps that users are allowed to install. To stay compliant, users must not install other apps. Intune-managed apps are automatically allowed, including the Company Portal app. - **Apps list**: **Add** your app: @@ -171,7 +172,7 @@ This feature is supported on Android and Samsung Knox Standard devices. To find the URL of an app, open the [Google Play store](https://play.google.com/store/apps), and search for the app. For example, search for `Microsoft Remote Desktop Play Store` or `Microsoft Planner`. Select the app, and copy the URL. - **App bundle ID**: Enter the app bundle ID. To get the bundle ID of an app added to Intune, [you can use the Intune admin center](../apps/get-app-bundle-id-intune-admin-center.md). - **App name**: Enter the name you want. This name is shown to users. - - **Publisher** (optional): Enter the publisher of the app, such as `Microsoft`. + - **Publisher** (optional): Enter the publisher of the app, like `Microsoft`. You can also **Import** a CSV file with details about the app, including the URL. Use the <*app url*>, <*app name*>, <*app publisher*> format. Or, **Export** an existing list that includes the restricted apps list in the same format. @@ -208,27 +209,27 @@ For each setting, add your apps: ## Cloud and Storage -- **Google backup (Samsung Knox only)**: **Block** prevents devices from syncing to Google backup. When set to **Not configured** (default), Intune doesn't change or update this setting. By default, the OS might allow using Google backup. +- **Google backup (Samsung KNOX Android 15 and earlier only)​**: **Block** prevents devices from syncing to Google backup. When set to **Not configured** (default), Intune doesn't change or update this setting. By default, the OS might allow using Google backup. - **Google account auto sync (Samsung Knox only)**: **Block** prevents the Google account auto sync feature on devices. When set to **Not configured** (default), Intune doesn't change or update this setting. By default, the OS might allow Google account settings to be automatically synchronized. - **Removable storage (Samsung Knox only)**: **Block** prevents devices from using removable storage. When set to **Not configured** (default), Intune doesn't change or update this setting. By default, the OS might allow devices to use removable storage, like an SD card. -- **Encryption on storage cards (Samsung Knox only)**: **Require** enforces that storage cards must be encrypted. When set to **Not configured** (default), Intune doesn't change or update this setting. By default, the OS might allow unencrypted storage cards to be used. Not all devices support storage card encryption. To confirm, check with the device manufacturer. +- **Encryption on storage cards (Samsung KNOX Android 15 and earlier only)​**: **Require** enforces that storage cards must be encrypted. When set to **Not configured** (default), Intune doesn't change or update this setting. By default, the OS might allow unencrypted storage cards to be used. Not all devices support storage card encryption. To confirm, check with the device manufacturer. ## Cellular and Connectivity - **Data roaming (Samsung Knox only)**: **Block** prevents data roaming over the cellular network. When set to **Not configured** (default), Intune doesn't change or update this setting. By default, the OS might allow data roaming. -- **SMS/MMS messaging (Samsung Knox only)**: **Block** prevents text messaging on devices. When set to **Not configured** (default), Intune doesn't change or update this setting. By default, the OS might allow using SMS and MMS messaging. +- **SMS/MMS messaging (Samsung KNOX Android 15 and earlier only)**: **Block** prevents text messaging on devices. When set to **Not configured** (default), Intune doesn't change or update this setting. By default, the OS might allow using SMS and MMS messaging. - **Voice dialing (Samsung Knox only)**: **Block** prevents users from using the voice dialing feature on devices. When set to **Not configured** (default), Intune doesn't change or update this setting. By default, the OS might allow voice dialing. - **Voice roaming (Samsung Knox only)**: **Block** prevents voice roaming over the cellular network. When set to **Not configured** (default), Intune doesn't change or update this setting. By default, the OS might allow voice roaming. -- **Bluetooth (Samsung Knox only)**: **Block** prevents using Bluetooth on devices. When set to **Not configured** (default), Intune doesn't change or update this setting. By default, the OS might allow using Bluetooth. +- **Bluetooth (Samsung KNOX Android 15 and earlier only)**: **Block** prevents using Bluetooth on devices. When set to **Not configured** (default), Intune doesn't change or update this setting. By default, the OS might allow using Bluetooth. - **NFC (Samsung Knox only)**: **Block** disables operations that use near field communication (NFC) on devices that support it. When set to **Not configured** (default), Intune doesn't change or update this setting. By default, the OS might allow NFC operations. -- **Wi-Fi (Samsung Knox only)**: **Block** prevents using Wi-Fi on devices. When set to **Not configured** (default), Intune doesn't change or update this setting. By default, the OS might allow using Wi-Fi. -- **Wi-Fi tethering (Samsung Knox only)**: **Block** prevents using Wi-Fi tethering on devices. When set to **Not configured** (default), Intune doesn't change or update this setting. By default, the OS might allow using Wi-Fi tethering. +- **Wi-Fi (Samsung KNOX Android 15 and earlier only)**: **Block** prevents using Wi-Fi on devices. When set to **Not configured** (default), Intune doesn't change or update this setting. By default, the OS might allow using Wi-Fi. +- **Wi-Fi tethering (Samsung KNOX Android 15 and earlier only)**: **Block** prevents using Wi-Fi tethering on devices. When set to **Not configured** (default), Intune doesn't change or update this setting. By default, the OS might allow using Wi-Fi tethering. ## Kiosk Kiosk settings apply only to Samsung Knox Standard devices running Android 10 or earlier, and only to apps you manage using Intune. -- Add apps you want to run when the device is in kiosk mode. In kiosk mode, only the apps you add run; apps not added don't run. Pre-installed browsers don't run as an app when the device is in kiosk mode. If a browser is required, consider using the [Managed Browser](../apps/manage-microsoft-edge.md). +- Add apps you want to run when the device is in kiosk mode. In kiosk mode, only the apps you add run; apps not added don't run. Preinstalled browsers don't run as an app when the device is in kiosk mode. If a browser is required, consider using the [Managed Browser](../apps/manage-microsoft-edge.md). Your app options: diff --git a/memdocs/intune/configuration/device-restrictions-ios.md b/memdocs/intune/configuration/device-restrictions-ios.md index 3cb23e0c936..6074512f15a 100644 --- a/memdocs/intune/configuration/device-restrictions-ios.md +++ b/memdocs/intune/configuration/device-restrictions-ios.md @@ -801,6 +801,9 @@ You can also: - When set to **Yes**, be sure the device has a Wi-Fi profile. If you don't assign a Wi-Fi profile, then this setting can prevent devices from connecting to the internet. For example, if this device restrictions profile is assigned before a Wi-Fi profile, then the device might be blocked from connecting to the internet. - If the device can't connect, then unenroll the device, and re-enroll with a Wi-Fi profile. Then, set this setting to **Yes** in a device restrictions profile, and assign the profile to the device. + + > [!NOTE] + > **Require devices to use Wi-Fi networks set up via configuration profiles** does not support Wi-Fi profiles deployed using [custom profiles](custom-settings-ios.md). This feature applies to: - iOS/iPadOS 14.5 and newer diff --git a/memdocs/intune/configuration/device-restrictions-windows-10.md b/memdocs/intune/configuration/device-restrictions-windows-10.md index 10070f19011..21ac048ffc0 100644 --- a/memdocs/intune/configuration/device-restrictions-windows-10.md +++ b/memdocs/intune/configuration/device-restrictions-windows-10.md @@ -1187,6 +1187,8 @@ You can exclude certain files from Microsoft Defender Antivirus scans by modifyi - **File extensions to exclude from scans and real-time protection**: Add one or more file extensions like **jpg** or **txt** to the exclusions list. Any files with these extensions aren't included in any real-time or scheduled scans. - **Processes to exclude from scans and real-time protection**: Add one or more processes of the type **.exe**, **.com**, or **.scr** to the exclusions list. These processes aren't included in any real-time, or scheduled scans. +For more information, see [Exclusions overview](/defender-endpoint/navigate-defender-endpoint-antivirus-exclusions) in the Microsoft Defender documentation. + ## Power settings These settings use the [power policy CSP](/windows/client-management/mdm/policy-csp-power), which also lists the supported Windows editions. diff --git a/memdocs/intune/configuration/kernel-extensions-overview-macos.md b/memdocs/intune/configuration/kernel-extensions-overview-macos.md index 11b5b8886a4..9ba602f763b 100644 --- a/memdocs/intune/configuration/kernel-extensions-overview-macos.md +++ b/memdocs/intune/configuration/kernel-extensions-overview-macos.md @@ -8,7 +8,7 @@ keywords: macos, kernel extensions, system extensions, microsoft intune, endpoin author: MandiOhlinger ms.author: mandia manager: dougeby -ms.date: 01/11/2024 +ms.date: 09/11/2024 ms.topic: how-to ms.service: microsoft-intune ms.subservice: configuration @@ -114,6 +114,11 @@ For more information on kernel extensions, go to [kernel extensions](https://dev ## Create the kernel extension policy +> [!IMPORTANT] +> This macOS extensions template is deprecated in the August 2024 service release (2408). Existing policies continue to work. But, you can't create new policies using this template. +> +> Instead, use the settings catalog to create new policies that configure the System Extension payload. To learn more about the settings catalog, go to [settings catalog](settings-catalog.md). + 1. Sign in to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431). 2. Select **Devices** > **Manage devices** > **Configuration** > **Create** > **New policy**. 3. Enter the following properties: diff --git a/memdocs/intune/configuration/kiosk-settings-windows.md b/memdocs/intune/configuration/kiosk-settings-windows.md index ab12dbee5b8..5324b12ffb8 100644 --- a/memdocs/intune/configuration/kiosk-settings-windows.md +++ b/memdocs/intune/configuration/kiosk-settings-windows.md @@ -100,7 +100,7 @@ Runs only one app on the device, such as a web browser or Store app. For more information on these options, see [Deploy Microsoft Edge kiosk mode](/microsoft-edge/deploy/microsoft-edge-kiosk-mode-deploy#supported-configuration-types). - - **Add Kiosk browser**: Select **Kiosk browser settings**. These settings control a web browser app on the kiosk. Be sure you get the [Kiosk browser app](https://businessstore.microsoft.com/store/details/kiosk-browser/9NGB5S5XG2KP) from the Store, add it to Intune as a [Client App](../apps/apps-add.md). Then, assign the app to the kiosk devices. + - **Add Kiosk browser**: Select **Kiosk browser settings**. These settings control a web browser app on the kiosk. Be sure you get the [Kiosk browser app](https://apps.microsoft.com/detail/9ngb5s5xg2kp?) from the Store, add it to Intune as a [Client App](../apps/apps-add.md). Then, assign the app to the kiosk devices. Enter the following settings: diff --git a/memdocs/intune/configuration/oemconfig-managed-home-screen-permissions-android.md b/memdocs/intune/configuration/oemconfig-managed-home-screen-permissions-android.md index f8dbf6f4974..1105223cf5e 100644 --- a/memdocs/intune/configuration/oemconfig-managed-home-screen-permissions-android.md +++ b/memdocs/intune/configuration/oemconfig-managed-home-screen-permissions-android.md @@ -46,7 +46,7 @@ This feature applies to: Supported OEMs include: -- Samsung +- Samsung (devices running OS 13+) - Zebra > [!NOTE] @@ -170,7 +170,7 @@ When you use the schema settings in the **Knox Service Plugin** app, the Intune For guidance on configuring the OEM app schema, use the following links: - [Blog - Frontline workers get a better experience from Microsoft and Samsung](https://techcommunity.microsoft.com/t5/microsoft-intune-blog/frontline-workers-get-a-better-experience-from-microsoft-and/ba-p/4078801) - - [Knox Service Plugin - Overview](https://docs.samsungknox.com/admin/knox-platform-for-enterprise/knox-service-plugin/welcome/) (opens Samsung's web site) + - [Knox Service Plugin - Grant special permissions for an app](https://docs.samsungknox.com/admin/knox-platform-for-enterprise/knox-service-plugin/kbas/kba-1261-grant-special-permissions-for-an-app/) (opens Samsung's web site) When you create the Intune policy, you enter the following info: diff --git a/memdocs/intune/configuration/platform-sso-macos.md b/memdocs/intune/configuration/platform-sso-macos.md index 1c4ce1c4a08..0ded4892380 100644 --- a/memdocs/intune/configuration/platform-sso-macos.md +++ b/memdocs/intune/configuration/platform-sso-macos.md @@ -162,6 +162,14 @@ This option: For more information, go to [Microsoft Entra certificate-based authentication on iOS and macOS](/entra/identity/authentication/concept-certificate-based-authentication-mobile-ios). +#### Configure keyvault recovery (optional) + +When using password sync authentication you can enable keyvault recovery to ensure that data can be recovered in the event that a user forgets their password. IT Admins should review Apple's documentation and evaluate whether using Institutional FileVault Recovery Keys is a good option for them. + +- [Manage FileVault with mobile device management](https://support.apple.com/en-ie/guide/deployment/dep0a2cb7686/web) + +- [FileVault MDM payload settings for Apple devices](https://support.apple.com/en-ie/guide/deployment/dep32bf53500/1/web/1.0) +- ## Step 2 - Create the Platform SSO policy in Intune To configure the Platform SSO policy, use the following steps to create an [Intune settings catalog](settings-catalog.md) policy. The Microsoft Enterprise SSO plug-in requires the settings listed. diff --git a/memdocs/intune/copilot/copilot-devices.md b/memdocs/intune/copilot/copilot-devices.md index 21481ca688a..df5f72f2d2d 100644 --- a/memdocs/intune/copilot/copilot-devices.md +++ b/memdocs/intune/copilot/copilot-devices.md @@ -4,8 +4,8 @@ title: Copilot in Intune shows device information and errors description: Microsoft Copilot in Intune can help you get information about your devices, compare devices, and get error information. Use this information to help you manage and troubleshoot device issues. keywords: security copilot, intune, microsoft intune, copilot, device information, device errors, device troubleshooting, analyze error code, compare devices, AI, generative-AI -author: MandiOhlinger -ms.author: mandia +author: Erikre +ms.author: erikre manager: dougeby ms.date: 04/01/2024 ms.topic: how-to diff --git a/memdocs/intune/copilot/copilot-intune-faq.md b/memdocs/intune/copilot/copilot-intune-faq.md index ae8ff1703f4..86c00f6728e 100644 --- a/memdocs/intune/copilot/copilot-intune-faq.md +++ b/memdocs/intune/copilot/copilot-intune-faq.md @@ -4,8 +4,8 @@ title: Copilot in Intune FAQ description: Get answers to common questions when using Copilot in Microsoft Intune. keywords: security copilot, intune, microsoft intune, copilot, faq -author: MandiOhlinger -ms.author: mandia +author: Erikre +ms.author: erikre manager: dougeby ms.date: 04/01/2024 ms.topic: how-to diff --git a/memdocs/intune/copilot/copilot-intune-overview.md b/memdocs/intune/copilot/copilot-intune-overview.md index 2f4e60be50b..c15da3ceec2 100644 --- a/memdocs/intune/copilot/copilot-intune-overview.md +++ b/memdocs/intune/copilot/copilot-intune-overview.md @@ -4,8 +4,8 @@ title: Microsoft Copilot in Intune features overview description: Microsoft Copilot in Intune is an AI platform. It can help you create policies, get information about existing policies, and show more details on specific settings, including their impacts on users and devices. You can also use Copilot to troubleshoot device issues. keywords: Security Copilot, Intune, Microsoft Intune, AI, Copilot, settings catalog, policies, device details, troubleshooting -author: MandiOhlinger -ms.author: mandia +author: Erikre +ms.author: erikre manager: dougeby ms.date: 04/01/2024 ms.topic: get-started @@ -164,7 +164,7 @@ For more information about using Copilot with your devices, go to [Use Microsoft ### Query with Copilot in device query -You can use Copilot to help you create KQL queries to run when using device query in Intune. +You can use Copilot to help you create Kusto Query Language (KQL) queries to run when using device query in Intune. > [!NOTE] > To use Device query in your tenant, you must have a license that includes Microsoft Intune Advanced Analytics. For more information, see [Intune add-ons](../fundamentals/intune-add-ons.md#microsoft-intune-advanced-analytics). diff --git a/memdocs/intune/copilot/security-copilot.md b/memdocs/intune/copilot/security-copilot.md index 1f227db1441..5f312d6a034 100644 --- a/memdocs/intune/copilot/security-copilot.md +++ b/memdocs/intune/copilot/security-copilot.md @@ -4,8 +4,8 @@ title: Use Copilot for Security to get device and policy information description: You can use Copilot for Security to get information about your Intune data, including devices, apps, policies, and groups managed in Intune. You can also compare policies, get device specific details, and get target info for policies. keywords: -author: MandiOhlinger -ms.author: mandia +author: Erikre +ms.author: erikre manager: dougeby ms.date: 04/01/2024 ms.topic: concept-article diff --git a/memdocs/intune/developer/app-sdk-android-phase1.md b/memdocs/intune/developer/app-sdk-android-phase1.md index 2b90fbda21d..0204f285ba7 100644 --- a/memdocs/intune/developer/app-sdk-android-phase1.md +++ b/memdocs/intune/developer/app-sdk-android-phase1.md @@ -166,8 +166,8 @@ The user is ***not*** required to sign into or even launch the Company Portal ap > [!NOTE] > Ensure that your app is compatible with the [Google Play requirements](https://developer.android.com/google/play/requirements/target-sdk). -The SDK fully supports Android API 28 (Android 9.0) through Android API 34 (Android 14). -In order to target Android API 34 (Android 14), you must use Intune App SDK `v10.0.0` or later. +The SDK fully supports Android API 28 (Android 9.0) through Android API 35 (Android 15). +In order to target Android API 35 (Android 15), you must use Intune App SDK `v11.0.0` or later. APIs 26 through 27 (Android 8.0 - 8.1) are in limited support. The Company Portal app isn't supported below Android API 26 (Android 8.0). diff --git a/memdocs/intune/developer/app-sdk-android-phase3.md b/memdocs/intune/developer/app-sdk-android-phase3.md index 238d78cf475..4f761255e49 100644 --- a/memdocs/intune/developer/app-sdk-android-phase3.md +++ b/memdocs/intune/developer/app-sdk-android-phase3.md @@ -7,7 +7,7 @@ keywords: SDK author: Erikre ms.author: erikre manager: dougeby -ms.date: 11/01/2023 +ms.date: 10/14/2024 ms.topic: reference ms.service: microsoft-intune ms.subservice: developer diff --git a/memdocs/intune/developer/app-sdk-android-phase4.md b/memdocs/intune/developer/app-sdk-android-phase4.md index aabf770f712..abb83cced5e 100644 --- a/memdocs/intune/developer/app-sdk-android-phase4.md +++ b/memdocs/intune/developer/app-sdk-android-phase4.md @@ -95,7 +95,7 @@ MAMStrictMode.global().setHandler(handler); If a check fails in a situation where your app is doing nothing incorrect, report it as mentioned above. In the meantime, it may be necessary to disable the check encountering a false positive, at least while waiting for an updated SDK. -The check, which failed will be shown in the error raised by the default handler, or will be passed to a custom handler if set. +The check that failed will be shown in the error raised by the default handler or it will be passed to a custom handler, if set. Although suppressions can be done globally, temporarily disabling per-thread at the specific call site is preferred. The following examples show various ways to disable [MAMStrictCheck.IDENTITY_NO_SUCH_FILE][MAMStrictCheck] (raised if an @@ -389,7 +389,7 @@ If the enrollment attempt fails, the account's status may change over time as th | `UNENROLLMENT_SUCCEEDED` | Unenrollment was successful.| | `UNENROLLMENT_FAILED` | The unenrollment request failed. Further details can be found in the device logs. In general, this won't occur as long as the app passes a valid (neither null nor empty) UPN. There's no direct, reliable remediation the app can take. If this value is received when unregistering a valid UPN, report as a bug to the Intune MAM team.| | `PENDING` | The initial enrollment attempt for the account is in progress. The app can block access to corporate data until the enrollment result is known, but isn't required to do so. | -| `COMPANY_PORTAL_REQUIRED` | The account is licensed for Intune, but the app can't be enrolled until the Company Portal app is installed on the device. The Intune App SDK attempts to block access to the app for the given account and direct them to install the Company Portal app. When sending this notification to the app, the Intune App SDK will show a nonblocking UI on top of the current Activity if the Activity is currently visible to the user or the next time `onResume` is called. If the user cancels out this nonblocking UI, the Intune App SDK will show a blocking UI the next time `onCreate` is called for an Activity and the current identity is managed (see below for details on troubleshooting). | +| `COMPANY_PORTAL_REQUIRED` | The account is licensed for Intune, but the app can't be enrolled until the Company Portal app is installed on the device. The Intune App SDK attempts to block access to the app for the given account and directs the user to install the Company Portal app. When sending this notification to the app, the Intune App SDK will show a nonblocking UI on top of the current Activity if the Activity is currently visible to the user or the next time `onResume` is called. If the user cancels out this nonblocking UI, the Intune App SDK will show a blocking UI the next time `onCreate` is called for an Activity and the current identity is managed (see below for details on troubleshooting). | ## (Recommended) Logging @@ -678,7 +678,7 @@ If you're unsure if any of these sections apply to your app, revisit [Key Decisi [First Policy Application Test]:#first-policy-application-test [Data Protection Tests]:#data-protection-tests [Diagnostics Information]:#recommended-diagnostics-information -[My app is not receiving or enforcing any policies]:#my-app-is-not-receiving-or-enforcing-any-policies +[My app isn't receiving or enforcing any policies]:#my-app-isnt-receiving-or-enforcing-any-policies [Stage 1: Plan the Integration]:app-sdk-android-phase1.md diff --git a/memdocs/intune/developer/app-sdk-get-started.md b/memdocs/intune/developer/app-sdk-get-started.md index aa084fae543..32d5f711591 100644 --- a/memdocs/intune/developer/app-sdk-get-started.md +++ b/memdocs/intune/developer/app-sdk-get-started.md @@ -7,7 +7,7 @@ keywords: author: Erikre ms.author: erikre manager: dougeby -ms.date: 11/14/2023 +ms.date: 10/14/2024 ms.topic: reference ms.service: microsoft-intune ms.subservice: developer @@ -51,7 +51,7 @@ You _**do not need**_ to register your app. For internal [line-of-business (LOB) You _**must**_ first register your app with Microsoft Intune and agree to the registration terms. IT administrators can then apply an app protection policy to the managed app, which will be listed as an [Partner productivity apps](../apps/apps-supported-intune-apps.md#partner-productivity-apps). -Until registration has been finished and confirmed by the Microsoft Intune team, Intune administrators won't have the option to apply app protection policy to your app's deep link. Microsoft will also add your app to its [Microsoft Intune Partners page](https://www.microsoft.com/cloud-platform/microsoft-intune-apps). There, the app's icon will be displayed to show that it supports Intune app protection policies. +Until registration has been finished and confirmed by the Microsoft Intune team, Intune administrators won't have the option to apply app protection policy to your app's deep link. Microsoft will also add your app to its Microsoft Intune Partners page. There, the app's icon will be displayed to show that it supports Intune app protection policies. ### The registration process To begin the registration process, and if you aren't already working with a Microsoft contact, fill out the [Microsoft Intune App Partner Questionnaire](https://forms.office.com/Pages/ResponsePage.aspx?id=v4j5cvGGr0GRqy180BHbR80SNPjnVA1KsGiZ89UxSdVUMEpZNUFEUzdENENOVEdRMjM5UEpWWjJFVi4u). @@ -67,7 +67,7 @@ We'll use the email addresses listed in your questionnaire response to reach out 2. After we receive all necessary information from you, we'll send you the Microsoft Intune App Partner Agreement to sign. This agreement describes the terms that your company must accept before it becomes a Microsoft Intune app partner. -3. You'll be notified when your app is successfully registered with the Microsoft Intune service and when your app is featured on the [Microsoft Intune partners](https://www.microsoft.com/cloud-platform/microsoft-intune-apps) site. +3. You'll be notified when your app is successfully registered with the Microsoft Intune service and when your app is featured on the Microsoft Intune partners site. 4. Finally, your app's deep link will be added to the next monthly Intune Service update. For example, if the registration information is finished in July, the deep link will be supported in mid-August. diff --git a/memdocs/intune/developer/app-sdk-ios-appendix.md b/memdocs/intune/developer/app-sdk-ios-appendix.md index 4970305c5a8..e2c3f845dc3 100644 --- a/memdocs/intune/developer/app-sdk-ios-appendix.md +++ b/memdocs/intune/developer/app-sdk-ios-appendix.md @@ -7,7 +7,7 @@ keywords: author: Erikre ms.author: erikre manager: dougeby -ms.date: 11/01/2023 +ms.date: 10/14/2024 ms.topic: reference ms.service: microsoft-intune ms.subservice: developer @@ -61,16 +61,16 @@ To do this, the application should make use of the `registeredAccounts:` method. ### How often does the SDK retry enrollments? -The SDK will automatically retry all previously failed enrollments on a 24-hour interval. The SDK does this to ensure that if a user's organization enabled MAM after the user signed in to the application, the user will successfully enroll and receive policies. +The SDK automatically retries all previously failed enrollments on a 24-hour interval. The SDK does this to ensure that if a user's organization enabled MAM after the user signed in to the application, the user will successfully enroll and receive policies. -The SDK will stop retrying when it detects that a user has successfully enrolled the application. This is because only one user can enroll an application at a particular time. If the user is unenrolled, the retries will begin again on the same 24-hour interval. +The SDK stops retrying when it detects that a user has successfully enrolled the application. This is because only one user can enroll an application at a particular time. If the user is unenrolled, the retries begin again on the same 24-hour interval. ### Why does the user need to be deregistered? -The SDK will take these actions in the background periodically: +The SDK takes these actions in the background periodically: -* If the application isn't yet enrolled, it will try to enroll all registered accounts every 24 hours. -* If the application is enrolled, the SDK will check for MAM policy updates every 8 hours. +* If the application isn't yet enrolled, it tries to enroll all registered accounts every 24 hours. +* If the application is enrolled, the SDK checks for MAM policy updates every 8 hours. Deregistering a user notifies the SDK that the user will no longer use the application, and the SDK can stop any of the periodic events for that user account. It also triggers an app unenroll and selective wipe if necessary. @@ -80,7 +80,7 @@ This method should be called before the user is signed out of the application. ### Are there any other ways that an application can be unenrolled? -Yes, the IT admin can send a selective wipe command to the application. This will deregister and unenroll the user, and it will wipe the user's data. The SDK automatically handles this scenario and sends a notification via the unenroll delegate method. +Yes, the IT admin can send a selective wipe command to the application. This will deregister and unenroll the user, and it wipes the user's data. The SDK automatically handles this scenario and sends a notification via the unenroll delegate method. ### Is there a sample app that demonstrates how to integrate the SDK? diff --git a/memdocs/intune/developer/app-sdk-ios-phase1.md b/memdocs/intune/developer/app-sdk-ios-phase1.md index 6d56f7568bc..b604b982fae 100644 --- a/memdocs/intune/developer/app-sdk-ios-phase1.md +++ b/memdocs/intune/developer/app-sdk-ios-phase1.md @@ -7,7 +7,7 @@ keywords: author: Erikre ms.author: erikre manager: dougeby -ms.date: 11/01/2023 +ms.date: 10/14/2024 ms.topic: reference ms.service: microsoft-intune ms.subservice: developer diff --git a/memdocs/intune/developer/app-sdk-ios-phase2.md b/memdocs/intune/developer/app-sdk-ios-phase2.md index 66ca3087b1d..0e3fa962ec8 100644 --- a/memdocs/intune/developer/app-sdk-ios-phase2.md +++ b/memdocs/intune/developer/app-sdk-ios-phase2.md @@ -7,7 +7,7 @@ keywords: author: Erikre ms.author: erikre manager: dougeby -ms.date: 11/01/2023 +ms.date: 10/14/2024 ms.topic: reference ms.service: microsoft-intune ms.subservice: developer diff --git a/memdocs/intune/developer/app-sdk-ios-phase3.md b/memdocs/intune/developer/app-sdk-ios-phase3.md index 99cda664cbb..b8ae1b08e10 100644 --- a/memdocs/intune/developer/app-sdk-ios-phase3.md +++ b/memdocs/intune/developer/app-sdk-ios-phase3.md @@ -7,7 +7,7 @@ keywords: author: Erikre ms.author: erikre manager: dougeby -ms.date: 11/01/2023 +ms.date: 10/14/2024 ms.topic: reference ms.service: microsoft-intune ms.subservice: developer diff --git a/memdocs/intune/developer/mam-tunnel-ios-xamarin-bindings.md b/memdocs/intune/developer/mam-tunnel-ios-xamarin-bindings.md index 94f1b603111..9ddaa6d4b1b 100644 --- a/memdocs/intune/developer/mam-tunnel-ios-xamarin-bindings.md +++ b/memdocs/intune/developer/mam-tunnel-ios-xamarin-bindings.md @@ -4,7 +4,7 @@ description: Use Xamarin Bindings to allow Microsoft Tunnel capabilities for iOS author: oluchic ms.author: brenduns manager: dougeby -ms.date: 09/26/2023 +ms.date: 09/12/2024 ms.topic: reference ms.service: microsoft-intune ms.subservice: developer @@ -27,9 +27,15 @@ ms.collection: # Microsoft Tunnel for MAM iOS Xamarin Bindings -> [!NOTE] +> [!IMPORTANT] +> +> Xamarin support ended on May 1, 2024 for all Xamarin SDKs including Xamarin.Forms and Intune App SDK Xamarin Bindings. The information in this article is maintained as a reference for previously created Xamarin Bindings. +> +> Xamarin.Forms has evolved into .NET Multi-platform App UI (MAUI). Existing Xamarin projects should be migrated to .NET MAUI. For more information about upgrading Xamarin projects to .NET, see the [Upgrade from Xamarin to .NET & .NET MAUI](/dotnet/maui/migration/?WT.mc_id=dotnet-35129-website) documentation. > -> The current Xamarin bindings for IOS platform only support apps targeting iOS 15.0 and higher. +> For Intune support on Android and iOS platforms, see [Intune App SDK for .NET MAUI - Android](https://www.nuget.org/packages/Microsoft.Intune.Maui.Essentials.android) and [Microsoft Intune App SDK for MAUI.iOS](https://www.nuget.org/packages/Microsoft.Intune.Maui.Essentials.iOS). +> +> > [!NOTE] > @@ -40,6 +46,7 @@ ms.collection: The Microsoft Tunnel iOS SDK Xamarin Bindings facilitate the integration of Microsoft Tunnel for MAM functionality for MAM iOS applications developed with Xamarin. These bindings empower developers by providing a straightforward means to embed tunnel connectivity features directly into their Xamarin-based applications, ensuring seamless and secure connectivity for end users. ## How it works + The Intune MAM Xamarin.iOS bindings are the native MAM Tunnel SDK with a wrapper/bridge to its public APIs. Since Xamarin/.NET apps typically use ADAL or MSAL for .NET as their Microsoft Entra auth library, and the native Intune SDK doesn't know how to call into those libraries for its own enrollment/auth scenarios, the Xamarin bindings depend on the MAM SDK bindings that also contain Objective-C MSAL library, which can share a common token cache with ADAL/MSAL for .NET. These bindings are also available as a NuGet package which developers can pull into their Xamarin.iOS project directly via the Visual Studio UI. diff --git a/memdocs/intune/enrollment/android-aosp-corporate-owned-user-associated-enroll.md b/memdocs/intune/enrollment/android-aosp-corporate-owned-user-associated-enroll.md index f3004c1b6a4..880a8923032 100644 --- a/memdocs/intune/enrollment/android-aosp-corporate-owned-user-associated-enroll.md +++ b/memdocs/intune/enrollment/android-aosp-corporate-owned-user-associated-enroll.md @@ -8,7 +8,7 @@ keywords: author: Lenewsad ms.author: lanewsad manager: dougeby -ms.date: 04/02/2024 +ms.date: 09/24/2024 ms.topic: how-to ms.service: microsoft-intune ms.subservice: enrollment @@ -40,7 +40,10 @@ Set up enrollment in Intune for corporate-owned, user-associated devices built o This article describes how to set up Android (AOSP) device management and enroll AOSP devices for use at work. -## Prerequisites +## Prerequisites + +>[!NOTE] +> Beginning October 1st, AOSP devices must have the Microsoft Intune app, version 24.7.0 or later to sync with the Microsoft Intune service. To enroll and manage AOSP devices, you must have: @@ -59,12 +62,12 @@ Create an enrollment profile to enable enrollment on devices. 1. Sign in to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431). 2. Go to **Devices** > **Enrollment**. 3. Select the **Android** tab. -4. Under **Android Open Source Project (AOSP) (Preview)**, choose **Corporate-owned, user-associated devices (Preview)**. +4. Under **Android Open Source Project (AOSP)**, choose **Corporate-owned, user-associated devices**. 5. Select **Create profile**. 6. Enter the basics for your profile: - **Name**: Give the profile a name. Note the name down for later, because you'll need it when you set up the dynamic device group. - **Description**: Enter a description for the profile. This setting is optional, but recommended. - - **Token expiration date**: Select the date the token expires, up to 90 days in the future. + - **Token expiration date**: Select the date the token expires, which can be up to 65 years in the future. - **SSID**: Identifies the network that the device will connect to. > [!NOTE] @@ -85,7 +88,7 @@ Create an enrollment profile to enable enrollment on devices. After you create a profile, Intune generates a token that's needed for enrollment. The token appears as a QR code. During device setup, when prompted to, scan the QR code to enroll the device in Intune. To view the token as a QR code, select your enrollment profile from the enrollment profile list. Then select **Token**. -You can also export the enrollment profile JSON file. To create a JSON file, select Export**. +You can also export the enrollment profile JSON file. To create a JSON file, select **Export**. > [!IMPORTANT] >- The QR code will contain any credentials provided in the profile in plain text to allow the device to successfully authenticate with the network. This is required as the user will not be able to join a network from the device. @@ -98,10 +101,10 @@ You can generate a new token to replace one that's nearing its expiration date. 1. In the [admin center](https://go.microsoft.com/fwlink/?linkid=2109431), go to **Devices** > **Enrollment**. 2. Select the **Android** tab. -3. In the **Android Open Source Project (AOSP) (Preview)** section, choose **Corporate-owned, user-associated devices (Preview)**. +3. In the **Android Open Source Project (AOSP)** section, choose **Corporate-owned, user-associated devices**. 3. Choose the profile that you want to work with. 4. Select **Token** > **Replace token**. -5. Enter the new token expiration date. Tokens must be replaced at least every 90 days. +5. Enter the token's new expiration date, which can be up to 65 years in the future. 6. Select **OK**. ### Revoke a token @@ -114,7 +117,7 @@ Revoke a token to immediately expire it and make it unusable. For example, it's 1. In the [admin center](https://go.microsoft.com/fwlink/?linkid=2109431), go to **Devices** > **Enrollment**. 2. Select the **Android** tab. -3. In the **Android Open Source Project (AOSP) (Preview)** section, choose **Corporate-owned, user-associated devices (Preview)**. +3. In the **Android Open Source Project (AOSP)** section, choose **Corporate-owned, user-associated devices**. 4. Choose the profile that you want to work with. 5. Select **Token** > **Revoke token** > **Yes**. @@ -180,6 +183,7 @@ You can take action on one device at a time. For more information about where to ## Troubleshooting ### View app versions + Find out which version of the Intune app or Microsoft Authenticator app is installed on a device. 1. Go to **Devices** and select the device name. diff --git a/memdocs/intune/enrollment/android-aosp-corporate-owned-userless-enroll.md b/memdocs/intune/enrollment/android-aosp-corporate-owned-userless-enroll.md index e8b7e943aac..2e29e256472 100644 --- a/memdocs/intune/enrollment/android-aosp-corporate-owned-userless-enroll.md +++ b/memdocs/intune/enrollment/android-aosp-corporate-owned-userless-enroll.md @@ -8,7 +8,7 @@ keywords: author: Lenewsad ms.author: lanewsad manager: dougeby -ms.date: 01/23/2024 +ms.date: 09/18/2024 ms.topic: how-to ms.service: microsoft-intune ms.subservice: enrollment @@ -46,9 +46,10 @@ Devices enrolled into Intune with this management mode are automatically set up Devices are configured in [Microsoft Entra shared device mode](/azure/active-directory/develop/msal-shared-devices) during enrollment. Devices enable single sign-on (SSO) between users across [participating apps](/azure/active-directory/develop/msal-android-shared-devices#microsoft-applications-that-support-shared-device-mode). By installing Company Portal, users can also leverage SSO when signing out of [apps that are integrated with the Intune SDK](../apps/apps-supported-intune-apps.md), even apps that don't yet participate with shared device mode. +## Prerequisites - -## Prerequisites +>[!NOTE] +> Beginning October 1st, AOSP devices must have the Microsoft Intune app, version 24.7.0 or later to sync with the Microsoft Intune service. To enroll and manage AOSP devices, you must have: @@ -59,7 +60,7 @@ You must also: * [Set Microsoft Intune as the mobile device management (MDM) authority in your tenant](../fundamentals/mdm-authority-set.md). You only need to do this once, when you first set up Intune for mobile device management. -* Assign valid licenses to all RealWear device users. For more information, see [Microsoft Intune licensing](../fundamentals/licenses.md). +* Assign valid licenses to all specialized device users. For more information, see [Microsoft Intune licensing](../fundamentals/licenses.md) and [Managing specialty devices with Microsoft Intune](../fundamentals/specialty-devices-with-intune.md). ## Create an enrollment profile @@ -71,12 +72,12 @@ Create an enrollment profile to enable enrollment on devices. 1. Sign in to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431). 2. Go to **Devices** > **Enrollment**. 3. Select the **Android** tab. -4. In the **Android Open Source Project (AOSP) (Preview)** section, choose **Corporate-owned, userless devices (Preview)**. +4. In the **Android Open Source Project (AOSP)** section, choose **Corporate-owned, userless devices**. 5. Select **Create profile**. 6. Enter the basics for your profile: - **Name**: Give the profile a name. Note the name down for later, because you'll need it when you set up the dynamic device group. - **Description**: Enter a description for the profile. This setting is optional, but recommended. - - **Token expiration date**: Select the date the token expires, up to 90 days in the future. + - **Token expiration date**: Select the date the token expires, which can be up to 90 days in the future. - **SSID**: Identifies the network that the device will connect to. > [!NOTE] @@ -97,12 +98,12 @@ Create an enrollment profile to enable enrollment on devices. ### Access enrollment token After you create a profile, Intune generates a token that's needed for enrollment. To access the token: -1. Go to **Corporate-owned, userless devices (Preview)**. +1. Go to **Corporate-owned, userless devices**. 2. From the list, select your enrollment profile. 3. Select **Tokens**. Another way to find the token is: -1. Go to **Corporate-owned, userless devices (Preview)**. +1. Go to **Corporate-owned, userless devices**. 2. Locate your profile in the list, and then select the **More** (**...**) menu that's next to it. 3. Select **View enrollment token**. @@ -110,7 +111,7 @@ The token appears as a QR code. During device setup, when prompted to, scan the You can also export the enrollment profile JSON file. To create a JSON file: -1. Go to **Corporate-owned, userless devices (Preview)**. +1. Go to **Corporate-owned, userless devices**. 2. From the list, select your enrollment profile. 3. Select **Token > Export**. @@ -124,10 +125,10 @@ Generate a new token to replace one that's nearing its expiration date. Replacin 1. In the [admin center](https://go.microsoft.com/fwlink/?linkid=2109431), go to **Devices** > **Enrollment**. 2. Select the **Android** tab. -3. In the **Android Open Source Project (AOSP) (Preview)** section, choose **Corporate-owned, userless devices (Preview)**. +3. In the **Android Open Source Project (AOSP)** section, choose **Corporate-owned, userless devices**. 4. Choose the profile that you want to work with. 5. Select **Token** > **Replace token**. -6. Enter the new token expiration date. Tokens must be replaced at least every 90 days. +6. Enter the token's new expiration date. The token must be replaced at least every 90 days. 7. Select **OK**. ### Revoke token @@ -140,7 +141,7 @@ Revoke a token to immediately expire it and make it unusable. For example, it's 1. In the [admin center](https://go.microsoft.com/fwlink/?linkid=2109431), go to **Devices** > **Enrollment**. 2. Select the **Android** tab. -3. In the **Android Open Source Project (AOSP) (Preview)** section, choose **Corporate-owned, userless devices (Preview)**. +3. In the **Android Open Source Project (AOSP)** section, choose **Corporate-owned, userless devices**. 4. Choose the profile that you want to work with. 5. Select **Token** > **Revoke token** > **Yes**. diff --git a/memdocs/intune/enrollment/android-corporate-owned-work-profile-enroll.md b/memdocs/intune/enrollment/android-corporate-owned-work-profile-enroll.md index a0578dc8780..d6a511ea3a4 100644 --- a/memdocs/intune/enrollment/android-corporate-owned-work-profile-enroll.md +++ b/memdocs/intune/enrollment/android-corporate-owned-work-profile-enroll.md @@ -8,7 +8,7 @@ keywords: author: Lenewsad ms.author: lanewsad manager: dougeby -ms.date: 05/17/2024 +ms.date: 10/28/2024 ms.topic: how-to ms.service: microsoft-intune ms.subservice: enrollment @@ -34,7 +34,7 @@ ms.collection: Android Enterprise corporate-owned devices with a work profile are single user devices intended for corporate and personal use. -End users can keep their work and personal data separate and are guaranteed that personal data and applications will remain private. Admins can control some settings and features for the entire device, including: +End users can keep their work and personal data separate and are guaranteed that personal data and applications remain private. Admins can control some settings and features for the entire device, including: - Setting requirements for the device password - Controlling Bluetooth and data roaming @@ -47,7 +47,8 @@ Intune helps you deploy apps and settings to Android Enterprise corporate-owned Devices must meet these requirements to be managed as Android Enterprise corporate-owned work profile devices: - Android OS version 8.0 and above. -- Devices must run a distribution of Android that has Google Mobile Services (GMS) connectivity. Devices must have GMS available and must be able to connect to GMS. +- Devices must run a distribution of Android that has Google Mobile Services (GMS) connectivity. Devices must have GMS available and must be able to connect to GMS. + ## Set up Android Enterprise corporate-owned work profile device management @@ -92,14 +93,14 @@ You must create an enrollment profile so that users can enroll corporate-owned w 8. Select **Next** to continue to **Scope tags**. -9. Optionally, apply one or more scope tags to limit restriction visibility and management to certain admin users in Intune. For more information about how to use scope tags, see [Use role-based access control (RBAC) and scope tags for distributed IT](../fundamentals/scope-tags.md). +9. Optionally, apply one or more scope tags to limit restriction visibility and management to certain admin users in Intune. For more information about how to use scope tags, see [Use role-based access control and scope tags for distributed IT](../fundamentals/scope-tags.md). 10. Choose **Next** to continue to **Create + review**. 11. Review your choices, and then select **Create** to finish creating the profile. ### Access enrollment token -After you create a profile, Intune generates a token that's needed for enrollment. +After you create a profile, Intune generates the token you need for enrollment. 1. Return to **Devices** > **Enrollment**, and select the Android tab. @@ -167,7 +168,7 @@ When you create the enrollment profile in the admin center, you have to select a The default token, *corporate-owned work profile*, enrolls devices into Microsoft Intune as standard Android Enterprise corporate-owned devices with work profiles. This token requires you to complete pre-provisioning steps before you distribute the devices. End users complete the remaining steps on the device when they sign in with their work or school account. -The device staging token, *Corporate-owned work profile, via staging*, enrolls devices into Microsoft Intune in a staging mode so that you or a third party vendor can complete all pre-provisioning steps. End users complete the last step of provisioning by signing into the Microsoft Intune app with their work or school account. Devices are ready to use upon sign-in. Intune supports device staging for Android Enterprise devices running Android 8 or later. +The device staging token, *Corporate-owned work profile, via staging*, enrolls devices into Microsoft Intune in a staging mode so that you or a partner vendor can complete all pre-provisioning steps. End users complete the last step of provisioning by signing into the Microsoft Intune app with their work or school account. Devices are ready to use upon sign-in. Intune supports device staging for Android Enterprise devices running Android 8 or later. For more information, see [Device staging overview](device-staging-overview.md). @@ -181,6 +182,12 @@ To remove an app from Android Enterprise corporate-owned work profile devices, y - Delete the Required app deployment. - Create an uninstall deployment for the app. +## Limitations + +The limitations in this section apply to corporate-owned devices with a work profile. + +Private space is a feature introduced with Android 15 that lets people create a space on their device for sensitive apps and data they want to keep hidden. The private space is considered a personal profile. Microsoft Intune doesn't support mobile device management within the private space or provide technical support for devices that attempt to enroll the private space. + ## Next steps - [Deploy Android apps](../apps/apps-deploy.md) - [Add Android configuration policies](../configuration/device-profiles.md) diff --git a/memdocs/intune/enrollment/android-dedicated-devices-fully-managed-enroll.md b/memdocs/intune/enrollment/android-dedicated-devices-fully-managed-enroll.md index 9b4cc58982b..2be5a0094cb 100644 --- a/memdocs/intune/enrollment/android-dedicated-devices-fully-managed-enroll.md +++ b/memdocs/intune/enrollment/android-dedicated-devices-fully-managed-enroll.md @@ -160,9 +160,12 @@ For corporate-owned work profile (COPE) devices, the NFC enrollment method is on ## Enroll by using a token We recommend this method for new or factory-reset devices, in scenarios where the QR code or NFC method aren't available. It requires the person provisioning the device to type in the enrollment token string (example: `12345`) that they're provided. When you're ready for enrollment, share the token directly with targeted users or post it to your organization's support site for easy retrieval. The token works for all Intune-licensed users and doesn't expire. -This method is supported on corporate-owned devices running Android 8.0 and later. It isn't supported with device enrollment manager accounts. +This method is supported on corporate-owned devices running Android 8.0 and later. It isn't supported on: -You can use this method in conjunction with the Microsoft Intune DPC identifier to set up fully managed devices. The DPC identifier method isn't supported on corporate-owned, personally enabled (COPE) devices running Android 11 and later. +* Corporate-owned, personally enabled (COPE) devices running Android 11 and later. +* Devices enrolled via device enrollment manager accounts. + +You can use this method in conjunction with the Microsoft Intune DPC identifier to set up fully managed devices. 1. Turn on the device. 2. On the **Welcome** screen, select your language. diff --git a/memdocs/intune/enrollment/android-enroll-device-administrator.md b/memdocs/intune/enrollment/android-enroll-device-administrator.md index 6415449397b..c13c4eac4ec 100644 --- a/memdocs/intune/enrollment/android-enroll-device-administrator.md +++ b/memdocs/intune/enrollment/android-enroll-device-administrator.md @@ -8,7 +8,7 @@ keywords: author: Lenewsad ms.author: lanewsad manager: dougeby -ms.date: 04/05/2024 +ms.date: 10/28/2024 ms.topic: how-to ms.service: microsoft-intune ms.subservice: enrollment @@ -34,7 +34,7 @@ ms.collection: [!INCLUDE [android_device_administrator_support](../includes/android-device-administrator-support.md)] -Android device administrator (sometimes referred to *legacy* Android management and released with Android 2.2) is a way to manage Android devices. However, improved management functionality is available with [Android Enterprise](https://www.android.com/enterprise/management/) in [countries where Android Enterprise is available](https://support.google.com/work/android/answer/6270910). In an effort to move to modern, richer, and more secure device management, Google deprecated Android device administrator management in 2020 and Intune will be ending support for device administrator devices with access to Google Mobile Services at the end of 2024. +Android device administrator (sometimes referred to *legacy* Android management and released with Android 2.2) is a way to manage Android devices. However, improved management functionality is available with [Android Enterprise](https://www.android.com/enterprise/management/) in [countries/regions where Android Enterprise is available](https://support.google.com/work/android/answer/6270910). Google deprecated Android device administrator management in 2020. Intune is ending support for device administrator devices with access to Google Mobile Services at the end of 2024. Therefore, we advise against enrolling new devices using the device administrator process described here and we also recommend that you migrate devices off of device administrator management. @@ -44,7 +44,7 @@ If you still decide to have users enroll their Android devices with device admin ## Set up device administrator enrollment -1. To prepare to manage mobile devices, you must set the mobile device management (MDM) authority to **Microsoft Intune**. See [Set the MDM authority](../fundamentals/mdm-authority-set.md) for instructions. You set this item only once, when you are first setting up Intune for mobile device management. +1. To prepare to manage mobile devices, you must set the mobile device management (MDM) authority to **Microsoft Intune**. See [Set the MDM authority](../fundamentals/mdm-authority-set.md) for instructions. You only need to configure this setting in your tenant once. 2. Sign in to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431). 3. Go to **Devices** > **Enrollment. 4. Select the **Android** tab. @@ -52,11 +52,13 @@ If you still decide to have users enroll their Android devices with device admin 6. Select the checkmark next to **Use device administrator to manage devices**. 7. [Tell your users how to enroll their devices](../user-help/enroll-device-android-company-portal.md). -After a user has enrolled, you can begin managing their devices in Intune, including [assigning compliance policies](../protect/compliance-policy-create-android.md), [managing apps](../apps/app-management.md), and more. +After a user enrolls, you can begin managing their devices in Intune, including [assigning compliance policies](../protect/compliance-policy-create-android.md), [managing apps](../apps/app-management.md), and more. -For information about other user tasks, see these articles: -- [Resources about the end-user experience with Microsoft Intune](../fundamentals/intune-planning-guide.md) -- [Using your Android device with Intune](../user-help/why-enroll-android-device.md) +For information about other user tasks, see these articles: + +- [Microsoft Intune planning guide](../fundamentals/intune-planning-guide.md) + +- [Android device enrollment overview ](../user-help/why-enroll-android-device.md) ## Block device administrator enrollment To block Android device administrator devices, or to block only personally owned Android device administrator devices from enrollment, see [Set device type restrictions](enrollment-restrictions-set.md). @@ -65,7 +67,24 @@ To block Android device administrator devices, or to block only personally owned [Microsoft Teams certified Android devices](/microsoftteams/devices/teams-ip-phones) should continue being managed with device administrator management until [AOSP user-associated](android-aosp-corporate-owned-user-associated-enroll.md) management becomes available for these devices. -To unenroll a Microsoft Teams certified Android device that's enrolled in Android device administrator, sign in to the [Microsoft 365 admin center](https://admin.microsoft.com/) and deselect the Intune license from the Teams account for the Android device. After you remove an Intune license, there is a 30 day grace period in which the device still functions. The device will have to sign in again after this step to avoid enrolling in Intune under device administrator management again. +To unenroll a Microsoft Teams-certified Android device you manage with Android device administrator, you must: + +1. Sign in to the [Microsoft 365 admin center](https://admin.microsoft.com/). +1. Deselect the Intune license from the Teams account for the Android device. + +After you remove an Intune license, there's a 30 day grace period, during which the device still functions. The device must sign in again after this step to avoid enrolling in Intune under device administrator management again. + +## Limitations + +The limitations in this section apply to devices managed with device administrator. + +Private space is a feature introduced with Android 15 that lets people create a space on their device for sensitive apps and data they want to keep hidden. + + * The private space is considered a personal profile. Microsoft Intune doesn't support mobile device management within the private space or provide technical support for devices that attempt to enroll the private space. + + * Users might try to create a work profile-like experience on their devices by enrolling only the private space, leading to partial device management. Microsoft Intune doesn't provide support for this scenario. To avoid this issue, we recommend using [personal work profile management](android-work-profile-enroll.md) or [corporate-owned work profile management](android-corporate-owned-work-profile-enroll.md) instead of device administrator management. + + * After a user enrolls their personal device, if they attempt to enroll the private space, Intune will initiate the personal work profile enrollment flow. However, in this scenario the enrollment process will fail without any notification. ## Next steps - [Assign compliance policies](../protect/compliance-policy-create-android.md) diff --git a/memdocs/intune/enrollment/android-fully-managed-enroll.md b/memdocs/intune/enrollment/android-fully-managed-enroll.md index 605aae55f8c..6aa7144dc92 100644 --- a/memdocs/intune/enrollment/android-fully-managed-enroll.md +++ b/memdocs/intune/enrollment/android-fully-managed-enroll.md @@ -67,7 +67,7 @@ To create a new enrollment profile: 1. Go to **Devices** > **Enrollment**. 1. Select the **Android** tab. 1. Under **Android Enterprise** > **Enrollment Profiles**, choose **Corporate-owned, fully managed user devices**. -1. Select **Create profile**. +1. Select **Create policy**. 1. Enter the basics for your profile: - **Name**: Give the profile a name. Note the name down for later, because you need it when you set up the dynamic device group. diff --git a/memdocs/intune/enrollment/android-work-profile-enroll.md b/memdocs/intune/enrollment/android-work-profile-enroll.md index a0bcad7f741..a76861d2d56 100644 --- a/memdocs/intune/enrollment/android-work-profile-enroll.md +++ b/memdocs/intune/enrollment/android-work-profile-enroll.md @@ -8,7 +8,7 @@ keywords: author: Lenewsad ms.author: lanewsad manager: dougeby -ms.date: 6/28/2024 +ms.date: 10/28/2024 ms.topic: how-to ms.service: microsoft-intune ms.subservice: enrollment @@ -33,7 +33,7 @@ ms.collection: # Set up enrollment of Android Enterprise personally owned work profile devices -Set up enrollment for bring-your-own-device (BYOD) and personal device scenarios using the *Android Enterprise personally owned work profile* management solution. During enrollment, a work profile is created on the device to house work apps and work data. The work profile can be managed by Microsoft Intune policies. Personal apps and data stay separate in another part of the device and remain unaffected by Intune. +Set up enrollment for bring-your-own-device (BYOD) and personal device scenarios using the *Android Enterprise personally owned work profile* management solution. During enrollment, a work profile is created on the device to house work apps and work data. You can use Microsoft Intune policies to manage the work profile and its contents. Personal apps and data stay separate in another part of the device and remain unaffected by Intune. For more information about Android Enterprise work profile features, see [Work profiles](https://support.google.com/work/android/answer/9563584) (opens Android Enterprise Help). @@ -68,7 +68,7 @@ Complete these steps to set up enrollment for Android Enterprise devices in BYOD [!INCLUDE [android_device_administrator_support](../includes/android-device-administrator-support.md)] 10. Select **Next** to continue to **Scope tags**. -11. Optionally, apply one or more scope tags to limit visibility and management of restrictions to certain admin users in Intune. For more information about how to use scope tags, see [Use role-based access control (RBAC) and scope tags for distributed IT](../fundamentals/scope-tags.md). +11. Optionally, apply one or more scope tags to limit visibility and management of restrictions to certain admin users in Intune. For more information about how to use scope tags, see [Use role-based access control and scope tags for distributed IT](../fundamentals/scope-tags.md). 12. Select **Next** to continue to **Assignments**. 13. Assign the restriction to all users, or select specific groups. 14. Select **Next** to continue to **Review + create**. @@ -86,7 +86,17 @@ For more information and screenshots of the end user experience, see [Enroll dev ## Data shared with Google -Microsoft Intune shares certain user and device information with Google when Android Enterprise device management is enabled. For more information, see [Data Intune sends to Google](../protect/data-intune-sends-to-google.md). +Microsoft Intune shares certain user and device information with Google when Android Enterprise device management is enabled. For more information, see [Data Intune sends to Google](../protect/data-intune-sends-to-google.md). + +## Limitations + +The limitations in this section apply to personal devices with a work profile. + +Private space is a feature introduced with Android 15 that lets people create a space on their device for sensitive apps and data they want to keep hidden. + + * The private space is considered a personal profile. Microsoft Intune doesn't support mobile device management within the private space or provide technical support for devices that attempt to enroll the private space. + + * If users attempt to enroll the private space after they enroll the device, Intune will initiate the device administrator enrollment process. The second enrollment causes two enrollment records to appear in the Microsoft Intune admin center: one under work profile management and one under device administrator management. Microsoft Intune doesn't provide support for this scenario. ## Next steps - [Deploy Android Enterprise apps](../apps/apps-add-android-for-work.md) diff --git a/memdocs/intune/enrollment/apple-account-driven-user-enrollment.md b/memdocs/intune/enrollment/apple-account-driven-user-enrollment.md index 621d4f8bf0e..90e0bf05376 100644 --- a/memdocs/intune/enrollment/apple-account-driven-user-enrollment.md +++ b/memdocs/intune/enrollment/apple-account-driven-user-enrollment.md @@ -8,7 +8,7 @@ keywords: author: Lenewsad ms.author: lanewsad manager: dougeby -ms.date: 08/19/2024 +ms.date: 09/09/2024 ms.topic: how-to ms.service: microsoft-intune ms.subservice: enrollment @@ -84,8 +84,6 @@ Deploy the web app version of the Intune Company Portal website so that users ha Apple User Enrollment requires you to create and provide managed Apple IDs to enrolling users. If you enable federated authentication, which consists of linking Apple Business Manager with Microsoft Entra ID, you don't have to create and provide unique Apple IDs to each user. Instead, a device user can sign in to their apps with the same credentials they use for their work account. For more information, see [Intro to federated authentication with Apple Business Manager](https://support.apple.com/guide/apple-business-manager/intro-to-federated-authentication-axmb19317543/1/web/1) in the Apple Business Manager User Guide. ## Step 1: Set up just in time registration and assign Microsoft Authenticator -> [!IMPORTANT] -> This feature is in public preview. For more information, see [Public preview in Microsoft Intune](../fundamentals/public-preview.md). Configure just-in-time registration and assign Microsoft Authenticator as a required app. For steps, see [Set up JIT registration in Intune](set-up-just-in-time-registration.md). Return to this article when you're done so you can continue to the next step. diff --git a/memdocs/intune/enrollment/apple-mdm-push-certificate-get.md b/memdocs/intune/enrollment/apple-mdm-push-certificate-get.md index 1f043d8a346..d71f42a9501 100644 --- a/memdocs/intune/enrollment/apple-mdm-push-certificate-get.md +++ b/memdocs/intune/enrollment/apple-mdm-push-certificate-get.md @@ -90,7 +90,7 @@ The Apple MDM push certificate is valid for 365 days. You must renew it annually Renew the MDM push certificate with the same Apple account you used to create it. 1. Sign in to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431). -2. Go to **Devices** > **Enrollment**. +2. Go to **Devices** > **Device onboarding** > **Enrollment**. 3. Select the **Apple** tab. 4. Select **Apple MDM Push Certificate**. Your MDM push certificate settings open. 5. Select **Download your CSR** to download and save the request file locally. The file is used to request a trust relationship certificate from the Apple Push Certificates Portal. diff --git a/memdocs/intune/enrollment/apple-school-manager-set-up-ios.md b/memdocs/intune/enrollment/apple-school-manager-set-up-ios.md index cfcc7dae956..812b2fd0bcd 100644 --- a/memdocs/intune/enrollment/apple-school-manager-set-up-ios.md +++ b/memdocs/intune/enrollment/apple-school-manager-set-up-ios.md @@ -181,5 +181,5 @@ Apple School Manager devices managed by Intune must be assigned an enrollment pr You have enabled management and syncing between Apple and Intune, and assigned a profile to let your Apple School devices enroll. You can now distribute devices to users. When an iOS/iPadOS Apple School Manager device is turned on, it's enrolled for management by Intune. Profiles can't be applied to activated devices currently in use until the device is wiped. -## School data sync +## Connect School Data Sync Microsoft Education is transitioning to a new School Data Sync (SDS) experience with enhanced features, starting August 2024 for the Northern Hemisphere and January 2025 for the Southern Hemisphere. The current Apple School Manager support will be retired by December 31, 2024. This new experience offers various enhancements over SDS (Classic) including decoupled data ingestion, faster syncs with fewer errors, support for larger organizations, and a modern user interface. If you have further questions, please contact Microsoft Education support with questions regarding the transition to the new School Data Sync experience. diff --git a/memdocs/intune/enrollment/apple-user-enrollment-with-company-portal.md b/memdocs/intune/enrollment/apple-user-enrollment-with-company-portal.md index 9e3856840f0..2ceb990673d 100644 --- a/memdocs/intune/enrollment/apple-user-enrollment-with-company-portal.md +++ b/memdocs/intune/enrollment/apple-user-enrollment-with-company-portal.md @@ -32,6 +32,9 @@ ms.collection: # Set up user enrollment with Company Portal +>[!NOTE] +> Microsoft Intune doesn't support this enrollment profile type for newly enrolled devices. This article is only applicable to existing devices with this profile type. We recommend [account-driven user enrollment](apple-account-driven-user-enrollment.md) for new enrollments. + Set up user enrollment with Company Portal for iOS/iPadOS personal devices enrolling in Microsoft Intune. This Apple User Enrollment method gives you access to a limited but appropriate set of device management settings and actions, so you can protect work data without affecting the device user's personal data or apps. When the device owner attempts to sign into an app with their work or school account, Intune prompts them to enroll their device and provides instructions for next steps. The device user authenticates and initiates enrollment by signing into the Intune Company Portal app. From there, they're redirected to Safari and the device settings app, where they download and install the enrollment profile. diff --git a/memdocs/intune/enrollment/chrome-enterprise-remote-actions.md b/memdocs/intune/enrollment/chrome-enterprise-remote-actions.md deleted file mode 100644 index f3ac946680b..00000000000 --- a/memdocs/intune/enrollment/chrome-enterprise-remote-actions.md +++ /dev/null @@ -1,84 +0,0 @@ ---- -# required metadata - -title: Remote actions for ChromeOS devices | Microsoft Intune -description: Remotely run Microsoft Intune device actions on ChromeOS devices in the Microsoft Intune admin center. -keywords: -author: Lenewsad -ms.author: lanewsad -manager: dougeby -ms.date: 10/26/2022 -ms.topic: how-to -ms.service: microsoft-intune -ms.subservice: protect -ms.localizationpriority: high - -# optional metadata - -#ROBOTS: -#audience: - -ms.reviewer: shsivak -ms.suite: ems -search.appverid: MET150 -#ms.tgt_pltfrm: -ms.custom: intune-azure -ms.collection: -- tier2 -- M365-identity-device-management ---- - -# Remote device actions for ChromeOS - -> [!IMPORTANT] -> This feature is in public preview. For more information, see [Public preview in Microsoft Intune](../fundamentals/public-preview.md). - -Remotely run device actions on ChromeOS devices synced with Microsoft Intune. There are four remote actions supported on ChromeOS devices: - -* Deprovision -* Lost mode, known in Chrome Enterprise as *disabling a device* -* Wipe -* Restart (only for kiosk devices and managed guest session devices) - -To access remote actions, select a device in your **Chrome Enterprise (preview)** list or go to **Devices** > **All devices** and select a device. This article describes the remote actions, and provides information about required permissions and known issues. - -## Prerequisites -[Set up the Chrome Enterprise connector](chrome-enterprise-connector-configure.md) with Microsoft Intune, and enroll devices using the Google Admin console. - -Permission requirements are provided in the sections that follow. - -## Deprovision -Select **Deprovision** to remove Google Admin policies from devices your organization no longer uses. To deprovision a ChromeOS device, you must be assigned a role that has the *Remote tasks: Retire* permission. - -After you deprovision a device, it remains in the Intune admin center and the Google Admin console. Then on the admin center **System info** page, the device status changes to **DEPROVISIONED**. The device can't be enrolled again until it's restored to factory settings. For more information about the deprovision action, such as how to select the best reason for deprovisioning, see the [Chrome Enterprise and Education Help documentation](https://support.google.com/chrome/a/answer/3523633?). - -## Lost mode -Select **Lost mode** to prevent people from using a ChromeOS device that's lost or stolen. Devices in lost mode display the contact information and message you configured in the Google Admin console. To deprovision a device, you must be assigned a role that has the following permissions: - -* *Remote tasks: Enable lost mode* -* *Remote tasks: Disable lost mode* - ->[!TIP] -> Chrome Enterprise and the Google Admin console refer to devices in lost mode as *disabled*. For more information about how to disable a device, see the Chrome Enterprise and Education Help documentation. - - ## Wipe - Select **Wipe** to remove data from a device. With this action, you can either: - - * **Remove user profiles only**: This option removes all user account data. Device and enrollment policies remain on the device. - * **Factory reset (powerwash)**: This option fully restores a device to its factory state, removing all personal and work data. Before using this action, [deprovision](chrome-enterprise-remote-actions.md#deprovision) the device. Otherwise, once it connects to Wi-Fi, it will automatically enroll again. - -To wipe a device, you must be assigned a role that has the *Remote tasks: Wipe* permission. For more information about wiping ChromeOS devices, see [Wipe ChromeOS device data](https://support.google.com/chrome/a/answer/1360642) (opens Google Chrome Enterprise Help). - -## Restart -Select **Restart** to restart a device. To restart a device, you must be assigned a role that has the *Remote tasks: Reboot now* permission. - ->[!IMPORTANT] -> Device users aren't automatically notified of restarts, and might lose unsaved work if you don't tell them about it ahead of time. - -Restart is only available for kiosk devices and managed guest session devices. The restart will fail on any other type of device. For more information, see [Kiosk apps, managed guest sessions, and smart cards](https://support.google.com/chrome/a/topic/6128720?) (opens Google Chrome Enterprise Help). - -## Bulk device actions -You can issue all of these remote actions as part of a bulk device action. For more information about how to do that, see [Use bulk device actions](../remote-actions/bulk-device-actions.md). - -## Known issues -In some cases, device commands remain in a pending state even if they’ve already completed or failed. diff --git a/memdocs/intune/enrollment/corporate-identifiers-add.md b/memdocs/intune/enrollment/corporate-identifiers-add.md index dbbce515741..8de4cc4aa20 100644 --- a/memdocs/intune/enrollment/corporate-identifiers-add.md +++ b/memdocs/intune/enrollment/corporate-identifiers-add.md @@ -247,7 +247,15 @@ To confirm the reason for an enrollment failure, go to **Devices** > **Enrollmen ## Known issues and limitations -- Windows corporate device identifiers are only supported for devices running Windows 10 version 22H2 and later and Windows 11 version 22H2 and later. Earlier versions can't render the model and manufacturer property. As a result, the property appears in the admin center as **Unknown**. We're working on expanding corporate identifer support to devices running earlier versions of Windows. +- Windows corporate device identifiers are only supported for devices running: + + - Windows 10 version 22H2 (OS build 19045.4598) or later. + + - Windows 11 version 22H2 (OS build 22621.3374) or later. + + - Windows 11 version 23H2 (OS build 22631.3374) or later. + + Earlier versions can't render the model and manufacturer property. As a result, the property appears in the admin center as **Unknown**. - You can upload up to 10 CSV files for Windows corporate identifiers in the admin center. If you need to upload more data, we recommend using PowerShell or the Microsoft Intune Graph API to add corporate identifiers. diff --git a/memdocs/intune/enrollment/device-enrollment-program-enroll-ios.md b/memdocs/intune/enrollment/device-enrollment-program-enroll-ios.md index cb73c3cfc12..97e38d865e2 100644 --- a/memdocs/intune/enrollment/device-enrollment-program-enroll-ios.md +++ b/memdocs/intune/enrollment/device-enrollment-program-enroll-ios.md @@ -1,14 +1,14 @@ --- # required metadata -title: Enroll iOS/iPadOS devices with Apple ADE +title: Set up automated device enrollment (ADE) for iOS/iPadOS titleSuffix: Microsoft Intune -description: Learn how to enroll corporate-owned iOS/iPadOS devices by using Automated Device Enrollment (ADE). +description: Learn how to enroll corporate-owned iOS/iPadOS devices into Microsoft Intune with Apple Automated Device Enrollment (ADE). keywords: author: Lenewsad ms.author: lanewsad manager: dougeby -ms.date: 11/15/2023 +ms.date: 09/19/2024 ms.topic: how-to ms.service: microsoft-intune ms.subservice: enrollment @@ -30,7 +30,7 @@ ms.collection: - highpri --- -# Set up automated device enrollment in Intune +# Set up automated device enrollment (ADE) for iOS/iPadOS *Applies to iOS/iPadOS* @@ -50,10 +50,19 @@ The following table shows the features and scenarios supported with automated de | Devices are associated with a single user. | ✔️ | | Devices are user-less, such as kiosk or dedicated device. | ✔️ | | Devices are in shared device mode. | ✔️ | -| Devices are personal or BYOD. | ❌

Not recommended. Applications on BYOD or personal devices can be managed using [MAM](../fundamentals/deployment-guide-enrollment-mamwe.md), or [User and Device enrollment](../enrollment/ios-user-enrollment.md). | -| Devices are managed by another MDM provider. | ❌

To be fully managed by Intune, users must unenroll from the current MDM provider, and then enroll in Intune. Or, you can use MAM to manage specifics apps on the device. Since these devices are owned by the organization, we recommend enrolling them in Intune. | +| Devices are personal or bring-your-own (BYOD). | ❌

Not recommended. Applications on BYOD or personal devices can be managed using [MAM](../fundamentals/deployment-guide-enrollment-mamwe.md), or [User and Device enrollment](../enrollment/ios-user-enrollment.md). | +| Devices are managed by another MDM provider. | ❌

If you want to fully manage a device in Intune, users must unenroll from the current MDM provider, and then enroll in Intune. Or, you can use MAM to manage specifics apps on the device. Since these devices are owned by the organization, we recommend enrolling them in Intune. | | You use the device enrollment manager (DEM) account. | ❌

The DEM account isn't supported. | +## Certificates +This enrollment type supports the Automated Certificate Management Environment (ACME) protocol. When new devices enroll, the management profile from Intune receives an ACME certificate. The ACME protocol provides better protection than the SCEP protocol against unauthorized certificate issuance through robust validation mechanisms and automated processes, which helps reduce errors in certificate management. + +Devices that are already enrolled do not get an ACME certificate unless they re-enroll into Microsoft Intune. ACME is supported on devices running: + +- iOS 16.0 or later + +- iPadOS 16.1 or later + ## Prerequisites Before you create the enrollment profile, you must have: @@ -70,9 +79,9 @@ Read through these enrollment requirements and best practices to prepare for a s ### Choose an authentication method -Before you create the enrollment profile, decide how you want users to authenticate on their devices: via the Intune Company Portal app, Setup Assistant (legacy), or Setup Assistant with modern authentication. Using the Company Portal app or Setup Assistant with modern authentication is considered modern authentication and has features like multi-factor authentication. +Before you create the enrollment profile, decide how you want users to authenticate on their devices: via the Intune Company Portal app, Setup Assistant (legacy), or Setup Assistant with modern authentication. Using the Company Portal app or Setup Assistant with modern authentication is considered modern authentication and has features like multifactor authentication. -Intune also supports Just in Time Registration for Setup Assistant with modern authentication, which eliminates the need for the Company Portal app for Microsoft Entra registration and compliance. To use JIT Registration, you'll need to create a device configuration policy *before* you create the Apple enrollment profile and configure Setup Assistant with modern authentication. +Intune also supports just-in-time registration (JIT registration) for Setup Assistant with modern authentication, which eliminates the need for the Company Portal app for Microsoft Entra registration and compliance. To use JIT registration, you have to create a device configuration policy *before* you create the Apple enrollment profile and configure Setup Assistant with modern authentication. Setup Assistant with modern authentication is supported on devices running iOS/iPadOS 13.0 and later. Older iOS/iPadOS devices given this profile will instead use Setup Assistant (legacy) for authentication. @@ -102,7 +111,7 @@ Deploying the Intune Company Portal app through Intune is the best way to provid Deploy the app as a required VPP app [with device licensing](../apps/vpp-apps-ios.md#how-are-purchased-apps-licensed). For information about how to sync, assign, and manage a VPP app, see [assign a volume-purchased app](../apps/vpp-apps-ios.md#assign-a-volume-purchased-app). -To enable automatic app updates for Company Portal, go to your app token settings in the admin center and change **Automatic app updates** to **Yes**. See [Upload an Apple VPP or Apple Business Manager location token](../apps/vpp-apps-ios.md#upload-an-apple-vpp-or-apple-business-manager-location-token) for the steps to access your token settings. If you don't enable automatic updates, the device user will need to manually check for them on their own. +To enable automatic app updates for Company Portal, go to your app token settings in the admin center and change **Automatic app updates** to **Yes**. See [Upload an Apple VPP or Apple Business Manager location token](../apps/vpp-apps-ios.md#upload-an-apple-vpp-or-apple-business-manager-location-token) for the steps to access your token settings. If you don't enable automatic updates, the device user must manually check for them on their own. *Device staging* is used to transition a device without user affinity to a device with user affinity. To stage a device, set up VPP deployment as described earlier in this section. Then configure and deploy an [app configuration policy](../apps/app-configuration-policies-use-ios.md#configure-the-company-portal-app-to-support-ios-and-ipados-devices-enrolled-with-automated-device-enrollment). Make sure the policy only targets those ADE devices without user affinity. @@ -115,7 +124,7 @@ To enable automatic app updates for Company Portal, go to your app token setting - Maximum Automated Device Enrollment tokens per Intune account: 2,000 - Maximum Automated Device Enrollment devices per token: 200,000 - We recommend that you don't exceed 200,000 devices per token. Otherwise, you might have sync problems. If you have more than 200,000 devices, split the devices into multiple ADE tokens. - - Apple Business Manager and Apple School Manager sync about 3,000 devices over to Intune per minute. We recommend that you hold off manually syncing from the admin center again until enough time has passed for all of the devices to finish syncing (total number of devices/3,000 devices per minute). + - Apple Business Manager and Apple School Manager sync about 3,000 devices over to Intune per minute. We recommend that you hold off manually syncing from the admin center again until enough time passes for all of the devices to finish syncing (total number of devices/3,000 devices per minute). ### Troubleshoot enrollment If you experience sync problems during the enrollment process, you can look for solutions at [Troubleshoot iOS/iPadOS device enrollment problems](/troubleshoot/mem/intune/troubleshoot-ios-enrollment-errors#error-messages). @@ -127,7 +136,7 @@ Before you can enroll iOS/iPadOS devices with ADE, you need an automated device Use [Apple Business Manager (ABM)](https://business.apple.com/) or [Apple School Manager (ASM)](https://school.apple.com/) to create a token and assign devices to Intune for management. > [!NOTE] -> You can use either the ABM portal or the ASM portal to enable ADE. The rest of this article refers to the ABM portal, but the steps are the same for both portals. +> You can use either of the Apple portals to enable ADE. The rest of this article refers to Apple Business Manager, but the steps are the same for Apple School Manager. ### Step 1: Download the Intune public key certificate @@ -143,7 +152,7 @@ Use [Apple Business Manager (ABM)](https://business.apple.com/) or [Apple School 2. Select **Download the Intune public key certificate required to create the token**. This step downloads and saves the encryption key (.pem) file locally. The .pem file is used to request a trust-relationship certificate from the Apple Business Manager portal. - You'll upload this .pem file in Apple Business Manager in [Step 2: Go to the Apple Business Manager portal](#step-2-go-to-the-apple-business-manager-portal) (in this article). + Later, in [Step 2: Go to the Apple Business Manager portal](#step-2-go-to-the-apple-business-manager-portal), you upload this .pem file in Apple Business Manager. 3. Keep this web browser tab and page open. If you close the tab: @@ -167,7 +176,7 @@ Use the Apple Business Manager portal to create and renew your ADE token (MDM se Use the server name to identify the mobile device management (MDM) server. It isn't the name or URL of the Microsoft Intune service. - - After you save the MDM server, select it, and then download the token (.p7m file). You'll upload this .p7m token in Intune in [Step 4: Upload your token and finish](#step-4-upload-your-token-and-finish) (in this article). + - After you save the MDM server, select it, and then download the token (.p7m file). Later, in [Step 4: Upload your token and finish](#step-4-upload-your-token-and-finish), you upload the .p7m token in Intune. #### Assign devices to the Apple token (MDM server) @@ -176,16 +185,17 @@ Use the Apple Business Manager portal to create and renew your ADE token (MDM se ### Step 3: Save the Apple ID -1. In your web browser, go back to the **Add enrollment program token** page in Intune. You should have kept this page open, as noted in [Step 1: Download the Intune public key certificate](#step-1-download-the-intune-public-key-certificate) (in this article). +1. In your web browser, go back to the tab that has the Microsoft Intune **Add enrollment program token** page, where you started in [Step 1: Download the Intune public key certificate](#step-1-download-the-intune-public-key-certificate). 2. In **Apple ID**, enter your ID. This step saves the ID. The ID can be used in the future. :::image type="content" source="./media/device-enrollment-program-enroll-ios/image03.png" alt-text="Sreenshot that shows the Apple ID box on the Basics tab."::: ### Step 4: Upload your token and finish -1. In **Apple token**, browse to the .p7m certificate file, and then select **Open**. +1. In **Apple token**, browse to the .p7m certificate file, and then select **Open**. - You downloaded this .p7m token in [Step 2: Go to the Apple Business Manager portal](#step-2-go-to-the-apple-business-manager-portal). + >[!TIP] + > You downloaded the token in [Step 2: Go to the Apple Business Manager portal](#step-2-go-to-the-apple-business-manager-portal). 2. Select **Next**. @@ -253,12 +263,12 @@ Now that you've installed your token, you can create an enrollment profile for a 1. In the **Locked enrollment** list, select **Yes** or **No**. Locked enrollment disables iOS/iPadOS settings that allow the management profile to be removed. If you enable locked enrollment, the button in the Settings app that lets users remove a management profile will be hidden and users won't be able to unenroll their device. If you're setting up devices in Microsoft Entra ID shared mode, select **Yes**. - Locked enrollment works a little differently, at first, on devices not originally purchased through Apple Business Manager but later added to be a part of automated device enrollment: users on these devices will see the remove management button in the Settings app for the first 30 days after activating their device. After that provisional period, the option will be hidden. For more information, see [Prepare devices manually](https://help.apple.com/configurator/mac/2.8/#/cad99bc2a859) (opens Apple Configurator Help docs). + Locked enrollment works a little differently, at first, on devices not originally purchased through Apple Business Manager but later added to be a part of automated device enrollment: users on these devices can see the remove management button in the Settings app for the first 30 days after activating their device. After that provisional period, this option is hidden. For more information, see [Prepare devices manually](https://help.apple.com/configurator/mac/2.8/#/cad99bc2a859) (opens Apple Configurator Help docs). > [!IMPORTANT] > This setting is different from the remove and reset options in the Company Portal app. Regardless of how you configure locked enrollment, the **Remove Device** or **Factory Reset** options in the Company Portal app remain unavailable on devices enrolled through automated device enrollment. Users won't be able to remove the device on the Company Portal website either. For more information about the self-service actions available on enrolled devices, see [Self-service actions](../apps/company-portal-app.md#self-service-actions). -1. If you selected **Enroll without User Affinity** and **Supervised** in the previous steps, you need to decide whether to configure the devices to be [Apple Shared iPad for Business devices](https://support.apple.com/guide/mdm/shared-ipad-overview-cad7e2e0cf56/web). Select **Yes** for **Shared iPad** to enable multiple users to sign in to a single device. Users will authenticate by using their Managed Apple IDs and federated authentication accounts or by using a temporary session (like the Guest account). This option requires iOS/iPadOS 13.4 or later. With Shared iPad, all Setup Assistant panes after activation are automatically skipped. +1. If you selected **Enroll without User Affinity** and **Supervised** in the previous steps, you need to decide whether to configure the devices to be [Apple Shared iPad for Business devices](https://support.apple.com/guide/mdm/shared-ipad-overview-cad7e2e0cf56/web). Select **Yes** for **Shared iPad** to enable multiple users to sign in to a single device. Users authenticate by using their Managed Apple IDs and federated authentication accounts or by using a temporary session (like the Guest account). This option requires iOS/iPadOS 13.4 or later. With Shared iPad, all Setup Assistant panes after activation are automatically skipped. > [!NOTE] > @@ -274,7 +284,7 @@ Now that you've installed your token, you can create an enrollment profile for a * **Maximum seconds after screen lock before password is required**: Enter the amount of time in seconds. Accepted values include: 0, 60, 300, 900, 3600, and 14400. If the screen lock exceeds this amount of time, a device password will be required to unlock the device. Available for devices in Shared iPad mode running iPadOS 13.0 and later. - * **Maximum seconds of inactivity until user session logs out**: The minimum allowed value for this setting is 30. If there isn't any activity after the defined period, the user session ends and signs the user out. If you leave the entry blank or set it to zero (0), the session won't end due to inactivity. Available for devices in Shared iPad mode running iPadOS 14.5 and later. + * **Maximum seconds of inactivity until user session logs out**: The minimum allowed value for this setting is 30. If there isn't any activity after the defined period, the user session ends and signs the user out. If you leave the entry blank or set it to zero (0), the session will never end due to inactivity. Available for devices in Shared iPad mode running iPadOS 14.5 and later. * **Require Shared iPad temporary session only**: Configures the device so that users only see the guest version of the sign-in experience and must sign in as guests. They can't sign in with a Managed Apple ID. Available for devices in Shared iPad mode running iPadOS 14.5 and later. @@ -284,7 +294,7 @@ Now that you've installed your token, you can create an enrollment profile for a - Maximum seconds after screen lock before password is required - Maximum seconds of inactivity until user session logs out - * **Maximum seconds of inactivity until temporary session logs out**: The minimum allowed value for this setting is 30. If there isn't any activity after the defined period, the temporary session ends and signs the user out. If you leave the entry blank or set it to zero (0), the session won't end due to inactivity. Available for devices in Shared iPad mode running iPadOS 14.5 and later. + * **Maximum seconds of inactivity until temporary session logs out**: The minimum allowed value for this setting is 30. If there isn't any activity after the defined period, the temporary session ends and signs the user out. If you leave the entry blank or set it to zero (0), the session will never end due to inactivity. Available for devices in Shared iPad mode running iPadOS 14.5 and later. This setting is available when **Require Shared iPad temporary session only** is set to **Yes**. @@ -304,7 +314,10 @@ Now that you've installed your token, you can create an enrollment profile for a 1. For **Await final configuration**, your options are: * **Yes**: Enable a locked experience at the end of Setup Assistant to ensure your most critical device configuration policies are installed on the device. Just before the home screen loads, Setup Assistant pauses and lets Intune check in with the device. The end-user experience locks while users await final configurations. - The amount of time that users are held on the Awaiting final configuration screen varies, and depends on the total number of policies and apps you apply to the device. The more policies and apps assigned to the device, the longer the waiting time. Neither Setup Assistant nor Intune enforce a minimum or maximum time limit during this portion of setup. During product validation, the majority of devices we tested were released and able to access the home screen within fifteen minutes. If you enable this feature and are using a third party to help you provision devices, tell them about the potential for increased provisioning time. Note that only device configuration policies start installing during the awaiting final configuration screen, and applications are not included in this. + The amount of time that users are held on the Awaiting final configuration screen varies, and depends on the total number of policies and apps you apply to the device. The more policies and apps assigned to the device, the longer the waiting time. Setup Assistant and Microsoft Intune do not enforce a minimum or maximum time limit during this portion of setup. During product validation, most devices we tested were released and able to access the home screen within 15 minutes. If you enable this feature and are using someone outside of Microsoft to help you provision devices, tell them about the potential for increased provisioning time. + + >[!NOTE] + > Only device configuration policies start installing during the awaiting final configuration screen, and applications are not included in this. The locked experience works on devices targeted with new and existing enrollment profiles. Supported devices include: * iOS/iPadOS 13+ devices enrolling with Setup Assistant with modern authentication @@ -313,7 +326,7 @@ Now that you've installed your token, you can create an enrollment profile for a This setting is applied once during the out-of-box automated device enrollment experience in Setup Assistant. The device user doesn't experience it again unless they re-enroll their device. **Yes** is the default setting for new enrollment profiles. - * **No**: The device is released to the home screen when Setup Assistant ends, regardless of policy installation status. Device users may be able to access the home screen or change device settings before all policies are installed. **No** is the default setting for existing enrollment profiles. + * **No**: The device is released to the home screen when Setup Assistant ends, regardless of policy installation status. Device users might be able to access the home screen or change device settings before all policies are installed. **No** is the default setting for existing enrollment profiles. The await configuration setting is unavailable in profiles with this combination of configurations: * User affinity: **Enroll without user affinity** (Step 6 in this section) @@ -323,7 +336,7 @@ Now that you've installed your token, you can create an enrollment profile for a 1. Under **Apply device name template**, select **Yes** . 2. In the **Device Name Template** box, enter the template you want to use to construct device names. The template can include the device type and serial number. It can't contain more than 63 characters, including the variables. Example: `{{DEVICETYPE}}-{{SERIAL}}` -1. You can activate a cellular data plan. This setting applies to devices running iOS/iPadOS 13.0 and later. Configuring this option will send a command to activate cellular data plans for your eSim-enabled cellular devices. Your carrier must provision activations for your devices before you can activate data plans using this command. To activate cellular data plan, click **Yes** and then enter your carrier’s activation server URL. +1. You can activate a cellular data plan. This setting applies to devices running iOS/iPadOS 13.0 and later. Configuring this option sends a command to activate cellular data plans for your eSim-enabled cellular devices. Your carrier must provision activations for your devices before you can activate data plans using this command. To activate cellular data plan, select **Yes**, and then enter your carrier’s activation server URL. 1. Select **Next**. @@ -335,8 +348,8 @@ Now that you've installed your token, you can create an enrollment profile for a | **Department Phone** | Appears when users tap the **Need Help** button during activation. | You can hide Setup Assistant screens on the device during user setup. For a description of all screens, see [Setup Assistant screen reference](#setup-assistant-screen-reference) (in this article). - - If you select **Hide**, the screen won't be displayed during setup. After setting up the device, the user can still go to the **Settings** menu to set up the feature. - - If you select **Show**, the screen will be displayed during setup, but only if there are steps to complete after the restore or after the software update. Users can sometimes skip the screen without taking action. They can then later go to the device's **Settings** menu to set up the feature. + - If you select **Hide**, the screen isn't shown during setup. After setting up the device, the user can still go to the **Settings** menu to set up the feature. + - If you select **Show**, the screen is shown during setup, but only if there are steps to complete after the restore or after the software update. Users can sometimes skip the screen without taking action. They can then later go to the device's **Settings** menu to set up the feature. - With Shared iPad, all Setup Assistant panes after activation are automatically skipped regardless of the configuration. 1. Select **Next**. @@ -351,40 +364,46 @@ You can use the enrollment **Name** field to create a dynamic group in Microsoft You can use the profile name to define the [enrollmentProfileName parameter](/azure/active-directory/users-groups-roles/groups-dynamic-membership#rules-for-devices) to assign devices with this enrollment profile. -Prior to device setup, and to ensure quick delivery to devices with user affinity, make sure the enrolling user is a member of a Microsoft Entra user group. +Before device setup, and to ensure quick delivery to devices with user affinity, make sure the enrolling user is a member of a Microsoft Entra user group. If you assign dynamic groups to enrollment profiles, there might be a delay in delivering applications and policies to devices after the enrollment. ### Setup Assistant screen reference -The following table describes the Setup Assistant screens shown during automated device enrollment for iOS/iPadOS. You can show or hide these screens on supported devices during enrollment. +The following table describes the Setup Assistant screens shown during automated device enrollment for iOS/iPadOS. You can show or hide these screens on supported devices during enrollment. For more information about how each Setup Assistant screen affects the user experience, see these Apple resources: + +- [Apple Platform Deployment guide: Manage Setup Assistant for Apple devices](https://support.apple.com/en-mide/guide/deployment/depdeff4a547/web) +- [Apple Developer documentation: ShipKeys](https://developer.apple.com/documentation/devicemanagement/skipkeys) | Setup Assistant screen | What happens when visible | |------------------------------------------|------------------------------------------| -| **Passcode** | Prompt the user for a passcode. Always require a passcode for unsecured devices unless access is controlled in some other way. (For example, a kiosk mode configuration that restricts the device to one app.) For iOS/iPadOS 7.0 and later. | -| **Location Services** | Prompt the user for their location. For macOS 10.11 and later, and iOS/iPadOS 7.0 and later. | -| **Restore** | Display the Apps & Data screen. This screen gives users the option to restore or transfer data from iCloud Backup when they set up the device. For macOS 10.9 and later, and iOS/iPadOS 7.0 and later. | -| **Apple ID** | Give the user the options to sign in with their Apple ID and use iCloud. For macOS 10.9 and later, and iOS/iPadOS 7.0 and later. | -| **Terms and conditions** | Require the user to accept Apple's terms and conditions. For macOS 10.9 and later, and iOS/iPadOS 7.0 and later. | -| **Touch ID and Face ID** | Give the user the option to set up fingerprint or facial identification on their device. For macOS 10.12.4 and later, and iOS/iPadOS 8.1 and later. On iOS/iPadOS 14.5 and later, the Passcode and Touch ID Setup Assistant screens during device setup aren’t working. If you use version 14.5+, then don't configure the Passcode or Touch ID Setup Assistant screens. If you require a passcode on devices, then use a device configuration policy or a compliance policy. After the user enrolls and they receive the policy, they're prompted for a passcode. | -| **Apple Pay** | Give the user the option to set up Apple Pay on the device. For macOS 10.12.4 and later, and iOS/iPadOS 7.0 and later. | -| **Zoom** | Give the user to the option to zoom the display when they set up the device. For iOS/iPadOS 8.3 and later. | -| **Siri** | Give the user the option to set up Siri. For macOS 10.12 and later, and iOS/iPadOS 7.0 and later. | -| **Diagnostics Data** | Display the Diagnostics screen. This screen gives the user the option to send diagnostic data to Apple. For macOS 10.9 and later, and iOS/iPadOS 7.0 and later. | -| **Display Tone** | Give the user the option to turn on Display Tone. For macOS 10.13.6 and later, and iOS/iPadOS 9.3.2 and later. | -| **Privacy** | Display the Privacy screen. For macOS 10.13.4 and later, and iOS/iPadOS 11.3 and later. | -| **Android Migration** | Give the user the option to migrate data from an Android device. For iOS/iPadOS 9.0 and later.| -| **iMessage & FaceTime** | Give the user the option to set up iMessage and FaceTime. For iOS/iPadOS 9.0 and later. | -| **Onboarding** | Display onboarding informational screens for user education, like Cover Sheet and Multitasking and Control Center. For iOS/iPadOS 11.0 and later. | -| **Screen Time** | Display the Screen Time screen. For macOS 10.15 and later, and iOS/iPadOS 12.0 and later. | -| **SIM Setup** | Give the user the option to add a cellular plan. For iOS/iPadOS 12.0 and later. | -| **Software Update** | Display the mandatory software update screen. For iOS/iPadOS 12.0 and later. | -| **Watch Migration** | Give the user the option to migrate data from a watch device. For iOS/iPadOS 11.0 and later.| -| **Appearance** | Display the Appearance screen. For macOS 10.14 and later, and iOS/iPadOS 13.0 and later. | -| **Device to Device Migration** | Give the user the option to transfer data from an old device to this device. The option to transfer data directly from a device isn't available for ADE devices running iOS 13 or later. +| **Passcode** | Shows the passcode and password lock pane to users, and prompts users for a passcode. Always require a passcode for unsecured devices unless access is controlled in some other way (such as through a kiosk mode configuration that restricts the device to one app). This screen is available for iOS/iPadOS 7.0 and later, with some limitations. For more information, see [Limitations](#limitations) in this article. | +| **Location Services** | Shows the location services setup pane, where users can enable location services on their device. For iOS/iPadOS 7.0 and later. | +| **Restore** | Shows the apps and data setup pane. On this screen, users setting up devices can restore or transfer data from iCloud Backup. For iOS/iPadOS 7.0 and later. | +| **Apple ID** | Shows the Apple ID setup pane, which gives users to the option to sign in with their Apple ID and use iCloud. For iOS/iPadOS 7.0 and later. | +| **Terms and conditions** | Shows the Apple terms and conditions pane, and requires users to accept them. For iOS/iPadOS 7.0 and later. | +| **Touch ID and Face ID** | Shows the biometric setup pane, which gives users the option to set up fingerprint or facial identification on their devices. For iOS/iPadOS 8.1 and later, with some limitations. For more information, see [Limitations](#limitations) in this article. | +| **Apple Pay** | Shows the Apple Pay setup pane, which gives users the option to set up Apple Pay on their devices. For iOS/iPadOS 7.0 and later. | +| **Zoom** | Shows the zoom setup pane, which gives users the option to configure zoom settings. For iOS/iPadOS 8.3 and later, and deprecated in iOS/iPadOS 17. | +| **Siri** | Shows the Siri setup pane to users. For iOS/iPadOS 7.0 and later. | +| **Diagnostics Data** | Shows the diagnostics pane where users can opt-in to send diagnostic data to Apple. For iOS/iPadOS 7.0 and later. | +| **Display Tone** | Shows the display tone setup pane, where users can configure the display's white balance settings. For iOS/iPadOS 9.3.2 and later, and deprecated in iOS/iPadOS 15. | +| **Privacy** | Shows the privacy setup pane to the user. For iOS/iPadOS 11.3 and later. | +| **Android Migration** | Shows a setup pane meant for previous Android users. On this screen, users can migrate data from an Android device. For iOS/iPadOS 9.0 and later.| +| **iMessage & FaceTime** | Shows the setup pane for iMessage and FaceTime. For iOS/iPadOS 9.0 and later. | +| **Onboarding** | Shows onboarding informational screens for user education, such as Cover Sheet and Multitasking and Control Center. For iOS/iPadOS 11.0 and later. | +| **Screen Time** | Shows the Screen Time screen. For iOS/iPadOS 12.0 and later. | +| **SIM Setup** | Shows the cellular setup pane, where users can add a cellular plan. For iOS/iPadOS 12.0 and later. | +| **Software Update** | Shows the mandatory software update screen. For iOS/iPadOS 12.0 and later. | +| **Watch Migration** | Shows the Apple Watch migration pane, where users can migrate data from an Apple Watch. For iOS/iPadOS 11.0 and later.| +| **Appearance** | Shows the appearance setup pane. For iOS/iPadOS 13.0 and later. | +| **Device to Device Migration** | Shows the device-to-device migration pane. On this screen, users can transfer data from an old device to their current device. The option to transfer data directly from a device isn't available for devices running iOS 13 or later. | **Restore Completed** | Shows users the Restore Completed screen after a backup and restore is performed during Setup Assistant. | -| **Software Update Completed** | Shows the user all software updates that happen during Setup Assistant.| +| **Software Update Completed** | Shows users all software updates that happen during Setup Assistant.| | **Get Started**| Shows users the Get Started welcome screen. -| **Terms of Address**| Give the user the option to choose how they want to be addressed throughout the system: feminine, masculine, or neutral. This Apple feature is available for select languages. For more information, see [Key Features and Enhancements](https://www.apple.com/ios/ios-16/features/)(opens Apple website). For iOS/iPadOS 16.0 and later. +| **Terms of Address**| Shows the terms of address pane, which gives users the option to choose how they want to be addressed throughout the system: feminine, masculine, or neutral. This Apple feature is available for select languages. For more information, see [Key Features and Enhancements](https://www.apple.com/ios/ios-16/features/)(opens Apple website). For iOS/iPadOS 16.0 and later. +| **Emergency SOS**| Shows the safety setup pane. For iOS/iPadOS 16.0 and later. +| **Action button**| Shows the configuration pane for the action button. For iOS/iPadOS 17.0 and later. +| **Intelligence**| Shows the Apple Intelligence setup pane, where users can configure Apple Intelligence features. For iOS/iPadOS 18.0 and later. ## Sync managed devices @@ -402,8 +421,8 @@ Now that Intune has permission to manage your devices, you can synchronize Intun - A full sync can run no more than once every seven days. During a full sync, Intune fetches the complete updated list of serial numbers assigned to the Apple MDM server connected to Intune. > [!IMPORTANT] > If a device is deleted from Intune, but remains assigned to the ADE enrollment token in the ASM/ABM portal, it will reappear in Intune on the next full sync. If you don't want the device to reappear in Intune, unassign it from the Apple MDM server in the ABM/ASM portal. - - If a device is released from ABM/ASM, it can take up to 45 days for it to be automatically deleted from the devices page in Intune. You can manually delete released devices from Intune one by one if needed. Released devices will be accurately reported as being Removed from ABM/ASM in Intune until they're automatically deleted within 30-45 days. - - A delta sync is run automatically every 12 hours. You can also trigger a delta sync by selecting the **Sync** button (no more than once every 15 minutes). All sync requests are given 15 minutes to finish. The **Sync** button is disabled until a sync is completed. This sync will refresh existing device status and import new devices assigned to the Apple MDM server. If a delta sync fails for any reason, the next sync will be a full sync to hopefully resolve any issues. + - If a device is released from ABM/ASM, it can take up to 45 days for it to be automatically deleted from the devices page in Intune. You can manually delete released devices from Intune one by one if needed. Released devices are accurately reported as being *removed* from ABM/ASM in Intune until they're automatically deleted within 30-45 days. + - A delta sync is run automatically every 12 hours. You can also trigger a delta sync by selecting the **Sync** button (no more than once every 15 minutes). All sync requests have 15 minutes to finish. The **Sync** button becomes inactive until the sync is done. Syncing refreshes the existing device status and imports new devices assigned to the Apple MDM server. If a delta sync fails for any reason, the next sync is a full sync and could resolve any issues. ## Assign an enrollment profile to devices @@ -427,7 +446,7 @@ You can pick a default profile to be applied to all devices that enroll with a s 1. In the admin center, return to **Enrollment program tokens**. 2. Select an enrollment token. 2. Select **Set Default Profile**. -4. Select a profile in the list, and then select **Save**. The profile will be applied to all devices that enroll with the selected enrollment token. +4. Select a profile in the list, and then select **Save**. From here, Intune applies the profile to all devices that enroll with the selected enrollment token. > [!NOTE] > Ensure that **Device Type Restrictions** under **Enrollment Restrictions** does not have the default **All Users** policy set to block the iOS/iPadOS platform. This setting will cause automated enrollment to fail and your device will show as Invalid Profile, regardless of user attestation. To permit enrollment only by company-managed devices, block only personally owned devices, which will permit corporate devices to enroll. Microsoft defines a corporate device as a device that's enrolled via a Device Enrollment Program or a device that's manually entered under **Corporate device identifiers**. @@ -436,20 +455,20 @@ You can pick a default profile to be applied to all devices that enroll with a s You enabled management and syncing between Apple and Intune and assigned a profile so your ADE devices can be enrolled. You're now ready to distribute devices to users. Some things to know: -- Devices enrolled with user affinity require that each user be assigned an Intune license. -- Devices enrolled without user affinity typically don't have any associated users. These devices need to have an Intune device license. If devices enrolled without user affinity will be used by an Intune-licensed user, a device license isn't needed. +- To use devices enrolled with user affinity, users must have an Intune license assigned. +- Devices enrolled without user affinity typically don't have any associated users. These devices need to have an Intune device license. If a device without user affinity is used by an Intune-licensed user, a device license isn't needed. To summarize, if a device has a user, the user needs to have an assigned Intune license. If the device doesn't have an Intune-licensed user, the device needs to have an Intune device license. For more information on Intune licensing, see [Microsoft Intune licensing](../fundamentals/licenses.md) and the [Intune planning guide](../fundamentals/intune-planning-guide.md). -- A device that's been activated needs to be wiped before it can enroll properly using ADE in Intune. After it's been wiped but before activating it again, you can apply the enrollment profile. See [Set up an existing iPhone, iPad, or iPod touch](https://support.apple.com/en-us/HT207516) +- A device that is already activated needs to be wiped before it can enroll properly with automated device enrollment. After you wipe it but before activating it again, you can apply the enrollment profile. See [Set up an existing iPhone, iPad, or iPod touch](https://support.apple.com/en-us/HT207516) - If you're enrolling with ADE and user affinity, the following error can happen during setup: `The SCEP server returned an invalid response.` - You can resolve this error by trying to download the management again within 15 minutes. If it's been more than 15 minutes, to resolve this error you'll need to factory reset the device. This error occurs because of a 15-minute time limit on SCEP certificates, which is enforced for security. + You can resolve this error by trying to download the management again within 15 minutes. After 15 minutes, you have to factory reset the device to resolve the error. This error occurs because of a 15 minute time limit on SCEP certificates, which is enforced for security. For information on the end-user experience, see [Enroll your iOS/iPadOS device in Intune by using ADE](../user-help/enroll-your-device-dep-ios.md). @@ -463,12 +482,11 @@ Complete these steps to re-enroll a device that already went through automated d ## Renew an Automated Device Enrollment token -You'll sometimes need to renew your tokens: +It's important to renew your enrollment program token yearly. The Intune admin center shows the expiration date. -- Renew your ADE token yearly. The Intune admin center shows the expiration date. -- If the Apple ID password changes for the user who set up the token in Apple Business Manager, renew your enrollment program token in Intune and Apple Business Manager. +- If the Apple ID password changes for the user who set up the token in Apple Business Manager, renew your enrollment program token in Intune and Apple Business Manager. - If the user who set up the token in Apple Business Manager leaves the organization, renew your enrollment program token in Intune and Apple Business Manager. -- If you change the Apple ID used to create the ADE token, the change won't affect currently enrolled devices with that token, until they re-enroll. This is unlike the Apple Push Notification Service (APNS) certificate used for the tenant which cannot be changed without requiring all devices to be re-enrolled unless you contact Apple Support to perform the change on the back end. +- When you change the Apple ID used to create the ADE token, the change doesn't affect currently enrolled devices with that token, until they re-enroll. This behavior is unlike the Apple Push Notification Service (APNS) certificate used for the tenant. The APNS certificate can be changed with help from Apple Support. Otherwise, to make changes, all devices must re-enroll. ### Renew your tokens @@ -486,7 +504,7 @@ You'll sometimes need to renew your tokens: 5. Select **Devices** > **Enrollment**. 6. Choose **Enrollment program tokens**. 7. Select the token. -8. Select **Renew token**. Enter the **Apple ID** used to create the original token (if it's not automatically populated): +8. Select **Renew token**. Enter the **Apple ID** used to create the original token (if it's not already filled-in): :::image type="content" source="./media/device-enrollment-program-enroll-ios/renewtoken.png" alt-text="Screenshot that shows the Renew token page." lightbox="./media/device-enrollment-program-enroll-ios/renewtoken.png"::: @@ -494,7 +512,7 @@ You'll sometimes need to renew your tokens: 10. Select **Next** to go to the **Scope tags** page. Assign scope tags if you want to. -11. Select **Renew token**. You'll see a confirmation that the token is renewed. +11. Select **Renew token**. Wait for confirmation that the token renewal is done. :::image type="content" source="./media/device-enrollment-program-enroll-ios/confirmation.png" alt-text="Screenshot that shows the confirmation message."::: @@ -517,5 +535,14 @@ To delete an enrollment profile token: 1. If there's a default profile or any other enrollment profile, they must all be deleted. 1. Return to **Enrollment program tokens**. Select the token, and then select **Delete**. +## Limitations + +These Setup Assistant screens don't work correctly on devices running iOS/iPadOS 14.5 and later: + + * Passcode + * Touch ID and Face ID + +Hide both screens on devices running iOS/iPadOS 14.5 and later. If you want to require passcodes on those devices, create a device configuration policy or a compliance policy with passcode requirements. After the user enrolls and receives the policy, the passcode requirement will kick in. + ## Next steps -For an overview of what's required of device users, see [ADE end user tasks](../fundamentals/deployment-guide-enrollment-ios-ipados.md#ade-end-user-tasks). +For an overview of requirements for device users, see [ADE end user tasks](../fundamentals/deployment-guide-enrollment-ios-ipados.md#ade-end-user-tasks). diff --git a/memdocs/intune/enrollment/device-enrollment-program-enroll-macos.md b/memdocs/intune/enrollment/device-enrollment-program-enroll-macos.md index 5262b9ba62e..53e3bcbcc00 100644 --- a/memdocs/intune/enrollment/device-enrollment-program-enroll-macos.md +++ b/memdocs/intune/enrollment/device-enrollment-program-enroll-macos.md @@ -1,13 +1,13 @@ --- # required metadata -title: Enroll macOS devices - Apple Business Manager or Apple School Manager -description: Prepare Macs purchased through Apple Business Manager and Apple School Manager for Intune enrollment. +title: Set up automated device enrollment (ADE) for macOS +description: Learn how to enroll corporate-owned Macs into Microsoft Intune with Apple Automated Device Enrollment (ADE). keywords: author: Lenewsad ms.author: lanewsad manager: dougeby -ms.date: 02/19/2024 +ms.date: 09/18/2024 ms.topic: how-to ms.service: microsoft-intune ms.subservice: enrollment @@ -27,7 +27,7 @@ ms.collection: - M365-identity-device-management --- -# Automatically enroll Macs with Apple Business Manager or Apple School Manager +# Set up automated device enrollment (ADE) for macOS Set up automated device enrollment in Intune for new or wiped Macs purchased through an Apple enrollment program, such as Apple Business Manager or Apple School Manager. With this method, you don't need to have the devices with you to configure them. Intune automatically syncs with Apple to obtain device info from your enrollment program account, and deploys your preconfigured enrollment profiles to Macs over-the-air. Prepared devices can be shipped directly to employees or students. Setup Assistant and device enrollment begin when someone turns on the Mac. @@ -44,8 +44,14 @@ This article describes how to set up an automated device enrollment profile for 4. [Assign DEP profile to devices](#assign-an-enrollment-profile-to-devices) 5. [Distribute devices to users](#end-user-experience-with-managed-devices) --> +## Certificates + +This enrollment type supports the Automated Certificate Management Environment (ACME) protocol. When new devices enroll, the management profile from Intune receives an ACME certificate. The ACME protocol provides better protection than the SCEP protocol against unauthorized certificate issuance through robust validation mechanisms and automated processes, which helps reduce errors in certificate management. + +Devices that are already enrolled do not get an ACME certificate unless they re-enroll into Microsoft Intune. ACME is supported on devices running macOS 13.1 and later. ## Limitations + Automated device enrollment via Apple Business Manager and Apple School Manager isn't supported with [device enrollment manager accounts](device-enrollment-manager-enroll.md). ## Prerequisites @@ -131,14 +137,14 @@ At the end of this procedure, you can assign this profile to Microsoft Entra dev 1. Select **Next**. -1. On the **Management Settings** page, configure **User Affinity**. *User affinity* determines whether devices enroll with or without an assigned user. Your options: +1. On the **Management Settings** page, configure **User Affinity**. *User affinity* determines whether devices enroll with or without an assigned user. Your options: * **Enroll without User Affinity**: Enroll devices that aren't associated with a single user. Choose this option for shared devices and devices that don't need to access local user data. The Company Portal app doesn't work on these types of devices. * **Enroll with User Affinity**: Enroll devices that are associated with an assigned user. Choose this option for work devices that belong to users, and if you want to require users to have the Company Portal app to install apps. Multifactor authentication (MFA) is available with this option. Option 2 requires more configurations. Users must authenticate themselves before enrollment to confirm their identity. Select one of the following authentication methods: - - **Setup Assistant with modern authentication**: This method requires users to complete all Setup Assistant screens and sign in to the Company Portal app with their Microsoft Entra credentials before they can access resources. After they sign in to Company Portal, the device: + - **Setup Assistant with modern authentication**: This method requires users to complete all Setup Assistant screens and sign in to the Company Portal app with their Microsoft Entra credentials before they can access resources. After they sign in to Company Portal, the device: - Registers with Microsoft Entra ID. - Is added to the user's device record in Microsoft Entra ID. @@ -174,24 +180,24 @@ At the end of this procedure, you can assign this profile to Microsoft Entra dev > [!div class="mx-imgBorder"] > ![Image of admin center showing new Account settings section in the macOS automated device enrollment profile.](./media/device-enrollment-program-enroll-macos/macos-account-settings-intune.png) - These settings are supported on devices running macOS 10.11 or later. Keep in mind while you configure the primary account that this account will be an *admin* account after it's created. Having at least one admin account is a Mac setup requirement. + These settings are supported on devices running macOS 10.11 or later. Keep in mind while you configure the primary account that this account is going to be an *admin* account. Having at least one admin account is a Mac setup requirement. Your options: * **Create a local primary account**: Select **Yes** to configure local primary account settings for targeted Macs. Select **Not configured** to skip all account setting configurations. - * **Prefill account info**: The default configuration, **Not configured**, requires the device user to enter their account username and full name in Setup Assistant. To prefill the account information for them instead, select **Yes**. Then enter the primary account name and full name: + * **Prefill account info**: The default configuration, **Not configured**, requires the device user to enter their account username and full name in Setup Assistant. To prefill the account information for them instead, select **Yes**. Then enter the primary account name and full name: * **Primary account name**: Enter the username for the account. `{{partialupn}}` is the supported token variable for *account name*. * **Primary account full name**: Enter the full name of the account. `{{username}}` is the supported token variable for *full name*. * **Restrict editing**: The default configuration is set to **Yes** so that device users can't edit the account name and full name configured for them. To allow device users to edit the account name and full name, select **Not configured**. If you're only using Setup Assistant (legacy) to enroll devices running macOS 10.15 and later, you can expect the following end user experience: - * **Yes**: The account creation screen in Setup Assistant never appears. Instead, the local primary account is automatically created based on the other setting configurations, and the password is automatically populated from the Entra ID authentication screen. The device user can't edit these fields. - * **Not configured**: The local primary account screen is shown to the end user in Setup Assistant and is populated with the configured account values, and the password from the Entra ID authentication screen. The device user can edit these fields during Setup Assistant. + * **Yes**: The account creation screen in Setup Assistant never appears. Instead, the local primary account is automatically created based on the other setting configurations, and the password is automatically populated from the Microsoft Entra authentication screen. The device user can't edit these fields. + * **Not configured**: The local primary account screen is shown to the end user in Setup Assistant and is populated with the configured account values, and the password from the Microsoft Entra authentication screen. The device user can edit these fields during Setup Assistant. For account settings to work as intended, your enrollment profile must have the following configurations: * **User affinity**: Select **Enroll with User affinity**. * **Authentication method**: Select **Setup Assistant with modern authentication** or **Setup Assistant (legacy)**. * **Await final configuration**: Select **Yes**. - Local accounts depend on the *await final configuration* feature when they're being created. As a result, if you configure any local primary account settings, this setting is always enabled. Even if you don't touch the *await final configuration* setting, it is enabled in the background and applied to the enrollment profile. + Local accounts depend on the *await final configuration* feature when they're being created. As a result, if you configure any local primary account settings, this setting is always enabled. Even if you don't touch the *await final configuration* setting, it's enabled in the background and applied to the enrollment profile. 1. Select **Next**. @@ -199,36 +205,44 @@ At the end of this procedure, you can assign this profile to Microsoft Entra dev 1. Enter your department information so that users know who to contact for support: * **Department Name**: This name appears when device users select **About Configuration** during activation. * **Department Phone**: This phone number appears when device users select **Need Help** during activation. - 2. Select the Setup Assistant screens you want to show or hide during device setup. For a description of all screens, see Setup Assistant screen reference (in this article). Your options: + 2. Select the Setup Assistant screens you want to show or hide during device setup. For a description of all screens, [see Setup Assistant screen reference](#setup-assistant-screen-reference) (in this article). Your options: * **Hide**: The screen doesn't appear to users during device setup. After device setup, the user can go to their device settings to set up the feature. * **Show**: The screen appears to users during device setup. The user can still skip screens that don't require immediate action. After device setup, the user can go to their device settings to set up the feature. 1. Select **Next**. 1. Review the summary of changes, and then select **Create** to finish creating the profile. ### Setup Assistant screen reference -The following table describes the Setup Assistant screens shown during automated device enrollment for Macs. You can show or hide these screens on supported devices during enrollment. +The following table describes the Setup Assistant screens shown during automated device enrollment for Macs. You can show or hide these screens on supported devices during enrollment. For more information about how each Setup Assistant screen affects the user experience, see these Apple resources: + +- [Apple Platform Deployment guide: Manage Setup Assistant for Apple devices](https://support.apple.com/en-mide/guide/deployment/depdeff4a547/web) +- [Apple Developer documentation: ShipKeys](https://developer.apple.com/documentation/devicemanagement/skipkeys) +- | Setup Assistant screen | What happens when visible | |------------------------------------------|------------------------------------------| -| **Location Services** | Prompt the user for their location. For macOS 10.11 and later and iOS/iPadOS 7.0 and later. | -| **Restore** | Display the Apps & Data screen. This screen gives the user the option to restore or transfer data from iCloud Backup when they set up the device. For macOS 10.9 and later, and iOS/iPadOS 7.0 and later. | -| **Apple ID** | Give the user the options to sign in with their Apple ID and use iCloud. For macOS 10.9 and later, and iOS/iPadOS 7.0 and later. | -| **Terms and Conditions** | Require the user to accept Apple's terms and conditions. For macOS 10.9 and later, and iOS/iPadOS 7.0 and later. | -| **Touch ID and Face ID** | Give the user the option to set up fingerprint identification for the device. For macOS 10.12.4 and later, and iOS/iPadOS 8.1 and later. | -| **Apple Pay** | Give the user the option to set up Apple Pay on the device. For macOS 10.12.4 and later, and iOS/iPadOS 7.0 and later. | -| **Siri** | Give the user the option to set up Siri. For macOS 10.12 and later, and iOS/iPadOS 7.0 and later. | -| **Diagnostics Data** | Display the Diagnostics screen to the user. This screen gives the user the option to send diagnostic data to Apple. For macOS 10.9 and later, and iOS/iPadOS 7.0 and later. | -| **Display Tone** | Give the user the option to turn on Display Tone. For macOS 10.13.6 and later, and iOS/iPadOS 9.3.2 and later. | -| **FileVault** | Display the FileVault 2 encryption screen to the user. For macOS 10.10 and later. | -| **iCloud diagnostics** | Display the iCloud Analytics screen to the user. For macOS 10.12.4 and later. | -| **Registration** | Display the registration screen. For macOS 10.9 and later. | -| **iCloud Storage** | Display the iCloud Documents and Desktop screen to the user. For macOS 10.13.4 and later. | -| **Appearance** | Display the Appearance screen to the user. For macOS 10.14 and later, and iOS/iPadOS 13.0 and later. | -| **Screen Time** | Display the Screen Time screen. For macOS 10.15 and later, and iOS/iPadOS 12.0 and later. | -| **Privacy** | Display the Privacy screen to the user. For macOS 10.13.4 and later, and iOS/iPadOS 11.3 and later. | -| **Accessibility** | Display the Accessibility screen to the user. If this screen is hidden, the user can't use the Voice Over feature. Voice Over is supported on devices that:
- Run macOS 11.
- Are connected to the internet using Ethernet.
- Have the serial number appear in Apple School Manager or Apple Business Manager. | -| **Auto unlock with Apple Watch**| Give the user an option to use their Apple Watch to unlock their Mac. For macOS 12.0 and later. -| **Terms of Address**| Give the user the option to choose how they want to be addressed throughout the system: feminine, masculine, or neutral. This Apple feature is available for select languages. For more information, see [Change Language & Region settings on Mac](https://support.apple.com/guide/mac-help/intl163/mac)(opens Apple website). For macOS 13.0 and later. +| **Location Services** | Shows the location services setup pane, where users can enable location services on their device. For macOS 10.11 and later. | +| **Restore** | Shows the apps and data setup pane. On this screen, users setting up devices can restore or transfer data from iCloud Backup. For macOS 10.9 and later. | +| **Apple ID** | Shows the Apple ID setup pane, which gives users to the option to sign in with their Apple ID and use iCloud. For macOS 10.9 and later. | +| **Terms and conditions** |Shows the Apple terms and conditions pane, and requires users to accept them. For macOS 10.9 and later. | +| **Touch ID and Face ID** | Shows the biometric setup pane, which gives users the option to set up fingerprint or facial identification on their devices. For macOS 10.12.4 and later. | +| **Apple Pay** | Shows the Apple Pay setup pane, which gives users the option to set up Apple Pay on their devices. For macOS 10.12.4 and later. | +| **Siri** | Shows the Siri setup pane to users. For macOS 10.12 and later. | +| **Diagnostics Data** | Shows the diagnostics pane where users can opt-in to send diagnostic data to Apple. For macOS 10.9 and later. | +| **Display Tone** |Shows the setup pane for the display tone. This screen gives users the option to turn on true tone display. For macOS 10.13.6 and later. | +| **FileVault** | Shows the FileVault 2 encryption screen to users. For macOS 10.10 and later. | +| **iCloud Diagnostics** | Shows the iCloud Analytics screen to users. For macOS 10.12.4 and later. | +| **Registration** | Shows the registration screen to users. For macOS 10.9 and later. | +| **iCloud Storage** | Shows the iCloud Documents and Desktop screen to the user. For macOS 10.13.4 and later. | +| **Appearance** | Shows the appearance pane where users can select an appearance mode. For macOS 10.14 and later. | +| **Screen Time** | Shows the macOS Screen Time setup pane, a feature users can enable to gain insight on screen-time, and app and website activity. For macOS 10.15 and later. | +| **Privacy** | Shows the privacy setup pane to the user. For macOS 10.13.4 and later. | +| **Accessibility** | Shows the accessibility setup screen to the user. If this screen is hidden, the user can't use the macOS Voice Over feature. Voice Over is supported on devices that:
- Run macOS 11.
- Are connected to the internet using Ethernet.
- Have a serial number in Apple School Manager or Apple Business Manager. | +| **Auto unlock with Apple Watch**| Shows the macOS Unlock with Apple Watch pane, where users can configure their Apple Watch to unlock their Mac. For macOS 12.0 and later. +| **Terms of Address**| Shows the terms of address pane, which gives users the option to choose how they want to be addressed throughout the system: feminine, masculine, or neutral. This Apple feature is available for select languages. For more information, see [Change Language & Region settings on Mac](https://support.apple.com/guide/mac-help/intl163/mac)(opens Apple website). For macOS 13.0 and later. +| **Wallpaper**| Shows the macOS Sonoma wallpaper setup pane after devices complete a software upgrade. If you hide this screen, devices get the default macOS Sonoma wallpaper. For macOS 14.1 and later. +| **Lockdown mode**| Shows the lockdown mode setup pane to users who set up an Apple ID. For macOS 14.0 and later. +| **Intelligence**| Shows the Apple Intelligence setup pane, where users can configure Apple Intelligence features. For macOS 15.0 and later. + ## Sync managed devices Syncing refreshes existing device status and imports new devices assigned to the Apple MDM server. To see all associated Apple devices and device info, sync your enrollment program token in the admin center. @@ -241,7 +255,7 @@ Syncing refreshes existing device status and imports new devices assigned to the ### Sync restrictions To comply with Apple's terms for acceptable enrollment program traffic, Microsoft Intune imposes the following restrictions: - - A *full sync* can run no more than once every seven days. During a full sync, Intune fetches the most recent, updated list of serial numbers assigned to the connected Apple MDM server. If you delete a device from Intune without unassigning it from the MDM server in Apple Business Manager or Apple School Manager, it won't be reimported to Intune until the full sync is run. + - A *full sync* can run no more than once every seven days. During a full sync, Intune fetches the most recent, updated list of serial numbers assigned to the connected Apple MDM server. If you delete a device from Intune without unassigning it from the MDM server in Apple Business Manager or Apple School Manager, it won't be reimported to Intune until the full sync runs. - If a device is released from either of the Apple enrollment programs, it can take up to 45 days for it to be automatically deleted from the Devices page in Intune. You can manually delete released devices in Intune one-by-one, if needed. Intune reports released devices as being removed from Apple Business Manager or Apple School Manager until they're automatically deleted, which occurs within 30-45 days. - A sync is run automatically every 24 hours. You can initiate a sync no more than once every 15 minutes. All sync requests are given 15 minutes to finish. The **Sync** button becomes inactive until syncing is complete. @@ -267,13 +281,13 @@ Optionally, you can select a default enrollment profile. The default profile is Distribute prepared devices throughout your organization. -* New or wiped Macs: New or wiped Macs configured in Apple Business Manager or Apple School Manager will automatically enroll in Microsoft Intune during Setup Assistant when someone turns on the device. If you assigned the device to a macOS enrollment profile with user affinity, the device user must sign in to the Company Portal after Setup Assistant is done to finish Microsoft Entra registration and conditional access requirements. +* New or wiped Macs: New or wiped Macs configured in Apple Business Manager or Apple School Manager automatically enroll in Microsoft Intune during Setup Assistant when someone turns on the device. If you assigned the device to a macOS enrollment profile with user affinity, the device user must sign in to the Company Portal after Setup Assistant is done to finish Microsoft Entra registration and conditional access requirements. * Existing Macs: You can enroll devices that already went through Setup Assistant. Complete these steps to enroll corporate-owned Macs running macOS 10.13 and later. 1. Ensure that: - * The device has been imported to Apple Business Manager or Apple School Manager. - * The device has been assigned a macOS enrollment profile in the admin center. + * The device is imported to Apple Business Manager or Apple School Manager. + * The device is assigned a macOS enrollment profile in the admin center. 1. Sign in to the device with a local administrator account. 1. To trigger enrollment, from the **Home** page open **Terminal**, and run the following command: diff --git a/memdocs/intune/enrollment/device-enrollment-shared-ios.md b/memdocs/intune/enrollment/device-enrollment-shared-ios.md index ebe08d94289..5da6c93d68b 100644 --- a/memdocs/intune/enrollment/device-enrollment-shared-ios.md +++ b/memdocs/intune/enrollment/device-enrollment-shared-ios.md @@ -8,7 +8,7 @@ keywords: author: Lenewsad ms.author: lanewsad manager: dougeby -ms.date: 08/17/2021 +ms.date: 09/16/2024 ms.topic: overview ms.service: microsoft-intune ms.subservice: enrollment diff --git a/memdocs/intune/enrollment/device-limit-intune-azure.md b/memdocs/intune/enrollment/device-limit-intune-azure.md index 76c59e3f8b8..9cd2b033fa1 100644 --- a/memdocs/intune/enrollment/device-limit-intune-azure.md +++ b/memdocs/intune/enrollment/device-limit-intune-azure.md @@ -8,7 +8,7 @@ keywords: author: Lenewsad ms.author: lanewsad manager: dougeby -ms.date: 03/04/2024 +ms.date: 10/14/2024 ms.topic: conceptual ms.service: microsoft-intune ms.subservice: enrollment @@ -58,7 +58,8 @@ Intune device limit restrictions don't apply to devices enrolled via: - Co-management with Configuration Manager - Automatic enrollment + group policy - Automatic enrollment + device enrollment manager -- Automatic enrollment + bulk device enrollment +- Automatic enrollment + bulk device enrollment +- Automatic enrollment initiated by user through desktop (for example, when they [connect a work or school account in the Windows Settings app](https://support.microsoft.com/windows/manage-user-accounts-in-windows-104dc19f-6430-4b49-6a2b-e4dbd1dcdf32)) - Windows Autopilot Devices enrolled via these methods are enrolled automatically or by an Intune admin, not by an employee or student, and are considered shared devices. Instead, you can apply the Microsoft Entra limit, where supported. diff --git a/memdocs/intune/enrollment/enrollment-restrictions-set.md b/memdocs/intune/enrollment/enrollment-restrictions-set.md index b2bbd55c30a..93079dc5b66 100644 --- a/memdocs/intune/enrollment/enrollment-restrictions-set.md +++ b/memdocs/intune/enrollment/enrollment-restrictions-set.md @@ -153,7 +153,13 @@ Intune also blocks personal devices using these enrollment methods: ## Limitations -* Enrollment restrictions are applied to users. For enrollment scenarios that aren't user-driven, such as Windows Autopilot self-deploying mode and Autopilot for pre-provisioned deployment, bulk enrollment (WCD), Azure Virtual desktop, or userless Apple Automated device enrollment (ADE without user device affinity), Intune enforces the default policy. +* Enrollment restrictions are applied to enrollments that are user-driven. Intune enforces the default policy in enrollment scenarios that aren't user-driven, such as: + + * Windows Autopilot self-deploying mode and Autopilot for pre-provisioned deployment + * Bulk enrollment via Windows Configuration Designer + * Userless Apple automated device enrollment (without user-device affinity) + * Azure Virtual Desktop + * Windows 365 * Device limit restrictions can't be applied to devices in the following Windows enrollment scenarios, because these scenarios utilize shared device mode: diff --git a/memdocs/intune/enrollment/ios-user-enrollment-supported-actions.md b/memdocs/intune/enrollment/ios-user-enrollment-supported-actions.md index c5701e52ea8..94884a32267 100644 --- a/memdocs/intune/enrollment/ios-user-enrollment-supported-actions.md +++ b/memdocs/intune/enrollment/ios-user-enrollment-supported-actions.md @@ -36,7 +36,10 @@ This article provides an overview of the Apple User Enrollment features and func ## Apple User Enrollment methods -Microsoft Intune supports account driven Apple User Enrollment and Apple User Enrollment with Company Portal. +>[!IMPORTANT] +> Apple user enrollment with Company Portal has been deprecated as an enrollment option, and is no longer available for newly enrolled devices. Microsoft Intune product and technical support remains available to devices that already have the enrollment profile. For new enrollments, we recommend account-driven user enrollment. + +Microsoft Intune supports account driven Apple User Enrollment and profile based Apple User Enrollment with Company Portal. * Account driven user enrollment: Also referred to as *account-based enrollment*. The device user initiates enrollment by going to the **Settings** app > **VPN & Device Management** and adding their work or school account. After the device user approves device management, the enrollment profile silently installs, and Intune policies are applied. diff --git a/memdocs/intune/enrollment/move-to-android-mobile-application-management.md b/memdocs/intune/enrollment/move-to-android-mobile-application-management.md index 9dba817610f..d9ed65a4881 100644 --- a/memdocs/intune/enrollment/move-to-android-mobile-application-management.md +++ b/memdocs/intune/enrollment/move-to-android-mobile-application-management.md @@ -70,7 +70,7 @@ The following table lists configurations commonly used with Android device admin | --- | --- | --- | --- | |Conditional Access | Use [device-based Conditional Access policies](../protect/app-based-conditional-access-intune-create.md). | Use [app-based Conditional Access policies](../protect/app-based-conditional-access-intune-create.md). | Before you unenroll devices, consider updating your device-based Conditional Access policies to include an `or` condition for app-based Conditional Access policies. Otherwise, device users could be in an interim state without MDM or mobile application management enforced. | | Prevent copy and paste | **Restrict copy and paste (Knox only)**

Setting available in [Configuration policy > General](../configuration/device-restrictions-android.md#general). | **Restrict cut, copy, and paste between other apps**

Setting available in [App protection policy > Data protection](../apps/app-protection-policy-settings-android.md#data-protection). | | -| Enforce password | Password settings vary depending on policy type used.

Settings available in [Configuration policy > Password](../configuration/device-restrictions-android.md#password) and [Compliance policy > Password](../protect/compliance-policy-create-android.md#password). | **PIN for app access**

Setting available in [App protection policy > Access requirements](../apps/app-protection-policy-settings-android.md#access-requirements). | | +| Enforce password | Password settings vary depending on policy type used.

Settings available in [Configuration policy > Password](../configuration/device-restrictions-android.md#password) and [Compliance policy > Device security](../protect/compliance-policy-create-android.md#device-security). | **PIN for app access**

Setting available in [App protection policy > Access requirements](../apps/app-protection-policy-settings-android.md#access-requirements). | | | Enforce minimum and maximum OS version | OS version settings vary depending on policy type used.

Settings available in [Compliance policy > Operating system version](../protect/compliance-policy-create-android.md#operating-system-version) and [Enrollment > Device platform restriction](../enrollment/create-device-platform-restrictions.md#create-a-device-platform-restriction). | **Min OS version** and **Max OS version**

Settings available in [App protection policy > Conditional launch](../apps/app-protection-policy-settings-android.md#conditional-launch). | | Block rooted devices| **Rooted devices**

Setting available in [Compliance policy > Device health](../protect/compliance-policy-create-android.md#device-health).| **Jailbroken/rooted devices**

Setting available in [App protection policy > Conditional launch](../apps/app-protection-policy-settings-android.md#conditional-launch). | | Allow specific manufacturers | **Device manufacturers**

Setting available in [Enrollment > Device platform restriction](../enrollment/create-device-platform-restrictions.md#create-a-device-platform-restriction). | **Device manufacturers**

Setting available in [App protection policy > Conditional launch](../apps/app-protection-policy-settings-android.md#conditional-launch). | | diff --git a/memdocs/intune/enrollment/multi-factor-authentication.md b/memdocs/intune/enrollment/multi-factor-authentication.md index 031502c3ec6..cc9bad1e8f0 100644 --- a/memdocs/intune/enrollment/multi-factor-authentication.md +++ b/memdocs/intune/enrollment/multi-factor-authentication.md @@ -77,6 +77,9 @@ Complete these steps to enable multi-factor authentication during Microsoft Intu | **Microsoft Intune** | Setup Assistant,
Company Portal app | With this option, MFA is required during enrollment and each time the user signs into the Company Portal app or website. The MFA prompts appear on the Company Portal sign-in page. | | **Microsoft Intune Enrollment** | Setup Assistant | With this option, MFA is required during device enrollment and appears as a one-time MFA prompt on the Company Portal sign-in page. | + > [!NOTE] + > The Microsoft Intune Enrollment cloud app isn't created automatically for new tenants. To add the app for new tenants, a Microsoft Entra administrator must create a service principal object, with app ID d4ebce55-015a-49b5-a083-c84d1797ae8c, in PowerShell or Microsoft Graph. + 1. Select the **Grant** category. 1. Select **Require multifactor authentication** and **Require device to be marked as compliant**. 1. Under **For multiple controls**, select **Require all the selected controls**. @@ -90,7 +93,7 @@ Complete these steps to enable multi-factor authentication during Microsoft Intu After you apply and deploy this policy, users will see a one-time MFA prompt when they enroll their device. > [!NOTE] -> A second device is required to complete the MFA challenge for these types of corporate-owned devices: +> A second device or a Temporary Access Pass is required to complete the MFA challenge for these types of corporate-owned devices: > > - Android Enterprise fully managed devices > - Android Enterprise corporate-owned devices with a work profile diff --git a/memdocs/intune/enrollment/quickstart-setup-auto-enrollment.md b/memdocs/intune/enrollment/quickstart-setup-auto-enrollment.md index 47701b8017e..b9f4442956c 100644 --- a/memdocs/intune/enrollment/quickstart-setup-auto-enrollment.md +++ b/memdocs/intune/enrollment/quickstart-setup-auto-enrollment.md @@ -11,7 +11,7 @@ ms.service: microsoft-intune ms.subservice: enrollment ms.localizationpriority: high ms.topic: quickstart -ms.date: 5/10/2024 +ms.date: 10/03/2024 # optional metadata @@ -50,13 +50,13 @@ If you don't have an Intune subscription, [sign up for a free trial account](../ - [Create a group](../fundamentals/quickstart-create-group.md). - [Have Microsoft Entra ID P1 or P2](/azure/active-directory/active-directory-get-started-premium) or the [Premium trial subscription](https://go.microsoft.com/fwlink/?LinkID=816845). You can activate a free Premium trial subscription during setup. -To configure automatic MDM enrollment, you must be an [Intune Administrator](/entra/identity/role-based-access-control/permissions-reference#intune-administrator). If you signed up for an Intune Trial subscription at the beginning of this quickstart, your account has [Global Administrator](/entra/identity/role-based-access-control/permissions-reference#global-administrator) permissions and can complete all procedures in this article. +To configure automatic MDM enrollment, you must be a [Microsoft Entra Global Administrator](/entra/identity/role-based-access-control/permissions-reference#global-administrator). If you signed up for a Microsoft Intune Trial subscription at the beginning of this quickstart, your account has Global Administrator permissions and can complete all procedures in this article. ## Set up automatic enrollment For this example, you'll configure Microsoft Intune mobile device management (MDM) enrollment settings so that corporate-owned and personal devices automatically enroll in Microsoft Intune. *MDM user scope* enables automatic enrollment for Microsoft Intune device management. -1. In the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431) go to **Devices** > **Enrollment**. +1. In the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431), go to **Devices** > **Enrollment**. 2. Go to the **Windows** tab. Then select **Automatic Enrollment**. > [!IMPORTANT] diff --git a/memdocs/intune/enrollment/web-based-device-enrollment-ios.md b/memdocs/intune/enrollment/web-based-device-enrollment-ios.md index 715907e26c7..442dedd32ed 100644 --- a/memdocs/intune/enrollment/web-based-device-enrollment-ios.md +++ b/memdocs/intune/enrollment/web-based-device-enrollment-ios.md @@ -8,7 +8,7 @@ keywords: author: Lenewsad ms.author: lanewsad manager: dougeby -ms.date: 05/15/2024 +ms.date: 09/23/2024 ms.topic: conceptual ms.service: microsoft-intune ms.subservice: enrollment @@ -81,14 +81,14 @@ When an employee attempts to sign into a work app on their personal device, the Alternatively, you can provide employees and students with a URL that opens the Company Portal website. If you aren't utilizing conditional access, it's important to share the enrollment link with device users so that they know how to initiate enrollment. The link to share is: - `portal.manage.microsoft.com/conditionalaccess/enrollment` + `https://portal.manage.microsoft.com/enrollment/webenrollment/ios` This section provides the high-level enrollment steps for device users. We recommend using this information in your organization's device onboarding documentation or for troubleshooting and support. >[!IMPORTANT] > Safari browser is the only supported browser for this type of enrollment, and is needed to download the management profile and complete enrollment. If a user's default browser is anything other than Safari, they will need to copy the enrollment link and paste it into a Safari browser to initiate enrollment. After they complete enrollment, users can return to their preferred browser. -1. Open Safari and go to [https://portal.manage.microsoft.com/conditionalaccess/enrollment](https://portal.manage.microsoft.com/conditionalaccess/enrollment). Sign in with your work or school account. +1. Open Safari and go to [https://portal.manage.microsoft.com/enrollment/webenrollment/ios](https://portal.manage.microsoft.com/enrollment/webenrollment/ios). Sign in with your work or school account. 2. When prompted to, download the management profile. Wait in Safari while Company Portal downloads the management profile. 3. Go to your device settings app to view and install the management profile. 4. Wait until Microsoft Authenticator is installed on the device before signing into a work or school app. The device won't be ready for work use until Authenticator is on the device, which can take a few minutes. To verify that Authenticator installed, open your device settings and go to **Profile** > **Management Profile** > **Single Sign On Extension**. Authenticator should be listed as the SSO extension. diff --git a/memdocs/intune/enrollment/windows-enroll.md b/memdocs/intune/enrollment/windows-enroll.md index e840100b3a4..0c810d8fcb2 100644 --- a/memdocs/intune/enrollment/windows-enroll.md +++ b/memdocs/intune/enrollment/windows-enroll.md @@ -59,13 +59,13 @@ This article describes how to enable automatic mobile device management (MDM) en You must have: - A [Microsoft Entra ID P1 or P2 subscription](/azure/active-directory/active-directory-get-started-premium) or [Premium trial subscription](https://go.microsoft.com/fwlink/?LinkID=816845) for automatic MDM enrollment and custom company branding. - A Microsoft Intune subscription. -- A Microsoft Entra Global Administator or Intune Administrator role. For more information about role-based-access-control (RBAC), see [RBAC with Microsoft Intune](../fundamentals/role-based-access-control.md). +- A Microsoft Entra Global Administrator role. For more information about role-based-access-control (RBAC), see [RBAC with Microsoft Intune](../fundamentals/role-based-access-control.md). [!INCLUDE [AAD-enrollment](../includes/win10-automatic-enrollment-aad.md)] ## Support for device users -The Microsoft Intune user-help docs provide conceptual information, tutorials, and how-to guides for employees and students setting up their devices for work. You can point people directly to the Intune docs, or use these articles as guidance when developing and updating your own device management docs. +The Microsoft Intune user help docs provide conceptual information, tutorials, and how-to guides for employees and students setting up their devices for work. You can point people directly to the Intune docs, or use these articles as guidance when developing and updating your own device management docs. Users on personal devices running Windows 11 or Windows 10 can automatically enroll by adding their work or school account on their device, or by using the Intune Company Portal app. Devices running earlier versions of Windows must enroll using the Intune Company Portal app. For more information, see [Enroll Windows 10/11 devices](../user-help/enroll-windows-10-device.md). diff --git a/memdocs/intune/fundamentals/account-sign-up.md b/memdocs/intune/fundamentals/account-sign-up.md index 0acdf36b454..90a6b299baa 100644 --- a/memdocs/intune/fundamentals/account-sign-up.md +++ b/memdocs/intune/fundamentals/account-sign-up.md @@ -7,7 +7,7 @@ keywords: author: Smritib17 ms.author: smbhardwaj manager: dougeby -ms.date: 06/20/2024 +ms.date: 10/02/2024 ms.topic: how-to ms.service: microsoft-intune ms.subservice: fundamentals @@ -43,6 +43,8 @@ If you already have a work or school account, **sign in** with that account and >[!WARNING] >You can't combine an existing work or school account after you sign up for a new account. +[!INCLUDE [MFA requirement for admin center](../includes/mfa-console.md)] + ## How to sign up for Intune 1. Visit the [Intune Sign up page](https://admin.microsoft.com/Signup/Signup.aspx?OfferId=40BE278A-DFD1-470a-9EF7-9F2596EA7FF9&dl=INTUNE_A&ali=1#0%20). diff --git a/memdocs/intune/fundamentals/android-os-project-supported-devices.md b/memdocs/intune/fundamentals/android-os-project-supported-devices.md index f91e1890bee..0361383d0a3 100644 --- a/memdocs/intune/fundamentals/android-os-project-supported-devices.md +++ b/memdocs/intune/fundamentals/android-os-project-supported-devices.md @@ -7,7 +7,7 @@ keywords: author: Smritib17 ms.author: smbhardwaj manager: dougeby -ms.date: 03/01/2024 +ms.date: 10/15/2024 ms.topic: conceptual ms.service: microsoft-intune ms.subservice: fundamentals @@ -43,6 +43,7 @@ Before setting up Microsoft Intune for Android Open Source Project devices, ensu |**OEM** | **Device** | **Minimum Firmware** | **Type of Device** | **Restrictions** | | ------- | -------------------| ------------------- | -------------- | ------------------ | +| HTC | Vive Focus Vision | 7.0.999.159 | AR/VR Headset | | | HTC | HTC Vive Focus 3 | 5.2 - 5.0.999.624 | AR/VR Headset | | | HTC | HTC Vive XR Elite | 4.0 - 1.0.999.350 | AR/VR Headset | | | Meta | Quest 2 | v49 | AR/VR Headset | [Available in select regions only](https://work.meta.com/help/307276701907179) | @@ -55,3 +56,5 @@ Before setting up Microsoft Intune for Android Open Source Project devices, ensu | Realwear| Navigator 500 | 1.1 | AR/VR Headset | | | Lenovo| ThinkReality VRX | VRX_user_S766001_2310192349_kona | AR/VR Headset | | | DigiLens Inc.| DigiLens ARGO | DigiOS 2068 (B1.0001.2068) | AR/VR Headset | | +| Vuzix | M400 | M-Series Version 3.0.2 | AR/VR Headset | | +| Vuzix | M4000 | M-Series Version 3.0.2 | AR/VR Headset | | \ No newline at end of file diff --git a/memdocs/intune/fundamentals/cloud-configuration-setup-guide.md b/memdocs/intune/fundamentals/cloud-configuration-setup-guide.md index f1c0a8d5e7c..9796042f2b2 100644 --- a/memdocs/intune/fundamentals/cloud-configuration-setup-guide.md +++ b/memdocs/intune/fundamentals/cloud-configuration-setup-guide.md @@ -287,18 +287,9 @@ The script is deployed to devices using in Intune. To add and deploy the script, #### Microsoft Store app -If you previously removed the Microsoft Store app, you can redeploy it using Microsoft Intune. To re-add the Microsoft Store app (or any other apps you want to re-add), add the Microsoft Store app to your private organization app repository. Then, deploy the app to devices using Intune. The Microsoft Store app helps keep apps updated. +If you previously removed the Microsoft Store app, you can redeploy it using Microsoft Intune. To re-add the Microsoft Store app (or any other apps you want to re-add), add the Microsoft Store app to your private organization app repository. Then, deploy the app to devices using Intune. The Microsoft Store app helps keep apps updated. For information about how to configure access to the Microsoft Store app, see [Manage access to private store](/microsoft-store/manage-access-to-private-store). -Your private organization app repository can be: - -- The Intune Company Portal app or website (preferred) - -- Microsoft Store for Business or Microsoft Store for Education - - Previously, the Microsoft Store app had a Microsoft Store for Business tab. This tab is removed. If you use Microsoft Store for Business, then to access your private app repository, go to the [Microsoft Store for Business website](https://businessstore.microsoft.com/). For more information, go to [Manage access to private store](/microsoft-store/manage-access-to-private-store). - - > [!NOTE] - > The Microsoft Store for Business and Microsoft Store for Education will be retired. For more information, go to [Microsoft Store for Business and Microsoft Store for Education](/microsoft-store/microsoft-store-for-business-overview). +Your private organization app repository can be the Intune Company Portal app or website. Using Intune, on Windows 10/11 Enterprise and Education devices, you can block end users from installing Microsoft Store apps outside of your organization's private app repository. diff --git a/memdocs/intune/fundamentals/deployment-guide-enroll.md b/memdocs/intune/fundamentals/deployment-guide-enroll.md index a4d22eff85b..ef72e3c7235 100644 --- a/memdocs/intune/fundamentals/deployment-guide-enroll.md +++ b/memdocs/intune/fundamentals/deployment-guide-enroll.md @@ -141,7 +141,7 @@ The following tabs describe the Intune-supported Android and AOSP enrollment opt * [Corporate-owned, userless devices](../enrollment/android-aosp-corporate-owned-userless-enroll.md): Enroll devices that are built from the Android Open Source Project (AOSP) and absent of Google Mobile services as *corporate-owned, userless devices*. These devices don't have a user associated with them and are intended to be shared, like in a library or lab. * [Corporate-owned, user associated devices](../enrollment/android-aosp-corporate-owned-user-associated-enroll.md): Enroll devices that are built from AOSP and absent of Google Mobile services as *corporate-owned, user-associated devices*. These devices are associated with a single user and intended to be exclusively for work use. -* [Zero-touch enrollment](../enrollment/android-dedicated-devices-fully-managed-enroll.md#enroll-by-using-google-zero-touch): We recommend using zero-touch enrollment for bulk enrollments and to simplify enrollment for remote workers. This method lets you prepare corporate-owned devices ahead of time so that they automatically provision and enroll as fully manged devices when users turn them on. +* [Zero-touch enrollment](../enrollment/android-dedicated-devices-fully-managed-enroll.md#enroll-by-using-google-zero-touch): We recommend using zero-touch enrollment for bulk enrollments and to simplify enrollment for remote workers. This method lets you prepare corporate-owned devices ahead of time so that they automatically provision and enroll as fully managed devices when users turn them on. # [User owned](#tab/user-owned-android) diff --git a/memdocs/intune/fundamentals/deployment-guide-enrollment-ios-ipados.md b/memdocs/intune/fundamentals/deployment-guide-enrollment-ios-ipados.md index 22d19142aa6..f2f4ec2cd4a 100644 --- a/memdocs/intune/fundamentals/deployment-guide-enrollment-ios-ipados.md +++ b/memdocs/intune/fundamentals/deployment-guide-enrollment-ios-ipados.md @@ -214,7 +214,7 @@ When you create an enrollment profile in the [Intune admin center](https://go.mi 5. If you don't **Install Company Portal app with VPP**, and want to use the Company Portal app, then: - 1. Users sign in to the Apple app store with their Apple ID (`user@iCloud.com` or `user@gmail.com`). When they sign in, the Company Portal app automatically installs. + 1. Users sign in to the Apple App Store with their Apple ID (`user@iCloud.com` or `user@gmail.com`). When they sign in, the Company Portal app automatically installs. This extra sign-in step slows the enrollment, especially if users don't sign in immediately. @@ -222,7 +222,7 @@ When you create an enrollment profile in the [Intune admin center](https://go.mi 2. Users open the Company Portal app, and sign in with their work or school account (`user@contoso.com`) again. They complete Microsoft Entra registration in the Company Portal app, which fully registers the device with Microsoft Entra ID. At the next check-in, users gain access to corporate resources protected by Conditional Access policies. -- **Enroll without user affinity**: No actions. Be sure they don't install the Company Portal app from the Apple app store. +- **Enroll without user affinity**: No actions. Be sure they don't install the Company Portal app from the Apple App Store. :::image type="content" source="./media/deployment-guide-enrollment-ios-ipados/ade-enroll-without-user-affinity.png" alt-text="In the Intune admin center and Microsoft Intune, enroll iOS/iPadOS devices using automated device enrollment (ADE). Select enroll without user affinity."::: @@ -305,7 +305,7 @@ This task list provides an overview. For more specific information, go to [Apple - If you choose **Enroll without user affinity**, then you're automatically using **Direct enrollment**. Remember: - You're using the settings from an existing macOS enrollment profile. - - Users can't use apps that require a user, including the Company Portal app. The Company Portal app isn't used, needed, or supported on enrollments without user affinity. Be sure users don't install the Company Portal app from the Apple app store. + - Users can't use apps that require a user, including the Company Portal app. The Company Portal app isn't used, needed, or supported on enrollments without user affinity. Be sure users don't install the Company Portal app from the Apple App Store. - When the enrollment profile is ready, USB connect the devices to the Mac, and open the **Apple Configurator** app. When the app opens, it detects the USB connected device, and deploys the Intune enrollment profile you created. @@ -340,7 +340,7 @@ The tasks depend on the option you configured in the enrollment profile. 2. The Setup Assistant prompts the user for information, including the Apple ID (`user@iCloud.com` or `user@gmail.com`). This step pushes the Intune management profile to the device. 3. Users install the management profile. The profile checks in with the Intune service, and enrolls the device. The device isn't registered in Microsoft Entra ID. -- **Enroll without user affinity**: You're using Direct enrollment. No actions. Be sure they don't install the Company Portal app from the Apple app store. +- **Enroll without user affinity**: You're using Direct enrollment. No actions. Be sure they don't install the Company Portal app from the Apple App Store. :::image type="content" source="./media/deployment-guide-enrollment-ios-ipados/configurator-enroll-without-user-affinity.png" alt-text="In the Intune admin center and Microsoft Intune, enroll iOS/iPadOS devices using Apple Configurator. Select enroll without user affinity."::: @@ -350,9 +350,9 @@ The tasks depend on the option you configured in the enrollment profile. These iOS/iPadOS devices are personal or BYOD (bring your own device) devices that can access organization email, apps, and other data. Starting with iOS 13 and newer, this enrollment option targets users or targets devices. It doesn't require resetting the devices. -When you create the enrollment profile, you're asked to choose **User enrollment with Company Portal**, **Device enrollment with Company Portal**, **Account driven user enrollment**, or **Determine based on user choice**. +When you create the enrollment profile, you're asked to choose **Device enrollment with Company Portal**, **Account driven user enrollment**, or **Determine based on user choice**. -For the specific enrollment steps, and its prerequisites, go to [Set up iOS/iPadOS user enrollment](../enrollment/ios-user-enrollment.md) and [Set up iOS/iPadOS device enrollment](../enrollment/ios-device-enrollment.md). +For the specific enrollment steps, and its prerequisites, go to [Set up account driven user enrollment](../enrollment/apple-account-driven-user-enrollment.md) and [Set up iOS/iPadOS device enrollment](../enrollment/ios-device-enrollment.md). --- | Feature | Use this enrollment option when | @@ -371,7 +371,7 @@ For the specific enrollment steps, and its prerequisites, go to [Set up iOS/iPad ### User and Device enrollment administrator tasks -This task list provides an overview. For more specific information, go to [Set up iOS/iPadOS and iPadOS User Enrollment](../enrollment/ios-user-enrollment.md). +This list provides an overview of the tasks required of administrators. - Be sure your devices are [supported](supported-devices-browsers.md). - Be sure the [Apple MDM push certificate](../enrollment/apple-mdm-push-certificate-get.md) is added to Intune, and is active. This certificate is required to enroll iOS/iPadOS devices. For more information, go to [Get an Apple MDM push certificate](../enrollment/apple-mdm-push-certificate-get.md). @@ -387,26 +387,26 @@ This task list provides an overview. For more specific information, go to [Set u - **Determine based on user choice**: Gives end users a choice when they enroll. Depending on their selection, **User enrollment** or **Device enrollment** is used. - - **User enrollment**: Starting with iOS 13 and newer. This option configures a specific set of features and organization apps, like password, per-app VPN, Wi-Fi, and Siri. If you use User enrollment, and to help secure apps and their data, then we recommend also using app protection policies. + - **Account driven user enrollment**: Starting with iOS 13 and newer. This option configures a specific set of features and organization apps, like password, per-app VPN, Wi-Fi, and Siri. If you use this method, and to help secure apps and their data, then we recommend also using app protection policies. - For the complete list of what you can and can't do, go to [Intune actions and options supported with Apple User Enrollment](../enrollment/ios-user-enrollment-supported-actions.md). For the specific user enrollment steps, go to [Set up iOS/iPadOS User Enrollment](../enrollment/ios-user-enrollment.md). + For the complete list of what you can and can't do, go to [Overview of Apple User Enrollment in Microsoft Intune](../enrollment/ios-user-enrollment-supported-actions.md). > [!NOTE] > BYOD can become organization-owned devices. To make these devices corporate, go to [Identify devices as corporate-owned](../enrollment/corporate-identifiers-add.md). - User enrollment is considered friendlier to end users. But, it might not provide the feature set and security features administrators need. In some scenarios, user enrollment might not be the best option. Consider the following scenarios: + Account driven user enrollment is considered friendlier to end users. But, it might not provide the feature set and security features administrators need. In some scenarios, account driven user enrollment might not be the best option. Consider the following scenarios: - - User enrollment creates a work partition on the devices. The features and security you configure in the user enrollment profile only exist in the work partition. They don't exist in the user partition. Users can't factory reset the work partition; administrators can. Users can factory reset the personal partition; administrators can't. + - Account driven user enrollment creates a work partition on the devices. The features and security you configure in the user enrollment profile only exist in the work partition. They don't exist in the user partition. Users can't factory reset the work partition; administrators can. Users can factory reset the personal partition; administrators can't. - - If users primarily use Microsoft apps, or use apps created with the [Intune App SDK](../developer/app-sdk.md), then users should download these apps from the Apple app store. Then, use app protection policies to protect these apps. In this scenario, you don't need user enrollment. + - If users primarily use Microsoft apps, or use apps created with the [Intune App SDK](../developer/app-sdk.md), then users should download these apps from the Apple App Store. Then, use app protection policies to protect these apps. In this scenario, you don't need account driven user enrollment. - - For line of business (LOB) apps, user enrollment might be an option, as it deploys these apps to the work partition. Application management (MAM) doesn't support LOB apps. So if you need LOB apps, then use User Enrollment. + - For line of business (LOB) apps, account driven user enrollment might be an option, as it deploys these apps to the work partition. Application management (MAM) doesn't support LOB apps. So if you need LOB apps, then use account driven user enrollment. - - When devices are enrolled using user enrollment, you can't switch to device enrollment. With user enrollment, you can't move an app from unmanaged to managed. Users must unenroll from user enrollment, and then re-enroll to device enrollment. + - When devices are enrolled using account driven user enrollment, you can't switch to device enrollment. With account driven user enrollment, you can't move an app from unmanaged to managed. Users must unenroll from user enrollment, and then re-enroll to device enrollment. - If you install apps before the user enrollment profile is applied, then these apps aren't protected or managed by the user enrollment profile. - For example, a user downloads the Outlook app from the Apple app store. The app automatically installs to the user partition on the device. The user configures Outlook for their personal email. When users configure their organization email, they're blocked by Conditional Access, and asked to enroll. They enroll, and a user enrollment profile deploys. + For example, a user downloads the Outlook app from the Apple App Store. The app automatically installs to the user partition on the device. The user configures Outlook for their personal email. When users configure their organization email, they're blocked by Conditional Access, and asked to enroll. They enroll, and a user enrollment profile deploys. Since the Outlook app was installed before the user enrollment profile, the user enrollment profile fails. The Outlook app can't be managed because it's installed and configured in the user partition, not the work partition. Users must manually uninstall the Outlook app. @@ -414,18 +414,18 @@ This task list provides an overview. For more specific information, go to [Set u - Assign the enrollment profile to user groups. Don't assign to device groups. -### User and Device enrollment end user tasks +### Device enrollment end user tasks -Your users must do the following steps. For the specific user experience, go to [enroll the device](../user-help/enroll-your-device-in-intune-ios.md). +Your users must do the following steps. -1. Go to the Apple app store, and [install the Intune Company Portal app](../user-help/sign-in-to-the-company-portal.md). -2. Open the Company Portal app, and sign in with their organization credentials (`user@contoso.com`). After they sign in, your enrollment profile applies to the device. +1. Go to the Apple App Store, and [install the Intune Company Portal app](../user-help/sign-in-to-the-company-portal.md). +2. Open the Company Portal app, and sign in with their work or school account (`user@contoso.com`). After they sign in, your enrollment profile applies to the device. - Users might have to enter more information. For more specific steps, go to [enroll the device](../user-help/enroll-your-device-in-intune-ios.md). + Users might have to enter more information. For more specific steps, go to [enroll the device](../user-help/enroll-your-device-in-intune-ios.md). Users with enabled app notifications receive a prompt to return to the Company Portal app to complete the required device registration. Users with disabled app notifications aren't alerted to this requirement. If you're utilizing dynamic groups, which rely on device registration to work, it's important that users complete device registration. Plan to communicate these steps to end users. If you're using Conditional Access (CA) policies, no action is required because any CA-protected app users try to sign into will prompt them to return to Company Portal to complete device registration. -When enrollment completes, Intune automatically installs a profile signing certificate on the device. This certificate is valid for one year. At the year end when the certificate is expiring, Intune renews the certificate. If this renew process fails, then on the device, the **Settings** app > **General** > **VPN & Device management** > **Management Profile** status shows **Not verified**. With this status, end users aren't impacted, and devices continue to check-in with Intune and receive policy updates. +When enrollment completes, Intune automatically installs a profile signing certificate on the device. This certificate is valid for one year. At the year end when the certificate is expiring, Intune renews the certificate. If renewal fails, then a **Not verified** status appears within the **VPN & Device management** > **Management Profile** settings on the device. With this status, end users aren't impacted, and devices continue to check-in with Intune and receive policy updates. [!INCLUDE [users-dont-like-enroll](../includes/users-dont-like-enroll.md)] @@ -434,6 +434,19 @@ When enrollment completes, Intune automatically installs a profile signing certi > > [Enroll your iOS/iPadOS device](https://www.youtube.com/watch?v=mJyv6YcHi7c) +### User enrollment end user tasks + +Your users must complete the following steps during account driven user enrollment. + +1. Open the Settings app and go to **General** > **VPN & Device Management**. +2. Sign in to their work or school account. +4. Follow the onscreen prompts and allow remote management. +5. Enter the device passcode to set up remote management. + +When enrollment completes, Intune automatically installs a profile signing certificate on the device. This certificate is valid for one year. At the year end when the certificate is expiring, Intune renews the certificate. If renewal fails, then a **Not verified** status appears within the **VPN & Device management** > **Management Profile** settings on the device. With this status, end users aren't impacted, and devices continue to check in with Intune and receive policy updates. + +For more information about the user experience, go to [Prepare employees for enrollment](../enrollment/apple-account-driven-user-enrollment.md#step-3-prepare-employees-for-enrollment). + ## Related articles - [MAM](deployment-guide-enrollment-mamwe.md) diff --git a/memdocs/intune/fundamentals/deployment-guide-enrollment.md b/memdocs/intune/fundamentals/deployment-guide-enrollment.md index 1924b7bf387..0556bfafa2d 100644 --- a/memdocs/intune/fundamentals/deployment-guide-enrollment.md +++ b/memdocs/intune/fundamentals/deployment-guide-enrollment.md @@ -146,7 +146,7 @@ On the platforms that don't require a factory reset, when these devices enroll i There's an enrollment guide for every platform. Choose your scenario, and get started: -- [Application management without enrollment (MAM-WE)](deployment-guide-enrollment-mamwe.md) +- [Application management without enrollment](deployment-guide-enrollment-mamwe.md) - [Android](deployment-guide-enrollment-android.md) - [iOS/iPadOS](deployment-guide-enrollment-ios-ipados.md) - [Linux](deployment-guide-enrollment-linux.md) diff --git a/memdocs/intune/fundamentals/deployment-plan-protect-apps.md b/memdocs/intune/fundamentals/deployment-plan-protect-apps.md index 75252fe7e0f..73427bba58d 100644 --- a/memdocs/intune/fundamentals/deployment-plan-protect-apps.md +++ b/memdocs/intune/fundamentals/deployment-plan-protect-apps.md @@ -32,7 +32,7 @@ The next step when deploying Intune is to add and protect apps that access organ :::image type="content" source="./media/deployment-plan-protect-apps/deployment-plan-add-apps.png" alt-text="Diagram that shows getting started with Microsoft Intune with step 2, which is adding and protect apps using Microsoft Intune."::: -Managing applications on devices in your organization is a central part to a secure and productive enterprise ecosystem. You can use Microsoft Intune to manage the apps that your company's workforce uses. By managing apps, you help control which apps your company uses, as well as the configuration and protection of the apps. This functionality is called mobile application management (MAM). MAM in Intune is designed to protect organization data at the application level, including custom apps and store apps. App management can be used on organization-owned devices and personal devices. When it is used with personal devices, only organization-related access and data is managed. This type of app management is called MAM without enrollment (MAM-WE), or from an end-user perspective, bring your own device (BYOD). +Managing applications on devices in your organization is a central part to a secure and productive enterprise ecosystem. You can use Microsoft Intune to manage the apps that your company's workforce uses. By managing apps, you help control which apps your company uses, as well as the configuration and protection of the apps. This functionality is called mobile application management (MAM). MAM in Intune is designed to protect organization data at the application level, including custom apps and store apps. App management can be used on organization-owned devices and personal devices. When it is used with personal devices, only organization-related access and data is managed. This type of app management is called MAM without enrollment, or from an end-user perspective, bring your own device (BYOD). ## MAM configurations @@ -45,7 +45,7 @@ Microsoft Intune supports two MAM configurations: ### MAM without device management -This configuration allows your organization's apps to be managed by Intune, but doesn't enroll the devices to be managed by Intune. This configuration is commonly referred to as **MAM without device enrollment**, or **MAM-WE**. IT administrators can manage apps using MAM by using Intune configuration and protection policies on devices not enrolled with Intune mobile-device management (MDM). +This configuration allows your organization's apps to be managed by Intune, but doesn't enroll the devices to be managed by Intune. This configuration is commonly referred to as **MAM without device enrollment**. IT administrators can manage apps using MAM by using Intune configuration and protection policies on devices not enrolled with Intune mobile-device management (MDM). > [!NOTE] > This configuration includes managing apps with Intune on devices enrolled with third-party enterprise mobility management (EMM) providers. You can use Intune app protection policies independent of any MDM solution. This independence helps you protect your company's data with or without enrolling devices in a device management solution. By implementing app-level policies, you can restrict access to company resources and keep data within the purview of your IT department. diff --git a/memdocs/intune/fundamentals/education-settings-configure-ios.md b/memdocs/intune/fundamentals/education-settings-configure-ios.md index 17020f81d9a..2bd57b06222 100644 --- a/memdocs/intune/fundamentals/education-settings-configure-ios.md +++ b/memdocs/intune/fundamentals/education-settings-configure-ios.md @@ -162,7 +162,7 @@ When you're finished configuring certificates, choose **OK**. The profile is created and appears on the profiles list pane. -Assign the profile to student devices in the classroom groups that were created when you synchronized your school data with Microsoft Entra ID (see [How to assign device profiles](../configuration/device-profile-assign.md). +Assign the profile to student devices in the classroom groups that were created when you synchronized your school data with Microsoft Entra ID (see [How to assign device profiles](../configuration/device-profile-assign.md)). ## Next steps diff --git a/memdocs/intune/fundamentals/free-trial-sign-up.md b/memdocs/intune/fundamentals/free-trial-sign-up.md index f9fc5c0bbea..9521ef85f54 100644 --- a/memdocs/intune/fundamentals/free-trial-sign-up.md +++ b/memdocs/intune/fundamentals/free-trial-sign-up.md @@ -8,7 +8,7 @@ keywords: author: Erikre ms.author: erikre manager: dougeby -ms.date: 05/13/2024 +ms.date: 10/02/2024 ms.topic: conceptual ms.service: microsoft-intune ms.subservice: fundamentals @@ -54,6 +54,8 @@ Trying out Intune is free for 30 days. If you already have a work or school acco > [!IMPORTANT] > You can't combine an existing work or school account after you sign up for a new account. +[!INCLUDE [MFA requirement for admin center](../includes/mfa-console.md)] + To sign up for the Microsoft Intune free trial, follow the steps below: 1. Navigate to the [Intune set up account page](https://go.microsoft.com/fwlink/?linkid=2019088). diff --git a/memdocs/intune/fundamentals/in-development.md b/memdocs/intune/fundamentals/in-development.md index f7b0db850cb..4e975e33bbc 100644 --- a/memdocs/intune/fundamentals/in-development.md +++ b/memdocs/intune/fundamentals/in-development.md @@ -7,7 +7,7 @@ keywords: author: dougeby ms.author: dougeby manager: dougeby -ms.date: 08/23/2024 +ms.date: 10/29/2024 ms.topic: conceptual ms.service: microsoft-intune ms.subservice: fundamentals @@ -77,20 +77,13 @@ EPM is available as an [Intune Suite add-on-capability](../fundamentals/intune-a ## App management -### New UI for Intune Company Portal app for Windows +### Additional reporting details for LOB apps on AOSP devices -The UI for the Intune Company Portal app for Windows will be updated. Users will be able to use the same functionality they’re used to with an improved experience for their desktop app. With the updated design, users will see improvements in user experience for the **Home**, **Devices**, and **Downloads & updates** pages. The new design will be more intuitive and will highlights areas where users need to take action. - -For more information, see [New look for Intune Company Portal app for Windows](https://techcommunity.microsoft.com/t5/intune-customer-success/new-look-for-intune-company-portal-app-for-windows/ba-p/4158755). - -### Working Time settings for Microsoft Teams - -Working time settings will allow you to enforce policies that limit access and to mute notifications received during non-working time on Microsoft Teams app. You'll be able to limit access by using App Protection Policies (APP) to block end users from using the iOS/iPadOS or Android Teams app during non-working time. Also, you'll be able to create a non-working time policy to mute notifications from the Teams app to end users during non-working time. +Additional details will be provided for app installation reporting of Line of Business (LOB) apps on Android Open Source Project (AOSP) devices. You will be able to see error codes and detailed error messages for LOB apps. For information about app status details, see [Monitor app information and assignments with Microsoft Intune](../apps/apps-monitor.md). Applies to: -- Android -- iOS/iPadOS +- Android Open Source Project (AOSP) devices ### Added protection for iOS/iPadOS app widgets @@ -104,214 +97,112 @@ Applies to: ## Device configuration -### New settings available in the Apple settings catalog - -The [Settings Catalog](../configuration/settings-catalog.md) lists all the settings you can configure in a device policy, and all in one place. For more information about configuring Settings Catalog profiles in Intune, go to [Create a policy using settings catalog](../configuration/settings-catalog.md). - -There are new settings in the Settings Catalog. To see these settings, in the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431), go to **Devices** > **Manage devices** > **Configuration** > **Create** > **New policy** > **iOS/iPadOS** or **macOS** for platform > **Settings catalog** for profile type. - -#### iOS/iPadOS - -**Declarative Device Management (DDM) > Math Settings**: - -- Calculator - - Basic Mode - - Math Notes Mode - - Scientific Mode - -- System Behavior - - Keyboard Suggestions - - Math Notes - -**Restrictions**: - -- Allow Personalized Handwriting Results -- Allow Video Conferencing Remote Control -- Allow Genmoji -- Allow Image Playground -- Allow Image Wand -- Allow iPhone Mirroring -- Allow Writing Tools - -**Web Content Filter**: - -- Hide Deny List URLs - -#### macOS - -**Declarative Device Management (DDM) > Math Settings**: - -- Calculator - - Basic Mode - - Math Notes Mode - - Programmer Mode - - Scientific Mode - -- System Behavior - - Keyboard Suggestions - - Math Notes - -**Restrictions**: - -- Allow Genmoji -- Allow Image Playground -- Allow iPhone Mirroring -- Allow Writing Tools - -**System Configuration > System Extensions**: +### Device Firmware Configuration Interface (DFCI) support for Samsung devices -- Non Removable From UI System Extensions -- Non Removable System Extensions +We're adding support to use DFCI profiles to manage UEFI (BIOS) settings for Samsung devices that run Windows 10 or Windows 11. Not all Samsung devices running Windows are enabled for DFCI. Contact your device vendor or device manufacturer for eligible devices. - -### Device Firmware Configuration Interface (DFCI) supports VAIO devices - -For Windows 10/11 devices, you can create a DFCI profile to manage UEFI (BIOS) settings. In [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431), select **Devices** > **Manage devices** > **Configuration** > **Create** > **New policy** > **Windows 10 and later** for platform > **Templates** > **Device Firmware Configuration Interface** for profile type. - -Some VAIO devices running Windows 10/11 are enabled for DFCI. Contact your device vendor or device manufacturer for eligible devices. - -For more information about DFCI profiles, see: +You can manage DFCI profiles from within the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431) by going to **Devices** > **Manage devices** > **Configuration** > **Create** > **New policy** > **Windows 10 and later** for platform > **Templates** > **Device Firmware Configuration Interface** for profile type. For more information about DFCI profiles, see: - [Configure Device Firmware Configuration Interface (DFCI) profiles on Windows devices in Microsoft Intune](../configuration/device-firmware-configuration-interface-windows.md) - [Device Firmware Configuration Interface (DFCI) management with Windows Autopilot](../../autopilot/dfci-management.md) Applies to: -- Windows 10 -- Windows 11 - -### Samsung ended support for multiple Android device administrator (DA) settings - -On Android device administrator managed (DA) devices, Samsung has deprecated many [Samsung Knox APIs](https://docs.samsungknox.com/dev/knox-sdk/api-reference/deprecated-api-methods/) (opens Samsung's web site) configuration settings. - -In Intune, this deprecation impacts the following device restrictions settings, compliance settings and trusted certificate profiles: +- Windows -- [Device restriction settings for Android in Microsoft Intune](../configuration/device-restrictions-android.md) -- [View the Android device administrator compliance settings for Microsoft Intune compliance policies](../protect/compliance-policy-create-android.md) -- [Create trusted certificate profiles in Microsoft Intune](../protect/certificates-trusted-root.md#trusted-certificate-profiles-for-android-device-administrator) +### New settings for Windows 24H2 in the Windows settings catalog -In the Intune admin center, when you create or update a profile with these settings, the impacted settings are noted. +The Settings Catalog lists all the settings you can configure in a device policy, and all in one place. You can view these Windows settings in the Microsoft Intune admin center by going to **Devices** > **Manage devices** > **Configuration** > **Create** > **New policy** > **Windows 10 and later for platform** > **Settings catalog** for profile type. -Though the functionality might continue to work, there's no guarantee that it will continue working for any or all Android DA versions supported by Intune. For more information on Samsung support for deprecated APIs, see [What kind of support is offered after an API is deprecated?](https://docs.samsungknox.com/dev/knox-sdk/faqs/general/deprecated-api-support-change.htm) (opens Samsung's web site). - -Instead, you can manage Android devices with Intune using one of the following Android Enterprise options: - -- [Set up enrollment of Android Enterprise personally owned work profile devices](../enrollment/android-work-profile-enroll.md) -- [Set up Intune enrollment of Android Enterprise corporate-owned devices with work profile](../enrollment/android-corporate-owned-work-profile-enroll.md) -- [Set up enrollment for Android Enterprise fully managed devices](../enrollment/android-fully-managed-enroll.md) -- [Set up Intune enrollment of Android Enterprise dedicated devices](../enrollment/android-kiosk-enroll.md) -- [App protection policies overview](../apps/app-protection-policy.md) +We're working on the addition of new settings for Window 24H2. Applies to: -- Android device administrator (DA) - -### Consent prompt update for remote log collection +- Windows -End users might see a different consent experience for remote log collection after the Android APP SDK 10.4.0 and iOS APP SDK 19.6.0 updates. End users will no longer see a common prompt from Intune and will only see a prompt from the application if it has one. +### New settings available in the Apple settings catalog -Applies to: - -- Android -- iOS/iPadOS +The [Settings Catalog](../configuration/settings-catalog.md) lists all the settings you can configure in a device policy, and all in one place. For more information about configuring Settings Catalog profiles in Intune, see [Create a policy using settings catalog](../configuration/settings-catalog.md). - +We're adding new settings to the Settings Catalog. To view available settings, in the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431), go to **Devices** > **Manage devices** > **Configuration** > **Create** > **New policy** > **iOS/iPadOS** or **macOS** for platform > **Settings catalog** for profile type. -## Device enrollment - -### New Setup Assistant screens available for configuration - -New Setup Assistant screens will be available to configure in the Microsoft Intune admin center. You can hide or show these screens during automated device enrollment. - -For macOS: - -- **Wallpaper**: Show or hide the macOS Sonoma wallpaper setup pane that appears after an upgrade on devices running macOS 14 and later. -- **Lockdown mode**: Show or hide the macOS lockdown mode setup pane on devices running macOS 14 and later. -- **Intelligence**: Show or hide the intelligence setup pane on devices running macOS 15 and later. +#### iOS/iPadOS -For iOS/iPadOS: +**Restrictions**: -- **Emergency SOS**: Show or hide the safety (emergency SOS) setup pane on devices running iOS/iPadOS 16 and later. -- **Action button**: Show or hide the action button setup pane on devices running iOS/iPadOS 17 and later. -- **Intelligence**: Show or hide the intelligence setup pane on devices running iOS/iPadOS 18 and later. +- Allow Apps To Be Hidden +- Allow Apps To Be Locked +- Allow Call Recording +- Allow Mail Summary +- Allow RCS Messaging -You can configure these screens in new and existing enrollment policies. +##### macOS -Applies to: +**Declarative Device Management (DDM) > Math Settings**: -- iOS/iPadOS -- macOS +- Calculator + - Input Mode - RPN -### Support ending for Apple User Enrollment with Company Portal +**Restrictions**: -After the release of iOS/iPadOS 18, Apple will no longer support profile-based Apple User Enrollment. As a result, Intune will end support for [user enrollment with Company Portal](../enrollment/apple-user-enrollment-with-company-portal.md) shortly after the release of iOS/iPadOS 18. +- Allow Mail Summary +- Allow Media Sharing Modification -After Intune ends support for user enrollment with Company Portal: +The following settings have been deprecated by Apple and will be marked as deprecated in the Settings Catalog: -- Existing enrolled devices won't be impacted. -- Users won't be able to enroll devices if they're targeted with this enrollment profile type. -- Microsoft Intune technical support will be available for existing enrolled devices with this enrollment profile type. Technical support won't be available for new enrollments. +#### macOS -To prepare, use a different management method to enroll devices. We recommend account-driven Apple User Enrollment for similar functionality and an improved user experience. For a simpler enrollment experience, try web- based device enrollment. For more information, see: +**Security > Firewall**: -- [Set up account-driven Apple User Enrollment](../enrollment/apple-account-driven-user-enrollment.md) -- [Set up web-based device enrollment for iOS/iPadOS](../enrollment/web-based-device-enrollment-ios.md) +- Enable Logging +- Logging Option -Applies to: + -- iOS/iPadOS + ## Device management -### Intune will support macOS 13.x as the minimum version - -With Apple's release of macOS 15 Sequoia, Microsoft Intune, the Company Portal app, and the Intune MDM agent will now require macOS 13 (Big Sur) and later. - -For more information on this change, see [Plan for change: Intune is moving to support macOS 13 and later](../fundamentals/whats-new.md#plan-for-change-intune-is-moving-to-support-macos-13-and-higher-later-this-year). +### Store macOS certificates in user keychain -> [!NOTE] -> macOS devices enrolled through Automated Device Enrollment (ADE) have a slightly nuanced support statement due to their shared usage. For more information, see [Support statement](https://aka.ms/Intune/macOS/ADE-DE-support). +Soon you'll have the option to store macOS certificates in the user keychain. Currently, Microsoft Intune automatically stores user and device certificates in the *device* keychain. The enhancement will strengthen system security, and will improve the user experience by reducing certificate prompts. Applies to: - macOS -### Intune supports iOS/iPadOS 16.x as the minimum version - -Later this year, we expect iOS18 and iPadOS 18 to be released by Apple. Microsoft Intune, including the Intune Company Portal and Intune app protection policies (APP, also known as MAM), will require iOS/iPadOS 16 and higher shortly after the iOS/iPadOS 18 release. +### Device Inventory for Windows -For more information on this change, see [Plan for change: Intune is moving to support iOS/iPadOS 16 and later](../fundamentals/whats-new.md#plan-for-change-intune-is-moving-to-support-iosipados-16-and-later). +Device inventory lets you collect and view additional hardware properties from your managed devices to help you better understand the state of your devices and make business decisions. -> [!NOTE] -> Userless iOS and iPadOS devices enrolled through Automated Device Enrollment (ADE) have a slightly nuanced support statement due to their shared usage. For more information, see [Support statement for supported versus allowed iOS/iPadOS versions for user-less devices](https://aka.ms/ADE_userless_support). +You'll soon be able to choose what you want to collect from your devices, using the catalog of properties and then view the collected properties in the Resource Explorer view. Applies to: -- iOS/iPadOS +- Windows (Corporate owned devices managed by Intune) ## Device security -### New disk encryption template for Personal Data Encryption - -We’re adding a new template named *Personal Data Encryption* (PDE) to endpoint security BitLocker policy. The new template configures the Windows PDE configuration service provider (CSP) that was introduced in Windows 11 22H2. +### Linux support for Endpoint detection and response exclusion settings -PDE is different than BitLocker. PDE encrypts individual files and content, instead of whole volumes and disks. You can use PDE with other encryption methods, such as BitLocker. +We are adding a new Endpoint Security template under Endpoint detection and response (EDR) for the Linux platform, that will be supported through the [Microsoft Defender for Endpoint security settings management](../protect/mde-security-integration.md) scenario. -Previously, the [PDE CSP](/windows/client-management/mdm/personaldataencryption-csp) was made available through the [Intune settings catalog](../fundamentals/whats-new-archive.md#turn-onoff-personal-data-encryption-on-windows-11-devices-using-the-settings-catalog). +The template will support settings related to global exclusion settings. Applicable to antivirus and EDR engines on the client, the settings can configure exclusions to stop associated real time protection EDR alerts for the excluded items. Exclusions can be defined by the file path, folder, or process explicitly defined by the admin in the policy. Applies to: -- Windows 11 +- Linux -### Defender for Endpoint security settings support in government cloud environments +### New Microsoft Tunnel readiness check for auditd package -Customer tenants in US Government Community Cloud (GCC) High, and Department of Defense (DoD) environments will soon be able to use Intune to manage the Defender security settings on the devices you’ve onboarded to Defender without enrolling those devices with Intune. This capability is known as [Defender for Endpoint security settings management](../protect/mde-security-integration.md). +We're updating the [Microsoft Tunnel readiness tool](../protect/microsoft-tunnel-prerequisites.md#run-the-readiness-tool) to detect if the **auditd** package for Linux System Auditing (LSA) is installed on your Linux Server. When this check is in place, the mst-readiness tool will raise a warning if the audit package isn't installed. Auditing isn't a required prerequisite for the Linux Server, but recommended. + +For more information on *auditd* and how to install it on your Microsoft Tunnel server, see [Linux system auditing](../protect/microsoft-tunnel-prerequisites.md#linux-system-auditing). -For more information about the Intune features supported in GCC High and DoD environments, see [Intune US Government service description](../fundamentals/intune-govt-service-description.md). ### Support for Intune Device control policy for devices managed by Microsoft Defender for Endpoint @@ -336,8 +227,41 @@ When this change takes effect, devices that are assigned this policy while manag - - +## Monitor and troubleshoot + +### New device actions for single device query + +We're adding the Intune remote device actions to Single device query to help you manage your devices remotely. From the device query interface, you'll be able to run device actions based on query results for faster and more efficient troubleshooting. + +Applies to: + +- Windows + +For more information, see: + +- [Device query in Microsoft Intune](../../analytics/device-query.md) +- [Run remote actions on devices with Microsoft Intune](../remote-actions/device-management.md) + +### Device Query for Multiple Devices + +We're adding Device query for multiple devices. This feature allows you to gain comprehensive insights about your entire fleet of devices using Kusto Query Language (KQL) to query across collected inventory data for your devices. + +Device query for multiple devices will be supported for devices running Windows 10 or later. This feature will be included as part of Advanced Analytics. + +Applies to: + +- Windows + +### ICCID will be inventoried for Android Enterprise Dedicated and Fully Managed + +We're adding the ability to view a device's ICCID number for devices enrolled as Android Enterprise Dedicated or Android Fully Managed. Admins can view ICCID numbers in their device inventory. + +When available, you can find the ICCID number for Android devices by navigating to **Devices** > **Android**. Select a device of interest. In the side panel, under **Monitor** select **Hardware**. The ICCID number will be in the **Network details** group. The ICCID number isn't supported for Android Corporate-Owned Work Profile devices. + +Applies to: + +- Android + diff --git a/memdocs/intune/fundamentals/intune-endpoints.md b/memdocs/intune/fundamentals/intune-endpoints.md index 628bee2182f..60f00240b75 100644 --- a/memdocs/intune/fundamentals/intune-endpoints.md +++ b/memdocs/intune/fundamentals/intune-endpoints.md @@ -8,7 +8,7 @@ keywords: author: Smritib17 ms.author: smbhardwaj manager: dougeby -ms.date: 07/11/2024 +ms.date: 09/24/2024 ms.topic: reference ms.service: microsoft-intune ms.subservice: fundamentals @@ -48,7 +48,7 @@ To manage devices behind firewalls and proxy servers, you must enable communicat - For some tasks, Intune requires unauthenticated proxy server access to manage.microsoft.com, *.azureedge.net, and graph.microsoft.com. > [!NOTE] - > SSL traffic inspection is not supported for 'manage.microsoft.com', 'dm.microsoft.com', or the [Device Health Attestation (DHA) endpoints listed in the compliance section](#migrating-device-health-attestation-compliance-policies-to-microsoft-azure-attestation). + > SSL traffic inspection is not supported for '\*.manage.microsoft.com', '\*.dm.microsoft.com', or the [Device Health Attestation (DHA) endpoints listed in the compliance section](#migrating-device-health-attestation-compliance-policies-to-microsoft-azure-attestation). You can modify proxy server settings on individual client computers. You can also use Group Policy settings to change settings for all client computers located behind a specified proxy server. @@ -97,7 +97,7 @@ The data columns shown in the tables are: ID |Desc |Category |ER |Addresses |Ports -- |---------------------------------------------------------------- |---------------------|--- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------| -163 | Endpoint Manager client and host service| Allow
Required | False | `*.manage.microsoft.com`
`manage.microsoft.com`
`EnterpriseEnrollment.manage.microsoft.com`
`104.46.162.96/27, 13.67.13.176/28, 13.67.15.128/27, 13.69.231.128/28, 13.69.67.224/28, 13.70.78.128/28, 13.70.79.128/27, 13.71.199.64/28, 13.73.244.48/28, 13.74.111.192/27, 13.77.53.176/28, 13.86.221.176/28,13.89.174.240/28, 13.89.175.192/28, 20.189.229.0/25, 20.191.167.0/25, 20.37.153.0/24, 20.37.192.128/25, 20.38.81.0/24, 20.41.1.0/24, 20.42.1.0/24, 20.42.130.0/24, 20.42.224.128/25, 20.43.129.0/24, 20.44.19.224/27, 20.49.93.160/27, 40.119.8.128/25, 40.67.121.224/27, 40.70.151.32/28, 40.71.14.96/28, 40.74.25.0/24, 40.78.245.240/28, 40.78.247.128/27, 40.79.197.64/27, 40.79.197.96/28, 40.80.180.208/28, 40.80.180.224/27, 40.80.184.128/25, 40.82.248.224/28, 40.82.249.128/25, 52.150.137.0/25, 52.162.111.96/28, 52.168.116.128/27, 52.182.141.192/27, 52.236.189.96/27, 52.240.244.160/27, 20.204.193.12/30, 20.204.193.10/31, 20.192.174.216/29, 20.192.159.40/29` | **TCP:** 80, 443| +163 | Intune client and host service| Allow
Required | False | `*.manage.microsoft.com`
`manage.microsoft.com`
`EnterpriseEnrollment.manage.microsoft.com`
`104.46.162.96/27, 13.67.13.176/28, 13.67.15.128/27, 13.69.231.128/28, 13.69.67.224/28, 13.70.78.128/28, 13.70.79.128/27, 13.71.199.64/28, 13.73.244.48/28, 13.74.111.192/27, 13.77.53.176/28, 13.86.221.176/28,13.89.174.240/28, 13.89.175.192/28, 20.189.229.0/25, 20.191.167.0/25, 20.37.153.0/24, 20.37.192.128/25, 20.38.81.0/24, 20.41.1.0/24, 20.42.1.0/24, 20.42.130.0/24, 20.42.224.128/25, 20.43.129.0/24, 20.44.19.224/27, 20.49.93.160/27, 40.119.8.128/25, 40.67.121.224/27, 40.70.151.32/28, 40.71.14.96/28, 40.74.25.0/24, 40.78.245.240/28, 40.78.247.128/27, 40.79.197.64/27, 40.79.197.96/28, 40.80.180.208/28, 40.80.180.224/27, 40.80.184.128/25, 40.82.248.224/28, 40.82.249.128/25, 52.150.137.0/25, 52.162.111.96/28, 52.168.116.128/27, 52.182.141.192/27, 52.236.189.96/27, 52.240.244.160/27, 20.204.193.12/30, 20.204.193.10/31, 20.192.174.216/29, 20.192.159.40/29` | **TCP:** 80, 443| 172 | MDM Delivery Optimization | Default
Required | False | `*.do.dsp.mp.microsoft.com`
`*.dl.delivery.mp.microsoft.com`
| **TCP:** 80, 443| 170 | MEM - Win32Apps| Default
Required | False | `swda01-mscdn.manage.microsoft.com`
`swda02-mscdn.manage.microsoft.com`
`swdb01-mscdn.manage.microsoft.com`
`swdb02-mscdn.manage.microsoft.com`
`swdc01-mscdn.manage.microsoft.com`
`swdc02-mscdn.manage.microsoft.com`
`swdd01-mscdn.manage.microsoft.com`
`swdd02-mscdn.manage.microsoft.com`
`swdin01-mscdn.manage.microsoft.com`
`swdin02-mscdn.manage.microsoft.com` | **TCP:** 443| 97 | Consumer Outlook.com, OneDrive, Device authentication and Microsoft account | Default
Required | False | `account.live.com`
`login.live.com`
|**TCP:** 443 | @@ -105,7 +105,6 @@ ID |Desc |Category |ER |Addresses |Ports 189 | Dependency - Feature Deployment| Default
Required | False |`config.edge.skype.com`
| **TCP:** 443| - ### Autopilot dependencies ID |Desc |Category |ER |Addresses |Ports| @@ -318,9 +317,6 @@ Managed Windows devices using the Microsoft Store – either to acquire, install - licensing.mp.microsoft.com - storeedgefd.dsx.mp.microsoft.com -**Proxy configuration** -- [Prerequisites for Microsoft Store for Business and Education](/microsoft-store/prerequisites-microsoft-store-for-business) - **Windows Update Agent:** For details, see the following resources: diff --git a/memdocs/intune/fundamentals/intune-govt-service-description.md b/memdocs/intune/fundamentals/intune-govt-service-description.md index eb9bc28b8b8..1db705490c7 100644 --- a/memdocs/intune/fundamentals/intune-govt-service-description.md +++ b/memdocs/intune/fundamentals/intune-govt-service-description.md @@ -7,7 +7,7 @@ keywords: author: MandiOhlinger ms.author: mandia manager: dougeby -ms.date: 08/01/2024 +ms.date: 09/19/2024 ms.topic: article ms.service: microsoft-intune ms.suite: ems @@ -73,11 +73,12 @@ The following features are available and supported in Microsoft GCC High and/or | --- | --- | | Standard MDM features | ✅

You can use app policies, device configuration profiles, compliance policies, and more. | | Mobile Threat Defense (MTD) | ✅

Mobile Threat Defense (MTD) connectors for Android and iOS/iPadOS devices with MTD vendors that **also support** the GCC High environment can be used. When you sign in to a GCC High tenant, you see the connectors that are available in these environments. | +| Microsoft Defender for Endpoint security settings management (public preview)| ✅

On devices onboarded to Defender but not enrolled in Intune, you can use Intune endpoint security policies to manage Defender security settings. For more information on this feature, go to [Defender for Endpoint security settings management](../protect/mde-security-integration.md). | | Platform support | ✅

You can use the same operating systems - Android, AOSP, iOS/iPadOS, Linux, macOS, and Windows.

- **Android (AOSP)**: There are some device restrictions. For more information, go to [Supported operating systems and browsers in Intune - AOSP](supported-devices-browsers.md#android).
- **Linux**: Generally available (GA) in February 2024.| | Remote Help | ✅

Remote Help is supported in GCC on Android, macOS, and Windows devices. It's not supported in GCC High or DoD.

For more information on this feature, go to [Remote Help in Microsoft Intune](../fundamentals/remote-help.md). | | Windows Autopilot device preparation | ✅

Some features are available now, such as user-driven deployments, and some are still [in the planning phase](#in-the-planning-phase). For more information on the recent changes to Windows Autopilot device preparation, go to [Blog: Windows deployment with the next generation of Windows Autopilot](https://techcommunity.microsoft.com/t5/microsoft-intune-blog/windows-deployment-with-the-next-generation-of-windows-autopilot/ba-p/4148169).

To get started with Windows Autopilot device preparation, go to [Windows Autopilot Device Preparation overview](/autopilot/device-preparation/overview). | | Log Analytics | ✅

You can send Intune log data to Azure Storage, Event Hubs, or Log Analytics.

For more information on this feature, go to [Send log data to storage, event hubs, or log analytics from Intune](review-logs-using-azure-monitor.md). | -| Microsoft Intune Plan 2
and Microsoft Intune Suite | For more information on these plans, go to [Use Intune Suite add-on capabilities](intune-add-ons.md).

The following Plan 2 features support the GCC High and DoD environements:
- [Microsoft Tunnel for Mobile Application Management](../protect/microsoft-tunnel-mam.md)
- [Firmware-over-the-air update](../protect/fota-updates-android.md)
- [Specialty devices management](../fundamentals/specialty-devices-with-intune.md)

The following Microsoft Intune Suite features support the GCC High and DoD environements:
- [Endpoint Privilege Management](../protect/epm-overview.md)
- [Advanced Analytics](../../analytics/advanced-endpoint-analytics.md) - With this release, GCC High and DoD support for Advanced Endpoint Analytics not include the [*Device query*](../../analytics/device-query.md) functionality.| +| Microsoft Intune Plan 2
and Microsoft Intune Suite | For more information on these plans, go to [Use Intune Suite add-on capabilities](intune-add-ons.md).

The following Plan 2 features support the GCC High and DoD environments:
- [Microsoft Tunnel for Mobile Application Management](../protect/microsoft-tunnel-mam.md)
- [Firmware-over-the-air update](../protect/fota-updates-android.md)
- [Specialty devices management](../fundamentals/specialty-devices-with-intune.md)

The following Microsoft Intune Suite features support the GCC High and DoD environments:
- [Endpoint Privilege Management](../protect/epm-overview.md)
- [Advanced Analytics](../../analytics/advanced-endpoint-analytics.md) ### In the planning phase diff --git a/memdocs/intune/fundamentals/intune-planning-guide.md b/memdocs/intune/fundamentals/intune-planning-guide.md index 82caaf3feb0..2d39a8ba885 100644 --- a/memdocs/intune/fundamentals/intune-planning-guide.md +++ b/memdocs/intune/fundamentals/intune-planning-guide.md @@ -623,7 +623,7 @@ Validate the end-user experience with success metrics in your deployment plan. S - Tools and resources - Q & A -The community-based [Intune forum](https://social.technet.microsoft.com/Forums/home) and [end-user documentation](/intune-user-help/use-managed-devices-to-get-work-done) are also great resources. +The community-based [Intune forum](https://social.technet.microsoft.com/Forums/home) and [end-user documentation](/mem/intune/user-help/use-managed-devices-to-get-work-done) are also great resources. ## Related articles diff --git a/memdocs/intune/fundamentals/intune-scale-guidelines.md b/memdocs/intune/fundamentals/intune-scale-guidelines.md index a6072d64e44..88d50b1ff9b 100644 --- a/memdocs/intune/fundamentals/intune-scale-guidelines.md +++ b/memdocs/intune/fundamentals/intune-scale-guidelines.md @@ -224,7 +224,7 @@ For more information, go to [How many tokens can I upload.](../apps/vpp-apps-ios - Local admins can create Win32 apps as needed within the cross-platform, line-of-business app and web-link limit. For more information, go to [Win32 app management](../apps/apps-win32-app-management.md). > [!NOTE] - > [Microsoft Store for Business](/microsoft-store/microsoft-store-for-business-overview) is being retired. Starting with Windows 11, you have a new option for your private volume-licensed apps. For more information, go to [Private app repository in Windows 11](/windows/application-management/private-app-repository-mdm-company-portal-windows-11) and [Update to Microsoft Intune integration with the Microsoft Store on Windows](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/update-to-endpoint-manager-integration-with-the-microsoft-store/ba-p/3585077). + > Microsoft Store for Business is being retired. Starting with Windows 11, you have a new option for your private volume-licensed apps. For more information, go to [Private app repository in Windows 11](/windows/application-management/private-app-repository-mdm-company-portal-windows-11) and [Update to Microsoft Intune integration with the Microsoft Store on Windows](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/update-to-endpoint-manager-integration-with-the-microsoft-store/ba-p/3585077). #### Android diff --git a/memdocs/intune/fundamentals/manage-apps.md b/memdocs/intune/fundamentals/manage-apps.md index f5bcbfb2ed9..beb5c63fd50 100644 --- a/memdocs/intune/fundamentals/manage-apps.md +++ b/memdocs/intune/fundamentals/manage-apps.md @@ -125,7 +125,7 @@ The app features in the Intune admin center make it easier to deploy these diffe - [Win32 app management](../apps/apps-win32-app-management.md) > [!NOTE] - > [Microsoft Store for Business](/microsoft-store/microsoft-store-for-business-overview) is being retired. Starting with Windows 11, you have a new option for your private volume-licensed apps. For more information, go to [Private app repository in Windows 11](/windows/application-management/private-app-repository-mdm-company-portal-windows-11) and [Update to Microsoft Intune integration with the Microsoft Store on Windows](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/update-to-endpoint-manager-integration-with-the-microsoft-store/ba-p/3585077). + > Microsoft Store for Business is being retired. Starting with Windows 11, you have a new option for your private volume-licensed apps. For more information, go to [Private app repository in Windows 11](/windows/application-management/private-app-repository-mdm-company-portal-windows-11) and [Update to Microsoft Intune integration with the Microsoft Store on Windows](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/update-to-endpoint-manager-integration-with-the-microsoft-store/ba-p/3585077). ## Configure apps before they're installed diff --git a/memdocs/intune/fundamentals/mdm-authority-set.md b/memdocs/intune/fundamentals/mdm-authority-set.md index 51abd15fb1d..b3d4f12a43f 100644 --- a/memdocs/intune/fundamentals/mdm-authority-set.md +++ b/memdocs/intune/fundamentals/mdm-authority-set.md @@ -8,7 +8,7 @@ keywords: author: Smritib17 ms.author: smbhardwaj manager: dougeby -ms.date: 09/27/2023 +ms.date: 09/24/2024 ms.topic: how-to ms.service: microsoft-intune ms.subservice: fundamentals @@ -50,12 +50,6 @@ Possible configurations are: ## Set MDM authority to Intune -For tenants using the 1911 service release and later, the MDM authority is automatically set to Intune. - -For tenants using the 1911 service release and later, if you activated Basic Mobility and Security, follow the steps in this section. - -For pre-1911 service release tenants, if you haven't yet set the MDM authority, follow the steps in this section. - 1. In the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431), select the orange banner to open the **Mobile Device Management Authority** setting. The orange banner is only displayed if you haven't yet set the MDM authority. 2. Under **Mobile Device Management Authority**, choose your MDM authority from the following options: @@ -114,7 +108,7 @@ To enable coexistence, you must add Intune as the MDM authority for your environ 1. Sign in to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431) with Microsoft Entra Global or Intune service administrator rights. 2. Navigate to **Devices**. -3. The **Add MDM Authority blade** displays. +3. The **Add MDM Authority blade** banner is displayed. 4. To switch the MDM authority from *Office 365* to *Intune* and enable coexistence, select **Intune MDM Authority** > **Add**. :::image type="content" alt-text="Screenshot of Add MDM Authority screen." source="./media/mdm-authority-set/add-mdm-authority.png" lightbox="./media/mdm-authority-set/add-mdm-authority.png"::: diff --git a/memdocs/intune/fundamentals/media/mdm-authority-set/add-mdm-authority.png b/memdocs/intune/fundamentals/media/mdm-authority-set/add-mdm-authority.png index 382c3caaaa1..e794b42fa8c 100644 Binary files a/memdocs/intune/fundamentals/media/mdm-authority-set/add-mdm-authority.png and b/memdocs/intune/fundamentals/media/mdm-authority-set/add-mdm-authority.png differ diff --git a/memdocs/intune/fundamentals/remote-help-macos.md b/memdocs/intune/fundamentals/remote-help-macos.md index 2be06f0425f..1965687d518 100644 --- a/memdocs/intune/fundamentals/remote-help-macos.md +++ b/memdocs/intune/fundamentals/remote-help-macos.md @@ -91,6 +91,7 @@ General prerequisites for Remote Help are listed here [Prerequisites for Remote - macOS 12 (Monterey) - macOS 13 (Ventura) - macOS 14 (Sonoma) +- macOS 15 (Sequoia) ### Remote Help Web App supported browsers diff --git a/memdocs/intune/fundamentals/remote-help-windows.md b/memdocs/intune/fundamentals/remote-help-windows.md index 91589e8b70d..568e10cd49a 100644 --- a/memdocs/intune/fundamentals/remote-help-windows.md +++ b/memdocs/intune/fundamentals/remote-help-windows.md @@ -186,8 +186,7 @@ As a sharer, when you've requested help and both you and the helper are ready to During assistance, helpers that have the *Elevation* permission can enter local admin permissions on your shared device. *Elevation* allows the helper to run executable programs or take similar actions when you lack sufficient permissions. -5. After the issues are resolved, or at any time during the session, both the sharer and helper can end the session. To end the session, select **Leave** in the upper right corner of the Remote Help app. When a helper performs elevated actions on a user's device, at the end of the session the sharer is automatically signed out of their device. If a helper performs elevated actions on a user's device and the sharer ends the session, a warning message appears for the helper. The message warns that if the helper continues, they'll be logged off. - +5. After the issues are resolved, or at any time during the session, both the sharer and helper can end the session. To end the session, select **Leave** in the upper right corner of the Remote Help app. #### Request help on an unenrolled device The device might not need to be enrolled to Intune if your administrator allows you to get help on unenrolled devices. If your device is unenrolled and you're trying to receive help, be prepared to enter a security code that you'll get from the individual who is assisting you. You'll enter the code in your Remote Help instance to establish a connection to the helper's instance of Remote Help. @@ -236,7 +235,7 @@ As a helper, after receiving a request from a user who wants assistance by using During assistance, helpers that have the *Elevation* permission can enter local admin permissions on your shared device. *Elevation* allows the helper to run executable programs or take similar actions when you lack sufficient permissions. -5. After the issues are resolved, or at any time during the session, both the sharer and helper can end the session. To end the session, select **Leave** in the upper right corner of the Remote Help app. When a helper performs elevated actions on a user's device, at the end of the session the sharer is automatically signed out of their device. If a helper performs elevated actions on a user's device and the sharer ends the session, a warning message appears for the helper. The message warns that if the helper continues, they'll be logged off. +5. After the issues are resolved, or at any time during the session, both the sharer and helper can end the session. To end the session, select **Leave** in the upper right corner of the Remote Help app. If a helper performs elevated actions on a user's device and the sharer ends the session, at the end of the session the sharer is automatically signed out. #### Provide help on an unenrolled device @@ -392,7 +391,7 @@ Microsoft Edge WebView2 is required to use Remote Help. If you get an error mess ## Known Issues For remotely starting a session on the user's device, notifications that are sent to the sharer's device when a helper launches a Remote Help session fails if the Microsoft Intune Management Service isn't running. -After the user's device is restarted, there's a delay for the service to start. You can either manually wait for the service to start (30-60 seconds after restart), or manually start the service through services.msc. +After the user's device is restarted, there's a delay for the service to start. You can either manually wait for the service to start (30 minutes after restart), or manually start the service through services.msc. For newly enrolled devices, there's a 1 hour delay before the user's device begins receiving notifications when a helper initiates a session. ## What's New for Remote Help diff --git a/memdocs/intune/fundamentals/remote-help.md b/memdocs/intune/fundamentals/remote-help.md index d1ebb1bf7bb..988ed027dc7 100644 --- a/memdocs/intune/fundamentals/remote-help.md +++ b/memdocs/intune/fundamentals/remote-help.md @@ -93,7 +93,7 @@ Limitations: - Windows 10/11 on ARM64 devices - Windows 365 - Samsung and Zebra devices enrolled as Android Enterprise dedicated devices - - macOS 12, 13, 14 + - macOS 12, 13, 14, and 15 Remote Help isn't supported on GCC High or DoD (U.S. Department of Defense) tenants. For more information, go to [Microsoft Intune for US Government GCC High and DoD service description](intune-govt-service-description.md). @@ -109,7 +109,7 @@ This feature applies to: - Windows 10 on ARM64 devices - Windows 365 - Android Enterprise Dedicated (Samsung and Zebra devices) -- macOS 12, 13 and 14 +- macOS 12, 13, 14, and 15 ## Data and privacy diff --git a/memdocs/intune/fundamentals/reports-export-graph-apis.md b/memdocs/intune/fundamentals/reports-export-graph-apis.md index e35848b24c0..9ed9d074408 100644 --- a/memdocs/intune/fundamentals/reports-export-graph-apis.md +++ b/memdocs/intune/fundamentals/reports-export-graph-apis.md @@ -7,7 +7,7 @@ keywords: author: Erikre ms.author: erikre manager: dougeby -ms.date: 03/28/2024 +ms.date: 09/20/2024 ms.topic: conceptual ms.service: microsoft-intune ms.subservice: fundamentals @@ -109,7 +109,7 @@ You can then use the `id` field to query the status of the export with a GET req For example: ```https://graph.microsoft.com/beta/deviceManagement/reports/exportJobs('Devices_05e62361-783b-4cec-b635-0aed0ecf14a3')``` or ```https://graph.microsoft.com/beta/deviceManagement/reports/exportJobs/Devices_05e62361-783b-4cec-b635-0aed0ecf14a3``` -You will need to continue calling this URL until you get a response with a `status: completed` attribute. It will look like the following example: +You'll need to continue calling this URL until you get a response with a `status: completed` attribute. It looks like the following example: ```http { @@ -144,8 +144,8 @@ You can then directly download the compressed CSV from the `url` field. There are five main parameters you can submit in your request body to define the export request: - `reportName`: Required. This parameter is the name of the report you want to specify. -- `filter`: Not required for most reports. Note that the filter parameter is a string. -- `select`: Not required. Specify which columns from the report you want. Only valid column names relevant to the report you are calling will be accepted. +- `filter`: Not required for most reports. The filter parameter is a string. +- `select`: Not required. Specify which columns from the report you want. Only valid column names relevant to the report you're calling will be accepted. - `format`: Not required. By default, the data is output in `csv` format. Specify `json` to output the file in JSON format. - `localizationType`: This parameter controls localization behavior for the report. Possible values are `LocalizedValuesAsAdditionalColumn` and `ReplaceLocalizableValues`. @@ -155,9 +155,9 @@ The `localizationType` parameter controls localization behavior for the report. ### LocalizedValuesAsAdditionalColumn report value -This value for the `localizationType` parameter is the default value. It will be inserted automatically if the `localizationType` parameter is not specified. This value specifies that Intune provides two columns for each localizable column. -- *enum value*: The *enum value* column contains either a raw string, or a set of numbers that don't change, regardless of locale. This column will be under the original column name (see example). -- *localized string value*: This column will be the original column name with _loc appended. It will contain string values that are human readable, and locale conditional (see example). +This value for the `localizationType` parameter is the default value. It is inserted automatically if the `localizationType` parameter isn't specified. This value specifies that Intune provides two columns for each localizable column. +- *enum value*: The *enum value* column contains either a raw string, or a set of numbers that don't change, regardless of locale. This column is under the original column name (see example). +- *localized string value*: This column is the original column name with _loc appended. It contains string values that are human readable, and locale conditional (see example). #### Example @@ -173,7 +173,7 @@ This value for the `localizationType` parameter is the default value. It will be ### ReplaceLocalizableValues report value -ReplaceLocalizableValues report value will only return one column per localized attribute. This column will contain the original column name with the localized values. +ReplaceLocalizableValues report value will only return one column per localized attribute. This column contains the original column name with the localized values. #### Example @@ -191,6 +191,14 @@ For columns without localized values, only a single column with the true column > [!IMPORTANT] > The `localizationType` parameter is relevant for any export experience hosted by Intune's reporting infrastructure with a few exceptions. The`Devices` and `DevicesWithInventory` report types will not honor the `localizationType` parameter due to legacy compatibility requirements. +## API throttling conditions + +To ensure that the `exportJobs` API doesn't have too many concurrent requests, which would impact the API's response rate, the below throttling limits are applied. + +- **The APIs will support up to 100 requests per tenant per minute**: This support covers all users and apps in a tenant. Any additional requests initiated by either users or apps in the tenant within the same minute will be throttled. + - If the APIs are initiated by a user, up to 8 requests will be allowed by the same user within a minute. Subsequent requests by the same user within the same minute will be throttled. + - If the APIs are initiated by an app, then up to 48 requests will be allowed by the same app within a minute. Subsequent requests by the same app within the same minute will be throttled. + ## Next steps - [Microsoft Graph documentation](/graph/) diff --git a/memdocs/intune/fundamentals/reports-export-graph-available-reports.md b/memdocs/intune/fundamentals/reports-export-graph-available-reports.md index 36153a1962c..965a1d0e6f1 100644 --- a/memdocs/intune/fundamentals/reports-export-graph-available-reports.md +++ b/memdocs/intune/fundamentals/reports-export-graph-available-reports.md @@ -860,6 +860,7 @@ The following table contains the possible output when calling the `AppInvAggrega | ApplicationShortVersion | | ApplicationVersion | | DeviceCount | +| Platform | There are no filters for this report. @@ -884,7 +885,19 @@ The following table contains the possible output when calling the `AppInvRawData | EmailAddress | | UserName | -There are no filters for this report. +You can filter the `AppInvRawData` report using the `eq` comparison operator on the following properties: +- ApplicationName +- ApplicationPublisher +- ApplicationShortVersion +- ApplicationVersion +- DeviceId +- DeviceName +- OSDescription +- OSVersion +- Platform +- UserId +- EmailAddress +- UserName ## ChromeOSDevices report diff --git a/memdocs/intune/fundamentals/role-based-access-control.md b/memdocs/intune/fundamentals/role-based-access-control.md index 00b49d14ee7..b5bef210f22 100644 --- a/memdocs/intune/fundamentals/role-based-access-control.md +++ b/memdocs/intune/fundamentals/role-based-access-control.md @@ -38,6 +38,7 @@ To create, edit, or assign roles, your account must have one of the following pe - **Global Administrator** - **Intune Service Administrator** (also known as **Intune Administrator**) +- An Intune role with Role permissions ## Roles @@ -76,6 +77,9 @@ You can create your own roles with custom permissions. For more information abou ### Microsoft Entra roles with Intune access +Microsoft recommends following the principle of least-permissions by only assigning the minimum required permissions for an administrator to perform their duties. Global Administrator and Intune Service Administrator +are [privileged roles](/entra/identity/role-based-access-control/privileged-roles-permissions) and assignment should be limited. + | Microsoft Entra role | All Intune data | Intune audit data | | --- | :---: | :---: | | Global Administrator | Read/write | Read/write | @@ -101,13 +105,13 @@ A role assignment defines: - what resources they can see - what resources they can change. -You can assign both custom and built-in roles to your users. To be assigned an Intune role, the user must have an Intune license. +You can assign both custom and built-in roles to your users who are administrators in Intune. To be assigned an Intune role, the user must have an Intune license. To see a role assignment, choose **Intune** > **Tenant administration** > **Roles** > **All roles** > choose a role > **Assignments** > choose an assignment. On the **Properties** page, you can edit: - **Basics**: The assignments name and description. - **Members**: All users in the listed Azure security groups have permission to manage the users/devices that are listed in Scope (Groups). - **Scope (Groups)**: Scope Groups are Microsoft Entra security groups of users or devices or both for which administrators in that role assignment are limited to performing operations on. For example, deployment of a policy or application to a user or remotely locking a device. All users and devices in these Microsoft Entra security groups can be managed by the users in Members. -- **[Scope (Tags)](scope-tags.md)**: Users in Members can see the resources that have the same scope tags. +- **[Scope Tags](scope-tags.md)**: Users in Members can see the resources that have the same scope tags. > [!NOTE] > Scope Tags are freeform text values that an administrator defines and then adds to a Role Assignment. The scope tag added on a role controls visibility of the role itself, while the scope tag added in role assignment limits the visibility of Intune objects (such as policies and apps) or devices to only administrators in that role assignment because the role assignment contains one or more matching scope tags. diff --git a/memdocs/intune/fundamentals/supported-devices-browsers.md b/memdocs/intune/fundamentals/supported-devices-browsers.md index c577ba0e12c..54103b3fec7 100644 --- a/memdocs/intune/fundamentals/supported-devices-browsers.md +++ b/memdocs/intune/fundamentals/supported-devices-browsers.md @@ -7,7 +7,7 @@ keywords: author: Smritib17 ms.author: smbhardwaj manager: dougeby -ms.date: 04/24/2024 +ms.date: 10/10/2024 ms.topic: conceptual ms.service: microsoft-intune ms.subservice: fundamentals diff --git a/memdocs/intune/fundamentals/whats-new-app-ui.md b/memdocs/intune/fundamentals/whats-new-app-ui.md index 737faffcf03..537631104c6 100644 --- a/memdocs/intune/fundamentals/whats-new-app-ui.md +++ b/memdocs/intune/fundamentals/whats-new-app-ui.md @@ -640,30 +640,12 @@ If users have used their work or school account to sign in to other Microsoft ap The Managed Browser is receiving updated icons for both the Android and iOS versions of the app. The new icon will contain the updated Intune badge to make it more consistent with other apps in Enterprise Mobility + Security (EM+S). -Before - > [!div class="mx-imgBorder"] - > ![Screenshot of the previous version of the Managed Browser app icon.](/intune/media/cp_manbro_before_042017.png) - - -After - > [!div class="mx-imgBorder"] - > ![Screenshot of the new version of the Managed Browser app icon.](/intune/media/cp_manbro_before_042017.png) - - The Company Portal is also receiving updated icons for the Android, iOS, and Windows versions of the app to improve consistency with other apps in EM+S. These icons will be gradually released across platforms from April to late May. ### Sign in progress indicator in Android Company Portal An update to the Android Company Portal app shows a sign-in progress indicator when the user launches or resumes the app. The indicator progresses through new statuses, beginning with "Connecting...", then "Signing in...", then "Checking for security requirements..." before allowing the user to access the app. -**Before** - > [!div class="mx-imgBorder"] - > ![The Company Portal app for Android sign-in screen that shows a partially filled loading bar with the phrase 'Connecting' underneath it.](/intune/media/cp_android_connecting_042017.png) - - **After** - > [!div class="mx-imgBorder"] - > ![The Company Portal app for Android sign-in screen that shows a partially filled loading bar with the phrase 'Connecting' underneath it.](/intune/media/cp_android_connecting_042017.png) - ### Improved app install status for the Windows 10 Company Portal app The Windows 10 Company Portal app now provides an install progress bar on the app details page. This is supported for modern apps on devices running the Windows 10 Anniversary Update and up. @@ -688,8 +670,6 @@ Beginning in March, the Company Portal app for Android will follow [material des * __Navigation__: All Apps shows a tabbed view of __Featured__, __All__ and __Categories__ for easier navigation. __Contact IT__ has been streamlined for improved readability. - > [!div class="mx-imgBorder"] - > ![Screenshot of Company Portal app for Android showing an updated version of the Contact IT tab. The tab shows available contact information for IT, including phone number, email address, IT website, and IT contact information.](/intune/media/cp_android_contactit_after.png) ## January 2017 diff --git a/memdocs/intune/fundamentals/whats-new-archive.md b/memdocs/intune/fundamentals/whats-new-archive.md index 6a7cadaf7c9..b4b41c64ea9 100644 --- a/memdocs/intune/fundamentals/whats-new-archive.md +++ b/memdocs/intune/fundamentals/whats-new-archive.md @@ -7,7 +7,7 @@ keywords: author: dougeby ms.author: dougeby manager: dougeby -ms.date: 06/14/2024 +ms.date: 09/25/2024 ms.topic: conceptual ms.service: microsoft-intune ms.subservice: fundamentals @@ -37,6 +37,368 @@ ms.collection: Maintain ~2 years of archived content --> +## Week of April 15, 2024 + +### Intune apps + +#### Newly available protected app for Intune + +The following protected app is now available for Microsoft Intune: + +- Atom Edge by Arlanto Apps + +For more information about protected apps, see [Microsoft Intune protected apps](../apps/apps-supported-intune-apps.md). + +## Week of April 1, 2024 + +### Device management + +#### Copilot in Intune is available in the Intune admin center (public preview) + +Copilot in Intune is integrated in the Intune admin center, and can help you get information quickly. You can use Copilot in Intune for the following tasks: + +✅ **Copilot can help you manage your settings and policies** + +- **Copilot tooltip on settings**: When you add settings to a policy or review settings in an existing policy, there's a new Copilot tooltip. When you select the tooltip, you get AI generated guidance based on Microsoft content and recommendations. You can see what each setting does, how the setting works, any recommended values, if the setting is configured in another policy, and more. + +- **Policy summarizer**: On existing policies, you get a Copilot summary of the policy. The summary describes what the policy does, the users and groups assigned to the policy, and the settings in the policy. This feature can help you understand the impact of a policy and its settings on your users and devices. + +✅ **Copilot shows device details and can help troubleshoot** + +- **All about a device**: On a device, you can use Copilot to get key information about the device, including its properties, configuration, and status information. + +- **Device compare**: Use Copilot to compare the hardware properties and device configurations of two devices. This feature helps you determine what's different between two devices with similar configurations, especially when troubleshooting. + +- **Error code analyzer**: Use Copilot in the device view to analyze an error code. This feature helps you understand what the error means and provides a potential resolution. + +✅ **Intune capabilities in Copilot for Security** + +Intune has capabilities available in the Copilot for Security portal. SOC Analysts and IT admins can use these capabilities to get more information on policies, devices, group membership, and more. On a single device, you can get more specific information that's unique to Intune, like compliance status, device type, and more. + +You can also ask Copilot to tell you about a user's devices and get a quick summary of critical information. For example, the output shows links to the user's devices in Intune, device ID, enrollment date, last check-in date, and compliance status. If you're an IT admin and reviewing a user, then this data provides a quick summary. + +As a SOC analyst that's investigating a suspicious or potentially compromised user or device, information like enrollment date and last check-in can help you make informed decisions. + +For more information on these features, see: + +- [Microsoft Copilot in Intune](../copilot/copilot-intune-overview.md) +- [Access your Microsoft Intune data in Copilot for Security](../copilot/security-copilot.md) + +Applies to: + +- Android +- iOS/iPadOS +- macOS +- Windows + +#### GCC customers can use Remote Help for Windows and Android devices + +The [Microsoft Intune Suite](intune-add-ons.md) includes advanced endpoint management and security features, including Remote Help. + +On Windows and enrolled Android Enterprise dedicated devices, you can use remote help on US Government GCC environments. + +For more information on these features, see: + +- [Microsoft Intune for US Government GCC service description](intune-govt-service-description.md) +- [Use Remote Help with Microsoft Intune](remote-help.md) + +Applies to: + +- Windows 10/11 +- Windows 10/11 on ARM64 devices +- Windows 365 +- Samsung and Zebra devices enrolled as Android Enterprise dedicated devices + +### Device configuration + +#### New BIOS device configuration profile for OEMs + +There's a new **BIOS configuration and other settings** device configuration policy for OEMs. Admins can use this new policy to enable or disable different BIOS features that secure device. In the Intune device configuration policy, you add the BIOS configuration file, deploy a Win32 app, and then assign the policy to your devices. + +For example, admins can use the [Dell Command tool](https://www.dell.com/support/kbdoc/000108963/how-to-use-and-troubleshoot-dell-command-update-to-update-all-drivers-bios-and-firmware-for-your-system) (opens Dell's website) to create the BIOS configuration file. Then, they add this file to the new Intune policy. + +For more information on this feature, see [Use BIOS configuration profiles on Windows devices in Microsoft Intune](../configuration/bios-configuration.md). + +Applies to + +- Windows 10 and later + +## Week of March 25, 2024 (Service release 2403) + +### Microsoft Intune Suite + +#### New elevation type for Endpoint Privilege Management + +Endpoint Privilege Management has a new file elevation type, **support approved**. Endpoint Privilege Management is a feature component of the Microsoft Intune Suite and is also available as a standalone [Intune add-on](../fundamentals/intune-add-ons.md). + +A support-approved elevation gives you a third option for both the default elevation response and the elevation type for each rule. Unlike automatic or user confirmed, a support-approved elevation request requires Intune administrators to manage which files can run as elevated on a case-by-case basis. + +With support approved elevations, users can request approval to elevate an application that isn't explicitly allowed for elevation by automatic or user approved rules. This takes the form of an elevation request that must be reviewed by an Intune administrator who can approve or deny the elevation request. + +When the request is approved, users are notified that the application can now be run as elevated, and they have 24 hours from the time of approval to do so before the elevation approval expires. + +Applies to: + +- Windows 10 +- Windows 11 + +For more information on this new capability, see [Support approved elevation requests](../protect/epm-support-approved.md). + +### App management + +#### Extended capabilities for Managed Google Play apps on personally owned Android devices with a work profile + +There are new capabilities extended to work profile devices. The following capabilities were previously available only on corporate-owned devices: + +- **Available apps for device groups**: You can use Intune to make apps available for device groups through the Managed Google Play store. Previously, apps could only be made available to user groups. + +- **Update priority setting**: You can use Intune to configure the app update priority on devices with a work profile. To learn more about this setting, see [Update a Managed Google Play app](../apps/apps-add-android-for-work.md#update-a-managed-google-play-app). + +- **Required apps display as available in Managed Google Play**: You can use Intune to make required apps available for users through the Managed Google Play store. Apps that are part of existing policies now display as available. + +These new capabilities will follow a phased rollout over multiple months. + +Applies to: + +- Android Enterprise personally owned devices with a work profile + +### Device configuration + +#### New settings available in the Apple settings catalog + +The [Settings Catalog](../configuration/settings-catalog.md) lists all the settings you can configure in a device policy, and all in one place. For more information about configuring Settings Catalog profiles in Intune, see [Create a policy using settings catalog](../configuration/settings-catalog.md). + +There are new settings in the Settings Catalog. To see these settings, in the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431), go to **Devices** > **Manage devices** > **Configuration** > **Create** > **New policy** > **iOS/iPadOS** or **macOS** for platform > **Settings catalog** for profile type. + +##### iOS/iPadOS + +**Declarative Device Management (DDM) > Passcode**: + +- Maximum Passcode Age In Days +- Minimum Complex Characters +- Require Alphanumeric Passcode + +**Restrictions**: + +- Allow Marketplace App Installation + +##### macOS + +**Declarative Device Management (DDM) > Passcode**: + +- Change At Next Auth +- Custom Regex +- Failed Attempts Reset In Minutes +- Maximum Passcode Age In Days +- Minimum Complex Characters +- Require Alphanumeric Passcode + +**Full Disk Encryption > FileVault**: + +- Recovery Key Rotation In Months + +#### New settings available in the Windows settings catalog + +The [Settings Catalog](../configuration/settings-catalog.md) lists all the settings you can configure in a device policy, and all in one place. + +There are new settings in the Settings Catalog. To see these settings, in the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431), go to **Devices** > **Manage devices** > **Configuration** > **Create** > **New policy** > **Windows 10 and later** for platform > **Settings catalog** for profile type. + +- **Delivery optimization**: + + - **DO Disallow Cache Server Downloads On VPN** - This setting blocks downloads from Microsoft Connected Cache servers when the device connects using VPN. By default, the device is allowed to download from Microsoft Connected Cache when connected using VPN. + + - **DO Set Hours To Limit Background Download Bandwidth** - This setting specifies the maximum background download bandwidth. Delivery Optimization uses this bandwidth during and outside business hours across all concurrent download activities as a percentage of available download bandwidth. + + - **DO Set Hours To Limit Foreground Download Bandwidth** - This setting specifies the maximum foreground download bandwidth. Delivery Optimization uses this bandwidth during and outside business hours across all concurrent download activities as a percentage of available download bandwidth. + + - **DO Vpn Keywords** - This policy allows you to set one or more keywords used to recognize VPN connections. + +- **Messaging**: + + - **Allow Message Sync** - This policy setting allows the backup and restore of cellular text messages to Microsoft's cloud services. + +- **Microsoft Defender Antivirus**: + + - **Specify the maximum depth to scan archive files** + - **Specify the maximum size of archive files to be scanned** + +For more information on these settings, see: + +- [Policy CSP - DeliveryOptimization](/windows/client-management/mdm/policy-csp-deliveryoptimization) +- [Policy CSP - Messaging](/windows/client-management/mdm/policy-csp-messaging#allowmessagesync) +- [Policy CSP - ADMX_MicrosoftDefenderAntivirus](/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus) + +Applies to: + +- Windows 10 and later + +#### New archive file scan settings added to Antivirus policy for Windows devices + +We added the following two settings to the *Microsoft Defender Antivirus* profile for [endpoint security Antivirus policy](../protect/endpoint-security-antivirus-policy.md#antivirus-profiles) that apply to Windows 10 and Windows 11 devices: + +- [Specify the maximum depth to scan archive files](/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus?WT.mc_id=Portal-fx#scan_archivemaxdepth) - This setting allows you to configure the maximum directory depth level into which archive files such as .ZIP or .CAB are unpacked during scanning. +- [Specify the maximum size of archive files to be scanned](/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus?WT.mc_id=Portal-fx#scan_archivemaxsize) - This setting allows you to configure the maximum size of archive files such as .ZIP or .CAB that are scanned. The value represents file size in kilobytes (KB). + +With Antivirus policy, you can manage these settings on devices enrolled by Intune and on devices managed through the [Defender for Endpoint security settings management](../protect/mde-security-integration.md) scenario. + +Both settings are also available in the [settings catalog](../configuration/settings-catalog.md) at **Devices** > **Manage devices** > **Configuration** > **Create** > **New policy** > **Windows 10 and later** for platform > **Settings catalog** for profile type > **Defender**. + +Applies to: + +- Windows 10 +- Windows 11 + +#### Updates to assignment filters + +You can use [Intune assignment filters](filters.md) to assign a policy based on rules you create. + +Now, you can: + +- Use managed app assignment filters for Window MAM app protection policies and app configuration policies. +- Filter your existing assignment filters by **Platform**, and by the **Managed apps** or **Managed devices** filter type. When you have many filters, this feature makes it easier to find specific filters you created. + +For more information on these features, see: + +- [Use filters when assigning your apps, policies, and profiles in Microsoft Intune](filters.md) +- [Data protection for Windows MAM](../apps/protect-mam-windows.md) + +This feature applies to: + +- **Managed devices** on the following platforms: + + - Android device administrator + - Android Enterprise + - Android (AOSP) + - iOS/iPadOS + - macOS + - Windows 10/11 + +- **Managed apps** on the following platforms: + + - Android + - iOS/iPadOS + - Windows + +### Device management + +#### New compliance setting lets you verify device integrity using hardware-backed security features + +A new compliance setting called **Check strong integrity using hardware-backed security features** lets you verify device integrity using hardware-backed key attestation. If you configure this setting, strong integrity attestation is added to Google Play's integrity verdict evaluation. Devices must meet device integrity to remain compliant. Microsoft Intune marks devices that don't support this type of integrity check as noncompliant. + +This setting is available in profiles for Android Enterprise fully managed, dedicated, and corporate-owned work profile, under **Device Health** > **Google Play Protect**. It only becomes available when the Play integrity verdict policy in your profile is set to **Check basic integrity** or **Check basic integrity & device integrity**. + +Applies to: + +- Android Enterprise + +For more information, see [Device compliance - Google Play Protect](../protect/compliance-policy-create-android-for-work.md#google-play-protect). + +#### New compliance settings for Android work profile, personal devices + +Now you can add compliance requirements for work profile passwords without impacting device passwords. All new Microsoft Intune settings are available in compliance profiles for Android Enterprise personally owned work profiles under **System Security** > **Work Profile Security**, and include: + +- Require a password to unlock work profile +- Number of days until password expires +- Number of previous passwords to prevent reuse +- Maximum minutes of inactivity before password is required +- Password complexity +- Required password type +- Minimum password length + +If a work profile password fails to meet requirements, Company Portal marks the device as noncompliant. Intune compliance settings take precedence over the respective settings in an Intune device configuration profile. For example, the password complexity in your compliance profile is set to *medium*. The password complexity in a device configuration profile is set to *high*. Intune prioritizes and enforces the compliance policy. + +Applies to: + +- Android Enterprise personally owned devices with a work profile + +For more information, see [Compliance settings - Android Enterprise](../protect/compliance-policy-create-android-for-work.md#personally-owned-work-profile). + +#### Windows quality updates support for expediting non-security updates + +Windows quality updates now support expediting non-security updates for those times when a quality fix needs to be deployed faster than the normal quality update settings. + +Applies to: + +- Windows 11 devices + +For more information about installing an expedited update, see [Expedite Windows quality updates in Microsoft Intune](../protect/windows-10-expedite-updates.md#create-and-assign-an-expedited-quality-update). + +#### Introducing a remote action to pause the config refresh enforcement interval + +In the Windows Settings Catalog, you can configure **Configuration Refresh**. This feature lets you set a cadence for Windows devices to reapply previously received policy settings, without requiring devices to check in to Intune. The device will replay and re-enforce settings based on previously received policy to minimize the chance for configuration drift. + +To support this feature, a remote action is added to allow a pause in action. If an admin needs to make changes or run remediation on a device for troubleshooting or maintenance, they can issue a pause from Intune for a specified period. When the period expires, settings are enforced again. + +The remote action **Pause configuration refresh** can be accessed from the device summary page. + +For more information, see: + +- [Remote actions](../remote-actions/device-management.md) +- [Pause Config Refresh Remote action](../remote-actions/pause-config-refresh.md) + +### Device security + +#### Updated security baseline for Windows version 23H2 + +You can now deploy the Intune security baseline for Windows version 23H2. This new baseline is based on the **version 23H2** of the Group Policy security baseline found in the [Security Compliance Toolkit and Baselines](https://www.microsoft.com/en-us/download/details.aspx?id=55319) from the Microsoft Download Center, and includes only the settings that are applicable to devices managed through Intune. Use of this updated baseline can help you maintain best-practice configurations for your Windows devices. + +This baseline uses the unified settings platform seen in the Settings Catalog. It features an improved user interface and reporting experience, consistency and accuracy improvements related to setting tattooing, and can support assignment filters for profiles. + +Use of [Intune security baselines](../protect/security-baselines.md) can help you rapidly deploy configurations to your Windows devices that meet the security recommendations of the applicable security teams at Microsoft. As with all baselines, the default baseline represents the recommended configurations, which you can modify to meet the requirements of your organization. + +Applies to: + +- Windows 10 +- Windows 11 + +To view the new baselines included settings with their default configurations, see, [Windows MDM security baseline version 23H2](../protect/security-baseline-settings-mdm-all.md?pivots=mdm-23h2). + +#### Use a rootless implementation of Podman to host Microsoft Tunnel + +When prerequisites are met, you can use a rootless Podman container to host a Microsoft Tunnel server. This capability is available when you use [Podman for Red Hat Enterprise Linux (RHEL)](../protect/microsoft-tunnel-prerequisites.md#linux-server) version 8.8 or later, to host Microsoft Tunnel. + +When using a rootless Podman container, the mstunnel services run under a non-privileged service user. This implementation can help limit impact from a container escape. To use a rootless Podman container, you must start the tunnel installation script using a modified command line. + +For more information about this Microsoft Tunnel install option, see [Use a rootless Podman container](../protect/microsoft-tunnel-configure.md#use-a-rootless-podman-container). + +#### Improvements for Intune deployments of Microsoft Defender for Endpoint + +We improved and simplified the experience, workflow, and report details for onboarding devices to Microsoft Defender when using Intune's endpoint detection and response (EDR) policy. These changes apply for Windows devices managed by Intune and by the tenant-attach scenario. These improvements include: + +- Changes to the EDR node, dashboards, and reports to improve the visibility of your Defender EDR deployment numbers. See [About the endpoint detection and response node](../protect/endpoint-security-edr-policy.md#about-the-endpoint-detection-and-response-node). + +- A new tenant-wide option to deploy a preconfigured EDR policy that streamlines the deployment of Defender for Endpoint to applicable Windows devices. See [Use a preconfigured EDR policy](../protect/endpoint-security-edr-policy.md#use-a-preconfigured-edr-policy). + +- Changes to Intune's the Overview page of the endpoint security node. These changes provide a consolidated view of reports for the device signals from Defender for Endpoint on your managed devices. See [Use a preconfigured EDR policy](../protect/endpoint-security-edr-policy.md#use-a-preconfigured-edr-policy). + +These changes apply to the Endpoint security and endpoint detection and response nodes of the admin center, and the following device platforms: + +- Windows 10 +- Windows 11 + +#### Windows quality updates support expediting non-security updates + +Windows quality updates now support expediting non-security updates for those times when a quality fix needs to be deployed faster than the normal quality update settings. + +Applies to: + +- Windows 11 devices + +For more information about installing an expedited update, see [Expedite Windows quality updates in Microsoft Intune](../protect/windows-10-expedite-updates.md#create-and-assign-an-expedited-quality-update). + +### Intune apps + +#### Newly available protected apps for Intune + +The following protected apps are now available for Microsoft Intune: + +- Cerby by Cerby, Inc. +- OfficeMail Go by 9Folders, Inc. +- DealCloud by Intapp, Inc. +- Intapp 2.0 by Intapp, Inc. + +For more information about protected apps, see [Microsoft Intune protected apps](../apps/apps-supported-intune-apps.md). + ## Week of March 3, 2024 ### Device enrollment @@ -4150,7 +4512,7 @@ Applies to: - Windows 10/11 > [!NOTE] -> ASR polices don't support merge functionality for *ASR Only Per Rule Exclusions* and a policy conflict can result when multiple polices that configure *ASR Only Per Rule Exclusions* for the same device conflict. To avoid conflicts, combine the configurations for *ASR Only Per Rule Exclusions* into a single ASR policy. We are investigating adding policy merge for *ASR Only Per Rule Exclusions* in a future update. +> ASR policies don't support merge functionality for *ASR Only Per Rule Exclusions* and a policy conflict can result when multiple policies that configure *ASR Only Per Rule Exclusions* for the same device conflict. To avoid conflicts, combine the configurations for *ASR Only Per Rule Exclusions* into a single ASR policy. We are investigating adding policy merge for *ASR Only Per Rule Exclusions* in a future update. #### Grant apps permission to silently use certificates on Android Enterprise devices You can now configure silent use of certificates by apps on Android Enterprise devices that enrolled as **Fully Managed, Dedicated, and Corporate-Owned work Profile**. @@ -4195,7 +4557,7 @@ As of October 12, 2022, the name Microsoft Endpoint Manager will no longer be us For more information, see [Intune documentation]( ../../index.yml). #### Grace period status visible in Windows Company Portal -Windows Company Portal now displays a grace period status to account for devices that don't meet compliance requirements but are still within their given grace period. Users are shown the date by which they need to become compliant and the instructions for how to become compliant. If users don't update their device by the given date, their device status changes to noncompliant. For more information about setting grace periods, see [Configure compliance policies with actions for noncompliance](../protect/actions-for-noncompliance.md#available-actions-for-noncompliance) and [Check access from Device details page](../user-help/check-device-access-windows-cpapp.md#check-access-from-device-details-page). +Windows Company Portal now displays a grace period status to account for devices that don't meet compliance requirements but are still within their given grace period. Users are shown the date by which they need to become compliant and the instructions for how to become compliant. If users don't update their device by the given date, their device status changes to noncompliant. For more information about setting grace periods, see [Configure compliance policies with actions for noncompliance](../protect/actions-for-noncompliance.md#available-actions-for-noncompliance) and [Check access from Device details page](../user-help/check-device-access-windows-cpapp.md). #### Linux device management available in Microsoft Intune Microsoft Intune now supports Linux device management for devices running Ubuntu Desktop 22.04 or 20.04 LTS. Intune admins don't need to do anything to enable Linux enrollment in the Microsoft Intune admin center. Linux users can [enroll supported Linux devices](../user-help/enroll-device-linux.md) on their own and use the Microsoft Edge browser to access corporate resources online. @@ -4457,7 +4819,7 @@ You can now use Intune role-based access control (RBAC) when interacting with te ### App management #### Android strong biometric change detection -The Android **Fingerprint instead of PIN for access** setting in Intune, which allows the end-user to use [fingerprint authentication](https://developer.android.com/about/versions/marshmallow/android-6.0.html#fingerprint-authentication) instead of a PIN, is being modified. This change allows you to require end-users to set strong biometrics. And, if a change in strong biometrics is detected, you can require end-users to confirm their app protection policy (APP) PIN. You can find Android app protection polices in [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431) by selecting **Apps** > **App protection policies** > **Create policy** > **Android**. For more information, see [Android app protection policy settings in Microsoft Intune](../apps/app-protection-policy-settings-android.md#access-requirements). +The Android **Fingerprint instead of PIN for access** setting in Intune, which allows the end-user to use [fingerprint authentication](https://developer.android.com/about/versions/marshmallow/android-6.0.html#fingerprint-authentication) instead of a PIN, is being modified. This change allows you to require end-users to set strong biometrics. And, if a change in strong biometrics is detected, you can require end-users to confirm their app protection policy (APP) PIN. You can find Android app protection policies in [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431) by selecting **Apps** > **App protection policies** > **Create policy** > **Android**. For more information, see [Android app protection policy settings in Microsoft Intune](../apps/app-protection-policy-settings-android.md#access-requirements). #### Noncompliance details available for Android (AOSP) in Microsoft Intune app Android (AOSP) users can view noncompliance reasons in the Microsoft Intune app. These details describe why a device is marked noncompliant. This information is available on the Device details page for devices enrolled as user-associated Android (AOSP) devices. diff --git a/memdocs/intune/fundamentals/whats-new.md b/memdocs/intune/fundamentals/whats-new.md index 35146ce5580..3791d16f6de 100644 --- a/memdocs/intune/fundamentals/whats-new.md +++ b/memdocs/intune/fundamentals/whats-new.md @@ -7,7 +7,7 @@ keywords: author: brenduns ms.author: brenduns manager: dougeby -ms.date: 08/23/2024 +ms.date: 10/19/2024 ms.topic: conceptual ms.service: microsoft-intune ms.subservice: fundamentals @@ -54,8 +54,8 @@ You can also read: > > For new information about Windows Autopilot solutions, see: > -> - [Windows Autopilot device preparation: What's new](/autopilot/device-preparation/whats-new). -> - [Windows Autopilot: What's new](/autopilot/whats-new). +> - [Windows Autopilot device preparation: What's new](/autopilot/device-preparation/whats-new) +> - [Windows Autopilot: What's new](/autopilot/whats-new) You can use RSS to be notified when this page is updated. For more information, see [How to use the docs](../../use-docs.md#notifications). @@ -76,6 +76,342 @@ You can use RSS to be notified when this page is updated. For more information, --> +## Week of October 14, 2024 (Service release 2410) + +### App management + +#### Updates to app configuration policies for Android Enterprise devices + +App configuration policies for Android Enterprise devices now support overriding the following permissions: + +- Access background location +- Bluetooth (connect) + +For more information about app configuration policies for Android Enterprise devices, see [Add app configuration policies for managed Android Enterprise devices](../apps/app-configuration-policies-use-android.md). + +Applies to: + +- Android Enterprise devices + +### Device configuration + +#### Windows Autopilot device preparation support in Intune operated by 21Vianet in China + +Intune now supports *Windows Autopilot device preparation* policy for [Intune operated by 21Vianet in China](../fundamentals/china.md) cloud. Customers with tenants located in China can now use *Windows Autopilot device preparation* with Intune to provision devices. + +For information about this Autopilot support, see the following in the Autopilot documentation: + +- Overview: [Overview of Windows Autopilot device preparation](/autopilot/device-preparation/overview) +- Tutorial: [Windows Autopilot device preparation scenarios](/autopilot/device-preparation/tutorial/scenarios) + +### Device management + +#### Minimum OS version for Android devices is Android 10 and later for user-based management methods + +Beginning in October 2024, Android 10 and later is the minimum Android OS version that is supported for user-based management methods, which includes: + +- Android Enterprise personally-owned work profile +- Android Enterprise corporate owned work profile +- Android Enterprise fully managed +- Android Open Source Project (AOSP) user-based +- Android device administrator +- App protection policies (APP) +- App configuration policies (ACP) for managed apps + +For enrolled devices on unsupported OS versions (Android 9 and lower) + +- Intune technical support is not provided. +- Intune won't make changes to address bugs or issues. +- New and existing features aren't guaranteed to work. + +While Intune doesn't prevent enrollment or management of devices on unsupported Android OS versions, functionality isn't guaranteed, and use isn't recommended. + +Userless methods of Android device management (Dedicated and AOSP userless) and Microsoft Teams certified Android devices are not affected by this change. + +#### Collection of additional device inventory details + +Intune now collects additional files and registry keys to assist in troubleshooting the Device Hardware Inventory feature. + +Applies to: + +- Windows + +## Week of October 7, 2024 + +### App management + +#### New UI for Intune Company Portal app for Windows + +The UI for the Intune Company Portal app for Windows is updated. Users now see an improved experience for their desktop app without changing the functionality they've used in the past. Specific UI improvements are focused on the **Home**, **Devices**, and **Downloads & updates** pages. The new design is more intuitive and highlights areas where users need to take action. + +For more information, see [New look for Intune Company Portal app for Windows](https://techcommunity.microsoft.com/t5/intune-customer-success/new-look-for-intune-company-portal-app-for-windows/ba-p/4158755). For end user details, see [Install and share apps on your device](../user-help/install-apps-cpapp-windows.md). + +### Device security + +#### New strong mapping requirements for SCEP certificates authenticating with KDC + +The Key Distribution Center (KDC) requires user or device objects to be strongly mapped to Active Directory for certificate-based authentication. This means that a Simple Certificate Enrollment Protocol (SCEP) certificate's subject alternative name (SAN) must have a security identifier (SID) extension that maps to the user or device SID in Active Directory. The mapping requirement protects against certificate spoofing and ensures that certificate-based authentication against the KDC continues working. + +To meet requirements, modify or create a SCEP certificate profile in Microsoft Intune. Then add a `URI` attribute and the `OnPremisesSecurityIdentifier` variable to the SAN. After you do that, Microsoft Intune appends a tag with the SID extension to the SAN and issues new certificates to targeted users and devices. If the user or device has a SID on premises that's been synced to Microsoft Entra ID, the certificate shows the SID. If they don't have a SID, a new certificate is issued without the SID. + +For more information and steps, see [Update certificate connector: Strong mapping requirements for KB5014754](../protect/certificates-profile-scep.md). + +Applies to: + +- Windows 10/11, iOS/iPadOS, and macOS user certificates +- Windows 10/11 device certificates + +This requirement isn't applicable to device certificates used with Microsoft Entra joined users or devices, because the SID attribute is an on-premises identifier. + +#### Defender for Endpoint security settings support in government cloud environments (public preview) + +In public preview, customer tenants in US Government Community (GCC) High, and Department of Defense (DoD) environments can now use Intune to manage the Defender security settings on the devices that onboarded to Defender without enrolling those devices with Intune. This capability is known as [Defender for Endpoint security settings management](../protect/mde-security-integration.md). + +For more information about the Intune features supported in GCC High and DoD environments, see [Intune US Government service description](../fundamentals/intune-govt-service-description.md). + +## Week of September 30, 2024 + +### Device security + +#### Updates to PKCS certificate issuance process in Microsoft Intune Certificate Connector, version 6.2406.0.1001 + +We've updated the process for Public Key Cryptography Standards (PKCS) certificate issuance in Microsoft Intune to support the security identifiers (SID) information requirements described in [KB5014754](https://support.microsoft.com/topic/kb5014754-certificate-based-authentication-changes-on-windows-domain-controllers-ad2c23b0-15d8-4340-a468-4d4f3b188f16). As part of this update, an OID attribute containing the user or device SID is added to the certificate. This change is available with the Certificate Connector for Microsoft Intune, version 6.2406.0.1001, and applies to users and devices synced from Active Directory on-premises to Microsoft Entra ID. + +The SID update is available for user certificates across all platforms, and for device certificates specifically on Microsoft Entra hybrid joined Windows devices. + +For more information, see: + +- [What's new for the certificate connector](../protect/certificate-connector-overview.md#september-19-2024) + +- [Apply PFX changes to certificate](../protect/certificates-pfx-configure.md) + +## Week of September 23, 2024 (Service release 2409) + +### App management + +#### Working Time settings for app protection policies + +Working time settings allow you to enforce policies that limit access to apps and mute message notifications received from apps during non-working time. The limit access setting is now available for the Microsoft Teams and Microsoft Edge apps. You can limit access by using App Protection Policies (APP) to block or warn end users from using the iOS/iPadOS or Android Teams and Microsoft Edge apps during non-working time by setting the **Non-working time** conditional launch setting. Also, you can create a non-working time policy to mute notifications from the Teams app to end users during non-working time. + +Applies to: + +- Android +- iOS/iPadOS + +#### Streamlined app creation experience for apps from Enterprise App Catalog + +We've streamlined the way apps from Enterprise App Catalog are added to Intune. We now provide a direct app link rather than duplicating the app binaries and metadata. App contents now download from a `*.manage.microsoft.com` subdomain. This update helps to improve the latency when adding an app to Intune. When you add an app from Enterprise App Catalog, it syncs immediately and is ready for additional action from within Intune. + +#### Update Enterprise App Catalog apps + +Enterprise App Management is enhanced to allow you to update an **Enterprise App Catalog** app. This capability guides you through a wizard that allows you to add a new application and use supersedence to update the previous application. + +For more information, see [Guided update supersedence for Enterprise App Management](../apps/apps-eam-supersedence.md). + +### Device configuration + +#### Samsung ended support for multiple Android device administrator (DA) settings + +On Android device administrator managed (DA) devices, Samsung has deprecated many [Samsung Knox APIs](https://docs.samsungknox.com/dev/knox-sdk/api-reference/deprecated-api-methods/) (opens Samsung's web site) configuration settings. + +In Intune, this deprecation impacts the following device restrictions settings, compliance settings, and trusted certificate profiles: + +- [Device restriction settings for Android in Microsoft Intune](../configuration/device-restrictions-android.md) +- [View the Android device administrator compliance settings for Microsoft Intune compliance policies](../protect/compliance-policy-create-android.md) +- [Create trusted certificate profiles in Microsoft Intune](../protect/certificates-trusted-root.md#trusted-certificate-profiles-for-android-device-administrator) + +In the Intune admin center, when you create or update a profile with these settings, the impacted settings are noted. + +Though the functionality might continue to work, there's no guarantee that it will continue working for any or all Android DA versions supported by Intune. For more information on Samsung support for deprecated APIs, see [What kind of support is offered after an API is deprecated?](https://docs.samsungknox.com/dev/knox-sdk/faqs/general/deprecated-api-support-change.htm) (opens Samsung's web site). + +Instead, you can manage Android devices with Intune using one of the following Android Enterprise options: + +- [Set up enrollment of Android Enterprise personally owned work profile devices](../enrollment/android-work-profile-enroll.md) +- [Set up Intune enrollment of Android Enterprise corporate-owned devices with work profile](../enrollment/android-corporate-owned-work-profile-enroll.md) +- [Set up enrollment for Android Enterprise fully managed devices](../enrollment/android-fully-managed-enroll.md) +- [Set up Intune enrollment of Android Enterprise dedicated devices](../enrollment/android-kiosk-enroll.md) +- [App protection policies overview](../apps/app-protection-policy.md) + +Applies to: + +- Android device administrator (DA) + +#### Device Firmware Configuration Interface (DFCI) supports VAIO devices + +For Windows 10/11 devices, you can create a DFCI profile to manage UEFI (BIOS) settings. In [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431), select **Devices** > **Manage devices** > **Configuration** > **Create** > **New policy** > **Windows 10 and later** for platform > **Templates** > **Device Firmware Configuration Interface** for profile type. + +Some VAIO devices running Windows 10/11 are enabled for DFCI. Contact your device vendor or device manufacturer for eligible devices. + +For more information about DFCI profiles, see: + +- [Configure Device Firmware Configuration Interface (DFCI) profiles on Windows devices in Microsoft Intune](../configuration/device-firmware-configuration-interface-windows.md) +- [Device Firmware Configuration Interface (DFCI) management with Windows Autopilot](../../autopilot/dfci-management.md) + +Applies to: + +- Windows 10 +- Windows 11 + +#### New settings available in the Apple settings catalog + +The [Settings Catalog](../configuration/settings-catalog.md) lists all the settings you can configure in a device policy, and all in one place. For more information about configuring Settings Catalog profiles in Intune, see [Create a policy using settings catalog](../configuration/settings-catalog.md). + +There are new settings in the Settings Catalog. To see these settings, in the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431), go to **Devices** > **Manage devices** > **Configuration** > **Create** > **New policy** > **iOS/iPadOS** or **macOS** for platform > **Settings catalog** for profile type. + +##### iOS/iPadOS + +**Declarative Device Management (DDM) > Math Settings**: + +- Calculator + - Basic Mode + - Math Notes Mode + - Scientific Mode + +- System Behavior + - Keyboard Suggestions + - Math Notes + +**Web Content Filter**: + +- Hide Deny List URLs + +##### macOS + +**Declarative Device Management (DDM) > Math Settings**: + +- Calculator + - Basic Mode + - Math Notes Mode + - Programmer Mode + - Scientific Mode + +- System Behavior + - Keyboard Suggestions + - Math Notes + +**System Configuration > System Extensions**: + +- Non Removable From UI System Extensions +- Non Removable System Extensions + +#### Consent prompt update for remote log collection + +End users might see a different consent experience for remote log collection after the Android APP SDK 10.4.0 and iOS APP SDK 19.6.0 updates. End users no longer see a common prompt from Intune and only see a prompt from the application, if it has one. + +Adoption of this change is per-application and is subject to each applications release schedule. + +Applies to: + +- Android +- iOS/iPadOS + +### Device enrollment + +#### New Setup Assistant screens available for configuration for ADE + +New Setup Assistant screens are available to configure in the Microsoft Intune admin center. You can hide or show these screens during automated device enrollment (ADE). + +For macOS: + +- **Wallpaper**: Show or hide the macOS Sonoma wallpaper setup pane that appears after an upgrade on devices running macOS 14.1 and later. +- **Lockdown mode**: Show or hide the lockdown mode setup pane on devices running macOS 14.1 and later. +- **Intelligence**: Show or hide the Apple Intelligence setup pane on devices running macOS 15 and later. + +For iOS/iPadOS: + +- **Emergency SOS**: Show or hide the safety setup pane on devices running iOS/iPadOS 16 and later. +- **Action button**: Show or hide the setup pane for the action button on devices running iOS/iPadOS 17 and later. +- **Intelligence**: Show or hide the Apple Intelligence setup pane on devices running iOS/iPadOS 18 and later. + +You can configure these screens in new and existing enrollment policies. For more information and additional resources, see: + +- [Set up Apple automated device enrollment for iOS/iPadOS](../enrollment/device-enrollment-program-enroll-ios.md) +- [Set up Apple automated device enrollment for Macs](../enrollment/device-enrollment-program-enroll-macos.md) + +#### Extended expiration date for corporate-owned, user-associated AOSP enrollment tokens + +Now when you create an enrollment token for Android Open Source Project (AOSP) corporate-owned, user-associated devices, you can select an expiration date that's up to 65 years into the future, an improvement over the previous 90 day expiration date. You can also modify the expiration date of existing enrollment tokens for Android Open Source Project (AOSP) corporate-owned, user-associated devices. + +### Device security + +#### New disk encryption template for Personal Data Encryption + +You can now use the new *Personal Data Encryption* (PDE) template that is available through endpoint security [*disk encryption* policy](../protect/encrypt-devices.md). This new template configures the Windows [PDE configuration service provider](/windows/client-management/mdm/personaldataencryption-csp) (CSP), which was introduced in Windows 11 22H2. The PDE CSP is also available through the settings catalog. + +PDE differs from BitLocker in that it encrypts files instead of whole volumes and disks. PDE occurs in addition to other encryption methods such as BitLocker. Unlike BitLocker that releases data encryption keys at boot, PDE doesn't release data encryption keys until a user signs in using Windows Hello for Business. + +Applies to: + +- Windows 11 version 22h2 or later + +For more information about PDE, including prerequisites, related requirements, and recommendations, see the following articles in the Windows security documentation: + +- [PDE overview](/windows/security/operating-system-security/data-protection/personal-data-encryption/) +- [Configure PDE](/windows/security/operating-system-security/data-protection/personal-data-encryption/configure) +- [PDE frequently asked questions (FAQ)](/windows/security/operating-system-security/data-protection/personal-data-encryption/faq) + +### Intune Apps + +#### Newly available protected app for Intune + +The following protected app is now available for Microsoft Intune: + +- Notate for Intune by Shafer Systems, LLC + +For more information about protected apps, see [Microsoft Intune protected apps](../apps/apps-supported-intune-apps.md). + +## Week of September 9, 2024 + +### App management + +#### Managed Home Screen user experience update + +All Android devices automatically migrate to the updated Managed Home Screen (MHS) user experience. For more information, see [Updates to the Managed Home Screen experience](https://techcommunity.microsoft.com/t5/intune-customer-success/updates-to-the-managed-home-screen-experience/bc-p/3997842). + +### Device enrollment + +#### Support has ended for Apple profile-based user enrollment with Company Portal + +Apple supports two types of manual enrollment methods for users and devices in bring-your-own-device (BYOD) scenarios: *profile-based enrollment* and *account-driven enrollment*. Apple has ended support for profile-based user enrollment, known in Intune as *user enrollment with Company Portal*. This method was their privacy-focused BYOD enrollment flow that used managed Apple IDs. As a result of this change, Intune has ended support for [profile-based user enrollment with Company Portal](../enrollment/apple-user-enrollment-with-company-portal.md). Users can no longer enroll devices targeted with this enrollment profile type. This change doesn't affect devices that are already enrolled with this profile type, so you can continue to manage them in the admin center and receive Microsoft Intune technical support. Less than 1% of Apple devices across all Intune tenants are currently enrolled this way, so this change doesn't affect most enrolled devices. + +There's no change to profile-based device enrollment with Company Portal, the default enrollment method for BYOD scenarios. Devices enrolled via Apple automated device enrollment also remain unaffected. + +We recommend account-driven user enrollment as a replacement method for devices. For more information about your BYOD enrollment options in Intune, see: + +- [Account-driven user enrollment](../enrollment/apple-account-driven-user-enrollment.md) +- [Web-based device enrollment](../enrollment/web-based-device-enrollment-ios.md) +- [Device enrollment with Company Portal](../enrollment/ios-device-enrollment.md#app-or-web-based-enrollment) (default enrollment method for BYOD scenarios) + +For more information about the device enrollment types supported by Apple, see [Intro to Apple device enrollment types](https://support.apple.com/en-mide/guide/deployment/dep08f54fcf6/web) in the Apple Platform Deployment guide. + +### Device management + +#### Intune now supports iOS/iPadOS 16.x as the minimum version + +Later this year, we expect iOS 18 and iPadOS 18 to be released by Apple. Microsoft Intune, including the Intune Company Portal and Intune app protection policies (APP, also known as MAM), will require iOS/iPadOS 16 and higher shortly after the iOS/iPadOS 18 release. + +For more information on this change, see [Plan for change: Intune is moving to support iOS/iPadOS 16 and later](whats-new.md#plan-for-change-intune-is-moving-to-support-iosipados-16-and-later). + +> [!NOTE] +> Userless iOS and iPadOS devices enrolled through Automated Device Enrollment (ADE) have a slightly nuanced support statement due to their shared usage. For more information, see [Support statement for supported versus allowed iOS/iPadOS versions for user-less devices](https://aka.ms/ADE_userless_support). + +Applies to: + +- iOS/iPadOS + +#### Intune now supports macOS 13.x as the minimum version + +With Apple's release of macOS 15 Sequoia, Microsoft Intune, the Company Portal app, and the Intune MDM agent will now require macOS 13 (Ventura) and later. + +For more information on this change, see [Plan for change: Intune is moving to support macOS 13 and later](whats-new.md#plan-for-change-intune-is-moving-to-support-macos-13-and-higher-later-this-year) + +> [!NOTE] +> macOS devices enrolled through Automated Device Enrollment (ADE) have a slightly nuanced support statement due to their shared usage. For more information, see [Support statement](https://aka.ms/Intune/macOS/ADE-DE-support). + +Applies to: + +- macOS + ## Week of August 19, 2024 (Service release 2408) ### Microsoft Intune Suite @@ -118,7 +454,7 @@ For related information, see: #### Updates to the Discovered Apps report -The **Discovered Apps** report, which provides a list of detected apps that are on Intune enrolled devices for your tenant, now provides publisher data for Win32 apps, in addition to Store apps. Rather than providing publisher information only in the exported report data, we are including it as a column in the **Discovered Apps** report. +The **Discovered Apps** report, which provides a list of detected apps that are on Intune enrolled devices for your tenant, now provides publisher data for Win32 apps, in addition to Store apps. Rather than providing publisher information only in the exported report data, we're including it as a column in the **Discovered Apps** report. For more information, see [Intune Discovered apps](../apps/app-discovered-apps.md#monitor-discovered-apps-with-intune). @@ -166,6 +502,13 @@ There are new settings in the Apple Settings Catalog. To see these settings, in **Restrictions**: - Allow ESIM Outgoing Transfers +- Allow Genmoji +- Allow Image Playground +- Allow Image Wand +- Allow iPhone Mirroring +- Allow Personalized Handwriting Results +- Allow Video Conferencing Remote Control +- Allow Writing Tools ##### macOS @@ -218,6 +561,13 @@ There are new settings in the Apple Settings Catalog. To see these settings, in - Enable - Enable Rollback +**Restrictions**: + +- Allow Genmoji +- Allow Image Playground +- Allow iPhone Mirroring +- Allow Writing Tools + **System Policy > System Policy Control**: - Enable XProtect Malware Upload @@ -246,7 +596,7 @@ For more information, see [Connect Intune account to Managed Google Play account ### Device management -#### 21 Vianet support for Mobile Threat Defense connectors +#### 21Vianet support for Mobile Threat Defense connectors Intune operated by 21Vianet now supports Mobile Threat Defense (MTD) connectors for Android and iOS/iPadOS devices for MTD vendors that also have support in that environment. When an MTD partner is supported and you sign in to a 21Vianet tenant, the supported connectors are available. @@ -360,7 +710,7 @@ For more information, see: ### Microsoft Intune Suite -#### Endpoint Privilege Management, Advanced Analytics, and Intune Plan 2 is available for GCC High and DoD +#### Endpoint Privilege Management, Advanced Analytics, and Intune Plan 2 are available for GCC High and DoD We are excited to announce that the following capabilities from the Microsoft Intune Suite are now supported in U.S. Government Community Cloud (GCC) High and U.S. Department of Defense (DoD) environments. @@ -383,17 +733,18 @@ For more information, see: ### Device enrollment #### ACME protocol support for iOS/iPadOS and macOS enrollment + As we prepare to support managed device attestation in Intune, we are starting a phased rollout of an infrastructure change for new enrollments that includes support for the *Automated Certificate Management Environment (ACME) protocol*. Now when new Apple devices enroll, the management profile from Intune receives an ACME certificate instead of a SCEP certificate. ACME provides better protection than SCEP against unauthorized certificate issuance through robust validation mechanisms and automated processes, which helps reduce errors in certificate management. -Existing OS and hardware eligible devices do not get the ACME certificate unless they re-enroll. There is no change to the end user's enrollment experience, and no changes to the Microsoft Intune admin center. This change only impacts enrollment certificates and has no impact on any device configuration policies. +Existing OS and hardware eligible devices do not get the ACME certificate unless they re-enroll. There is no change to the end user's enrollment experience, and no changes to the Microsoft Intune admin center. This change only impacts enrollment certificates and has no impact on any device configuration policies. -ACME is supported for Apple Device Enrollment and Apple Configurator enrollment methods. Eligible OS versions include: +ACME is supported for Apple Device Enrollment, Apple Configurator enrollment, and Automated device enrollment (ADE) methods. Eligible OS versions include: - iOS 16.0 or later - iPadOS 16.1 or later - macOS 13.1 or later -## Week of July 22, 2024 (Service release 2407) +## Week of July 22, 2024 (Service release 2407) ### Microsoft Intune Suite @@ -467,7 +818,7 @@ In an Intune device restrictions configuration policy, you can configure the **A The available options are updated to **Allow**, **Block**, and **Not configured**. -There is no impact to existing profiles using this setting. +There's no impact to existing profiles using this setting. For more information on this setting and the values you can currently configure, see [Android Enterprise device settings list to allow or restrict features on corporate-owned devices using Intune](../configuration/device-restrictions-android-for-work.md). @@ -611,7 +962,7 @@ The following protected apps are now available for Microsoft Intune: - HCSS Field: Time, cost, safety (iOS) by Heavy Construction Systems Specialists, Inc. - Synchrotab for Intune (iOS) by Synchrotab, LLC -For more information about protected apps, see [Microsoft Intune protected apps](../apps/apps-supported-intune-apps.md). +For more information about protected apps, see [Microsoft Intune protected apps](../apps/apps-supported-intune-apps.md). ## Week of July 15, 2024 @@ -621,9 +972,7 @@ For more information about protected apps, see [Microsoft Intune protected apps] We've added a new category and setting to the Device Control profile for the *Windows 10, Windows 11, and Windows Server* platform of Intune [Attack surface reduction policy](../protect/endpoint-security-asr-policy.md). -The new setting is **Allow Storage Card**, and found in the new **System** category of the profile. This setting is also available from the Intune [settings catalog](../configuration/settings-catalog.md). - -for the Windows devices. +The new setting is **Allow Storage Card**, and found in the new **System** category of the profile. This setting is also available from the Intune [settings catalog](../configuration/settings-catalog.md) for the Windows devices. This setting controls whether the user is allowed to use the storage card for device storage, and can prevent programmatic access to the storage card. For more information on this new setting, see [AllowStorageCard](/windows/client-management/mdm/policy-csp-system?branch=main&branchFallbackFrom=pr-en-us-15655&WT.mc_id=Portal-fx#allowstoragecard) in the Windows documentation. @@ -662,18 +1011,18 @@ You can now configure Managed Home Screen (MHS) to enable a virtual app-switcher We've made changes to the device registration process for Apple devices enrolling with Intune Company Portal. Previously, Microsoft Entra device registration occurred during enrollment. With this change, registration occurs after enrollment. -Existing enrolled devices are not affected by this change. For new user or device enrollments that utilize Company Portal, users must return to Company Portal to complete registration: +Existing enrolled devices aren't affected by this change. For new user or device enrollments that utilize Company Portal, users must return to Company Portal to complete registration: -- For iOS users: Users with notifications enabled will be prompted to return to the Company Portal app for iOS. If they disable notifications, they won't be alerted, but still need to return to Company Portal to complete registration. +- For iOS users: Users with notifications enabled are prompted to return to the Company Portal app for iOS. If they disable notifications, they aren't alerted, but still need to return to Company Portal to complete registration. -- For macOS devices: The Company Portal app for macOS will detect the installation of the management profile and automatically register the device, unless the user closes the app. If they close the app, they must reopen it to complete registration. +- For macOS devices: The Company Portal app for macOS detects the installation of the management profile and automatically register the device, unless the user closes the app. If they close the app, they must reopen it to complete registration. -If you're using dynamic groups, which rely on device registration to work, it's important for users to complete device registration. Update your user guidance and admin documentation as needed. If you're using Conditional Access (CA) policies, no action is required. When users attempt to sign in to a CA-protected app, they will be prompted to return to Company Portal to complete registration. +If you're using dynamic groups, which rely on device registration to work, it's important for users to complete device registration. Update your user guidance and admin documentation as needed. If you're using Conditional Access (CA) policies, no action is required. When users attempt to sign in to a CA-protected app, they are prompted to return to Company Portal to complete registration. -These changes are currently rolling out and will be made available to all Microsoft Intune tenants by the end of July. There's no change to the Company Portal user interface. For more information about device enrollment for Apple devices, see: +These changes are currently rolling out and will be made available to all Microsoft Intune tenants by the end of July. There's no change to the Company Portal user interface. For more information about device enrollment for Apple devices, see: - [Enrollment guide: Enroll macOS devices in Microsoft Intune](../fundamentals/deployment-guide-enrollment-macos.md#device-enrollment-end-user-tasks) -- [Enrollment guide: Enroll iOS and iPadOS devices in Microsoft Intune](../fundamentals/deployment-guide-enrollment-ios-ipados.md#user-and-device-enrollment-end-user-tasks) +- [Enrollment guide: Enroll iOS and iPadOS devices in Microsoft Intune](../fundamentals/deployment-guide-enrollment-ios-ipados.md) ## Week of June 24, 2024 @@ -681,7 +1030,7 @@ These changes are currently rolling out and will be made available to all Micros #### Add corporate device identifiers for Windows -Microsoft Intune now supports corporate device identifiers for devices running Windows 11, version 22H2 and later so that you can identify corporate machines ahead of enrollment. When a device that matches the model, manufacturer, and serial number criteria enrolls, Microsoft Intune will mark it as a corporate device and enable the appropriate management capabilities. For more information, see [Add corporate identifiers](../enrollment/corporate-identifiers-add.md). +Microsoft Intune now supports corporate device identifiers for devices running Windows 11, version 22H2 and later so that you can identify corporate machines ahead of enrollment. When a device that matches the model, manufacturer, and serial number criteria enrolls, Microsoft Intune marks it as a corporate device and enable the appropriate management capabilities. For more information, see [Add corporate identifiers](../enrollment/corporate-identifiers-add.md). ## Week of June 17, 2024 (Service release 2406) @@ -793,7 +1142,7 @@ For more information, see [Create device platform restrictions](../enrollment/cr ### Updates to replace Wandera with Jamf is complete in the Intune admin center -We've completed rebranding in the Microsoft Intune admin center to support replacing Wandera with Jamf. This includes updates to the name of the Mobile Threat Defense connector, which is now *Jamf*, and changes to the minimum required platforms to use the Jamf connector: +We've completed a rebrand in the Microsoft Intune admin center to support replacing Wandera with Jamf. This includes updates to the name of the Mobile Threat Defense connector, which is now *Jamf*, and changes to the minimum required platforms to use the Jamf connector: - Android 11 and later - iOS / iPadOS 15.6 and later @@ -857,7 +1206,7 @@ Each new permission supports the following rights for the related policy: - Update - View Reports -Each time we add a new granular permission for an endpoint security policy to Intune, those same rights are removed from the *Security baselines* permission. If you use custom roles with the *Security baselines* permission, the new RBAC permission is assigned automatically to your custom roles with the same rights that were granted through the *Security baseline* permission. This auto-assignment ensures your admins continue to have the same permissions they have today. +Each time we add a new granular permission for an endpoint security policy to Intune, those same rights are removed from the *Security baselines* permission. If you use custom roles with the *Security baselines* permission, the new RBAC permission is assigned automatically to your custom roles with the same rights that were granted through the *Security baseline* permission. This autoassignment ensures your admins continue to have the same permissions they have today. For more information about current RBAC permissions and built-in roles, see: @@ -875,7 +1224,7 @@ For more information about current RBAC permissions and built-in roles, see: #### New enrollment time grouping feature for devices -Enrollment time grouping is a new, faster way to group devices during enrollment. When it's configured, Intune adds devices to the appropriate group without requiring inventory discovery and dynamic membership evaluations. To set up enrollment time grouping, you must configure a static Microsoft Entra security group in each enrollment profile. After a device enrolls, Intune adds it to the static security group and delivers assigned apps and policies. +Enrollment time grouping is a new, faster way to group devices during enrollment. When configured, Intune adds devices to the appropriate group without requiring inventory discovery and dynamic membership evaluations. To set up enrollment time grouping, you must configure a static Microsoft Entra security group in each enrollment profile. After a device enrolls, Intune adds it to the static security group and delivers assigned apps and policies. This feature is available for Windows 11 devices enrolling via Windows Autopilot device preparation. For more information, see [Enrollment time grouping in Microsoft Intune](../enrollment/enrollment-time-grouping.md). @@ -962,7 +1311,7 @@ When frontline workers receive the devices, all they have to do is connect to Wi End users can now view the BitLocker Recovery Key for enrolled Windows devices from the Company Portal website. This capability can reduce helpdesk calls in the event the end user gets locked out of their corporate machines. End users can access the recovery key for an enrolled device by signing into the Company Portal website and selecting **Show recovery key**. This experience is similar to the MyAccount website, which also allows end users to see recovery keys. -You can prevent end users within your organization from accessing BitLocker recovery keys by configuring the Entra ID toggle **Restrict non-admin users from recovering the BitLocker key(s) for their owned device**. +You can prevent end users within your organization from accessing BitLocker recovery keys by configuring the Microsoft Entra toggle **Restrict non-admin users from recovering the BitLocker key(s) for their owned device**. For more information, see: @@ -985,9 +1334,9 @@ Applies to: #### Optional Feature updates -Feature updates can now be made available to end users as **Optional** updates, with the introduction of **Optional** Feature updates. End users will see the update in the **Windows Update** settings page in the same way that it's shown for consumer devices. +Feature updates can now be made available to end users as **Optional** updates, with the introduction of **Optional** Feature updates. End users see the update in the **Windows Update** settings page in the same way that it's shown for consumer devices. -End users can easily opt in to try out the next Feature update and provide feedback. When it's time to roll out the feature as a **Required** update, then admins can change the setting on the policy, and update the rollout settings so that the update is deployed as a **Required** update to devices that do not yet have it installed. +End users can easily opt in to try out the next Feature update and provide feedback. When it's time to roll out the feature as a **Required** update, then admins can change the setting on the policy, and update the rollout settings so that the update is deployed as a **Required** update to devices that don't yet have it installed. For more information on Optional Feature updates, see [Feature updates for Windows 10 and later policy in Intune](..//protect/windows-10-feature-updates.md#create-and-assign-feature-updates-for-windows-10-and-later-policy). @@ -1059,9 +1408,9 @@ For related information, see [Change the Portal settings](../fundamentals/tutori #### Updates to the Managed Home Screen experience -We recently released and improved the Managed Home Screen experience, which is now Generally Available. The app has been redesigned to improve the core workflows throughout the application. The updated design offers a more usable and supportable experience. +We recently released and improved the Managed Home Screen experience, which is now Generally Available. The app is redesigned to improve the core workflows throughout the application. The updated design offers a more usable and supportable experience. -With the release, we stop investing in previous Managed Home Screen workflows. New features and fixes for Managed Home Screen are only added to the new experience. During August 2024, the new experience will automatically be enabled for all devices. +With the release, we stop investing in previous Managed Home Screen workflows. New features and fixes for Managed Home Screen are only added to the new experience. During August 2024, the new experience is automatically enabled for all devices. For more information, see [Configure the Microsoft Managed Home Screen app for Android Enterprise](../apps/app-configuration-managed-home-screen-app.md) and [Android Enterprise device settings list to allow or restrict features on corporate-owned devices using Intune](../configuration/device-restrictions-android-for-work.md). @@ -1203,368 +1552,6 @@ Applies to: - macOS 12, 13 and 14 -## Week of April 15, 2024 - -### Intune apps - -#### Newly available protected app for Intune - -The following protected app is now available for Microsoft Intune: - -- Atom Edge by Arlanto Apps - -For more information about protected apps, see [Microsoft Intune protected apps](../apps/apps-supported-intune-apps.md). - -## Week of April 1, 2024 - -### Device management - -#### Copilot in Intune is available in the Intune admin center (public preview) - -Copilot in Intune is integrated in the Intune admin center, and can help you get information quickly. You can use Copilot in Intune for the following tasks: - -✅ **Copilot can help you manage your settings and policies** - -- **Copilot tooltip on settings**: When you add settings to a policy or review settings in an existing policy, there's a new Copilot tooltip. When you select the tooltip, you get AI generated guidance based on Microsoft content and recommendations. You can see what each setting does, how the setting works, any recommended values, if the setting is configured in another policy, and more. - -- **Policy summarizer**: On existing policies, you get a Copilot summary of the policy. The summary describes what the policy does, the users and groups assigned to the policy, and the settings in the policy. This feature can help you understand the impact of a policy and its settings on your users and devices. - -✅ **Copilot shows device details and can help troubleshoot** - -- **All about a device**: On a device, you can use Copilot to get key information about the device, including its properties, configuration, and status information. - -- **Device compare**: Use Copilot to compare the hardware properties and device configurations of two devices. This feature helps you determine what's different between two devices with similar configurations, especially when troubleshooting. - -- **Error code analyzer**: Use Copilot in the device view to analyze an error code. This feature helps you understand what the error means and provides a potential resolution. - -✅ **Intune capabilities in Copilot for Security** - -Intune has capabilities available in the Copilot for Security portal. SOC Analysts and IT admins can use these capabilities to get more information on policies, devices, group membership, and more. On a single device, you can get more specific information that's unique to Intune, like compliance status, device type, and more. - -You can also ask Copilot to tell you about a user's devices and get a quick summary of critical information. For example, the output shows links to the user's devices in Intune, device ID, enrollment date, last check-in date, and compliance status. If you're an IT admin and reviewing a user, then this data provides a quick summary. - -As a SOC analyst that's investigating a suspicious or potentially compromised user or device, information like enrollment date and last check-in can help you make informed decisions. - -For more information on these features, see: - -- [Microsoft Copilot in Intune](../copilot/copilot-intune-overview.md) -- [Access your Microsoft Intune data in Copilot for Security](../copilot/security-copilot.md) - -Applies to: - -- Android -- iOS/iPadOS -- macOS -- Windows - -#### GCC customers can use Remote Help for Windows and Android devices - -The [Microsoft Intune Suite](intune-add-ons.md) includes advanced endpoint management and security features, including Remote Help. - -On Windows and enrolled Android Enterprise dedicated devices, you can use remote help on US Government GCC environments. - -For more information on these features, see: - -- [Microsoft Intune for US Government GCC service description](intune-govt-service-description.md) -- [Use Remote Help with Microsoft Intune](remote-help.md) - -Applies to: - -- Windows 10/11 -- Windows 10/11 on ARM64 devices -- Windows 365 -- Samsung and Zebra devices enrolled as Android Enterprise dedicated devices - -### Device configuration - -#### New BIOS device configuration profile for OEMs - -There's a new **BIOS configuration and other settings** device configuration policy for OEMs. Admins can use this new policy to enable or disable different BIOS features that secure device. In the Intune device configuration policy, you add the BIOS configuration file, deploy a Win32 app, and then assign the policy to your devices. - -For example, admins can use the [Dell Command tool](https://www.dell.com/support/kbdoc/000108963/how-to-use-and-troubleshoot-dell-command-update-to-update-all-drivers-bios-and-firmware-for-your-system) (opens Dell's website) to create the BIOS configuration file. Then, they add this file to the new Intune policy. - -For more information on this feature, see [Use BIOS configuration profiles on Windows devices in Microsoft Intune](../configuration/bios-configuration.md). - -Applies to - -- Windows 10 and later - -## Week of March 25, 2024 (Service release 2403) - -### Microsoft Intune Suite - -#### New elevation type for Endpoint Privilege Management - -Endpoint Privilege Management has a new file elevation type, **support approved**. Endpoint Privilege Management is a feature component of the Microsoft Intune Suite and is also available as a standalone [Intune add-on](../fundamentals/intune-add-ons.md). - -A support-approved elevation gives you a third option for both the default elevation response and the elevation type for each rule. Unlike automatic or user confirmed, a support-approved elevation request requires Intune administrators to manage which files can run as elevated on a case-by-case basis. - -With support approved elevations, users can request approval to elevate an application that isn't explicitly allowed for elevation by automatic or user approved rules. This takes the form of an elevation request that must be reviewed by an Intune administrator who can approve or deny the elevation request. - -When the request is approved, users are notified that the application can now be run as elevated, and they have 24 hours from the time of approval to do so before the elevation approval expires. - -Applies to: - -- Windows 10 -- Windows 11 - -For more information on this new capability, see [Support approved elevation requests](../protect/epm-support-approved.md). - -### App management - -#### Extended capabilities for Managed Google Play apps on personally owned Android devices with a work profile - -There are new capabilities extended to work profile devices. The following capabilities were previously available only on corporate-owned devices: - -- **Available apps for device groups**: You can use Intune to make apps available for device groups through the Managed Google Play store. Previously, apps could only be made available to user groups. - -- **Update priority setting**: You can use Intune to configure the app update priority on devices with a work profile. To learn more about this setting, see [Update a Managed Google Play app](../apps/apps-add-android-for-work.md#update-a-managed-google-play-app). - -- **Required apps display as available in Managed Google Play**: You can use Intune to make required apps available for users through the Managed Google Play store. Apps that are part of existing policies now display as available. - -These new capabilities will follow a phased rollout over multiple months. - -Applies to: - -- Android Enterprise personally owned devices with a work profile - -### Device configuration - -#### New settings available in the Apple settings catalog - -The [Settings Catalog](../configuration/settings-catalog.md) lists all the settings you can configure in a device policy, and all in one place. For more information about configuring Settings Catalog profiles in Intune, see [Create a policy using settings catalog](../configuration/settings-catalog.md). - -There are new settings in the Settings Catalog. To see these settings, in the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431), go to **Devices** > **Manage devices** > **Configuration** > **Create** > **New policy** > **iOS/iPadOS** or **macOS** for platform > **Settings catalog** for profile type. - -##### iOS/iPadOS - -**Declarative Device Management (DDM) > Passcode**: - -- Maximum Passcode Age In Days -- Minimum Complex Characters -- Require Alphanumeric Passcode - -**Restrictions**: - -- Allow Marketplace App Installation - -##### macOS - -**Declarative Device Management (DDM) > Passcode**: - -- Change At Next Auth -- Custom Regex -- Failed Attempts Reset In Minutes -- Maximum Passcode Age In Days -- Minimum Complex Characters -- Require Alphanumeric Passcode - -**Full Disk Encryption > FileVault**: - -- Recovery Key Rotation In Months - -#### New settings available in the Windows settings catalog - -The [Settings Catalog](../configuration/settings-catalog.md) lists all the settings you can configure in a device policy, and all in one place. - -There are new settings in the Settings Catalog. To see these settings, in the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431), go to **Devices** > **Manage devices** > **Configuration** > **Create** > **New policy** > **Windows 10 and later** for platform > **Settings catalog** for profile type. - -- **Delivery optimization**: - - - **DO Disallow Cache Server Downloads On VPN** - This setting blocks downloads from Microsoft Connected Cache servers when the device connects using VPN. By default, the device is allowed to download from Microsoft Connected Cache when connected using VPN. - - - **DO Set Hours To Limit Background Download Bandwidth** - This setting specifies the maximum background download bandwidth. Delivery Optimization uses this bandwidth during and outside business hours across all concurrent download activities as a percentage of available download bandwidth. - - - **DO Set Hours To Limit Foreground Download Bandwidth** - This setting specifies the maximum foreground download bandwidth. Delivery Optimization uses this bandwidth during and outside business hours across all concurrent download activities as a percentage of available download bandwidth. - - - **DO Vpn Keywords** - This policy allows you to set one or more keywords used to recognize VPN connections. - -- **Messaging**: - - - **Allow Message Sync** - This policy setting allows the backup and restore of cellular text messages to Microsoft's cloud services. - -- **Microsoft Defender Antivirus**: - - - **Specify the maximum depth to scan archive files** - - **Specify the maximum size of archive files to be scanned** - -For more information on these settings, see: - -- [Policy CSP - DeliveryOptimization](/windows/client-management/mdm/policy-csp-deliveryoptimization) -- [Policy CSP - Messaging](/windows/client-management/mdm/policy-csp-messaging#allowmessagesync) -- [Policy CSP - ADMX_MicrosoftDefenderAntivirus](/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus) - -Applies to: - -- Windows 10 and later - -#### New archive file scan settings added to Antivirus policy for Windows devices - -We added the following two settings to the *Microsoft Defender Antivirus* profile for [endpoint security Antivirus policy](../protect/endpoint-security-antivirus-policy.md#antivirus-profiles) that apply to Windows 10 and Windows 11 devices: - -- [Specify the maximum depth to scan archive files](/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus?WT.mc_id=Portal-fx#scan_archivemaxdepth) - This setting allows you to configure the maximum directory depth level into which archive files such as .ZIP or .CAB are unpacked during scanning. -- [Specify the maximum size of archive files to be scanned](/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus?WT.mc_id=Portal-fx#scan_archivemaxsize) - This setting allows you to configure the maximum size of archive files such as .ZIP or .CAB that are scanned. The value represents file size in kilobytes (KB). - -With Antivirus policy, you can manage these settings on devices enrolled by Intune and on devices managed through the [Defender for Endpoint security settings management](../protect/mde-security-integration.md) scenario. - -Both settings are also available in the [settings catalog](../configuration/settings-catalog.md) at **Devices** > **Manage devices** > **Configuration** > **Create** > **New policy** > **Windows 10 and later** for platform > **Settings catalog** for profile type > **Defender**. - -Applies to: - -- Windows 10 -- Windows 11 - -#### Updates to assignment filters - -You can use [Intune assignment filters](filters.md) to assign a policy based on rules you create. - -Now, you can: - -- Use managed app assignment filters for Window MAM app protection policies and app configuration policies. -- Filter your existing assignment filters by **Platform**, and by the **Managed apps** or **Managed devices** filter type. When you have many filters, this feature makes it easier to find specific filters you created. - -For more information on these features, see: - -- [Use filters when assigning your apps, policies, and profiles in Microsoft Intune](filters.md) -- [Data protection for Windows MAM](../apps/protect-mam-windows.md) - -This feature applies to: - -- **Managed devices** on the following platforms: - - - Android device administrator - - Android Enterprise - - Android (AOSP) - - iOS/iPadOS - - macOS - - Windows 10/11 - -- **Managed apps** on the following platforms: - - - Android - - iOS/iPadOS - - Windows - -### Device management - -#### New compliance setting lets you verify device integrity using hardware-backed security features - -A new compliance setting called **Check strong integrity using hardware-backed security features** lets you verify device integrity using hardware-backed key attestation. If you configure this setting, strong integrity attestation is added to Google Play's integrity verdict evaluation. Devices must meet device integrity to remain compliant. Microsoft Intune marks devices that don't support this type of integrity check as noncompliant. - -This setting is available in profiles for Android Enterprise fully managed, dedicated, and corporate-owned work profile, under **Device Health** > **Google Play Protect**. It only becomes available when the Play integrity verdict policy in your profile is set to **Check basic integrity** or **Check basic integrity & device integrity**. - -Applies to: - -- Android Enterprise - -For more information, see [Device compliance - Google Play Protect](../protect/compliance-policy-create-android-for-work.md#google-play-protect). - -#### New compliance settings for Android work profile, personal devices - -Now you can add compliance requirements for work profile passwords without impacting device passwords. All new Microsoft Intune settings are available in compliance profiles for Android Enterprise personally owned work profiles under **System Security** > **Work Profile Security**, and include: - -- Require a password to unlock work profile -- Number of days until password expires -- Number of previous passwords to prevent reuse -- Maximum minutes of inactivity before password is required -- Password complexity -- Required password type -- Minimum password length - -If a work profile password fails to meet requirements, Company Portal marks the device as noncompliant. Intune compliance settings take precedence over the respective settings in an Intune device configuration profile. For example, the password complexity in your compliance profile is set to *medium*. The password complexity in a device configuration profile is set to *high*. Intune prioritizes and enforces the compliance policy. - -Applies to: - -- Android Enterprise personally owned devices with a work profile - -For more information, see [Compliance settings - Android Enterprise](../protect/compliance-policy-create-android-for-work.md#personally-owned-work-profile). - -#### Windows quality updates support for expediting non-security updates - -Windows quality updates now support expediting non-security updates for those times when a quality fix needs to be deployed faster than the normal quality update settings. - -Applies to: - -- Windows 11 devices - -For more information about installing an expedited update, see [Expedite Windows quality updates in Microsoft Intune](../protect/windows-10-expedite-updates.md#create-and-assign-an-expedited-quality-update). - -#### Introducing a remote action to pause the config refresh enforcement interval - -In the Windows Settings Catalog, you can configure **Configuration Refresh**. This feature lets you set a cadence for Windows devices to reapply previously received policy settings, without requiring devices to check in to Intune. The device will replay and re-enforce settings based on previously received policy to minimize the chance for configuration drift. - -To support this feature, a remote action is added to allow a pause in action. If an admin needs to make changes or run remediation on a device for troubleshooting or maintenance, they can issue a pause from Intune for a specified period. When the period expires, settings are enforced again. - -The remote action **Pause configuration refresh** can be accessed from the device summary page. - -For more information, see: - -- [Remote actions](../remote-actions/device-management.md) -- [Pause Config Refresh Remote action](../remote-actions/pause-config-refresh.md) - -### Device security - -#### Updated security baseline for Windows version 23H2 - -You can now deploy the Intune security baseline for Windows version 23H2. This new baseline is based on the **version 23H2** of the Group Policy security baseline found in the [Security Compliance Toolkit and Baselines](https://www.microsoft.com/en-us/download/details.aspx?id=55319) from the Microsoft Download Center, and includes only the settings that are applicable to devices managed through Intune. Use of this updated baseline can help you maintain best-practice configurations for your Windows devices. - -This baseline uses the unified settings platform seen in the Settings Catalog. It features an improved user interface and reporting experience, consistency and accuracy improvements related to setting tattooing, and can support assignment filters for profiles. - -Use of [Intune security baselines](../protect/security-baselines.md) can help you rapidly deploy configurations to your Windows devices that meet the security recommendations of the applicable security teams at Microsoft. As with all baselines, the default baseline represents the recommended configurations, which you can modify to meet the requirements of your organization. - -Applies to: - -- Windows 10 -- Windows 11 - -To view the new baselines included settings with their default configurations, see, [Windows MDM security baseline version 23H2](../protect/security-baseline-settings-mdm-all.md?pivots=mdm-23h2). - -#### Use a rootless implementation of Podman to host Microsoft Tunnel - -When prerequisites are met, you can use a rootless Podman container to host a Microsoft Tunnel server. This capability is available when you use [Podman for Red Hat Enterprise Linux (RHEL)](../protect/microsoft-tunnel-prerequisites.md#linux-server) version 8.8 or later, to host Microsoft Tunnel. - -When using a rootless Podman container, the mstunnel services run under a non-privileged service user. This implementation can help limit impact from a container escape. To use a rootless Podman container, you must start the tunnel installation script using a modified command line. - -For more information about this Microsoft Tunnel install option, see [Use a rootless Podman container](../protect/microsoft-tunnel-configure.md#use-a-rootless-podman-container). - -#### Improvements for Intune deployments of Microsoft Defender for Endpoint - -We improved and simplified the experience, workflow, and report details for onboarding devices to Microsoft Defender when using Intune's endpoint detection and response (EDR) policy. These changes apply for Windows devices managed by Intune and by the tenant-attach scenario. These improvements include: - -- Changes to the EDR node, dashboards, and reports to improve the visibility of your Defender EDR deployment numbers. See [About the endpoint detection and response node](../protect/endpoint-security-edr-policy.md#about-the-endpoint-detection-and-response-node). - -- A new tenant-wide option to deploy a preconfigured EDR policy that streamlines the deployment of Defender for Endpoint to applicable Windows devices. See [Use a preconfigured EDR policy](../protect/endpoint-security-edr-policy.md#use-a-preconfigured-edr-policy). - -- Changes to Intune's the Overview page of the endpoint security node. These changes provide a consolidated view of reports for the device signals from Defender for Endpoint on your managed devices. See [Use a preconfigured EDR policy](../protect/endpoint-security-edr-policy.md#use-a-preconfigured-edr-policy). - -These changes apply to the Endpoint security and endpoint detection and response nodes of the admin center, and the following device platforms: - -- Windows 10 -- Windows 11 - -#### Windows quality updates support expediting non-security updates - -Windows quality updates now support expediting non-security updates for those times when a quality fix needs to be deployed faster than the normal quality update settings. - -Applies to: - -- Windows 11 devices - -For more information about installing an expedited update, see [Expedite Windows quality updates in Microsoft Intune](../protect/windows-10-expedite-updates.md#create-and-assign-an-expedited-quality-update). - -### Intune apps - -#### Newly available protected apps for Intune - -The following protected apps are now available for Microsoft Intune: - -- Cerby by Cerby, Inc. -- OfficeMail Go by 9Folders, Inc. -- DealCloud by Intapp, Inc. -- Intapp 2.0 by Intapp, Inc. - -For more information about protected apps, see [Microsoft Intune protected apps](../apps/apps-supported-intune-apps.md). - ## What's new archive diff --git a/memdocs/intune/includes/android-supported-os.md b/memdocs/intune/includes/android-supported-os.md index a8f1701f022..5384b63e40c 100644 --- a/memdocs/intune/includes/android-supported-os.md +++ b/memdocs/intune/includes/android-supported-os.md @@ -4,11 +4,11 @@ ms.author: erikje ms.service: microsoft-intune ms.subservice: fundamentals ms.topic: include -ms.date: 02/01/2022 +ms.date: 10/10/2024 ms.localizationpriority: high --- > [!NOTE] -> Intune requires Android 8.x or higher for device enrollment scenarios and app configuration delivered through Managed devices app configuration policies. This requirement does not apply to [Microsoft Teams Android devices](https://www.microsoft.com/microsoft-teams/across-devices/devices?rtc=2) as these devices will continue to be supported. +> This requirement does not apply to [Microsoft Teams Android devices](https://www.microsoft.com/microsoft-teams/across-devices/devices?rtc=2) as these devices will continue to be supported. > > For Intune app protection policies and app configuration delivered through Managed apps app configuration policies, Intune requires Android 9.0 or higher. \ No newline at end of file diff --git a/memdocs/intune/includes/app-protection-framework-level1.md b/memdocs/intune/includes/app-protection-framework-level1.md index fbb834b6b77..c45f6c059cf 100644 --- a/memdocs/intune/includes/app-protection-framework-level1.md +++ b/memdocs/intune/includes/app-protection-framework-level1.md @@ -59,7 +59,7 @@ The policies in level 1 enforce a reasonable data access level while minimizing | Setting | Setting description | Value / Action | Platform | Notes | |--------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------|---------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | App conditions | Max PIN attempts | 5 / Reset PIN | iOS/iPadOS, Android | | -| App conditions | Offline grace period | 1440 / Block access (minutes) | iOS/iPadOS, Android, Windows | | +| App conditions | Offline grace period | 10080 / Block access (minutes) | iOS/iPadOS, Android, Windows | | | App conditions | Offline grace period | 90 / Wipe data (days) | iOS/iPadOS, Android, Windows | | | Device conditions | Jailbroken/rooted devices | N/A / Block access | iOS/iPadOS, Android | | | Device conditions | SafetyNet device attestation | Basic integrity and certified devices / Block access | Android |

This setting configures Google Play’s device integrity check on end-user devices. Basic integrity validates the integrity of the device. Rooted devices, emulators, virtual devices, and devices with signs of tampering fail basic integrity.

Basic integrity and certified devices validates the compatibility of the device with Google's services. Only unmodified devices that have been certified by Google can pass this check.

| diff --git a/memdocs/intune/includes/app-protection-framework-level2.md b/memdocs/intune/includes/app-protection-framework-level2.md index 85bf9eb0df5..4bf218ae1d3 100644 --- a/memdocs/intune/includes/app-protection-framework-level2.md +++ b/memdocs/intune/includes/app-protection-framework-level2.md @@ -45,7 +45,7 @@ Level 2 is the data protection configuration recommended as a standard for devic | Device conditions | Required SafetyNet evaluation type | Hardware-backed key | Android | Hardware backed attestation enhances the existing Google's Play Integrity service check by applying a new evaluation type called [Hardware Backed](https://developer.android.com/training/safetynet/attestation#evaluation-types), providing a more robust root detection in response to newer types of rooting tools and methods that can't always be reliably detected by a software only solution.

As its name implies, hardware backed attestation uses a hardware-based component, which shipped with devices installed with Android 8.1 and later. Devices that were upgraded from an older version of Android to Android 8.1 are unlikely to have the hardware-based components necessary for hardware backed attestation. While this setting should be widely supported starting with devices that shipped with Android 8.1, Microsoft strongly recommends testing devices individually before enabling this policy setting broadly.

| | Device conditions | Require device lock | Medium/Block Access | Android | This setting ensures that Android devices have a device password that meets the minimum password requirements. | | Device conditions | Samsung Knox device attestation | Block Access | Android | Microsoft recommends configuring the **Samsung Knox device attestation** setting to **Block access** to ensure the user account is blocked from access if the device doesn't meet Samsung's Knox hardware-based verification of device health. This setting verifies all Intune MAM client responses to the Intune service were sent from a healthy device.

This setting applies to all devices targeted. To apply this setting only to Samsung devices, you can use "Managed apps" assignment filters. For more information on assignment filters, see [Use filters when assigning your apps, policies, and profiles in Microsoft Intune](/mem/intune/fundamentals/filters).| -| App conditions | Offline grace period | 21 / Wipe data (days) | Windows | | +| App conditions | Offline grace period | 30 / Wipe data (days) | iOS/iPadOS, Android, Windows | | > [!NOTE] -> Windows conditional launch settings are labeled as **Health Checks**. \ No newline at end of file +> Windows conditional launch settings are labeled as **Health Checks**. diff --git a/memdocs/intune/includes/app-protection-framework-level3.md b/memdocs/intune/includes/app-protection-framework-level3.md index b4d565cb69a..ed0dc76c4bb 100644 --- a/memdocs/intune/includes/app-protection-framework-level3.md +++ b/memdocs/intune/includes/app-protection-framework-level3.md @@ -53,4 +53,5 @@ Level 3 is the data protection configuration recommended as a standard for organ | Device conditions | Max OS version | *Format: Major.Minor.Build
Example: 15.0* / Block access | iOS/iPadOS | Microsoft recommends configuring the maximum iOS/iPadOS major version to ensure beta or unsupported versions of the operating system aren't used. See [Apple security updates](https://support.apple.com/en-us/HT201222) for Apple's latest recommendations | | Device conditions | Max OS version | *Format: Major.Minor
Example: 22631.* / Block access | Windows | Microsoft recommends configuring the maximum Windows major version to ensure beta or unsupported versions of the operating system aren't used. | | Device conditions | Samsung Knox device attestation | Wipe data | Android | Microsoft recommends configuring the **Samsung Knox device attestation** setting to **Wipe data** to ensure the org data is removed if the device doesn't meet Samsung's Knox hardware-based verification of device health. This setting verifies all Intune MAM client responses to the Intune service were sent from a healthy device.

This setting will apply to all devices targeted. To apply this setting only to Samsung devices, you can use "Managed apps" assignment filters. For more information on assignment filters, see [Use filters when assigning your apps, policies, and profiles in Microsoft Intune](/mem/intune/fundamentals/filters).| +| App conditions | Offline grace period | 30 / Block access (days) | iOS/iPadOS, Android, Windows | | diff --git a/memdocs/intune/includes/intune-notices.md b/memdocs/intune/includes/intune-notices.md index 8623c80e37b..ef1daca0e81 100644 --- a/memdocs/intune/includes/intune-notices.md +++ b/memdocs/intune/includes/intune-notices.md @@ -12,6 +12,33 @@ ms.custom: include file These notices provide important information that can help you prepare for future Intune changes and features. +### Take Action: Update to the latest Intune App SDK for iOS and Intune App Wrapping Tool for iOS + +To support the upcoming release of iOS/iPadOS 18.1, update to the latest versions of the Intune App SDK and the Intune App Wrapping Tool to ensure applications stay secure and run smoothly. **Important:** If you don't update to the latest versions, some app protection policies may not apply to your app in certain scenarios. Review the following GitHub announcements for more details on the specific impact: + +- SDK for iOS: [Update recommended prior to iOS 18.1 general availability - microsoftconnect/ms-intune-app-sdk-ios - Discussion #477](https://github.com/microsoftconnect/ms-intune-app-sdk-ios/discussions/477) +- Wrapper for iOS: [Update recommended prior to iOS 18.1 general availability - microsoftconnect/intune-app-wrapping-tool-ios - Discussion #125](https://github.com/microsoftconnect/intune-app-wrapping-tool-ios/discussions/125) + +As a best practice, always update your iOS apps to the latest App SDK or App Wrapping Tool to ensure that your app continues to run smoothly. + +#### How does this affect you or your users? + +If you have applications using the Intune App SDK or Intune App Wrapping Tool, you'll need to update to the latest version to support iOS 18.1. + +#### How can you prepare? + +For apps running on iOS 18.1, you must update to the new version of the Intune App SDK for iOS + +- For apps built with XCode 15 use v19.7.1 - [Release 19.7.1 - microsoftconnect/ms-intune-app-sdk-ios - GitHub](https://github.com/microsoftconnect/ms-intune-app-sdk-ios/releases/tag/19.7.1) +- For apps built with XCode 16 use v20.1.2 - [Release 20.1.2 - microsoftconnect/ms-intune-app-sdk-ios - GitHub](https://github.com/microsoftconnect/ms-intune-app-sdk-ios/releases/tag/20.1.2) + +For apps running on iOS 18.1, you must update to the new version of the Intune App Wrapping Tool for iOS + +- For apps built with XCode 15 use v19.7.1 - [Release 19.7.1 - microsoftconnect/intune-app-wrapping-tool-ios - GitHub](https://github.com/microsoftconnect/intune-app-wrapping-tool-ios/releases/tag/19.7.1) +- For apps built with XCode 16 use v20.1.2 - [Release 20.1.2 - microsoftconnect/intune-app-wrapping-tool-ios - GitHub](https://github.com/microsoftconnect/intune-app-wrapping-tool-ios/releases/tag/20.1.2) + +Notify your users as applicable, to ensure they upgrade their apps to the latest version prior to upgrading to iOS 18.1. You can review the Intune App SDK version in use by your users in the Microsoft Intune admin center by navigating to **Apps** > **Monitor** > **App protection status**, then review “Platform version” and “iOS SDK version”. + ### Take Action: Enable multifactor authentication for your tenant before October 15, 2024 Starting on or after October 15, 2024, to further increase security, Microsoft will require admins to use multi-factor authentication (MFA) when signing into the Microsoft Azure portal, Microsoft Entra admin center, and Microsoft Intune admin center. To take advantage of the extra layer of protection MFA offers, we recommend enabling MFA as soon as possible. To learn more, review [Planning for mandatory multifactor authentication for Azure and admin portals](https://aka.ms/mfaforazure). @@ -33,13 +60,13 @@ For more information, refer to: [Planning for mandatory multifactor authenticati ### Plan for Change: Intune is moving to support iOS/iPadOS 16 and later -Later this year, we expect iOS 18 and iPadOS 18 to be released by Apple. Microsoft Intune, including the Intune Company Portal and Intune app protection policies (APP, also known as MAM), will require [iOS 16/iPadOS 16 and higher](../fundamentals/supported-devices-browsers.md) shortly after the iOS/iPadOS 18 release. +Later this year, we expect iOS 18 and iPadOS 18 to be released by Apple. Microsoft Intune, including the Intune Company Portal and Intune app protection policies (APP, also known as MAM), will require [iOS 16/iPadOS 16 and higher](../fundamentals/supported-devices-browsers.md) shortly after the iOS/iPadOS 18 release. #### How does this affect you or your users? -If you're managing iOS/iPadOS devices, you might have devices that won't be able to upgrade to the minimum supported version (iOS 16/iPadOS 16). +If you're managing iOS/iPadOS devices, you might have devices that won't be able to upgrade to the minimum supported version (iOS 16/iPadOS 16). -Given that Microsoft 365 mobile apps are supported on iOS 16/iPadOS 16 and higher, this may not affect you. You've likely already upgraded your OS or devices. +Given that Microsoft 365 mobile apps are supported on iOS 16/iPadOS 16 and higher, this may not affect you. You've likely already upgraded your OS or devices. To check which devices support iOS 16 or iPadOS 16 (if applicable), see the following Apple documentation: @@ -51,7 +78,7 @@ To check which devices support iOS 16 or iPadOS 16 (if applicable), see the foll #### How can you prepare? -Check your Intune reporting to see what devices or users might be affected. For devices with mobile device management (MDM), go to **Devices** > **All devices** and filter by OS. For devices with app protection policies, go to **Apps** > **Monitor** > **App protection status** and use the *Platform* and *Platform version* columns to filter. +Check your Intune reporting to see what devices or users might be affected. For devices with mobile device management (MDM), go to **Devices** > **All devices** and filter by OS. For devices with app protection policies, go to **Apps** > **Monitor** > **App protection status** and use the *Platform* and *Platform version* columns to filter. To manage the supported OS version in your organization, you can use Microsoft Intune controls for both MDM and APP. For more information, see [Manage operating system versions with Intune](../fundamentals/manage-os-versions.md). @@ -70,69 +97,20 @@ This change only affects you if you currently manage, or plan to manage, macOS d Check your Intune reporting to see what devices or users might be affected. Go to **Devices** > **All devices** and filter by macOS. You can add more columns to help identify who in your organization has devices running macOS 12.x or earlier. Ask your users to upgrade their devices to a supported OS version. -### Plan for Change: Update to Intune endpoint for Remote Help - -Starting on May 30, 2024, or soon after, to improve the experience for Remote Help on Windows, Web, and macOS, we're updating the primary network endpoint for Remote Help from https://remoteassistance.support.services.microsoft.com to https://remotehelp.microsoft.com. - -#### How does this affect you or your users? - -If you're using Remote Help and you have firewall rules that don't permit the new endpoint https://remotehelp.microsoft.com, admins and users may experience connectivity issues or disruptions with Remote Help. - -Additionally, the Remote Help app on Windows will need to be updated to the newest version. No action is needed for the Remote Help app for macOS and the Remote Help Web app. - -#### How can you prepare? - -Update your firewall rules to include the new Remote Help endpoint: https://remotehelp.microsoft.com. For Remote Help on Windows, users will need to update to the [newest version (5.1.124.0)](../fundamentals/remote-help-windows.md#march-13-2024). Most users have opted in for automatic updates and will be updated automatically without any action from the user. To learn more, review [Install and update Remote Help for Windows](../fundamentals/remote-help-windows.md#install-and-update-remote-help). - -#### Additional information: - -- [Remote Help on Windows with Microsoft Intune](../fundamentals/remote-help-windows.md) -- [Network endpoints for Microsoft Intune | Microsoft Learn](../fundamentals/intune-endpoints.md#remote-help) - -### Update to the latest Company Portal for Android, Intune App SDK for iOS, and Intune App Wrapper for iOS - -Starting **June 1, 2024**, we're making updates to improve the Intune mobile application management (MAM) service. This update will require iOS wrapped apps, iOS SDK integrated apps, and the Company Portal for Android to be updated to the latest versions to ensure applications stay secure and run smoothly. - -> [!IMPORTANT] -> If you don't update to the latest versions, users will be blocked from launching your app. -> -> Ahead of this change, for Microsoft apps that need to be updated, when a user opens the app, they'll receive a blocking message to update the app. - -Note that the way Android updates, once one Microsoft application with the updated SDK is on the device and the Company Portal is updated to the latest version, Android apps will update. So, this message is focused on iOS SDK/app wrapper updates. We recommend always updating your Android and iOS apps to the latest SDK or app wrapper to ensure that your app continues to run smoothly. - -#### How does this affect you or your users? -If your users haven't updated to the latest Microsoft or third-party app protection supported apps, they'll be blocked from launching their apps. If you have iOS line-of-business (LOB) applications that are using the Intune wrapper or Intune SDK, you must be on Wrapper/SDK version 17.7.0 or later to avoid your users being blocked. - -#### How can you prepare? -Plan to make the changes below before **June 1, 2024**: - -* Any of your iOS line-of-business (LOB) apps using older versions of the Intune SDK or wrapper must be updated to v17.7.0 or later. - * For apps using the Intune iOS SDK, use [Release 19.2.0 · msintuneappsdk/ms-intune-app-sdk-ios (github.com)](https://github.com/msintuneappsdk/ms-intune-app-sdk-ios/releases/tag/19.2.0) - * For apps using the Intune iOS wrapper, use [Release 19.2.0 · msintuneappsdk/intune-app-wrapping-tool-ios (github.com)](https://github.com/msintuneappsdk/intune-app-wrapping-tool-ios/releases/tag/19.2.0) -* For tenants with policies targeted to iOS apps: - * Notify your users that they need to upgrade to the latest version of the Microsoft apps. You can find the latest version of the apps in the [App store](https://www.apple.com/app-store/). For example, you can find the latest version of Microsoft Teams [here](https://apps.apple.com/app/microsoft-teams/id1113153706) and Microsoft Outlook [here](https://apps.apple.com/app/microsoft-outlook/id951937596). - * Additionally, you have the option to enable the following [conditional launch](../apps/app-protection-policy-settings-ios.md#conditional-launch) settings: - * The **Min OS version** setting to warn users using iOS 15 or older so that they can download the latest apps. - * The **Min SDK version** setting to block users if the app is using Intune SDK for iOS older than 17.7.0. - * The **Min app version** setting to warn users on older Microsoft apps. Note that this setting must be in a policy targeted to only the targeted app. -* For tenants with policies targeted to Android apps: - * Notify your users that they need to upgrade to the latest version (v5.0.6198.0) of the [Company Portal](https://play.google.com/store/apps/details?id=com.microsoft.windowsintune.companyportal) app. - * Additionally, you have the option to enable the following [conditional launch](../apps/app-protection-policy-settings-ios.md#conditional-launch) device condition setting: - * The **Min Company Portal version** setting to warn users using a Company Portal app version older than 5.0.6198.0. - ### Plan for Change: Ending support for Intune App SDK Xamarin Bindings in May 2024 + With the [end of support for Xamarin Bindings](https://dotnet.microsoft.com/platform/support/policy/xamarin), Intune will end support for Xamarin apps and the Intune App SDK Xamarin Bindings beginning on **May 1, 2024**. #### How does this affect you or your users? -If you you have iOS and/or Android apps built with Xamarin and are using the Intune App SDK Xamarin Bindings to enable app protection policies, upgrade your apps to .NET MAUI. +If you have iOS and/or Android apps built with Xamarin and are using the Intune App SDK Xamarin Bindings to enable app protection policies, upgrade your apps to .NET MAUI. #### How can you prepare? -Upgrade your Xamarin based apps to .NET MAUI. Review the following documentation for more information on Xamarin support and upgrading your apps: +Upgrade your Xamarin based apps to .NET MAUI. Review the following documentation for more information on Xamarin support and upgrading your apps: - [Xamarin Support Policy | .NET](https://dotnet.microsoft.com/platform/support/policy/xamarin) -- [Upgrade from Xamarin to .NET | Microsoft Lear](/dotnet/maui/migration/?view=net-maui-8.0) +- [Upgrade from Xamarin to .NET | Microsoft Lear](/dotnet/maui/migration/?view=net-maui-8.0&preserve-view=true) - [Microsoft Intune App SDK for .NET MAUI – Android | NuGet Gallery](https://www.nuget.org/packages/Microsoft.Intune.Maui.Essentials.android) - [Microsoft Intune App SDK for .NET MAUI – iOS | NuGet Gallery](https://www.nuget.org/packages/Microsoft.Intune.Maui.Essentials.iOS) @@ -156,6 +134,7 @@ For detailed step-by-step instructions visit [powershell-intune-samples/Updating ### Intune moving to support Android 10 and later for user-based management methods in October 2024 In October 2024, Intune will be moving to support Android 10 and later for user-based management methods, which includes: + - Android Enterprise personally-owned work profile - Android Enterprise corporate owned work profile - Android Enterprise fully managed @@ -175,7 +154,7 @@ For user-based management methods (as listed above), Android devices running And - Intune technical support won't be provided. - Intune won't make changes to address bugs or issues. -- New and existing features aren't guaranteed to work. +- New and existing features aren't guaranteed to work. While Intune won't prevent enrollment or management of devices on unsupported Android OS versions, functionality isn't guaranteed, and use isn't recommended. @@ -192,7 +171,7 @@ For more information, review: [Manage operating system versions with Microsoft I ### Plan for Change: Web based device enrollment will become default method for iOS/iPadOS device enrollment Today, when creating iOS/iPadOS enrollment profiles, “Device enrollment with Company Portal” is shown as the default method. In an upcoming service release, the default method will change to “Web based device enrollment” during profile creation. Additionally for *new* tenants, if no enrollment profile is created, the user will enroll using web-based device enrollment. - + > [!NOTE] > For web enrollment, you will need to deploy the single sign-on (SSO) extension policy to enable just in time (JIT) registration, for more information review: [Set up just in time registration in Microsoft Intune](../enrollment/set-up-just-in-time-registration.md). @@ -209,34 +188,6 @@ Update your documentation and user guidance as needed. If you currently use devi - [Set up just in time registration in Microsoft Intune](../enrollment/set-up-just-in-time-registration.md) - [Set up web based device enrollment for iOS](../enrollment/web-based-device-enrollment-ios.md) -### Wrapped iOS apps and iOS apps using the Intune App SDK will require Azure AD app registration - -We're making updates to improve the security of the Intune mobile application management (MAM) service. This update will require iOS wrapped apps and SDK integrated apps to be [registered with Microsoft Entra ID](/entra/identity-platform/quickstart-register-app) (formerly Azure Active Directory (Azure AD)) by March 31, 2024 to continue receiving MAM policy. - -#### How does this affect you or your users? - -If you have wrapped apps or SDK integrated apps that aren't registered with Azure AD, these apps will be unable to connect to the MAM service to receive policy and your users won't be able to access apps that aren't registered. - -#### How can you prepare? - -Prior to this change, you will need to register the apps with Azure AD. See below for detailed instructions. - -1. Register your apps with Azure AD by following these instructions: [Register an application with the Microsoft identity platform](/entra/identity-platform/quickstart-register-app). -1. Add the custom redirect URL to your app settings as documented [here](https://github.com/AzureAD/microsoft-authentication-library-for-objc#configuring-msal). -1. Give your app access to the Intune MAM service, for instructions see [here](../developer/app-sdk-get-started.md#give-your-app-access-to-the-intune-mobile-app-management-service). -1. Once the above changes are completed, configure your apps for Microsoft Authentication Library (MSAL): - 1. For wrapped apps: Add the Azure AD application client ID into the command-line parameters with the Intune App Wrapping Tool as outlined in the documentation: [Wrap iOS apps with the Intune App Wrapping Tool | Microsoft Learn](../developer/app-wrapper-prepare-ios.md#command-line-parameters) -ac and -ar are required parameters. Each app will need a unique set of these parameters. -aa is only required for single tenant applications. - 1. For SDK integrated apps see, [Microsoft Intune App SDK for iOS developer guide | Microsoft Learn](../developer/app-sdk-ios-phase2.md#configure-msal-settings-for-the-intune-app-sdk). ADALClientId and ADALRedirectUri/ADALRedirectScheme are now required parameters. ADALAuthority is only required for single tenant applications. -1. Deploy the app. -1. To validate the above steps: - 1. Target "com.microsoft.intune.mam.IntuneMAMOnly.RequireAADRegistration" application configuration policy and set it to Enabled - [Configuration policies for Intune App SDK managed apps - Microsoft Intune | Microsoft Learn](../apps/app-configuration-policies-managed-app.md) - 1. Target App Protection Policy to the application. Enable the ['Work or school account credentials for access' policy](../apps/app-protection-policy-settings-ios.md#access-requirements) and set 'Recheck the access requirements after (minutes of inactivity)' setting to a low number like 1. -1. Then launch the application on a device and verify if the sign-in (which should be required every minute on app launch) happens successfully with the configured parameters. -1. Note that if you only do step #6 and #7 before doing the other steps, you might be blocked on application launch. You will also notice the same behavior if some of the parameters are incorrect. -1. Once you’ve completed the validation steps, you can undo the changes made in step #6. -> [!NOTE] -> Intune will soon require an Azure AD device registration for iOS devices using MAM. If you have Conditional Access policies enabled, your devices should already be registered, and you won't notice any change. For more information see, [Microsoft Entra registered devices - Microsoft Entra | Microsoft Learn](/entra/identity/devices/concept-device-registration). - ### Plan for Change: Transition Jamf macOS devices from Conditional Access to Device Compliance We've been working with Jamf on a migration plan to help customers transition macOS devices from Jamf Pro’s Conditional Access integration to their Device Compliance integration. The Device Compliance integration uses the newer Intune partner compliance management API, which involves a simpler setup than the partner device management API and brings macOS devices onto the same API as iOS devices managed by Jamf Pro. The platform Jamf Pro’s Conditional Access feature is built on will no longer be supported after September 1, 2024. @@ -248,30 +199,25 @@ Note that customers in some environments cannot be transitioned initially, for m If you're using Jamf Pro’s Conditional Access integration for macOS devices, follow Jamf’s documented guidelines to migrate your devices to Device Compliance integration: [Migrating from macOS Conditional Access to macOS Device Compliance – Jamf Pro Documentation](https://learn.jamf.com/bundle/jamf-pro-documentation-current/page/Conditional_Access.html#ariaid-title6). After the Device Compliance integration is complete, some users might see a one-time prompt to enter their Microsoft credentials. - + #### How can you prepare? If applicable, follow the instructions provided by Jamf to migrate your macOS devices. If you need help, contact Jamf Customer Success. For more information and the latest updates, read the blog post: [Support tip: Transitioning Jamf macOS devices from Conditional Access to Device Compliance](https://techcommunity.microsoft.com/t5/intune-customer-success/support-tip-transitioning-jamf-macos-devices-from-conditional/ba-p/3913059). -### Update to the latest Intune App SDK and Intune App Wrapper for iOS to support iOS/iPadOS 17 - -To support the upcoming release of iOS/iPadOS 17, update to the latest versions of the Intune App SDK and the App Wrapping Tool for iOS to ensure applications stay secure and run smoothly. Additionally, for organizations using the Conditional Access grant “Require app protection policy”, users should update their apps to the latest version prior to upgrading to iOS 17. You can learn more by reading the blog: [Update Intune App SDK, Wrapper, and iOS apps using MAM policies to support iOS/iPadOS 17](https://techcommunity.microsoft.com/t5/intune-customer-success/update-intune-app-sdk-wrapper-and-ios-apps-using-mam-policies-to/ba-p/3926732). - ### Plan for Change: Intune ending support for Android device administrator on devices with GMS access in December 2024 [Google has deprecated](https://blog.google/products/android-enterprise/da-migration/) Android device administrator management, continues to remove management capabilities, and no longer provides fixes or improvements. Due to these changes, Intune will be ending support for Android device administrator management on devices with access to Google Mobile Services (GMS) beginning **December 31, 2024**. Until that time, we support device administrator management on devices running Android 14 and earlier. For more details, read the blog: [Microsoft Intune ending support for Android device administrator on devices with GMS access](https://aka.ms/Intune-Android-DA-blog). #### How does this affect you or your users? -After Intune ends support for Android device administrator, devices with access to GMS will be impacted in the following ways: +After Intune ends support for Android device administrator, devices with access to GMS will be impacted in the following ways: -1. Users won't be able to enroll devices with Android device administrator. -2. Intune won't make changes or updates to Android device administrator management, such as bug fixes, security fixes, or fixes to address changes in new Android versions. -3. Intune technical support will no longer support these devices. +1. Intune won't make changes or updates to Android device administrator management, such as bug fixes, security fixes, or fixes to address changes in new Android versions. +2. Intune technical support will no longer support these devices. #### How can you prepare? -Stop enrolling devices into Android device administrator and migrate impacted devices to other management methods. You can check your Intune reporting to see which devices or users might be affected. Go to **Devices** > **All devices** and filter the OS column to **Android (device administrator)** to see the list of devices. +Stop enrolling devices into Android device administrator and migrate impacted devices to other management methods. You can check your Intune reporting to see which devices or users might be affected. Go to **Devices** > **All devices** and filter the OS column to **Android (device administrator)** to see the list of devices. Read the blog, [Microsoft Intune ending support for Android device administrator on devices with GMS access](https://aka.ms/Intune-Android-DA-blog), for our recommended alternative Android device management methods and information about the impact to devices without access to GMS. @@ -313,27 +259,3 @@ If you have enabled WIP policies, you should turn off or disable these policies. ### How can you prepare? We recommend disabling WIP to ensure users in your organization do not lose access to documents that have been protected by WIP policy. Read the blog [Support tip: End of support guidance for Windows Information Protection](https://aka.ms/Intune-WIP-support) for more details and options for removing WIP from your devices. - -### Plan for change: Intune is ending Company Portal support for unsupported versions of Windows - -Intune follows the Windows 10 lifecycle for supported Windows 10 versions. We're now removing support for the associated Windows 10 Company Portals for Windows versions that are out of the Modern Support policy. - -#### How does this affect you or your users? - -Because Microsoft no longer supports these operating systems, this change might not affect you. You've likely already upgraded your OS or devices. This change only affects you if you're still managing unsupported Windows 10 versions. - -Windows and Company Portal versions that this change affects include: - -- Windows 10 version 1507, Company Portal version 10.1.721.0 -- Windows 10 version 1511, Company Portal version 10.1.1731.0 -- Windows 10 version 1607, Company Portal version 10.3.5601.0 -- Windows 10 version 1703, Company Portal version 10.3.5601.0 -- Windows 10 version 1709, any Company Portal version - -We won't uninstall these Company Portal versions, but we will remove them from the Microsoft Store and stop testing our service releases with them. - -If you continue to use an unsupported version of Windows 10, your users won't get the latest security updates, new features, bug fixes, latency improvements, accessibility improvements, and performance investments. You won't be able to co-manage users by using System Center Configuration Manager and Intune. - -#### How can you prepare? - -In the Microsoft Intune admin center, use the [discovered apps](../apps/app-discovered-apps.md) feature to find apps with these versions. On a user's device, the Company Portal version is shown on the **Settings** page of the Company Portal. Update to a supported Windows and Company Portal version. diff --git a/memdocs/intune/includes/mdm-supported-devices.md b/memdocs/intune/includes/mdm-supported-devices.md index 9e124761d4a..f0e4df39afe 100644 --- a/memdocs/intune/includes/mdm-supported-devices.md +++ b/memdocs/intune/includes/mdm-supported-devices.md @@ -4,7 +4,7 @@ ms.author: erikje ms.service: microsoft-intune ms.subservice: fundamentals ms.topic: include -ms.date: 04/24/2024 +ms.date: 10/10/2024 ms.localizationpriority: high --- @@ -12,26 +12,27 @@ ms.localizationpriority: high - **User assigned devices** - devices enrolled with user affinity using Automated Device Enrollment or personally enrolled devices. - iOS/iPadOS 15.x and later - - macOS 12.0 and later + - macOS 13.0 and later - **User-less devices** - devices enrolled without user affinity using Automated Device Enrollment or Apple Configurator. - Supported: - - iOS/iPadOS 15.x and later - - macOS 12.0 and later + - iOS/iPadOS 16.x and later + - macOS 13.0 and later - Allowed to enroll: - - iOS/iPadOS 12.x and later + - iOS/iPadOS 13.x and later - macOS 10.14 and later > [!NOTE] > **Supported** versions include devices running the three most recent operating system versions. These devices can enroll and take advantage of all Intune functionality that is applicable, and all new eligible features will work on these devices. > -> **Allowed** versions includes devices running a non-supported version (within three versions of the supported versions). These devices can enroll and take advantage of Intune's eligible features but there is no guarantee that they will work as expected. +> **Allowed** versions includes devices running a non-supported version (within three versions of the supported versions). These devices can enroll and take advantage of Intune's eligible features but there is no guarantee that they will work as expected. > > Intune requires iOS 15.x or later for app protection policies and app configuration. ### Android -- Android 8.0 and later (including Samsung KNOX Standard 3.0 and higher: [requirements](https://www.samsungknox.com/en/knox-platform/supported-devices/2.4+)) -- Android enterprise: [requirements](https://support.google.com/work/android/topic/9428066) +- For user-based management methods: Android 10.0 and later +- For userless management methods: Android 8.0 and later (including Samsung KNOX Standard 3.0 and higher: [requirements](https://www.samsungknox.com/en/knox-platform/supported-devices/2.4+)) +- Android enterprise - Android open source project device: [See here for the list of supported devices](../fundamentals/android-os-project-supported-devices.md) [!INCLUDE [android-supported-os](android-supported-os.md)] diff --git a/memdocs/intune/includes/mfa-console.md b/memdocs/intune/includes/mfa-console.md new file mode 100644 index 00000000000..2f07f60742e --- /dev/null +++ b/memdocs/intune/includes/mfa-console.md @@ -0,0 +1,28 @@ +--- +title: include file +description: include file +author: brenduns +ms.service: microsoft-intune +ms.topic: include +ms.date: 10/02/2024 +ms.author: dougeby +ms.custom: include file +ms.collection: +- tier2 +- M365-identity-device-management +--- + +> [!IMPORTANT] +> +> On October 15, 2024, Microsoft begins enforcement of the Azure sign-in requirement to use multi-factor authentication (MFA). When enforced, MFA must be used by all users who sign-in to Intune admin center regardless of any roles they have or don’t have. The MFA requirements also apply to services that are accessed through the admin center, like Windows 365 Cloud PC, and to use of the Microsoft Azure portal and Microsoft Entra admin center. MFA requirements don’t apply to end users who access applications, websites, or services hosted on Azure where those users don’t sign-in to the admin center. +> +> The requirement to sign-in using MFA applies to all Intune subscriptions, including Plan 1 subscriptions with or without add-ons, and free trial subscriptions. The prerequisites and process required to configure MFA depend on the MFA method you choose to use for your tenant. Shortly after MFA is enabled for a tenant, subsequent sign-in attemps will require the user to complete setup for using the configured MFA solution. +> +> To learn more about the MFA requirement, see [Planning for mandatory multifactor authentication for Azure and admin portals](/entra/identity/authentication/concept-mandatory-multifactor-authentication) in the Entra documentation. +> +> In the Entra planning article you’ll also find guidance and resources to help you [Prepare for multifactor authentication](/entra/identity/authentication/concept-mandatory-multifactor-authentication#prepare-for-multifactor-authentication), including methods to configure MFA including but not limited to: +> +> - Conditional Access policies +> - The *MFA Wizard for Microsoft Entra ID* from the Microsoft 365 admin center +> - Entra ID *security defaults* +> \ No newline at end of file diff --git a/memdocs/intune/industry/education/introduction-intune-education.md b/memdocs/intune/industry/education/introduction-intune-education.md index 569e04c66b6..1dd15dbdea8 100644 --- a/memdocs/intune/industry/education/introduction-intune-education.md +++ b/memdocs/intune/industry/education/introduction-intune-education.md @@ -51,7 +51,7 @@ For more information about Intune for Education, see [Overview of Intune for Edu ## Next steps -* Ensure your organization meets [Microsoft Intune technical requirements and capabilities](/intune/supported-devices-browsers). +* Ensure your organization meets [Microsoft Intune technical requirements and capabilities](/mem/intune/fundamentals/supported-devices-browsers). * Try Microsoft Intune [with a 90 day free trial](https://signup.microsoft.com/Signup?OfferId=5eec053c-cc40-4cd5-a06a-ea8d75cf2686&ali=1). * Sign in to [Intune for Education](https://intuneeducation.portal.azure.com) with your admin account. * [Learn about express configuration](/intune-education/what-is-express-configuration) to get started in Intune for Education. diff --git a/memdocs/intune/industry/education/tutorial-school-deployment/common-config-ipads-ai.md b/memdocs/intune/industry/education/tutorial-school-deployment/common-config-ipads-ai.md new file mode 100644 index 00000000000..471b12382f2 --- /dev/null +++ b/memdocs/intune/industry/education/tutorial-school-deployment/common-config-ipads-ai.md @@ -0,0 +1,52 @@ +--- +title: Common Education iPads Apple Intelligence configuration +description: Learn about common iPads Apple Intelligence configuration used by Education organizations in Intune. +ms.date: 10/16/2024 +ms.topic: tutorial +author: yegor-a +ms.author: egorabr +ms.manager: dougeby +no-loc: [Microsoft, Apple] +ms.collection: +- graph-interactive +--- + +# Apple Intelligence + +This article summarizes restrictions for Apple Intelligence introduced in iPadOS 18. + +To learn more, see: + +- [Use the settings catalog to configure settings on Windows, iOS/iPadOS and macOS devices](/mem/intune/configuration/settings-catalog) +- [Restrictions payload](https://developer.apple.com/documentation/devicemanagement/restrictions) +- [iPadOS 18](https://www.apple.com/ipados/ipados-18) + +> [!TIP] +> When creating a settings catalog profile in the Microsoft Intune admin center, you can copy a policy name from this article and paste it into the settings picker search field to find the desired policy. + +## [**Settings**](#tab/settings) + +| **Category** | **Property** | **Value** | **Notes** | **Payload property** | +|---|---|:---:|---|---| +| Restrictions | **:::no-loc text="Allow Genmoji":::** | False | Prohibits creating new Genmoji. | [:::no-loc text="allowGenmoji":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Allow Image Playground":::** | False | Prohibits the use of image generation. | [:::no-loc text="allowImagePlayground":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Allow Image Wand":::** | False | Prohibits the use of Image Wand. | [:::no-loc text="allowImageWand":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Allow Personalized Handwriting Results":::** | False | | [:::no-loc text="allowPersonalizedHandwritingResults":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Allow Writing Tool":::** | False | Disables Apple Intelligence writing tools. | [:::no-loc text="allowWritingTools":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | + +## [:::image type="icon" source="../../../media/icons/graph.svg"::: **Create policy using Graph Explorer**](#tab/graph) + +[!INCLUDE [graph-explorer-introduction](../../../includes/graph-explorer-intro.md)] + +This will create a policy in your tenant with the name **_MSLearn_Example_CommonEDU - iPads - Appple Intelligence**. + +```msgraph-interactive +POST https://graph.microsoft.com/beta/deviceManagement/configurationPolicies +Content-Type: application/json + +{"name":"_MSLearn_Example_CommonEDU - iPads - Apple Intelligence","description":"","platforms":"iOS","technologies":"mdm,appleRemoteManagement","roleScopeTagIds":["0"],"settings":[{"@odata.type":"#microsoft.graph.deviceManagementConfigurationSetting","settingInstance":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationGroupSettingCollectionInstance","settingDefinitionId":"com.apple.applicationaccess_com.apple.applicationaccess","groupSettingCollectionValue":[{"children":[{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowgenmoji","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowgenmoji_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowimageplayground","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowimageplayground_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowimagewand","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowimagewand_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowpersonalizedhandwritingresults","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowpersonalizedhandwritingresults_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowwritingtools","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowwritingtools_false","children":[]}}]}]}}]} +``` + +[!INCLUDE [graph-explorer-steps](../../../includes/graph-explorer-steps.md)] + +--- diff --git a/memdocs/intune/industry/education/tutorial-school-deployment/common-config-ipads-device-restrictions.md b/memdocs/intune/industry/education/tutorial-school-deployment/common-config-ipads-device-restrictions.md new file mode 100644 index 00000000000..15dde916548 --- /dev/null +++ b/memdocs/intune/industry/education/tutorial-school-deployment/common-config-ipads-device-restrictions.md @@ -0,0 +1,145 @@ +--- +title: Common Education iPads restrictions configuration +description: Learn about common iPads restrictions configuration used by Education organizations in Intune. +ms.date: 10/16/2024 +ms.topic: tutorial +author: yegor-a +ms.author: egorabr +ms.manager: dougeby +no-loc: [Microsoft, Apple] +ms.collection: +- graph-interactive +--- + +# Common Education iPad device restrictions + +This article summarizes the configurations that are most commonly used for student and teacher iPads in educational organizations. + +To learn more, see: + +- [Use the settings catalog to configure settings on Windows, iOS/iPadOS, and macOS devices](/mem/intune/configuration/settings-catalog) +- [Configure and secure devices with Microsoft Intune](/mem/intune/industry/education/tutorial-school-deployment/configure-device-settings) +- [Review MDM payloads for Apple devices](https://support.apple.com/guide/deployment/review-mdm-payloads-dep5370d089/web) +- [MDM payload list for iPhone and iPad devices](https://support.apple.com/guide/deployment/payload-list-for-iphone-and-ipad-depdca795ebd/1/web/1.0) + +> [!TIP] +> When creating a settings catalog profile in the Microsoft Intune admin center, you can copy a policy name from this article and paste it into the settings picker search field to find the desired policy. + +## General restrictions + +### [**Settings**](#tab/settings) + +| **Category** | **Property** | **Value** | **Notes** | **Payload property** | +|---|---|:---:|---|---| +| Restrictions | **:::no-loc text="Allow Activity Continuation":::** | False | | [:::no-loc text="allowActivityContinuation":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Allow Adding Game Center Friends":::** | False | | [:::no-loc text="allowAddingGameCenterFriends":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Allow AirDrop":::** | False | | [:::no-loc text="allowAirDrop":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Allow App Cellular Data Modification":::** | False | | [:::no-loc text="allowAppCellularDataModification":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Allow App Installation":::** | False | Disables the App Store, and the system removes its icon from the Home screen. Users are unable to install or update their apps. In iOS 10 and later, MDM commands can override this restriction. | [:::no-loc text="allowAppInstallation":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Allow Apple Personalized Advertising":::** | False | | [:::no-loc text="allowApplePersonalizedAdvertising":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Allow Assistant":::** | False | Disables Siri. | [:::no-loc text="allowAssistant":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Allow Assistant User Generated Content":::** | False | | [:::no-loc text="allowAssistantUserGeneratedContent":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Allow Assistant While Locked":::** | False | | [:::no-loc text="allowAssistantWhileLocked":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Allow Auto Unlock":::** | False | | [:::no-loc text="allowAutoUnlock":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Allow Bookstore Erotica":::** | False | | [:::no-loc text="allowBookstoreErotica":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Allow Cellular Plan Modification":::** | False | | [:::no-loc text="allowCellularPlanModification":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Allow Chat":::** | False | Disables the use of iMessage with supervised devices. If the device supports text messaging, the user can still send and receive text messages. | [:::no-loc text="allowChat":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Allow Cloud Backup":::** | False | Disables backing up the device to iCloud as it can't be restricted to Managed Apple ID only. | [:::no-loc text="allowCloudBackup":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Allow Cloud Document Sync":::** | False | Disables document and key-value syncing to iCloud. | [:::no-loc text="allowCloudDocumentSync":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Allow Cloud Keychain Sync":::** | False | Disables iCloud keychain synchronization. | [:::no-loc text="allowCloudKeychainSync":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Allow Cloud Photo Library":::** | False | Disables iCloud Photo Library. The system removes any photos from local storage that aren't fully downloaded from iCloud Photo Library to the device. | [:::no-loc text="allowCloudPhotoLibrary":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Allow Cloud Private Relay":::** | False | Disables iCloud Private Relay. | [:::no-loc text="allowCloudPrivateRelay":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Allow Device Name Modification":::** | False | Prevents the user from changing the device name. Intune Remote Action can override this restriction. | [:::no-loc text="allowDeviceNameModification":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Allow Enabling Restrictions":::** | False | Disables the Enable Restrictions option in the Restrictions UI in Settings. | [:::no-loc text="allowEnablingRestrictions":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Allow Enterprise App Trust":::** | False | Removes the Trust Enterprise Developer button in *Settings > General > Profiles & Device Management*, which prevents provisioning apps by universal provisioning profiles. | [:::no-loc text="allowEnterpriseAppTrust":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Allow ESIM Modification":::** | False | | [:::no-loc text="allowESIMModification":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Allow Explicit Content":::** | False | | [:::no-loc text="allowExplicitContent":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Allow Files Network Drive Access":::** | False | | [:::no-loc text="allowFilesNetworkDriveAccess":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Allow Files USB Drive Access":::** | False | | [:::no-loc text="allowFilesUSBDriveAccess":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Allow Find My Friends":::** | False | | [:::no-loc text="allowFindMyFriends":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Allow Find My Friends Modification":::** | False | | [:::no-loc text="allowFindMyFriendsModification":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Allow Game Center":::** | False | | [:::no-loc text="allowGameCenter":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Allow In App Purchases":::** | False | | [:::no-loc text="allowInAppPurchases":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Allow iPhone Widgets On Mac":::** | False | | [:::no-loc text="allowiPhoneWidgetsOnMac":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Allow iTunes":::** | False | | [:::no-loc text="allowiTunes":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Allow Lock Screen Control Center":::** | False | | [:::no-loc text="allowLockScreenControlCenter":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Allow Lock Screen Notifications View":::** | False | | [:::no-loc text="allowLockScreenNotificationsView":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Allow Lock Screen Today View":::** | False | | [:::no-loc text="allowLockScreenTodayView":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Allow Managed Apps Cloud Sync":::** | False | Prevents managed apps from using iCloud sync. | [:::no-loc text="allowManagedAppsCloudSync":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Allow Marketplace App Installation":::** | False | Prevents installation of alternative marketplace apps from the web and prevents any installed alternative marketplace apps from installing apps.

**Note:** For select markets. | [:::no-loc text="allowMarketplaceAppInstallation":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Allow Multiplayer Gaming":::** | False | | [:::no-loc text="allowMultiplayerGaming":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Allow Music Service":::** | False | | [:::no-loc text="allowMusicService":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Allow News":::** | False | | [:::no-loc text="allowNews":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Allow Notifications Modification":::** | False | | [:::no-loc text="allowNotificationsModification":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Allow Paired Watch":::** | False | | [:::no-loc text="allowPairedWatch":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Allow Passbook While Locked":::** | False | Hides Passbook notifications from the lock screen. | [:::no-loc text="allowPassbookWhileLocked":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Allow Password Proximity Requests":::** | False | Disables requesting passwords from nearby devices. | [:::no-loc text="allowPasswordProximityRequests":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Allow Password Sharing":::** | False | | [:::no-loc text="allowPasswordSharing":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Allow Personal Hotspot Modification":::** | False | | [:::no-loc text="allowPersonalHotspotModification":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Allow Podcasts":::** | False | | [:::no-loc text="allowPodcasts":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Allow Proximity Setup To New Device":::** | False | | [:::no-loc text="allowProximitySetupToNewDevice":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Allow Radio Service":::** | False | | [:::no-loc text="allowRadioService":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Allow Shared Stream":::** | False | Disables Shared Photo Stream. | [:::no-loc text="allowSharedStream":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Allow Spotlight Internet Results":::** | False | Disables Spotlight Internet search results in Siri Suggestions. | [:::no-loc text="allowSpotlightInternetResults":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Allow System App Removal":::** | False | | [:::no-loc text="allowSystemAppRemoval":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Allow UI App Installation":::** | False | Disables the App Store, and the systems removes its icon from the Home screen. However, users can continue to use host apps such as iTunes or Configurator to install or update their apps. | [:::no-loc text="allowUIAppInstallation":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Allow UI Configuration Profile Installation":::** | False | Prohibits the user from installing configuration profiles and certificates interactively. | [:::no-loc text="allowUIConfigurationProfileInstallation":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Allow VPN Creation":::** | False | | [:::no-loc text="allowVPNCreation":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Allow Wallpaper Modification":::** | False | | [:::no-loc text="allowWallpaperModification":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Allow Web Distribution App Installation":::** | False | Prevents installation of apps directly from the web.

**Note:** For select markets. | [:::no-loc text="allowWebDistributionAppInstallation":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Force Assistant Profanity Filter":::** | True | Forces the use of the profanity filter assistant. | [:::no-loc text="forceAssistantProfanityFilter":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Force Limit Ad Tracking":::** | True | Disables app tracking and the Allow Apps to Request to Track setting. | [:::no-loc text="forceLimitAdTracking":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Force WiFi Power On":::** | True | | [:::no-loc text="forceWiFiPowerOn":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Safari Force Fraud Warning":::** | True | | [:::no-loc text="safariForceFraudWarning":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Web Content Filter | **:::no-loc text="Auto Filter Enabled":::** | True | Enables automatic filtering.

**Note:** iPadOS's built-in filter checks for adult content and doesn't cover categories that are educationally inappropriate. A separate filtering solution is recommended. | [:::no-loc text="AutoFilterEnabled":::](https://developer.apple.com/documentation/devicemanagement/webcontentfilter) | + +### [:::image type="icon" source="../../../media/icons/graph.svg"::: **Create policy using Graph Explorer**](#tab/graph) + +[!INCLUDE [graph-explorer-introduction](../../../includes/graph-explorer-intro.md)] + +This will create a policy in your tenant with the name **_MSLearn_Example_CommonEDU - iPads - Device restrictions**. + +```msgraph-interactive +POST https://graph.microsoft.com/beta/deviceManagement/configurationPolicies +Content-Type: application/json + +{"name":"_MSLearn_Example_CommonEDU - iPads - Device restrictions","description":"","platforms":"iOS","technologies":"mdm,appleRemoteManagement","roleScopeTagIds":["0"],"settings":[{"@odata.type":"#microsoft.graph.deviceManagementConfigurationSetting","settingInstance":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationGroupSettingCollectionInstance","settingDefinitionId":"com.apple.applicationaccess_com.apple.applicationaccess","groupSettingCollectionValue":[{"children":[{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowactivitycontinuation","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowactivitycontinuation_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowaddinggamecenterfriends","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowaddinggamecenterfriends_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowairdrop","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowairdrop_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowappcellulardatamodification","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowappcellulardatamodification_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowappinstallation","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowappinstallation_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowapplepersonalizedadvertising","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowapplepersonalizedadvertising_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowassistant","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowassistant_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowassistantusergeneratedcontent","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowassistantusergeneratedcontent_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowassistantwhilelocked","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowassistantwhilelocked_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowautounlock","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowautounlock_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowbookstoreerotica","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowbookstoreerotica_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowcellularplanmodification","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowcellularplanmodification_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowchat","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowchat_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowcloudbackup","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowcloudbackup_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowclouddocumentsync","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowclouddocumentsync_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowcloudkeychainsync","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowcloudkeychainsync_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowcloudphotolibrary","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowcloudphotolibrary_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowcloudprivaterelay","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowcloudprivaterelay_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowdevicenamemodification","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowdevicenamemodification_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowenablingrestrictions","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowenablingrestrictions_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowenterpriseapptrust","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowenterpriseapptrust_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowesimmodification","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowesimmodification_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowexplicitcontent","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowexplicitcontent_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowfilesnetworkdriveaccess","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowfilesnetworkdriveaccess_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowfilesusbdriveaccess","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowfilesusbdriveaccess_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowfindmydevice","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowfindmydevice_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowfindmyfriends","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowfindmyfriends_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowfindmyfriendsmodification","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowfindmyfriendsmodification_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowgamecenter","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowgamecenter_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowinapppurchases","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowinapppurchases_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowiphonewidgetsonmac","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowiphonewidgetsonmac_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowitunes","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowitunes_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowlockscreencontrolcenter","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowlockscreencontrolcenter_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowlockscreennotificationsview","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowlockscreennotificationsview_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowlockscreentodayview","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowlockscreentodayview_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowmanagedappscloudsync","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowmanagedappscloudsync_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowmarketplaceappinstallation","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowmarketplaceappinstallation_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowmultiplayergaming","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowmultiplayergaming_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowmusicservice","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowmusicservice_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allownews","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allownews_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allownotificationsmodification","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allownotificationsmodification_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowpairedwatch","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowpairedwatch_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowpassbookwhilelocked","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowpassbookwhilelocked_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowpasswordproximityrequests","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowpasswordproximityrequests_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowpasswordsharing","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowpasswordsharing_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowpersonalhotspotmodification","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowpersonalhotspotmodification_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowpodcasts","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowpodcasts_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowproximitysetuptonewdevice","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowproximitysetuptonewdevice_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowradioservice","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowradioservice_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowsharedstream","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowsharedstream_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowspotlightinternetresults","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowspotlightinternetresults_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowsystemappremoval","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowsystemappremoval_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowuiappinstallation","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowuiappinstallation_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowuiconfigurationprofileinstallation","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowuiconfigurationprofileinstallation_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowvpncreation","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowvpncreation_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowwallpapermodification","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowwallpapermodification_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowwebdistributionappinstallation","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowwebdistributionappinstallation_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_forceassistantprofanityfilter","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_forceassistantprofanityfilter_true","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_forcelimitadtracking","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_forcelimitadtracking_true","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_forcewifipoweron","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_forcewifipoweron_true","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_safariforcefraudwarning","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_safariforcefraudwarning_true","children":[]}}]}]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationSetting","settingInstance":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationGroupSettingCollectionInstance","settingDefinitionId":"com.apple.webcontent-filter_com.apple.webcontent-filter","groupSettingCollectionValue":[{"children":[{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.webcontent-filter_autofilterenabled","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.webcontent-filter_autofilterenabled_true","children":[]}}]}]}}]} +``` + +[!INCLUDE [graph-explorer-steps](../../../includes/graph-explorer-steps.md)] + +--- + +## Settings that require additional consideration + +> [!CAUTION] +> Enable these settings with caution after carefully evaluating their effect on your environment. + +### [**Settings**](#tab/settings) + +| **Category** | **Property** | **Value** | **Notes** | **Payload property** | +|---|---|:---:|---|---| +| Managed Settings > MDM Options | **:::no-loc text="Activation Lock Allowed While Supervised":::** | False | Does not register a supervised device with Activation Lock. | [:::no-loc text="activationLockAllowedWhileSupervised":::](https://developer.apple.com/documentation/devicemanagement/settingscommand/command/settings/mdmoptions/mdmoptions) | +| Restrictions | **:::no-loc text="Allow App Removal":::** | False | Disables removal of apps from an iOS device.

**Note:** Could result in devices running out of disk space. | [:::no-loc text="allowAppRemoval":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Allow Erase Content And Settings":::** | False | Without an ability to locally reset the device it complicates device recovery. | [:::no-loc text="allowEraseContentAndSettings":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Allow Unpaired External Boot To Recovery":::** | False | Does not allow devices to be booted into recovery by an unpaired device. | [:::no-loc text="allowUnpairedExternalBootToRecovery":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Allow Untrusted TLS Prompt":::** | False | Websites with untrusted certificates will not be displayed. If you use a DNS filtering solution or need to accept certificate changes due to SSL inspection, distribute the root CA certificate of the changed certificate from MDM. | [:::no-loc text="allowUntrustedTLSPrompt":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Allow Video Conferencing":::** | False | Hides the FaceTime app.

**Note:** Disabling may prevent screen sharing in some remote assistant apps used by IT Helpdesk. | [:::no-loc text="allowVideoConferencing":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Force WiFi To Allowed Networks Only":::** | True | Limits the device to only join Wi-Fi networks set up through a configuration profile.

**Note:** Could potentially leave the device in an unmanageable state if unable to connect to allowed networks. | [:::no-loc text="forceWiFiToAllowedNetworksOnly":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | + +### [:::image type="icon" source="../../../media/icons/graph.svg"::: **Create policy using Graph Explorer**](#tab/graph) + +[!INCLUDE [graph-explorer-introduction](../../../includes/graph-explorer-intro.md)] + +This will create a policy in your tenant with the name **_MSLearn_Example_CommonEDU - iPads - Device restrictions (require additional consideration)**. + +```msgraph-interactive +POST https://graph.microsoft.com/beta/deviceManagement/configurationPolicies +Content-Type: application/json + +{"name":"_MSLearn_Example_CommonEDU - iPads - Device restrictions (require additional consideration)","description":"","platforms":"iOS","technologies":"mdm,appleRemoteManagement","roleScopeTagIds":["0"],"settings":[{"@odata.type":"#microsoft.graph.deviceManagementConfigurationSetting","settingInstance":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationGroupSettingCollectionInstance","settingDefinitionId":"settings_item_mdmoptions","groupSettingCollectionValue":[{"children":[{"@odata.type":"#microsoft.graph.deviceManagementConfigurationGroupSettingCollectionInstance","settingDefinitionId":"settings_item_mdmoptions_mdmoptions","groupSettingCollectionValue":[{"children":[{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"settings_item_mdmoptions_mdmoptions_activationlockallowedwhilesupervised","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"settings_item_mdmoptions_mdmoptions_activationlockallowedwhilesupervised_false","children":[]}}]}]}]}]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationSetting","settingInstance":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationGroupSettingCollectionInstance","settingDefinitionId":"com.apple.applicationaccess_com.apple.applicationaccess","groupSettingCollectionValue":[{"children":[{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowappremoval","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowappremoval_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowerasecontentandsettings","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowerasecontentandsettings_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowunpairedexternalboottorecovery","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowunpairedexternalboottorecovery_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowuntrustedtlsprompt","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowuntrustedtlsprompt_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowvideoconferencing","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowvideoconferencing_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_forcewifitoallowednetworksonly","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_forcewifitoallowednetworksonly_true","children":[]}}]}]}}]} +``` + +[!INCLUDE [graph-explorer-steps](../../../includes/graph-explorer-steps.md)] + +--- diff --git a/memdocs/intune/industry/education/tutorial-school-deployment/common-config-ipads-nouser.md b/memdocs/intune/industry/education/tutorial-school-deployment/common-config-ipads-nouser.md new file mode 100644 index 00000000000..8d5c79bbd0a --- /dev/null +++ b/memdocs/intune/industry/education/tutorial-school-deployment/common-config-ipads-nouser.md @@ -0,0 +1,57 @@ +--- +title: Common Education iPads with no user affinity configuration +description: Learn about common iPads with no user affinity configuration used by Education organizations in Intune. +ms.date: 10/16/2024 +ms.topic: tutorial +author: yegor-a +ms.author: egorabr +ms.manager: dougeby +no-loc: [Microsoft, Apple] +ms.collection: +- graph-interactive +--- + +# iPads with no user affinity + +iPads used in earlier grades are commonly enrolled with no user affinity to simplify the user experience for younger students and to allow sharing of devices. For more information, please refer to [Enroll devices with Automated Device Enrollment](/mem/intune/industry/education/tutorial-school-deployment/enroll-ios-ade). + +These iPads generally have additional restrictions that are not suitable for 1:1 devices. + +To learn more, see: + +- [Use the settings catalog to configure settings on Windows, iOS/iPadOS and macOS devices](/mem/intune/configuration/settings-catalog) +- [Restrictions payload](https://developer.apple.com/documentation/devicemanagement/restrictions) + +> [!TIP] +> When creating a settings catalog profile in the Microsoft Intune admin center, you can copy a policy name from this article and paste it into the settings picker search field to find the desired policy. + +## [**Settings**](#tab/settings) + +| **Category** | **Property** | **Value** | **Notes** | **Payload property** | +|---|---|:---:|---|---| +| Restrictions | **:::no-loc text="Allow Account Modification":::** | False | Disables modification of accounts such as Apple IDs and Internet-based accounts such as Mail, Contacts, and Calendar. | [:::no-loc text="allowAccountModification":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Allow Bookstore":::** | False | Removes the Book Store tab from the Books app. | [:::no-loc text="allowBookstore":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Allow Enterprise Book Backup":::** | False | Disables backup of Enterprise books. | [:::no-loc text="allowEnterpriseBookBackup":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Allow Enterprise Book Metadata Sync":::** | False | Disables sync of Enterprise books, notes, and highlights. | [:::no-loc text="allowEnterpriseBookMetadataSync":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Allow Fingerprint For Unlock":::** | False | Prevents Touch ID or Face ID from unlocking a device. | [:::no-loc text="allowFingerprintForUnlock":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Allow Fingerprint Modification":::** | False | Prevents the user from modifying Touch ID or Face ID. | [:::no-loc text="allowFingerprintModification":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Allow Passcode Modification":::** | False | Prevents adding, changing, or removing the passcode. | [:::no-loc text="allowPasscodeModification":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Allow Password Auto Fill":::** | False | | [:::no-loc text="allowPasswordAutoFill":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Safari Allow Autofill":::** | False | Disables Safari AutoFill for passwords, contact info, and credit cards and also prevents using the Keychain for AutoFill. | [:::no-loc text="safariAllowAutoFill":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | + +## [:::image type="icon" source="../../../media/icons/graph.svg"::: **Create policy using Graph Explorer**](#tab/graph) + +[!INCLUDE [graph-explorer-introduction](../../../includes/graph-explorer-intro.md)] + +This will create a policy in your tenant with the name **_MSLearn_Example_CommonEDU - iPads - No user affinity**. + +```msgraph-interactive +POST https://graph.microsoft.com/beta/deviceManagement/configurationPolicies +Content-Type: application/json + +{"name":"_MSLearn_Example_CommonEDU - iPads - No user affinity","description":"","platforms":"iOS","technologies":"mdm,appleRemoteManagement","roleScopeTagIds":["0"],"settings":[{"@odata.type":"#microsoft.graph.deviceManagementConfigurationSetting","settingInstance":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationGroupSettingCollectionInstance","settingDefinitionId":"com.apple.applicationaccess_com.apple.applicationaccess","groupSettingCollectionValue":[{"children":[{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowaccountmodification","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowaccountmodification_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowbookstore","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowbookstore_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowenterprisebookbackup","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowenterprisebookbackup_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowenterprisebookmetadatasync","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowenterprisebookmetadatasync_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowfingerprintforunlock","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowfingerprintforunlock_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowfingerprintmodification","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowfingerprintmodification_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowpasscodemodification","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowpasscodemodification_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowpasswordautofill","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowpasswordautofill_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_safariallowautofill","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_safariallowautofill_false","children":[]}}]}]}}]} +``` + +[!INCLUDE [graph-explorer-steps](../../../includes/graph-explorer-steps.md)] + +--- diff --git a/memdocs/intune/industry/education/tutorial-school-deployment/common-config-ipads-optional.md b/memdocs/intune/industry/education/tutorial-school-deployment/common-config-ipads-optional.md new file mode 100644 index 00000000000..dff086ba432 --- /dev/null +++ b/memdocs/intune/industry/education/tutorial-school-deployment/common-config-ipads-optional.md @@ -0,0 +1,60 @@ +--- +title: Common Education iPads optional configuration +description: Learn about common iPads optional configuration used by Education organizations in Intune. +ms.date: 10/16/2024 +ms.topic: tutorial +author: yegor-a +ms.author: egorabr +ms.manager: dougeby +no-loc: [Microsoft, Apple] +ms.collection: +- graph-interactive +--- + +# Optional restrictions + +Optional policies, while relatively common, are provided for more situational use cases. + +To learn more, see: + +- [Use the settings catalog to configure settings on Windows, iOS/iPadOS and macOS devices](/mem/intune/configuration/settings-catalog) +- [Restrictions payload](https://developer.apple.com/documentation/devicemanagement/restrictions) + +> [!TIP] +> When creating a settings catalog profile in the Microsoft Intune admin center, you can copy a policy name from this article and paste it into the settings picker search field to find the desired policy. + +## [**Settings**](#tab/settings) + +| **Category** | **Property** | **Value** | **Notes** | **Payload property** | +|---|---|:---:|---|---| +| Managed Settings > Bluetooth | **:::no-loc text="Enabled":::** | True | Enable the Bluetooth setting. | [:::no-loc text="Enabled":::](https://developer.apple.com/documentation/devicemanagement/settingscommand/command/settings/bluetooth) | +| Restrictions | **:::no-loc text="Force Automatic Date And Time":::** | True | Enables the Set Automatically feature in Date & Time and the user can't disable it.

**Note:**

| [:::no-loc text="forceAutomaticDateAndTime":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Managed Settings > Time Zone | **:::no-loc text="Time Zone":::** | **Example**:
America/Los_Angeles
Asia/Tokyo
Australia/Brisbane

See complete list in [:::no-loc text="IANA time zone database":::](https://data.iana.org/time-zones/tzdb/zone.tab). | If the **forceAutomaticDateAndTime** restriction is set in Restrictions, this setting fails with an error. Otherwise, setting this value disables automatic time zone logic. The user is still able to change the time zone; for example, by turning automatic date and time back on. The intention is to allow setting the time zone when automatic determination isn't available, such as when Location Services are off. | [:::no-loc text="TimeZone":::](https://developer.apple.com/documentation/devicemanagement/settingscommand/command/settings/timezone) | +| Restrictions | **:::no-loc text="Allow Bluetooth Modification":::** | False | Prevents modification of Bluetooth settings. | [:::no-loc text="allowBluetoothModification":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Allow USB Restricted Mode":::** | True | Allows iOS devices to always connect to USB accessories while locked. If the system has Lockdown mode enabled, it ignores this value. | [:::no-loc text="allowUSBRestrictedMode":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Blocked App Bundle IDs":::** | **Example:**
com.apple.facetime
com.apple.findmy
com.apple.Home
com.apple.MobileStore
com.apple.MobileSMS
com.apple.Music
com.apple.podcasts
com.apple.stocks
com.apple.tv
com.apple.store.Jolly
com.apple.supportapp | Prevents showing or launching apps with bundle IDs in the array. | [:::no-loc text="blockedAppBundleIDs":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Enforced Software Update Delay":::** | 30 | How many days to delay a software update on the device. | [:::no-loc text="enforcedSoftwareUpdateDelay":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Force Classroom Automatically Join Classes":::** | True | Automatically gives permission to the teacher's requests without prompting the student. | [:::no-loc text="forceClassroomAutomaticallyJoinClasses":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Force Classroom Request Permission To Leave Classes":::** | True | A student enrolled in an unmanaged course through Classroom needs to request permission from the teacher to leave the course. | [:::no-loc text="forceClassroomRequestPermissionToLeaveClasses":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Force Classroom Unprompted App And Device Lock":::** | True | Allows the teacher to lock apps or the device without prompting the student. | [:::no-loc text="forceClassroomUnpromptedAppAndDeviceLock":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Force Classroom Unprompted Screen Observation":::** | True | If true and ScreenObservationPermissionModificationAllowed is also true in the [Education](https://developer.apple.com/documentation/devicemanagement/educationconfiguration) payload, a student enrolled in a managed course through the Classroom app automatically gives permission to that course teacher's requests to observe the student's screen without prompting the student. | [:::no-loc text="forceClassroomUnpromptedScreenObservation":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| Restrictions | **:::no-loc text="Force Preserve ESIM On Erase":::** | True | Preserves eSIM when it erases the device due to too many failed password attempts or the Erase All Content and Settings option.

**Note:** Doesn't preserve eSIM if Find My initiates erasing the device. | [:::no-loc text="forcePreserveESIMOnErase":::](https://developer.apple.com/documentation/devicemanagement/restrictions) | +| System Configuration > Lock Screen Message | **:::no-loc text="Asset Tag Information":::** | {{devicename}} | Displayed in the login window and Lock screen. | [:::no-loc text="AssetTagInformation":::](https://developer.apple.com/documentation/devicemanagement/lockscreenmessage) | +| System Configuration > Lock Screen Message | **:::no-loc text="Lock Screen Footnote":::** | **Example**:
School of Fine Art | The footnote displayed in the login window and Lock screen. | [:::no-loc text="LockScreenFootnote":::](https://developer.apple.com/documentation/devicemanagement/lockscreenmessage) | + +## [:::image type="icon" source="../../../media/icons/graph.svg"::: **Create policy using Graph Explorer**](#tab/graph) + +[!INCLUDE [graph-explorer-introduction](../../../includes/graph-explorer-intro.md)] + +This will create a policy in your tenant with the name **_MSLearn_Example_CommonEDU - iPads - Optional**. + +```msgraph-interactive +POST https://graph.microsoft.com/beta/deviceManagement/configurationPolicies +Content-Type: application/json + +{"name":"_MSLearn_Example_CommonEDU - iPads - Optional","description":"","platforms":"iOS","technologies":"mdm,appleRemoteManagement","roleScopeTagIds":["0"],"settings":[{"@odata.type":"#microsoft.graph.deviceManagementConfigurationSetting","settingInstance":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationGroupSettingCollectionInstance","settingDefinitionId":"settings_item_bluetooth","groupSettingCollectionValue":[{"children":[{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"settings_item_bluetooth_enabled","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"settings_item_bluetooth_enabled_true","children":[]}}]}]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationSetting","settingInstance":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationGroupSettingCollectionInstance","settingDefinitionId":"settings_item_timezone","groupSettingCollectionValue":[{"children":[{"@odata.type":"#microsoft.graph.deviceManagementConfigurationSimpleSettingInstance","settingDefinitionId":"settings_item_timezone_timezone","simpleSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationStringSettingValue","value":"America/Los_Angeles"}}]}]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationSetting","settingInstance":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationGroupSettingCollectionInstance","settingDefinitionId":"com.apple.applicationaccess_com.apple.applicationaccess","groupSettingCollectionValue":[{"children":[{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowbluetoothmodification","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowbluetoothmodification_false","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_allowusbrestrictedmode","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_allowusbrestrictedmode_true","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationSimpleSettingCollectionInstance","settingDefinitionId":"com.apple.applicationaccess_blockedappbundleids","simpleSettingCollectionValue":[{"value":"com.apple.facetime","@odata.type":"#microsoft.graph.deviceManagementConfigurationStringSettingValue"},{"value":"com.apple.findmy","@odata.type":"#microsoft.graph.deviceManagementConfigurationStringSettingValue"},{"value":"com.apple.Home","@odata.type":"#microsoft.graph.deviceManagementConfigurationStringSettingValue"},{"value":"com.apple.MobileStore","@odata.type":"#microsoft.graph.deviceManagementConfigurationStringSettingValue"},{"value":"com.apple.MobileSMS","@odata.type":"#microsoft.graph.deviceManagementConfigurationStringSettingValue"},{"value":"com.apple.Music","@odata.type":"#microsoft.graph.deviceManagementConfigurationStringSettingValue"},{"value":"com.apple.podcasts","@odata.type":"#microsoft.graph.deviceManagementConfigurationStringSettingValue"},{"value":"com.apple.stocks","@odata.type":"#microsoft.graph.deviceManagementConfigurationStringSettingValue"},{"value":"com.apple.tv","@odata.type":"#microsoft.graph.deviceManagementConfigurationStringSettingValue"},{"value":"com.apple.store.Jolly","@odata.type":"#microsoft.graph.deviceManagementConfigurationStringSettingValue"},{"value":"com.apple.supportapp","@odata.type":"#microsoft.graph.deviceManagementConfigurationStringSettingValue"}]},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationSimpleSettingInstance","settingDefinitionId":"com.apple.applicationaccess_enforcedsoftwareupdatedelay","simpleSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationIntegerSettingValue","value":30}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_forceautomaticdateandtime","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_forceautomaticdateandtime_true","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_forceclassroomautomaticallyjoinclasses","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_forceclassroomautomaticallyjoinclasses_true","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_forceclassroomrequestpermissiontoleaveclasses","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_forceclassroomrequestpermissiontoleaveclasses_true","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_forceclassroomunpromptedappanddevicelock","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_forceclassroomunpromptedappanddevicelock_true","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_forceclassroomunpromptedscreenobservation","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_forceclassroomunpromptedscreenobservation_true","children":[]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance","settingDefinitionId":"com.apple.applicationaccess_forcepreserveesimonerase","choiceSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationChoiceSettingValue","value":"com.apple.applicationaccess_forcepreserveesimonerase_true","children":[]}}]}]}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationSetting","settingInstance":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationGroupSettingCollectionInstance","settingDefinitionId":"com.apple.shareddeviceconfiguration_com.apple.shareddeviceconfiguration","groupSettingCollectionValue":[{"children":[{"@odata.type":"#microsoft.graph.deviceManagementConfigurationSimpleSettingInstance","settingDefinitionId":"com.apple.shareddeviceconfiguration_assettaginformation","simpleSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationStringSettingValue","value":"{{devicename}}"}},{"@odata.type":"#microsoft.graph.deviceManagementConfigurationSimpleSettingInstance","settingDefinitionId":"com.apple.shareddeviceconfiguration_lockscreenfootnote","simpleSettingValue":{"@odata.type":"#microsoft.graph.deviceManagementConfigurationStringSettingValue","value":"MSLearn_Example_CommonEDU"}}]}]}}]} +``` + +[!INCLUDE [graph-explorer-steps](../../../includes/graph-explorer-steps.md)] + +--- diff --git a/memdocs/intune/industry/education/tutorial-school-deployment/common-config-overview.md b/memdocs/intune/industry/education/tutorial-school-deployment/common-config-overview.md index 8a94691e1ee..c89e98535ec 100644 --- a/memdocs/intune/industry/education/tutorial-school-deployment/common-config-overview.md +++ b/memdocs/intune/industry/education/tutorial-school-deployment/common-config-overview.md @@ -7,17 +7,32 @@ ms.topic: tutorial author: yegor-a ms.author: egorabr ms.manager: dougeby -no-loc: [Microsoft, Windows, Autopatch, Autopilot, Edge] +no-loc: [Microsoft, Windows, Autopatch, Autopilot, Edge, Apple] --- # Common Education configuration overview Intune is a powerful tool that can help Education organizations manage their devices and data efficiently. However, configuring the right settings can be a time-consuming task, especially for those new to the platform. To help accelerate the process, we have assembled common configurations based on customer engagements into this reference document. These settings can help ensure the security and compliance of your devices and data, while maximizing the user experience for your students and staff. Whether you're setting up a new tenant or need a quick reference guide, this document is a valuable resource for any Education organization looking to optimize their use of Intune. +## Guiding Principles and Methodology + +The recommended settings in this document are built from real-world customer configurations, reflecting how Education organizations are currently using Microsoft Intune to manage their Windows and iPadOS devices. The goal is to provide policies that prevent unintentional use, maintain consistency across devices, and ensure that devices are used solely for educational purposes. At the same time, these settings optimize the overall device experience for students. + +Key areas of focus include: + +- **Disabling AI capabilities**: Keep students focused by preventing distractions and the inappropriate use of OS AI features. +- **Update experience**: Ensure that devices are secure and up to date, while minimizing disruptions during class time. +- **Disabling changes to settings**: Maintain consistent device configurations and prevent tampering by locking critical settings. +- **Browsing experience**: Protect student privacy and data by ensuring a safe browsing environment, free from distractions and potential security risks. + +These policies are commonly used but not mandatory. Schools can tailor their configurations based on their specific needs, and optional policies are provided for more situational use cases. + > [!CAUTION] -> Adding these settings to your existing Intune tenant and assigning them to devices could potentially cause conflicts with your existing Intune policies. For more information, see [Compliance and device configuration policies that conflict](/mem/intune/configuration/device-profile-troubleshoot#conflicts). +> Adding these settings to your existing Intune tenant and assigning them to devices could potentially cause conflicts with your existing Intune policies. For more information, see [Compliance and device configuration policies that conflict](/mem/intune/configuration/device-profile-troubleshoot#conflicts) and [Avoiding policy conflicts](manage-avoid-policy-conflicts.md). + +## Intune policies for Windows in Education -## Configuration sections +### Configuration sections - [Device restrictions](/mem/intune/industry/education/tutorial-school-deployment/common-config-settings-catalog-device-restrictions) - [Windows Update](/mem/intune/industry/education/tutorial-school-deployment/common-config-windows-update) @@ -29,3 +44,10 @@ Intune is a powerful tool that can help Education organizations manage their dev - [Windows privacy](/mem/intune/industry/education/tutorial-school-deployment/common-config-settings-catalog-windows-privacy) - [Start menu customization](/mem/intune/industry/education/tutorial-school-deployment/common-config-settings-catalog-start-menu) - [OneDrive Known Folder Move](/mem/intune/industry/education/tutorial-school-deployment/common-config-settings-catalog-onedrive-knownfoldermove) + +## Intune policies for iPads in Education + +- [Device restrictions](common-config-ipads-device-restrictions.md) +- [Apple Intelligence](common-config-ipads-ai.md) +- [iPads with no user affinity](common-config-ipads-nouser.md) +- [Optional restrictions](common-config-ipads-optional.md) diff --git a/memdocs/intune/industry/education/tutorial-school-deployment/common-config-settings-catalog-device-restrictions.md b/memdocs/intune/industry/education/tutorial-school-deployment/common-config-settings-catalog-device-restrictions.md index 8360b845364..e2d4bc91e1f 100644 --- a/memdocs/intune/industry/education/tutorial-school-deployment/common-config-settings-catalog-device-restrictions.md +++ b/memdocs/intune/industry/education/tutorial-school-deployment/common-config-settings-catalog-device-restrictions.md @@ -9,7 +9,7 @@ ms.manager: dougeby no-loc: [Microsoft, Windows, Autopatch, Autopilot] --- -# Device restrictions +# Common Education device restrictions There are many device restriction settings and configuration options you have available. This article summarizes the configurations that are most commonly used for student and teacher devices. diff --git a/memdocs/intune/industry/education/tutorial-school-deployment/enroll-autopilot.md b/memdocs/intune/industry/education/tutorial-school-deployment/enroll-autopilot.md index 9247927bf69..6fa6279abfa 100644 --- a/memdocs/intune/industry/education/tutorial-school-deployment/enroll-autopilot.md +++ b/memdocs/intune/industry/education/tutorial-school-deployment/enroll-autopilot.md @@ -161,7 +161,7 @@ With the devices joined to Microsoft Entra tenant and managed by Intune, you can [MSFT-1]: https://partner.microsoft.com/ -[INT-1]: /intune/network-bandwidth-use +[INT-1]: /mem/intune/fundamentals/network-bandwidth-use [M365-1]: https://support.office.com/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2 diff --git a/memdocs/intune/industry/education/tutorial-school-deployment/manage-surface-devices.md b/memdocs/intune/industry/education/tutorial-school-deployment/manage-surface-devices.md index 144c273b266..38ef96e2fad 100644 --- a/memdocs/intune/industry/education/tutorial-school-deployment/manage-surface-devices.md +++ b/memdocs/intune/industry/education/tutorial-school-deployment/manage-surface-devices.md @@ -42,6 +42,6 @@ To access and use the Surface Management Portal: -[INT-1]: /intune/configuration/device-firmware-configuration-interface-windows +[INT-1]: /mem/intune/configuration/device-firmware-configuration-interface-windows-settings [MEM-1]: /mem/autopilot/dfci-management [SURF-1]: /surface/surface-manage-dfci-guide diff --git a/memdocs/intune/industry/education/tutorial-school-deployment/set-up-microsoft-entra-id.md b/memdocs/intune/industry/education/tutorial-school-deployment/set-up-microsoft-entra-id.md index 563087d1819..5348436a922 100644 --- a/memdocs/intune/industry/education/tutorial-school-deployment/set-up-microsoft-entra-id.md +++ b/memdocs/intune/industry/education/tutorial-school-deployment/set-up-microsoft-entra-id.md @@ -22,7 +22,7 @@ For more information, see [Create your Office 365 tenant][M365-1]. ### Explore the Microsoft 365 admin center -The **Microsoft 365 admin center** is the hub for all administrative consoles for the Microsoft 365 cloud. To access the [Microsoft 365 admin center](https://admin.microsoft.com), sign in with the same global administrator account when you [created the Microsoft 365 tenant](#create-a-microsoft-365-tenant). +The **Microsoft 365 admin center** is the hub for all administrative consoles for the Microsoft 365 cloud. To access the [Microsoft 365 admin center](https://admin.microsoft.com), sign in with the same account when you [created the Microsoft 365 tenant](#create-a-microsoft-365-tenant). From the Microsoft 365 admin center, you can access different administrative dashboards: Microsoft Entra ID, Microsoft Intune, Intune for Education, and others: diff --git a/memdocs/intune/protect/advanced-threat-protection-configure.md b/memdocs/intune/protect/advanced-threat-protection-configure.md index 43d387ca76d..1b5618f4fb0 100644 --- a/memdocs/intune/protect/advanced-threat-protection-configure.md +++ b/memdocs/intune/protect/advanced-threat-protection-configure.md @@ -39,7 +39,7 @@ Use the information and procedures in this article to configure integration of M - **Use Intune policy to onboard devices with Microsoft Defender for Endpoint**. You onboard devices to configure them to communicate with Microsoft Defender for Endpoint and to provide data that helps assess their risk level. - **Use Intune device compliance policies to set the level of risk you want to allow**. Microsoft Defender for Endpoint reports a devices risk level. Devices that exceed the allowed risk level are identified as noncompliant. - **Use a conditional access policy** to block users from accessing corporate resources from devices that are noncompliant. -- **Use** [**app protection policies**](../protect/mtd-app-protection-policy.md) for Android and iOS/iPadOS, to set device risk levels. App protection polices work with both enrolled and unenrolled devices. +- **Use** [**app protection policies**](../protect/mtd-app-protection-policy.md) for Android and iOS/iPadOS, to set device risk levels. App protection policies work with both enrolled and unenrolled devices. In addition to managing settings for Microsoft Defender for Endpoint on devices that enroll with Intune, you can manage Defender for Endpoint security configurations on devices that aren’t enrolled with Intune. This scenario is called *Security Management for Microsoft Defender for Endpoint* and requires configuring the *Allow Microsoft Defender for Endpoint to enforce Endpoint Security Configurations* toggle to *On*. For more information, see [MDE Security Configuration Management](../protect/mde-security-integration.md). diff --git a/memdocs/intune/protect/advanced-threat-protection-monitor.md b/memdocs/intune/protect/advanced-threat-protection-monitor.md index 3b87acbf0a8..a358be52bc0 100644 --- a/memdocs/intune/protect/advanced-threat-protection-monitor.md +++ b/memdocs/intune/protect/advanced-threat-protection-monitor.md @@ -1,13 +1,13 @@ --- # required metadata -title: Monitor integration of Microsoft Defender for Endpoint in Microsoft Intune +title: Monitor Microsoft Defender for Endpoint with Microsoft Intune description: Monitor Microsoft Defender for Endpoint with Intune, including device compliance and onboarding status. keywords: author: brenduns ms.author: brenduns manager: dougeby -ms.date: 11/29/2023 +ms.date: 10/10/2024 ms.topic: how-to ms.service: microsoft-intune ms.subservice: protect @@ -39,7 +39,7 @@ Monitor the state of devices that have the Microsoft Defender for Endpoint compl 1. Sign in to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431). -2. Select **Devices** > **Compliance**. On the **Monitor** tab, select **Noncompliant devices**. +2. Select **Devices** > **Compliance**. On the **Monitor** tab, select **Noncompliant devices**. 3. Find your Microsoft Defender for Endpoint policy in the list, and see which devices are compliant or noncompliant. @@ -47,8 +47,11 @@ For more information about reports, see [Intune reports](../fundamentals/reports ## View onboarding status -To view the onboarding status of your Intune-managed devices, go to **Endpoint security** > **Microsoft Defender for Endpoint**. At the bottom of this page is a visualization report for **Devices onboarded onto Microsoft Defender for Endpoint**, which displays the count of devices that report status from the Defender for Endpoint sensor. +To view the onboarding status of your Intune-managed devices: -## Next steps +1. Sign in to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431). +2. Select **Endpoint security** > **Overview**. As part of the default *Summary* is a visualization report for **Windows devices onboarded onto Microsoft Defender for Endpoint**, which displays the count of devices that report status from the Defender for Endpoint sensor. + +## Related content [Enforce compliance for Microsoft Defender for Endpoint with Conditional Access in Intune](../protect/advanced-threat-protection.md) diff --git a/memdocs/intune/protect/advanced-threat-protection.md b/memdocs/intune/protect/advanced-threat-protection.md index e1985409485..8b4d8a00323 100644 --- a/memdocs/intune/protect/advanced-threat-protection.md +++ b/memdocs/intune/protect/advanced-threat-protection.md @@ -75,7 +75,7 @@ For devices that run Android, you can use Intune policy to modify the configurat **Subscriptions**: To use Microsoft Defender for Endpoint with Intune, you must have the following subscriptions: -- **Microsoft Defender for Endpoint** - This subscription provides you access to the Microsoft Defender Security Center ([Microsoft Defender XDR](https://go.microsoft.com/fwlink/p/?linkid=2077139)). +- **Microsoft Defender for Endpoint** - This subscription provides you access to the Microsoft [Defender Security Center](https://go.microsoft.com/fwlink/p/?linkid=2077139). For Defender for Endpoint licensing options, see **Licensing requirements** in [Minimum requirements for Microsoft Defender for Endpoint](/windows/security/threat-protection/microsoft-defender-atp/minimum-requirements) and [How to set up a Microsoft 365 E5 Trial Subscription](/microsoft-365/security/defender/setup-m365deval#enable-microsoft-365-trial-subscription). diff --git a/memdocs/intune/protect/antivirus-microsoft-defender-settings-macos.md b/memdocs/intune/protect/antivirus-microsoft-defender-settings-macos.md index 2051c0c780e..db7d6fd54d0 100644 --- a/memdocs/intune/protect/antivirus-microsoft-defender-settings-macos.md +++ b/memdocs/intune/protect/antivirus-microsoft-defender-settings-macos.md @@ -5,7 +5,7 @@ keywords: author: brenduns ms.author: brenduns manager: dougeby -ms.date: 11/10/2023 +ms.date: 09/12/2024 ms.topic: reference ms.service: microsoft-intune ms.subservice: protect @@ -70,11 +70,6 @@ For details about these settings, see the settings entry in [Set preferences for - *Enabled* - *Disabled* -- **Enforcement level** - - *Passive* (*default*) - - *Real time* - - *On Demand* - - **Scan history size** - *Not configured* (*default*) - *Configured* - When configured, specify a number of entries to keep in scan history. @@ -128,6 +123,11 @@ For details about these settings, see the settings entry in [Set preferences for - *True* - *Not configured* +- **Enforcement level** + - *Passive* (*default*) + - *Real time* + - *On Demand* + ## Network protection - **Enforcement level** diff --git a/memdocs/intune/protect/antivirus-microsoft-defender-settings-windows-tenant-attach.md b/memdocs/intune/protect/antivirus-microsoft-defender-settings-windows-tenant-attach.md index 5bfa400a857..e89cf6b120d 100644 --- a/memdocs/intune/protect/antivirus-microsoft-defender-settings-windows-tenant-attach.md +++ b/memdocs/intune/protect/antivirus-microsoft-defender-settings-windows-tenant-attach.md @@ -7,7 +7,7 @@ keywords: author: brenduns ms.author: brenduns manager: dougeby -ms.date: 01/11/2024 +ms.date: 09/17/2024 ms.topic: reference ms.service: microsoft-intune ms.subservice: protect @@ -31,7 +31,7 @@ ms.reviewer: mattcall # Settings for Microsoft Defender Antivirus policy for tenant attached devices in Microsoft Intune -View the Microsoft Defender Antivirus settings you can manage with the **Microsoft Defender Antivirus Policy (ConfigMgr)** profile from Intune. The profile is available when you configure Intune [Endpoint security Antivirus policy](../protect/endpoint-security-antivirus-policy.md), and the policy deploys to devices you manage with Configuration Manager when you've configured the [tenant attach](../protect/tenant-attach-intune.md) scenario. +View the Microsoft Defender Antivirus settings you can manage with the **Microsoft Defender Antivirus Policy (ConfigMgr)** profile from Intune. The profile is available when you configure Intune [Endpoint security Antivirus policy](../protect/endpoint-security-antivirus-policy.md), and the policy deploys to devices you manage with Configuration Manager when you've configured the [tenant attach](../protect/tenant-attach-intune.md) scenario. (Path in the Microsoft Intune admin center: *Endpoint security* > *Antivirus* > *+ Create Policy* > Platform = *Windows (ConfigMgr)* > Profile = *Microsoft Defender Antivirus*.) ## Cloud protection @@ -60,6 +60,12 @@ View the Microsoft Defender Antivirus settings you can manage with the **Microso ## Microsoft Defender Antivirus Exclusions +> [!WARNING] +> **Defining exclusions lowers the protection offered by Microsoft Defender Antivirus**. Always evaluate the risks that are associated with implementing exclusions. Only exclude files you know aren't malicious. +> +> For more information, see [Exclusions overview](/defender-endpoint/navigate-defender-endpoint-antivirus-exclusions) in the Microsoft Defender documentation. + + For each setting in this group, you can expand the setting, select **Add**, and then specify a value for the exclusion. - **Defender Processes To Exclude** @@ -281,7 +287,7 @@ Learn more - **Time of day to run a scheduled scan** - **Not Configured** (*default*) -- **Check For Signature Updates Before Running Scan** +- **Check For Signature Updates Before Running Scan (Device)** - **Not Configured** (*default*) - **No** - **Yes** @@ -303,9 +309,9 @@ Learn more Specify the interval from zero to 24 (in hours) that is used to check for signatures. A value of zero results in no check for new signatures. A value of 2 will check every two hours, and so on. -- **Signature Update Fallback Order (Device)** + - **Signature Update Fallback Order (Device)** -- **Signature Update File Shares Sources (Device)** + - **Signature Update File Shares Sources (Device)** - **Security Intelligence Location (Device)** @@ -316,13 +322,7 @@ Learn more - **Not allowed** Prevents users from accessing UI. - **Allowed** Lets users access UI. -- **Show notifications messages on the client computer when the user needs to run a full scan, update security intelligence, or run Windows Defender Offline** - - **Not Configured** (*default*) - - **Yes** - - **No** - -- **Disable the client user interface** +- **Allow users to view the full History results** - **Not Configured** (*default*) - **Yes** - - **No** - + - **No** \ No newline at end of file diff --git a/memdocs/intune/protect/antivirus-microsoft-defender-settings-windows.md b/memdocs/intune/protect/antivirus-microsoft-defender-settings-windows.md index 837d41028b3..50a9ebdba2f 100644 --- a/memdocs/intune/protect/antivirus-microsoft-defender-settings-windows.md +++ b/memdocs/intune/protect/antivirus-microsoft-defender-settings-windows.md @@ -68,6 +68,11 @@ View details about the [endpoint security](../protect/endpoint-security-policy.m ## Microsoft Defender Antivirus Exclusions +> [!WARNING] +> **Defining exclusions lowers the protection offered by Microsoft Defender Antivirus**. Always evaluate the risks that are associated with implementing exclusions. Only exclude files you know aren't malicious. +> +> For more information, see [Exclusions overview](/defender-endpoint/navigate-defender-endpoint-antivirus-exclusions) in the Microsoft Defender documentation. + The following settings are available in the Microsoft Defender Antivirus profile: - **Defender local admin merge** diff --git a/memdocs/intune/protect/blackberry-mobile-threat-defense-connector.md b/memdocs/intune/protect/blackberry-mobile-threat-defense-connector.md index af6b80a3db0..fc99019d54f 100644 --- a/memdocs/intune/protect/blackberry-mobile-threat-defense-connector.md +++ b/memdocs/intune/protect/blackberry-mobile-threat-defense-connector.md @@ -8,7 +8,7 @@ keywords: author: brenduns ms.author: brenduns manager: dougeby -ms.date: 01/23/2024 +ms.date: 10/14/2024 ms.topic: how-to ms.service: microsoft-intune ms.subservice: protect @@ -33,7 +33,7 @@ ms.collection: # Use BlackBerry Protect Mobile with Intune -Control mobile device access to corporate resources using Conditional Access based on risk assessment conducted by BlackBerry Protect Mobile (powered by Cylance AI), a mobile threat defense (MTD) solution that integrates with Microsoft Intune. Risk is assessed based on telemetry collected from devices running the BlackBerry Protect Mobile app. +You can control mobile device access to corporate resources using Conditional Access based on risk assessment conducted by BlackBerry Protect Mobile (powered by Cylance AI), a mobile threat defense (MTD) solution that integrates with Microsoft Intune. Risk is assessed based on telemetry collected from devices running the BlackBerry Protect Mobile app. You can configure Conditional Access policies based on a BlackBerry Protect risk assessment, enabled through Intune device compliance policies for enrolled devices. You can set up your policies to allow or block noncompliant devices from accessing corporate resources based on detected threats. For unenrolled devices, you can use app protection policies to enforce a block or selective wipe based on detected threats. @@ -55,7 +55,7 @@ For more information about how to integrate BlackBerry UES with Microsoft Intune ## How do Intune and the BlackBerry MTD connector help protect your company resources? -The CylancePROTECT app for Android and iOS/iPadOS captures file system, network stack, device, and application telemetry where available, then sends the telemetry data to the Cylance AI Protection cloud service to assess the device's risk for mobile threats. +For Android and iOS/iPadOS, the CylancePROTECT app captures file system, network stack, device, and application telemetry where available, then sends the data to the Cylance AI Protection cloud service to assess the device's risk for mobile threats. - **Support for enrolled devices** - Intune device compliance policy includes a rule for MTD, which can use risk assessment information from CylancePROTECT (BlackBerry). When the MTD rule is enabled, Intune evaluates device compliance with the policy that you enabled. If the device is found noncompliant, users are blocked access to corporate resources, such as Exchange Online and SharePoint Online. Users also receive guidance from the BlackBerry Protect app installed on their devices to resolve the issue and regain access to corporate resources. To support using BlackBerry Protect with enrolled devices: - [Add MTD apps to devices](../protect/mtd-apps-ios-app-configuration-policy-add-assign.md) diff --git a/memdocs/intune/protect/certificate-authority-add-scep-overview.md b/memdocs/intune/protect/certificate-authority-add-scep-overview.md index 0e3ba545384..6f46a3c1400 100644 --- a/memdocs/intune/protect/certificate-authority-add-scep-overview.md +++ b/memdocs/intune/protect/certificate-authority-add-scep-overview.md @@ -5,7 +5,7 @@ keywords: author: lenewsad ms.author: lanewsad manager: dougeby -ms.date: 07/24/2024 +ms.date: 10/15/2024 ms.topic: how-to ms.service: microsoft-intune ms.subservice: protect @@ -27,9 +27,7 @@ ms.collection: - sub-certificates --- -# Add partner certification authority in Intune using SCEP - -[!INCLUDE [azure_portal](../includes/strong-mapping-cert.md)] +# Add partner certification authority in Intune using SCEP Use third-party certification authorities (CA) with Intune. Third-party CAs can provision mobile devices with new or renewed certificates by using the Simple Certificate Enrollment Protocol (SCEP), and can support Windows, iOS/iPadOS, Android, and macOS devices. @@ -139,6 +137,7 @@ After you unenroll or wipe the device, the certificates are removed from the dev The following third-party certification authorities support Intune: +- [AWS Private Certificate Authority](https://docs.aws.amazon.com/privateca/latest/userguide/connector-for-scep-getting-started.html) - [Cogito Group](https://cogitogroup.net/scep) - [DigiCert](https://knowledge.digicert.com/tutorials/microsoft-intune.html) - [EasyScep](https://docs.just-software.com/EasyScep/) diff --git a/memdocs/intune/protect/certificate-connector-install.md b/memdocs/intune/protect/certificate-connector-install.md index 36af0abe06d..eaaf83d2db9 100644 --- a/memdocs/intune/protect/certificate-connector-install.md +++ b/memdocs/intune/protect/certificate-connector-install.md @@ -1,13 +1,13 @@ --- # required metadata -title: Install the Certificate Connector for Microsoft Intune - Azure | Microsoft Docs +title: Install the Certificate Connector for Microsoft Intune description: Learn how to install and configure the unified Certificate Connector for Microsoft Intune, which supports SCEP, PKCS, imported PKCS, and certificate revocation. keywords: author: lenewsad ms.author: lanewsad manager: dougeby -ms.date: 09/11/2023 +ms.date: 10/09/2024 ms.topic: how-to ms.service: microsoft-intune ms.subservice: protect @@ -33,7 +33,7 @@ ms.collection: # Install the Certificate Connector for Microsoft Intune -To support your use of certificates with Intune, you can install the Certificate Connector for Microsoft Intune on any Windows Server that meets the [connector prerequisites](../protect/certificate-connector-prerequisites.md). The following sections will help you install and then configure the connector. This article also explains how to modify a previously installed connector, and how to remove the connector from a server. +To support your use of certificates with Intune, you can install the Certificate Connector for Microsoft Intune on any Windows Server that meets the [connector prerequisites](../protect/certificate-connector-prerequisites.md). The following sections help you install and then configure the connector. This article also explains how to modify a previously installed connector, and how to remove the connector from a server. ## Download and install the connector software @@ -47,11 +47,11 @@ To support your use of certificates with Intune, you can install the Certificate 4. Sign in to the Windows Server that will host the certificate connector and confirm that the [prerequisites for the certificate connector](../protect/certificate-connector-prerequisites.md) are installed. - If you’ll use SCEP with a Microsoft Certification Authority (CA), confirm that the Network Device Enrollment Service (NDES) role is installed. + To use the Simple Certificate Enrollment Protocol (SCEP) with a Microsoft Certification Authority (CA), confirm that the Network Device Enrollment Service (NDES) role is installed. 5. Use an account with admin permissions to the server to run the installer (**IntuneCertificateConnector.exe**). The installer also installs the policy module for NDES. The policy module runs as an application in IIS. - > [!NOTE] + > [!NOTE] > When **IntuneCertificateConnector.exe** runs to install a new connector or an existing connector auto upgrades while the Windows Event Viewer is open, the installation process logs a message similar to the following with an Event ID 1000 from the source *Microsoft-Intune-CertificateConnectors cannot be found*: > > - Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer. @@ -73,13 +73,13 @@ After a connector installs, you can run the installation program again to uninst ## Configure the certificate connector -To configure the certificate connector, you use the **Certificate Connector for Microsoft Intune** wizard. The configuration can start automatically when you choose *Configure Now* at the end of a certificate connector install, or manually by opening an elevated command prompt and running **C:\Program Files\Microsoft Intune\PFXCertificateConnector\ConnectorUI\PFXCertificateConnectorUI.exe**. An example is provided below. The command must be run as an administrator. +To configure the certificate connector, you use the **Certificate Connector for Microsoft Intune** wizard. The configuration can start automatically when you choose *Configure Now* at the end of a certificate connector install, or manually by opening an elevated command prompt and running **C:\Program Files\Microsoft Intune\PFXCertificateConnector\ConnectorUI\PFXCertificateConnectorUI.exe**. An example follows. The command must be run as an administrator. ``` command C:\Program Files\Microsoft Intune\PFXCertificateConnector\ConnectorUI\PFXCertificateConnectorUI.exe ``` -Each time **Certificate Connector for Microsoft Intune** starts on a server you’ll see the following *Welcome* page: +Each time **Certificate Connector for Microsoft Intune** starts on a server you should see the following *Welcome* page: :::image type="content" source="./media/certificate-connector-install/begin-connector-configuration.png" alt-text="Welcome page of the Certificate Connector for Microsoft Intune wizard."::: @@ -92,11 +92,11 @@ Use the following procedure to both configure a new connector and modify a previ 2. On *Features*, select the checkbox for each connector feature you want to install on this server, and then select **Next**. Options include: - - **SCEP**: Select this option to enable certificate delivery to devices from a Microsoft Active Directory Certification Authority using the SCEP protocol. Devices that submit a certificate request will generate a private/public key pair and submit only the public key as part of that request. + - **SCEP**: Select this option to enable certificate delivery to devices from a Microsoft Active Directory Certification Authority using the SCEP protocol. Devices that submit a certificate request generate a private/public key pair and submit only the public key as part of that request. - - **PKCS**: Select this option to enable certificate delivery to devices from a Microsoft Active Directory Certification Authority in PKCS #12 format. Ensure you’ve set up all the necessary prerequisites. + - **PKCS**: Select this option to enable certificate delivery to devices from a Microsoft Active Directory Certification Authority in PKCS #12 format. Ensure you set up all the necessary prerequisites. - - **PKCS imported certificates**: Select this option to enable certificate delivery to devices for pfx certificates that you've imported to Intune. Ensure you’ve set up all the necessary prerequisites. + - **PKCS imported certificates**: Select this option to enable certificate delivery to devices for pfx certificates that you import to Intune. Ensure you set up all the necessary prerequisites. - **Certificate revocation**: Select this option to enable automatic certificate revocation for certificates issued from a Microsoft Active Directory Certification Authority. @@ -108,12 +108,13 @@ Use the following procedure to both configure a new connector and modify a previ - **Domain user account** – Use any domain user account that is an administrator on the Windows Server. 4. On the *Proxy* page, add details for your proxy server if you require a proxy for internet access. For example, `http://proxy.contoso.com`. - > [!IMPORTANT] + + > [!IMPORTANT] > Be sure to include the HTTP or HTTPS prefix. This is a change from the proxy configuration for previous versions of the connector. 5. On the *Prerequisites* page, the wizard runs several checks on the server before the configuration can begin. Review and resolve any errors or warnings before you continue. -6. On the *Microsoft Entra sign-in* page, select the environment that hosts your Microsoft Entra ID, and then select **Sign In**. You’ll then be asked to authenticate your access. An Intune license is required for the account that you sign in with which can be either a Global Administrator or an Intune Administrator. +6. On the *Microsoft Entra sign-in* page (which appears as *Azure AD Sign-In*), select the environment that hosts your Microsoft Entra ID, and then select **Sign In**. Then when prompted, authenticate your access. An Intune license is required for the account that you sign in with which can be either a Global Administrator or an Intune Administrator. Unless you use a government cloud, use the default of **Public Commercial Cloud** for *Environment*. @@ -132,8 +133,8 @@ Use the following procedure to both configure a new connector and modify a previ After the configuration completes successfully and the wizard closes, the Certificate Connector for Microsoft Intune is now ready for use. > [!TIP] -> It might be helpful to rename the connector to reference the server the connector is installed on. -> +> It might be helpful to rename the connector to reference the server the connector is installed on. +> > To rename the connector, in the Microsoft Intune admin center, select **Tenant administration** > **Connectors and tokens** > **Certificate connectors**. Select the connector you want to rename. In **Name**, enter the name you want to use, and then select **save**. ## Modify the connector configuration @@ -143,9 +144,9 @@ After you configure a Certificate Connector for Microsoft Intune on a server, yo ## Remove the connector To uninstall the Certificate Connector for Microsoft Intune from a Windows Server, on the server run **IntuneCertificateConnector.exe**, which is the same [software you use to install the connector](#download-and-install-the-connector-software). When run on a server that has the connector installed, the only available option is to remove the current connector installation. -## Next steps -Deploy: +## Related content + - [SCEP certificate profiles](../protect/certificates-profile-scep.md) - [PKCS certificates](../protect/certificates-pfx-configure.md) - [Imported PKCS certificates](../protect/certificates-imported-pfx-configure.md) diff --git a/memdocs/intune/protect/certificate-connector-overview.md b/memdocs/intune/protect/certificate-connector-overview.md index 8b55c76fb6e..de6c93665b1 100644 --- a/memdocs/intune/protect/certificate-connector-overview.md +++ b/memdocs/intune/protect/certificate-connector-overview.md @@ -7,7 +7,7 @@ keywords: author: lenewsad ms.author: lanewsad manager: dougeby -ms.date: 02/14/2023 +ms.date: 09/19/2024 ms.topic: how-to ms.service: microsoft-intune ms.subservice: protect @@ -166,7 +166,7 @@ All events have one of the following IDs: ### Task Categories -All events are tagged with a Task Category to aid in filtering. Task categories contain but aren't limited to the following list: +All events are tagged with a Task Category to aid in filtering. Task categories contain but aren't limited to the following list: **PKCS** @@ -388,6 +388,16 @@ New updates for the connector can take a week or more to become available for ea > [!IMPORTANT] > Starting April 2022, certificate connectors earlier than version **6.2101.13.0** will be deprecated and will show a status of *Error*. Starting August 2022, these connector versions **won't** be able to revoke certificates. Starting September 2022, these connector versions **won't** be able to issue certificates. This includes both the [PFX Certificate Connector for Microsoft Intune](../protect/certificate-connectors.md#pfx-certificate-connector-release-history) and [Microsoft Intune Connector](../protect/certificate-connectors.md#microsoft-intune-connector-release-history), which on July 29, 2021 were replaced by the *Certificate Connector for Microsoft Intune* (as detailed in this article). + +### September 19, 2024 + +Version **6.2406.0.1001** - Changes in this release: + +- Changes to support KB5014754 requirements +- Improved PKCS import-pipeline logging +- Bug fixes +- Security improvements + ### February 15, 2023 Version **6.2301.1.0** - Changes in this release: diff --git a/memdocs/intune/protect/certificate-connector-prerequisites.md b/memdocs/intune/protect/certificate-connector-prerequisites.md index 67f89444f54..64d0fcc94a6 100644 --- a/memdocs/intune/protect/certificate-connector-prerequisites.md +++ b/memdocs/intune/protect/certificate-connector-prerequisites.md @@ -1,14 +1,14 @@ --- # required metadata -title: Prerequisites for use of the Certificate Connector for Microsoft Intune - Azure | Microsoft Docs +title: Prerequisites for the Certificate Connector for Microsoft Intune description: Review the software and network prerequisites for use of the Certificate Connector for Microsoft Intune. keywords: author: lenewsad ms.author: lanewsad manager: dougeby -ms.date: 09/11/2023 -ms.topic: how-to +ms.date: 10/09/2024 +ms.topic: conceptual ms.service: microsoft-intune ms.subservice: protect ms.localizationpriority: high @@ -33,21 +33,22 @@ ms.collection: # Prerequisites for the Certificate Connector for Microsoft Intune -Before you install and configure the Certificate Connector for Microsoft Intune, review the prerequisites and infrastructure requirements, which can vary depending on the features you’ll configure a connector instance to support. +Review the prerequisites and infrastructure requirements for the Certificate Connector for Microsoft Intune. Some prerequisites and infrastructure requirements can vary depending on the features you configure a connector instance to support. ## General prerequisites Requirements for the computer where you install the connector software: - Windows Server 2012 R2 or later. + > [!NOTE] > The Server installation must include the Desktop Experience and support use of a browser. For more information, see [Install Server with Desktop Experience](/windows-server/get-started/getting-started-with-server-with-desktop-experience) in the Windows Server 2016 documentation. - .NET 4.7.2 -- Transport Layer Security (TLS) 1.2. For more information, see [Enable support for TLS 1.2 in your environment](/troubleshoot/azure/active-directory/enable-support-tls-environment) in the Microsoft Entra documentation. +- Transport Layer Security (TLS) 1.2. For more information, see [Enable support for TLS 1.2 in your environment](/troubleshoot/azure/active-directory/enable-support-tls-environment) in the Microsoft Entra documentation. -- The server must meet the same network requirements as managed devices. See [Network endpoints for Microsoft Intune](../fundamentals/intune-endpoints.md), and [Intune network configuration requirements and bandwidth](../fundamentals/network-bandwidth-use.md) +- The server must meet the same network requirements as managed devices. See [Network endpoints for Microsoft Intune](../fundamentals/intune-endpoints.md), and [Intune network configuration requirements and bandwidth](../fundamentals/network-bandwidth-use.md). - To support automatic updates of the connector software, the server must have access to the **Azure update service**: - Port: **443** @@ -57,9 +58,9 @@ Requirements for the computer where you install the connector software: ## PKCS -Requirements for PKCS certificate templates: +Requirements for private and public key pair (PKCS) certificate templates: -- Certificate templates you’ll use for PKCS requests must be configured with permissions that allow the certificate connector service account to enroll the certificate. +- Certificate templates that you use for PKCS requests must be configured with permissions that allow the certificate connector service account to enroll the certificate. - The certificate templates must be added to the Certification Authority (CA). > [!NOTE] @@ -68,9 +69,9 @@ Requirements for PKCS certificate templates: ## PKCS imported certificates -To support PKCS imported certificates, the server that hosts the connector requires additional configurations, such as configuring a Key storage provider access to allow the Connector Service User to retrieve keys. +To support PKCS imported certificates, the server that hosts the connector requires additional configurations, such as configuring a Key storage provider access to allow the Connector Service User to retrieve keys. -For information about support for PKCS imported certificates, see [Configure and use imported PKCS certificates with Intune](../protect/certificates-imported-pfx-configure.md) +For information about support for PKCS imported certificates, see [Configure and use imported PKCS certificates with Intune](../protect/certificates-imported-pfx-configure.md). ## Revocation Prerequisites @@ -78,12 +79,12 @@ For information about support for PKCS imported certificates, see [Configure and ## SCEP -The Windows Server that hosts the connector must meet the following prerequisites that are in addition to the general prerequisites: +To support Simple Certificate Enrollment Protocol (SCEP) certificates, the Windows Server that hosts the connector must meet the following prerequisites in addition to the [general prerequisites](#general-prerequisites): - IIS 7 or higher -- Network Device Enrollment Service (NDES) service, which is part of the Active Directory Certification Services role. The connector isn't supported on the same server as your issuing Certification Authority (CA). For more information,see [Configure infrastructure to support SCEP with Intune](../protect/certificates-scep-configure.md) +- Network Device Enrollment Service (NDES) service, which is part of the Active Directory Certification Services role. The connector isn't supported on the same server as your issuing Certification Authority (CA). For more information, see [Configure infrastructure to support SCEP with Intune](../protect/certificates-scep-configure.md). -On the Windows Server, configure select the following Server Roles and Features: +On the Windows Server, select to add the following Server Roles and Features: - **Server Roles**: - Active Directory Certificate Services @@ -97,7 +98,7 @@ On the Windows Server, configure select the following Server Roles and Features: - HTTP Activation - **AD CS > Role Services**: - - Network Device Enrollment Service - For the connector SCEP when you use a Microsoft CA, [install and configure](../protect/certificates-scep-configure.md#set-up-ndes) the **Network Device Enrollment Service** (NDES) server role. When you configure NDES, you’ll need to assign a user account for use by the [NDES application pool](#ndes-application-pool-user). NDES also has its own requirements. + - Network Device Enrollment Service - For the connector SCEP when you use a Microsoft CA, [install, and configure](../protect/certificates-scep-configure.md#set-up-ndes) the **Network Device Enrollment Service** (NDES) server role. When you configure NDES, you need to assign a user account for use by the [NDES application pool](#ndes-application-pool-user). NDES also has its own requirements. - **Web Server Role (IIS) > Role Services**: - Security @@ -117,7 +118,7 @@ On the Windows Server, configure select the following Server Roles and Features: Requirements for SCEP certificate templates: -- Certificate templates you’ll use for SCEP requests must be configured with permissions that allow the Certificate Connector service account to auto enroll the certificate. +- Certificate templates you use for SCEP requests must be configured with permissions that allow the Certificate Connector service account to auto enroll the certificate. - The certificate templates must be added to the CA. ## Accounts @@ -136,7 +137,7 @@ The connector service account must have the following permissions: - [**Logon as Service**](/system-center/scsm/enable-service-log-on-sm?view=sc-sm-2019&preserve-view=true) - **Issue and Manage Certificates** permissions on the Certification Authority (required only for revocation scenarios). -- **Read** and **Enroll** permissions on any certificate template that you’ll use to issue certificates. +- **Read** and **Enroll** permissions on any certificate template that you use to issue certificates. - Permissions to the **Key Storage Provider** (KSP) that’s used by PFX Import. See [Import PFX Certificates to Intune](../protect/certificates-imported-pfx-configure.md#import-pfx-certificates). The following options are supported for use as the certificate connector service account: @@ -148,18 +149,16 @@ For more information, see [Install the Certificate Connector for Microsoft Intun ### NDES application pool user -To use SCEP with a Microsoft CA, you’ll need to add NDES to the server that hosts the connector before installing the connector. When you configure NDES, you’ll need to specify an account for use as the application pool user, which can also be referred to as the NDES service account. This account can be a local or domain user account and must have the following permissions: +To use SCEP with a Microsoft CA, you need to add NDES to the server that hosts the connector before installing the connector. When you configure NDES, you need to specify an account for use as the application pool user, which can also be referred to as the NDES service account. This account can be a local or domain user account and must have the following permissions: -- **Read** and **Enroll** permissions on each SCEP certificate template you’ll use to issue certificates. +- **Read** and **Enroll** permissions on each SCEP certificate template you use to issue certificates. - Member of the **IIS_IUSRS** group. For guidance on configuring the NDES server role for the Certificate Connector for Microsoft Intune, see [Set up NDES](../protect/certificates-scep-configure.md#set-up-ndes) in **Configure infrastructure to support SCEP with Intune**. - - ### Microsoft Entra user -When configuring the connector, you'll need to use a user account that: is either a Global Admin or Intune Admin and has an Intune license assigned. +When configuring the connector, you need to use a user account that: is either a Global Admin or Intune Admin and has an Intune license assigned. ## Next steps diff --git a/memdocs/intune/protect/certificates-configure.md b/memdocs/intune/protect/certificates-configure.md index 2b3a24ce2ad..cda2beba9d0 100644 --- a/memdocs/intune/protect/certificates-configure.md +++ b/memdocs/intune/protect/certificates-configure.md @@ -1,13 +1,13 @@ --- # required metadata -title: Learn about the types of certificate that are supported by Microsoft Intune +title: Types of certificate that are supported by Microsoft Intune description: Learn about Microsoft Intune's support for Simple Certificate Enrollment Protocol (SCEP), Public Key Cryptography Standards (PKCS) certificates. keywords: author: lenewsad ms.author: lanewsad manager: dougeby -ms.date: 08/21/2023 +ms.date: 10/04/2024 ms.topic: conceptual ms.service: microsoft-intune ms.subservice: protect @@ -58,7 +58,8 @@ To provision a user or device with a specific type of certificate, Intune uses a In addition to the three certificate types and provisioning methods, you need a trusted root certificate from a trusted Certification Authority (CA). The CA can be an on-premises Microsoft Certification Authority, or a [third-party Certification Authority](certificate-authority-add-scep-overview.md). The trusted root certificate establishes a trust from the device to your root or intermediate (issuing) CA from which the other certificates are issued. To deploy this certificate, you use the *trusted certificate* profile, and deploy it to the same devices and users that receive the certificate profiles for SCEP, PKCS, and imported PKCS. -> [!TIP] +> [!TIP] +> > Intune also supports use of [Derived credentials](derived-credentials.md) for environments that require use of smartcards. ### What’s required to use certificates @@ -120,11 +121,13 @@ When you use a Microsoft Certification Authority (CA): When you use a third-party (non-Microsoft) Certification Authority (CA): -- To use SCEP certificate profiles: +- SCEP certificate profiles don't require use of the Microsoft Intune Certificate Connector. Instead, the third-party CA handles the certificate issuance and management directly. To use SCEP certificate profiles without the Intune Certificate Connector: - Configure integration with a third-party CA from [one of our supported partners](certificate-authority-add-scep-overview.md#third-party-certification-authority-partners). Setup includes following the instructions from the third-party CA to complete integration of their CA with Intune. - [Create an application in Microsoft Entra ID](certificate-authority-add-scep-overview.md#set-up-third-party-ca-integration) that delegates rights to Intune to do SCEP certificate challenge validation. + + For more information, see [Set up third-party CA integration](../protect/certificate-authority-add-scep-overview.md#set-up-third-party-ca-integration) -- PKCS imported certificates require you to [Install the Certificate Connector for Microsoft Intune](certificate-connector-install.md). +- PKCS imported certificates require use of the Microsoft Intune Certificate Connector. See [Install the Certificate Connector for Microsoft Intune](certificate-connector-install.md). - Deploy certificates by using the following mechanisms: - [Trusted certificate profiles](certificates-trusted-root.md#create-trusted-certificate-profiles) to deploy the Trusted Root CA certificate from your root or intermediate (issuing) CA to devices @@ -152,10 +155,9 @@ When you use a third-party (non-Microsoft) Certification Authority (CA): [!INCLUDE [windows-phone-81-windows-10-mobile-support](../includes/windows-phone-81-windows-10-mobile-support.md)] +[!INCLUDE [android-device-administrator-support](../includes/android-device-administrator-support.md)] - [!INCLUDE [android_device_administrator_support](../includes/android-device-administrator-support.md)] - -## Next steps +## Related content More resources: diff --git a/memdocs/intune/protect/certificates-digicert-configure.md b/memdocs/intune/protect/certificates-digicert-configure.md index c4dcae6e38a..a0d29c11d14 100644 --- a/memdocs/intune/protect/certificates-digicert-configure.md +++ b/memdocs/intune/protect/certificates-digicert-configure.md @@ -6,7 +6,7 @@ keywords: author: lenewsad ms.author: lanewsad manager: dougeby -ms.date: 03/14/2022 +ms.date: 10/09/2024 ms.topic: how-to ms.service: microsoft-intune ms.subservice: protect @@ -30,39 +30,41 @@ ms.collection: - certificates - sub-certificates --- + # Set up the Certificate Connector for Microsoft Intune to support the DigiCert PKI Platform -You can use the *Certificate Connector for Microsoft Intune* to issue PKCS certificates from DigiCert PKI Platform to Intune-managed devices. The certificate connector works with either a DigiCert certification authority (CA) only, or with both a DigiCert CA and a Microsoft CA. +You can use the *Certificate Connector for Microsoft Intune* to issue Public Key Cryptography Standards (PKCS) certificates from DigiCert PKI Platform to Intune-managed devices. The certificate connector works with either a DigiCert certification authority (CA) only, or with both a DigiCert CA and a Microsoft CA. > [!TIP] > DigiCert acquired Symantec's Website Security and related PKI Solutions business. For more information about this change, see the [Symantec technical support article](https://support.symantec.com/en_US/article.INFO4722.html). If you already use the Certificate Connector for Microsoft Intune to issue certificates from a Microsoft CA by using PKCS or Simple Certificate Enrollment Protocol (SCEP), you can use that same connector to configure and issue PKCS certificates from a DigiCert CA. After you complete the configuration to support the DigiCert CA, the connector can issue the following certificates: -* PKCS certificates from a Microsoft CA -* PKCS certificates from a DigiCert CA -* Endpoint Protection certificates from a Microsoft CA +- PKCS certificates from a Microsoft CA +- PKCS certificates from a DigiCert CA +- Endpoint Protection certificates from a Microsoft CA -If you don't have the connector installed but plan to use it for both a Microsoft CA and a DigiCert CA, complete the connector configuration for the Microsoft CA first. Then, return to this article to configure it to also support DigiCert. For more information about certificate profiles and the connector, see [Configure a certificate profile for your devices in Microsoft Intune](certificates-configure.md). +If you don't have the connector installed but plan to use it for both a Microsoft CA and a DigiCert CA, complete the connector configuration for the Microsoft CA first. Then, return to this article to configure it to also support DigiCert. For more information about certificate profiles and the connector, see [Configure a certificate profile for your devices in Microsoft Intune](certificates-configure.md). -If you'll use the connector with only the DigiCert CA, you can use the instructions in this article to install and then configure the connector. +To use the connector with only the DigiCert CA, use the instructions in this article to install and then configure the connector. ## Prerequisites -You'll need the following to support use of a DigiCert CA: +The following are requirements to support use of a DigiCert CA: - **An active subscription at the DigiCert CA** - The subscription is required to get a registration authority (RA) certificate from the DigiCert CA. -- **Certificate Connector for Microsoft Intune** - You'll be instructed to install and configure the certificate connector later in this article. To help you plan for the connectors prerequesites in advance, see the following articles: +- **Certificate Connector for Microsoft Intune** - Later in this article there are instructions for installing and configuring the certificate connector. To help you plan for the connectors prerequisites in advance, see the following articles: - - Overview of the [Certificate Connector for Microsoft Intune](certificate-connector-overview.md). - - [Prerequisites](certificate-connector-prerequisites.md). - - [Installation and configuration](certificate-connector-install.md). + - Overview of the [Certificate Connector for Microsoft Intune](certificate-connector-overview.md) + - [Prerequisites](certificate-connector-prerequisites.md) + - [Installation and configuration](certificate-connector-install.md) ## Install the DigiCert RA certificate 1. Save the following code snippet as in a file named **certreq.ini** and update it as required (for example: *Subject name in CN format*). - ``` + ```ini + [Version] Signature="$Windows NT$" @@ -84,7 +86,7 @@ You'll need the following to support use of a DigiCert CA: KeyUsage = 0xa0 [EnhancedKeyUsageExtension] - OID=1.3.6.1.5.5.7.3.2 ; Client Authentication // Uncomment if you need a mutual TLS authentication + OID=1.3.6.1.5.5.7.3.2 ; Client Authentication // Uncomment if you need a mutual TLS authentication ;----------------------------------------------- ``` @@ -148,11 +150,11 @@ You'll need the following to support use of a DigiCert CA: f. Use the procedure from step 5 to import the private key certificate into the **Local Computer-Personal** store. - g. Record a copy the RA certificate thumbprint without any spaces. The following is an example of the thumbprint: + g. Record a copy the RA certificate thumbprint without any spaces. For example: `RA Cert Thumbprint: "EA7A4E0CD1A4F81CF0740527C31A57F6020C17C5"` - - Later, after you install the Certificate Connector for Microsoft Intune, you'll use this value to update three .config files for the connector. + + Later, you'll use this value to update three .config files for the Certificate Connector for Microsoft Intune, after installing the connector. > [!NOTE] > For assistance in getting the RA certificate from the DigiCert CA, contact [DigiCert customer support](mailto:enterprise-pkisupport@digicert.com). @@ -168,15 +170,15 @@ You'll need the following to support use of a DigiCert CA: 1. On the server where the connector installed, go to *%ProgramFiles%\Microsoft Intune\PFXCertificateConnector\ConnectorSvc*. (By default, the Certificate Connector for Microsoft Intune installs to %ProgramFiles%\Microsoft Intune\PFXCertificateConnector.) - 2. Use a simple text editor like Notepad.exe to update the *RACertThumbprint* key value in the following three files. Replace the value in the files with the value you copied during step **6.g.** of the procedure in the [preceding section](#install-the-digicert-ra-certificate): + 2. Use a text editor like Notepad.exe to update the *RACertThumbprint* key value in the following three files. Replace the value in the files with the value you copied during step **6.g.** of the procedure in the [preceding section](#install-the-digicert-ra-certificate): - Microsoft.Intune.ConnectorsPkiCreate.exe.config - Microsoft.Intune.ConnectorsPkiRevoke.exe.config - Microsoft.Intune.ConnectorsPkiCreateLegacy.exe.config - For example, locate the entry in each file that is similar to ``, and replace `EA7A4E0CD1A4F81CF0740527C31A57F6020C17C5` with the new *RA Cert Thumbprint* value. + For example, locate the entry in each file that is similar to ``, and replace `EA7A4E0CD1A4F81CF0740527C31A57F6020C17C5` with the new *RA Cert Thumbprint* value. - 3. Run **services.msc** and stop and then restart the following three services: + 3. Run **services.msc** and stop and then restart the following three services: - PFX Revoke Certificate Connector for Microsoft Intune (PkiRevokeConnectorSvc) - PFX Create Certificate Connector for Microsoft Intune (PkiCreateConnectorSvc) @@ -184,7 +186,7 @@ You'll need the following to support use of a DigiCert CA: ## Create a trusted certificate profile -The PKCS certificates you'll deploy for Intune managed devices must be chained with a trusted root certificate. To establish this chain, create an Intune trusted certificate profile with the root certificate from the DigiCert CA, and deploy both the trusted certificate profile and the PKCS certificate profile to the same groups. +The PKCS certificates you deploy for Intune managed devices must be chained with a trusted root certificate. To establish this chain, create an Intune trusted certificate profile with the root certificate from the DigiCert CA, and deploy both the trusted certificate profile and the PKCS certificate profile to the same groups. 1. Get a trusted root certificate from the DigiCert CA: @@ -198,9 +200,9 @@ The PKCS certificates you'll deploy for Intune managed devices must be chained w 2. Create a trusted certificate profile in the Microsoft Intune admin center. For detailed guidance, see [To create a trusted certificate profile](../protect/certificates-trusted-root.md#to-create-a-trusted-certificate-profile). Be sure to assign this profile to devices that will receive certificates. To assign the profile to groups, see [Assign device profiles](../configuration/device-profile-assign.md). - After you create the profile, it appears in the list of profiles in the **Device configuration – Profiles** pane, with a profile type of **Trusted certificate**. + After you create the profile, it appears in the list of profiles in the **Device configuration – Profiles** pane, with a profile type of **Trusted certificate**. -## Get the certificate profile OID +## Get the certificate profile OID The certificate profile OID is associated with a certificate profile template in the DigiCert CA. To create a PKCS certificate profile in Intune, the certificate template name must be in the form of a certificate profile OID that is associated with a certificate template in the DigiCert CA. @@ -236,9 +238,9 @@ The certificate profile OID is associated with a certificate profile template in |PKCS certificate parameter | Value | Description | | --- | --- | --- | - | Certificate authority | pki-ws.symauth.com | This value must be the DigiCert CA base service FQDN without trailing slashes. If you aren't sure whether this is the correct base service FQDN for your DigiCert CA subscription, contact DigiCert customer support.

*With the change from Symantec to DigiCert, this URL remains unchanged*.

If this FQDN is incorrect, the certificate connector won't issue PKCS certificates from the DigiCert CA.| - | Certificate authority name | Symantec | This value must be the string **Symantec**.

If there's any change to this value, the certificate connector won't issue PKCS certificates from the DigiCert CA.| - | Certificate template name | Certificate profile OID from the DigiCert CA. For example: **2.16.840.1.113733.1.16.1.2.3.1.1.61904612**| This value must be a certificate profile OID [obtained in the previous section](#get-the-certificate-profile-oid) from the DigiCert CA certificate profile template.

If the certificate connector can't find a certificate template associated with this certificate profile OID in the DigiCert CA, it won't issue PKCS certificates from the DigiCert CA.| + | Certificate authority | pki-ws.symauth.com | This value must be the DigiCert CA base service FQDN without trailing slashes. If you aren't sure whether this is the correct base service FQDN for your DigiCert CA subscription, contact DigiCert customer support.

*With the change from Symantec to DigiCert, this URL remains unchanged*.

If this FQDN is incorrect, the certificate connector doesn't issue PKCS certificates from the DigiCert CA.| + | Certificate authority name | Symantec | This value must be the string **Symantec**.

If there's any change to this value, the certificate connector doesn't issue PKCS certificates from the DigiCert CA.| + | Certificate template name | Certificate profile OID from the DigiCert CA. For example: **2.16.840.1.113733.1.16.1.2.3.1.1.61904612**| This value must be a certificate profile OID [obtained in the previous section](#get-the-certificate-profile-oid) from the DigiCert CA certificate profile template.

If the certificate connector can't find a certificate template associated with this certificate profile OID in the DigiCert CA, it doesn't issue PKCS certificates from the DigiCert CA.| ![Selections for CA and certificate template](./media/certificates-digicert-configure/certificates-digicert-pkcs-example.png) @@ -247,21 +249,21 @@ The certificate profile OID is associated with a certificate profile template in 7. Complete the configuration of the profile to meet your business needs, and then select **Create** to save the profile. -8. On the *Overview* page of the new profile, select **Assignments** and configure an appropriate group that will receive this profile. At least one user or device must be part of the assigned group. +8. On the *Overview* page of the new profile, select **Assignments** and configure an appropriate group to receive this profile. At least one user or device must be part of the assigned group. -After you complete the previous steps, Certificate Connector for Microsoft Intune will issue PKCS certificates from the DigiCert CA to Intune-managed devices in the assigned group. These certificates will be available in the **Personal** store of the **Current User** certificate store on the Intune-managed device. +After you complete the previous steps, Certificate Connector for Microsoft Intune will issue PKCS certificates from the DigiCert CA to Intune-managed devices in the assigned group. These certificates are available in the **Personal** store of the **Current User** certificate store on the Intune-managed device. ### Supported attributes for the PKCS certificate profile |Attribute | Intune supported formats | DigiCert Cloud CA supported formats | result | | --- | --- | --- | --- | -| Subject name |Intune supports the subject name in following three formats only:

1. Common name
2. Common name that includes email
3. Common name as email

For example:

`CN = IWUser0

E = IWUser0@samplendes.onmicrosoft.com` | The DigiCert CA supports more attributes. If you want to select more attributes, they must be defined with fixed values in the DigiCert certificate profile template.| We use common name or email from the PKCS certificate request.

Any mismatch in attribute selection between the Intune certificate profile and the DigiCert certificate profile template results in no certificates issued from the DigiCert CA.| -| SAN | Intune supports only the following SAN field values:

**AltNameTypeEmail**
**AltNameTypeUpn**
**AltNameTypeOtherName** (encoded value) | The DigiCert Cloud CA also supports these parameters. If you want to select more attributes, they must be defined with fixed values in the DigiCert certificate profile template.

**AltNameTypeEmail**: If this type isn't found in the SAN, the certificate connector uses the value from **AltNameTypeUpn**. If **AltNameTypeUpn** is also not found in the SAN, then the certificate connector uses the value from the subject name if it's in email format. If the type is still not found, the certificate connector fails to issue the certificates.

Example: `RFC822 Name=IWUser0@ndesvenkatb.onmicrosoft.com`

**AltNameTypeUpn**: If this type is not found in the SAN, the certificate connector uses the value from **AltNameTypeEmail**. If **AltNameTypeEmail** is also not found in the SAN, then the certificate connector uses the value from subject name if it's in email format. If the type is still not found, the certificate connector fails to issue the certificates.

Example: `Other Name: Principal Name=IWUser0@ndesvenkatb.onmicrosoft.com`

**AltNameTypeOtherName**: If this type isn't found in the SAN, the certificate connector fails to issue the certificates.

Example: `Other Name: DS Object Guid=04 12 b8 ba 65 41 f2 d4 07 41 a9 f7 47 08 f3 e4 28 5c ef 2c`

The value of this field is supported only in encoded format (hexadecimal value) by the DigiCert CA. For any value in this field, the certificate connector converts it to base64 encoding before it submits the certificate request. *Certificate Connector for Microsoft Intune doesn't validate whether this value is already encoded or not.* | None | +| Subject name |Intune supports the subject name in following three formats only:

1. Common name
2. Common name that includes email
3. Common name as email

For example:

`CN = IWUser0

E = IWUser0@samplendes.onmicrosoft.com` | The DigiCert CA supports more attributes. If you want to select more attributes, they must be defined with fixed values in the DigiCert certificate profile template.| We use common name or email from the PKCS certificate request.

Any mismatch in attribute selection between the Intune certificate profile and the DigiCert certificate profile template results in no certificates issued from the DigiCert CA.| +| SAN | Intune supports only the following SAN field values:

**AltNameTypeEmail**
**AltNameTypeUpn**
**AltNameTypeOtherName** (encoded value) | The DigiCert Cloud CA also supports these parameters. If you want to select more attributes, they must be defined with fixed values in the DigiCert certificate profile template.

**AltNameTypeEmail**: If this type isn't found in the SAN, the certificate connector uses the value from **AltNameTypeUpn**. If **AltNameTypeUpn** is also not found in the SAN, then the certificate connector uses the value from the subject name if it's in email format. If the type is still not found, the certificate connector fails to issue the certificates.

Example: `RFC822 Name=IWUser0@ndesvenkatb.onmicrosoft.com`

**AltNameTypeUpn**: If this type isn't found in the SAN, the certificate connector uses the value from **AltNameTypeEmail**. If **AltNameTypeEmail** is also not found in the SAN, then the certificate connector uses the value from subject name if it's in email format. If the type is still not found, the certificate connector fails to issue the certificates.

Example: `Other Name: Principal Name=IWUser0@ndesvenkatb.onmicrosoft.com`

**AltNameTypeOtherName**: If this type isn't found in the SAN, the certificate connector fails to issue the certificates.

Example: `Other Name: DS Object Guid=04 12 b8 ba 65 41 f2 d4 07 41 a9 f7 47 08 f3 e4 28 5c ef 2c`

The value of this field is supported only in encoded format (hexadecimal value) by the DigiCert CA. For any value in this field, the certificate connector converts it to base64 encoding before it submits the certificate request. *Certificate Connector for Microsoft Intune doesn't validate whether this value is already encoded or not.* | None | ## Troubleshooting -Logs for the Certificate Connector for Microsoft Intune are available as Event logs on the server where the connector is installed. These logs provide details about the connectors operation, and can be used to identify problems with the certificate connector and operations. For more information, see [Logging](../protect/certificate-connector-overview.md#logging). +Logs for the Certificate Connector for Microsoft Intune are available as Event logs on the server where the connector is installed. These logs provide details about the connectors operation, and can be used to identify problems with the certificate connector and operations. For more information, see [Logging](../protect/certificate-connector-overview.md#logging). -## Next steps +## Related content Use the information in this article with the information in [What are Microsoft Intune device profiles?](../configuration/device-profiles.md) to manage your organization's devices and the certificates on them. diff --git a/memdocs/intune/protect/certificates-pfx-configure.md b/memdocs/intune/protect/certificates-pfx-configure.md index b36525f9c69..06c5940cecb 100644 --- a/memdocs/intune/protect/certificates-pfx-configure.md +++ b/memdocs/intune/protect/certificates-pfx-configure.md @@ -5,7 +5,7 @@ keywords: author: lenewsad ms.author: lanewsad manager: dougeby -ms.date: 08/23/2023 +ms.date: 10/01/2024 ms.topic: how-to ms.service: microsoft-intune ms.subservice: protect @@ -32,7 +32,14 @@ ms.collection: --- # Configure and use PKCS certificates with Intune -Microsoft Intune supports the use of private and public key pair (PKCS) certificates. This article reviews what's required to use PKCS certificates with Intune, including the export of a PKCS certificate then adding it to an Intune device configuration profile. +**Applies to**L +- Android +- iOS/iPadOS +- macOS +- Windows 10/11 + + +Microsoft Intune supports the use of private and public key pair (PKCS) certificates. This article reviews the requirements for PKCS certificates with Intune, including the export of a PKCS certificate then adding it to an Intune device configuration profile. Microsoft Intune includes built-in settings to use PKCS certificates for access and authentication to your organizations resources. Certificates authenticate and secure access to your corporate resources like a VPN or a WiFi network. You deploy these settings to devices using device configuration profiles in Intune. @@ -43,46 +50,94 @@ For information about using imported PKCS certificates, see [Imported PFX Certif ## Requirements -To use PKCS certificates with Intune, you'll need the following infrastructure: +To use PKCS certificates with Intune, you need the following infrastructure: -- **Active Directory domain**: - All servers listed in this section must be joined to your Active Directory domain. +- Active Directory domain: All servers listed in this section must be joined to your Active Directory domain. - For more information about installing and configuring Active Directory Domain Services (AD DS), see [AD DS Design and Planning](/windows-server/identity/ad-ds/plan/ad-ds-design-and-planning). + For more information about installing and configuring Active Directory Domain Services (AD DS), see [AD DS Design and Planning](/windows-server/identity/ad-ds/plan/ad-ds-design-and-planning). -- **Certification Authority**: - An Enterprise Certification Authority (CA). +- Certification Authority: An Enterprise Certification Authority (CA). - For information on installing and configuring Active Directory Certificate Services (AD CS), see [Active Directory Certificate Services Step-by-Step Guide](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc772393(v=ws.10)). + For information on installing and configuring Active Directory Certificate Services (AD CS), see [Active Directory Certificate Services Step-by-Step Guide](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc772393(v=ws.10)). > [!WARNING] > Intune requires you to run AD CS with an Enterprise Certification Authority (CA), not a Standalone CA. -- **A client**: - To connect to the Enterprise CA. +- A client: To connect to the Enterprise CA. + +- Root certificate: An exported copy of your root certificate from your Enterprise CA. + +- Certificate Connector for Microsoft Intune: For information about the certificate connector, see: + + - Overview of the [Certificate Connector for Microsoft Intune](certificate-connector-overview.md) + - [Prerequisites](certificate-connector-prerequisites.md) + - [Installation and configuration](certificate-connector-install.md) + +## Update certificate connector: Strong mapping requirements for KB5014754 + +The Key Distribution Center (KDC) requires a strong mapping format in PKCS certificates deployed by Microsoft Intune and used for certificate-based authentication. The mapping must have a security identifier (SID) extension that maps to the user or device SID. If a certificate doesn't meet the new strong mapping criteria set by the full enforcement mode date, authentication will be denied. For more information about the requirements, see [KB5014754: Certificate-based authentication changes on Windows domain controllers ](https://support.microsoft.com/topic/kb5014754-certificate-based-authentication-changes-on-windows-domain-controllers-ad2c23b0-15d8-4340-a468-4d4f3b188f16). + +In the Microsoft Intune Certificate Connector, version 6.2406.0.1001, we released an update that adds the object identifier attribute containing the user or device SID to the certificate, effectively satisfying the strong mapping requirements. This update applies to users and devices synced from an on-premises Active Directory to Microsoft Entra ID, and is available across all platforms, with some differences: + + * Strong mapping changes apply to *user certificates* for all OS platforms. + + * Strong mapping changes apply to *device certificates* for Microsoft Entra hybrid-joined Windows devices. + + To ensure that certficate-based authentication continues working, you must take the following actions: + +- Update the Microsoft Intune Certificate Connector to version 6.2406.0.1001. For information about the latest version and how to update the certificate connector, see [Certificate connector for Microsoft Intune](certificate-connector-overview.md). -- **Root certificate**: - An exported copy of your root certificate from your Enterprise CA. +- Make changes to registry key information on the Windows server that hosts the certificate connector. -- **Certificate Connector for Microsoft Intune**: +Complete the following procedure to modify the registry keys and apply the strong mapping changes to certificates. These changes apply to new PKCS certificates and PKCS certificates that are being renewed. - For information about the certificate connector, see: +>[!TIP] +> This procedure requires you to modify the registry in Windows. For more information, see the following resources on Microsoft Support: +> - [How to back up and restore the registry in Windows - Microsoft Support](https://support.microsoft.com/topic/how-to-back-up-and-restore-the-registry-in-windows-855140ad-e318-2a13-2829-d428a2ab0692) +> - [How to add, modify, or delete registry subkeys and values by using a .reg file - Microsoft Support](https://support.microsoft.com/topic/how-to-add-modify-or-delete-registry-subkeys-and-values-by-using-a-reg-file-9c7f37cf-a5e9-e1cd-c4fa-2a26218a1a23) - - Overview of the [Certificate Connector for Microsoft Intune](certificate-connector-overview.md). - - [Prerequisites](certificate-connector-prerequisites.md). - - [Installation and configuration](certificate-connector-install.md). +1. In the Windows registry, change the value for `[HKLM\Software\Microsoft\MicrosoftIntune\PFXCertificateConnector](DWORD)EnableSidSecurityExtension` to **1**. + +1. Restart the certificate connector service. + 1. Go to **Start** > **Run**. + 2. Open **services.msc**. + 3. Restart these services: + - **PFX Create Legacy Connector for Microsoft Intune** + + - **PFX Create Certificate Connector for Microsoft Intune** + +1. Changes begin applying to all new certificates, and to certificates being renewed. To verify that authentication works, we recommend testing all places where certificate-based authentication could be used, including: + - Apps + - Intune-integrated certification authorities + - NAC solutions + - Networking infrastructure + + To roll back changes: + + 1. Restore the original registry settings. + + 1. Restart these services: + + - **PFX Create Legacy Connector for Microsoft Intune** + + - **PFX Create Certificate Connector for Microsoft Intune** + + 1. Create a new PKCS certificate profile for affected devices, to reissue certificates without the SID attribute. + + > [!TIP] + > If you use a Digicert CA, you must create a certificate template for users with an SID and another template for users without an SID. For more information, see the [DigiCert PKI Platform 8.24.1 release notes](https://knowledge.digicert.com/general-information/release-notes-pki). ## Export the root certificate from the Enterprise CA To authenticate a device with VPN, WiFi, or other resources, a device needs a root or intermediate CA certificate. The following steps explain how to get the required certificate from your Enterprise CA. -**Use a command line**: +Use a command line to complete these steps: -1. Log in to the Root Certification Authority server with Administrator Account. +1. Sign in to the Root Certification Authority server with Administrator Account. -2. Go to **Start** > **Run**, and then enter **Cmd** to open command prompt. +2. Go to **Start** > **Run**, and then enter **Cmd** to open a command prompt. -3. Specify **certutil -ca.cert ca_name.cer** to export the Root certificate as a file named *ca_name.cer*. +3. Enter **certutil -ca.cert ca_name.cer** to export the root certificate as a file named *ca_name.cer*. ## Configure certificate templates on the CA @@ -91,7 +146,7 @@ To authenticate a device with VPN, WiFi, or other resources, a device needs a ro 3. Find the **User** certificate template, right-click it, and choose **Duplicate Template** to open **Properties of New Template**. > [!NOTE] - > For S/MIME email signing and encryption scenarios, many administrators use separate certificates for signing and encryption. If you're using Microsoft Active Directory Certificate Services, you can use the **Exchange Signature Only** template for S/MIME email signing certificates, and the **Exchange User** template for S/MIME encryption certificates. If you're using a 3rd-party certification authority, it's suggested to review their guidance to set up signing and encryption templates. + > For S/MIME email signing and encryption scenarios, many administrators use separate certificates for signing and encryption. If you're using Microsoft Active Directory Certificate Services, you can use the Exchange Signature Only template for S/MIME email signing certificates, and the Exchange User template for S/MIME encryption certificates. If you're using a non-Microsoft certification authority, we recommend reviewing their guidance to set up signing and encryption templates. 4. On the **Compatibility** tab: @@ -100,50 +155,55 @@ To authenticate a device with VPN, WiFi, or other resources, a device needs a ro 5. On the **General** tab: - - set **Template display name** to something meaningful to you. - - Uncheck **Publish certificate in Active Directory**. + - Set **Template display name** to something meaningful to you. + - Deselect **Publish certificate in Active Directory**. > [!WARNING] - > **Template name** by default is the same as **Template display name** with *no spaces*. Note the template name, you need it later. + > **Template name** by default is the same as **Template display name** with *no spaces*. Note the template name, because you need it later. -8. In **Request Handling**, select **Allow private key to be exported**. +8. In **Request Handling**, select **Allow private key to be exported**. > [!NOTE] > > Unlike SCEP, with PKCS the certificate private key is generated on the server where the certificate connector is installed and not on the device. The certificate template must allow the private key to be exported so that the connector can export the PFX certificate and send it to the device. > - > When the certificates install on the device itself, the private key is marked as not exportable. + > After the certificates install on the device, the private key is marked as not exportable. -9. In **Cryptography**, confirm that the **Minimum key size** is set to 2048. +9. In **Cryptography**, confirm that the **Minimum key size** is set to 2048. - Windows and Android devices support use of 4096-bit key size with a PKCS certificate profile. To use this key size, specify 4096 as the *Minimum key size*. + Windows and Android devices support the use of 4096-bit key size with a PKCS certificate profile. To use this key size, adjust the value to 4096. > [!NOTE] > - > For Windows devices, 4096-bit key storage is supported only in the *Software Key Storage Provider* (KSP). The following do not support storing keys of this size: + > For Windows devices, 4096-bit key storage is supported only in the Software Key Storage Provider (KSP). The following features do not support storage for keys of this size: > - > - The hardware TPM (Trusted Platform Module). As a workaround you can use the Software KSP for key storage. - > - Windows Hello for Business. There is no workaround for Windows Hello for Business at this time. + > - The hardware TPM (Trusted Platform Module): As a workaround you can use the Software KSP for key storage. + > - Windows Hello for Business: There is no workaround for Windows Hello for Business at this time. -10. In **Subject Name**, choose **Supply in the request**. -11. In **Extensions**, confirm that you see Encrypting File System, Secure Email, and Client Authentication under **Application Policies**. +10. In **Subject Name**, choose **Supply in the request**. +11. In **Extensions**, under **Application Policies**, confirm that you see **Encrypting File System**, **Secure Email**, and **Client Authentication**. > [!IMPORTANT] - > For iOS/iPadOS certificate templates, go to the **Extensions** tab, update **Key Usage**, and confirm that **Signature is proof of origin** isn't selected. + > For iOS/iPadOS certificate templates, go to the **Extensions** tab, update **Key Usage**, and then deselect **Signature is proof of origin**. -12. In **Security**: - 1. (Required): Add the Computer Account for the server where you install the Certificate Connector for Microsoft Intune. Allow this account **Read** and **Enroll** permissions. - 1. (Optional but recommended): Remove the Domain Users group from the list of groups or user names allowed permissions on this template by selecting the **Domain Users** group and select *Remove*. Review the other entries in *Groups or user names* for permissions and applicability to your environment. +12. In **Security**: + 1. Add the computer account for the server where you install the Certificate Connector for Microsoft Intune. Allow this account **Read** and **Enroll** permissions. + 1. (Optional but recommended) Remove the domain users group from the list of groups or user names allowed permissions on this template. To remove the group: + 1. Select the **Domain Users** group. + 1. Select **Remove**. + 1. Review the other entries under **Groups or user names** to confirm permissions and applicability to your environment. -13. Select **Apply** > **OK** to save the certificate template. Close the **Certificate Templates Console**. -14. In the **Certification Authority** console, right-click **Certificate Templates** > **New** > **Certificate Template to Issue**. Choose the template that you created in the previous steps. Select **OK**. -15. For the server to manage certificates for enrolled devices and users, use the following steps: +13. Select **Apply** > **OK** to save the certificate template. Close the Certificate Templates Console. +14. In the **Certification Authority** console, right-click **Certificate Templates**. +14. Select **New** > **Certificate Template to Issue**. +15. Choose the template that you created in the previous steps. Select **OK**. +16. Permit the server to manage certificates for enrolled devices and users: - 1. Right-click the Certification Authority, choose **Properties**. - 2. On the security tab, add the Computer account of the server where you run the connector. - 3. Grant **Issue and Manage Certificates** and **Request Certificates** Allow permissions to the computer account. + 1. Right-click the Certification Authority, and then choose **Properties**. + 2. On the security tab, add the computer account of the server where you run the connector. + 3. Grant **Issue and Manage Certificates** and **Request Certificates** permissions to the computer account. -16. Sign out of the Enterprise CA. +16. Sign out of the Enterprise CA. ## Download, install, and configure the Certificate Connector for Microsoft Intune @@ -156,7 +216,7 @@ For guidance, see [Install and configure the Certificate Connector for Microsoft 2. Select and go to **Devices** > **Manage devices** > **Configuration** > **Create**. 3. Enter the following properties: - - **Platform**: Choose the platform of the devices that will receive this profile. + - **Platform**: Choose the platform of the devices receiving this profile. - Android device administrator - Android Enterprise: - Fully Managed @@ -185,9 +245,15 @@ For guidance, see [Install and configure the Certificate Connector for Microsoft 8. Select **Next**. -9. In **Assignments**, select the user or device group(s) that will be assigned the profile. For more granularity, see [Create filters in Microsoft Intune](https://go.microsoft.com/fwlink/?linkid=2150376) and apply them by selecting *Edit filter*. +9. In **Assignments**, select the user or device groups you want to include in the assignment. These groups receive the profile after you deploy it. For more granularity, see [Create filters in Microsoft Intune](https://go.microsoft.com/fwlink/?linkid=2150376) and apply them by selecting *Edit filter*. + + Plan to deploy this certificate profile to the same groups that receive: - Plan to deploy this certificate profile to the same groups that receive the PKCS certificate profile, and that receive a configuration profile like a Wi-Fi profile that makes use of the certificate. For more information on assigning profiles, see [Assign user and device profiles](../configuration/device-profile-assign.md). + - The PKCS certificate profile and + + - A configuration profile, such as a Wi-Fi profile that makes use of the certificate. + + For more information about assigning profiles, see [Assign user and device profiles](../configuration/device-profile-assign.md). Select **Next**. @@ -238,10 +304,10 @@ For guidance, see [Install and configure the Certificate Connector for Microsoft |Setting | Platform | Details | |------------|------------|------------| |**Renewal threshold (%)** |
  • All |Recommended is 20% | - |**Certificate validity period** |
    • All |If you didn't change the certificate template, this option may be set to one year.

      Use a validity period of five days or up to 24 months. When the validity period is less than five days, there's a high likelihood of the certificate entering a near-expiry or expired state, which can cause the MDM agent on devices to reject the certificate before it’s installed. | + |**Certificate validity period** |
      • All |If you didn't change the certificate template, this option might be set to one year.

        Use a validity period of five days or up to 24 months. When the validity period is less than five days, there's a high likelihood of the certificate entering a near-expiry or expired state, which can cause the MDM agent on devices to reject the certificate before it’s installed. | |**Key storage provider (KSP)** |
        • Windows 10/11 |For Windows, select where to store the keys on the device. | |**Certification authority** |
          • All |Displays the internal fully qualified domain name (FQDN) of your Enterprise CA. | - |**Certification authority name** |
            • All |Lists the name of your Enterprise CA, such as "Contoso Certification Authority". | + |**Certification authority name** |
              • All |Lists the name of your Enterprise CA, such as "Contoso Certification Authority." | |**Certificate template name** |
                • All |Lists the name of your certificate template. | |**Certificate type** |
                  • Android Enterprise (*Corporate-Owned and Personally-Owned Work Profile*)
                  • iOS
                  • macOS
                  • Windows 10/11 |Select a type:
                    • **User** certificates can contain both user and device attributes in the subject and subject alternative name (SAN) of the certificate.
                    • **Device** certificates can only contain device attributes in the subject and SAN of the certificate. Use Device for scenarios such as user-less devices, like kiosks or other shared devices.

                      This selection affects the Subject name format. | |**Subject name format** |
                      • All |For details on how to configure the subject name format, see [Subject name format](#subject-name-format) later in this article.

                        For the following platforms, the Subject name format is determined by the certificate type:
                        • Android Enterprise (*Work Profile*)
                        • iOS
                        • macOS
                        • Windows 10/11

                        | @@ -255,15 +321,21 @@ For guidance, see [Install and configure the Certificate Connector for Microsoft In **Apps**, configure **Certificate access** to manage how certificate access is granted to applications. Choose from: - **Require user approval for apps** *(default)* – Users must approve use of a certificate by all applications. - - **Grant silently for specific apps (require user approval for other apps)** – With this option, select **Add apps**, and then select one or more apps that will silently use the certificate without user interaction. + - **Grant silently for specific apps (require user approval for other apps)** – With this option, select **Add apps**. Then select all apps that should silently use the certificate without user interaction. 9. Select **Next**. -10. In **Assignments**, select the user or groups that will receive your profile. Plan to deploy this certificate profile to the same groups that receive the trusted certificate profile, and that receive a configuration profile like a Wi-Fi profile that makes use of the certificate. For more information on assigning profiles, see [Assign user and device profiles](../configuration/device-profile-assign.md). +10. In **Assignments**, select the users and groups you want to include in the assignment. Users and groups receive the profile after you deploy it. Plan to deploy this certificate profile to the same groups that receive: - Select **Next**. + - The trusted certificate profile and -11. In **Review + create**, review your settings. When you select **Create**, your changes are saved, and the profile is assigned. The policy is also shown in the profiles list. + - A configuration profile, such as a Wi-Fi profile that makes use of the certificate. + + For more information about assigning profiles, see [Assign user and device profiles](../configuration/device-profile-assign.md). + +11. Select **Next**. + +12. In **Review + create**, review your settings. When you select **Create**, your changes are saved, and the profile is assigned. The policy is also shown in the profiles list. ### Subject name format @@ -319,14 +391,14 @@ Platforms: By using a combination of one or many of these variables and static text strings, you can create a custom subject name format, such as: **CN={{UserName}},E={{EmailAddress}},OU=Mobile,O=Finance Group,L=Redmond,ST=Washington,C=US** - That example includes a subject name format that uses the CN and E variables, and strings for Organizational Unit, Organization, Location, State, and Country values. [CertStrToName function](/windows/win32/api/wincrypt/nf-wincrypt-certstrtonamea) describes this function, and its supported strings. + That example includes a subject name format that uses the CN and E variables, and strings for organizational unit, organization, location, state, and country/region values. [CertStrToName function](/windows/win32/api/wincrypt/nf-wincrypt-certstrtonamea) describes this function, and its supported strings. User attributes aren't supported for devices that don’t have user associations, such as devices that are enrolled as Android Enterprise dedicated. For example, a profile that uses *CN={{UserPrincipalName}}* in the subject or SAN can't get the user principal name when there isn't a user on the device. - **Device certificate type** Format options for the Subject name format include the following variables: - **{{AAD_Device_ID}}** - - **{{DeviceId}}** - This is the Intune device ID + - **{{DeviceId}}** - The Intune device ID - **{{Device_Serial}}** - **{{Device_IMEI}}** - **{{SerialNumber}}** @@ -344,7 +416,7 @@ Platforms: > > - When you specify a variable, enclose the variable name in curly brackets { } as seen in the example, to avoid an error. > - Device properties used in the *subject* or *SAN* of a device certificate, like **IMEI**, **SerialNumber**, and **FullyQualifiedDomainName**, are properties that could be spoofed by a person with access to the device. - > - A device must support all variables specified in a certificate profile for that profile to install on that device. For example, if **{{IMEI}}** is used in the subject name of a SCEP profile and is assigned to a device that doesn't have an IMEI number, the profile fails to install. + > - A device must support all variables specified in a certificate profile for that profile to install on that device. For example, if **{{IMEI}}** is used in the subject name of a SCEP profile and is assigned to a device that doesn't have an IMEI number, the profile fails to install. ## Next steps diff --git a/memdocs/intune/protect/certificates-profile-scep.md b/memdocs/intune/protect/certificates-profile-scep.md index 90c914b2917..c44baf140eb 100644 --- a/memdocs/intune/protect/certificates-profile-scep.md +++ b/memdocs/intune/protect/certificates-profile-scep.md @@ -5,7 +5,7 @@ keywords: author: lenewsad ms.author: lanewsad manager: dougeby -ms.date: 08/23/2023 +ms.date: 10/15/2024 ms.topic: how-to ms.service: microsoft-intune ms.subservice: protect @@ -29,9 +29,7 @@ ms.collection: - sub-certificates --- -# Create and assign SCEP certificate profiles in Intune - -[!INCLUDE [azure_portal](../includes/strong-mapping-cert.md)] +# Create and assign SCEP certificate profiles in Intune After you [configure your infrastructure](certificates-scep-configure.md) to support Simple Certificate Enrollment Protocol (SCEP) certificates, you can create and then assign SCEP certificate profiles to users and devices in Intune. @@ -48,8 +46,38 @@ Devices that run Android Enterprise might require a PIN before SCEP can provisio > For more information about this limitation, see [Trusted certificate profiles for Android device administrator](../protect/certificates-trusted-root.md#trusted-certificate-profiles-for-android-device-administrator). [!INCLUDE [windows-phone-81-windows-10-mobile-support](../includes/windows-phone-81-windows-10-mobile-support.md)] + > [!TIP] -> *SCEP certificate* profiles are supported for [Windows Enterprise multi-session remote desktops](../fundamentals/azure-virtual-desktop-multi-session.md). +> *SCEP certificate* profiles are supported for [Windows Enterprise multi-session remote desktops](../fundamentals/azure-virtual-desktop-multi-session.md). + +## Update certificate connector: Strong mapping requirements for KB5014754 + +**Applies to**: + +- Windows 10 +- Windows 11 +- iOS +- macOS + +The Key Distribution Center (KDC) requires user or device objects to be strongly mapped to Active Directory for certificate-based authentication. This means that the certificate's subject alternative name (SAN) must contain a security identifier (SID) extension that maps to the user or device SID in Active Directory. When a user or device authenticates with a certificate in Active Directory, the KDC checks for the SID to verify that the certificate is mapped and issued to the correct user or device. The mapping requirement protects against certificate spoofing and ensures that certificate-based authentication against the KDC continues working. + +Strong mapping is required for all certificates deployed by Microsoft Intune and used for certificate-based authentication against KDC. The strong mapping solution is applicable to user certificates across all platforms. For device certificates, it only applies to Microsoft Entra hybrid-joined Windows devices. If certificates in these scenarios don't meet the strong mapping requirements by the full enforcement mode date, authentication will be denied. + +To implement the strong mapping solution for SCEP certificates delivered via Intune, you must add the `OnpremisesSecurityIdentifier` variable to the SAN in the SCEP profile. + + > [!div class="mx-imgBorder"] + > ![Screenshot of the SCEP certificate profile create flow highlighting the Configuration settings label.](./media/certificates-profile-scep/scep-configuration-settings.png) + +This variable must be part of the URI attribute. You can create a new SCEP profile or edit an existing one to add the URI attribute. + + > [!div class="mx-imgBorder"] + > ![Screenshot of the SCEP certificate profile highlighting the Subject alternative name section and completed URI and Value fields.](./media/certificates-profile-scep/scep-san-add.png) + +After you add the URI attribute and value to the certificate profile, Microsoft Intune appends the SAN attribute with the tag and the resolved SID. Example formatting: `tag:microsoft.com,2022-09-14:sid:` At this point, the certificate profile meets the strong mapping requirements. + +To ensure your SCEP profile meets strong mapping requirements, create a SCEP certificate profile in the Microsoft Intune admin center, or modify an existing profile with the new SAN attribute and value. As a prerequisite, users and devices must be synced from Active Directory to Microsoft Entra ID. For more information, see [How objects and credentials are synchronized in a Microsoft Entra Domain Services managed domain](/entra/identity/domain-services/synchronization). + +For more information about the KDC's requirements and enforcement date for strong mapping, see [KB5014754: Certificate-based authentication changes on Windows domain controllers ](https://support.microsoft.com/topic/kb5014754-certificate-based-authentication-changes-on-windows-domain-controllers-ad2c23b0-15d8-4340-a468-4d4f3b188f16). ## Create a SCEP certificate profile @@ -73,8 +101,8 @@ Devices that run Android Enterprise might require a PIN before SCEP can provisio 1. Under Monitoring, certificate reporting isn't available for **Device Owner** SCEP certificate profiles. 1. You can't use Intune to revoke certificates that were provisioned by SCEP certificate profiles for **Device Owners**. You can manage revocation through an external process or directly with the certification authority. - 1. SCEP certificate profiles are supported for Wi-Fi network configuration. VPN configuration profile support is not available. A future update may include support for VPN configuration profiles. - 1. The following 3 variables are not available for use on Android (AOSP) SCEP certificate profiles. Support for these variables will come in a future update. + 1. SCEP certificate profiles are supported for Wi-Fi network configuration. VPN configuration profile support isn't available. A future update might include support for VPN configuration profiles. + 1. The following variables aren't available for use on Android (AOSP) SCEP certificate profiles. Support for these variables will come in a future update. - onPremisesSamAccountName - OnPrem_Distinguished_Name - Department @@ -100,7 +128,7 @@ Devices that run Android Enterprise might require a PIN before SCEP can provisio *(Applies to: Android, Android Enterprise, Android (AOSP), iOS/iPadOS, macOS, Windows 8.1, and Windows 10/11)* - Select a type depending on how you'll use the certificate profile: + Select a type, depending on how you plan to use the certificate profile: - **User**: *User* certificates can contain both user and device attributes in the subject and SAN of the certificate. @@ -176,7 +204,7 @@ Devices that run Android Enterprise might require a PIN before SCEP can provisio That example includes a subject name format that uses the CN and E variables, and strings for Organizational Unit, Organization, Location, State, and Country values. [CertStrToName function](/windows/win32/api/wincrypt/nf-wincrypt-certstrtonamea) describes this function, and its supported strings. - User attributes are not supported for devices that don’t have user associations, such as devices that are enrolled as Android Enterprise dedicated. For example, a profile that uses *CN={{UserPrincipalName}}* in the subject or SAN won’t be able to get the user principal name when there is no user on the device. + User attributes aren't supported for devices that don’t have user associations, such as devices that are enrolled as Android Enterprise dedicated. For example, a profile that uses *CN={{UserPrincipalName}}* in the subject or SAN won’t be able to get the user principal name when there's no user on the device. - **Device certificate type** @@ -193,6 +221,7 @@ Devices that run Android Enterprise might require a PIN before SCEP can provisio - **{{DeviceName}}** - **{{FullyQualifiedDomainName}}** *(Only applicable for Windows and domain-joined devices)* - **{{MEID}}** + You can specify these variables and static text in the textbox. For example, the common name for a device named *Device1* can be added as **CN={{DeviceName}}Device1**. @@ -203,7 +232,7 @@ Devices that run Android Enterprise might require a PIN before SCEP can provisio > - A device must support all variables specified in a certificate profile for that profile to install on that device. For example, if **{{IMEI}}** is used in the subject name of a SCEP profile and is assigned to a device that doesn't have an IMEI number, the profile fails to install. - **Subject alternative name**: - Select how Intune automatically creates the subject alternative name (SAN) in the certificate request. You can specify multiple subject alternative names. For each one, you may select from four SAN attributes and enter a text value for that attribute. The text value can contain variables and static text for the attribute. + Configure the subject alternative name (SAN) in the certificate request. You can enter more than one subject alternative name. The text value can contain variables and static text for the attribute. > [!NOTE] > The following Android Enterprise profiles don’t support use of the {{UserName}} variable for the SAN: @@ -211,14 +240,14 @@ Devices that run Android Enterprise might require a PIN before SCEP can provisio > - Fully Managed, Dedicated, and Corporate-Owned Work Profile - Select from the available SAN attributes: + Select from the available SAN attributes: - **Email address** - **User principal name (UPN)** - **DNS** - **Uniform Resource Identifier (URI)** - Variables available for the SAN value depend on the Certificate type you selected; either **User** or **Device**. + The type of certificate you choose determines the SAN variable. > [!NOTE] > Beginning with Android 12, Android no longer supports use of the following hardware identifiers for *personally owned work profile* devices: @@ -229,29 +258,33 @@ Devices that run Android Enterprise might require a PIN before SCEP can provisio > > Intune certificate profiles for personally owned work profile devices that rely on these variables in the subject name or SAN will fail to provision a certificate on devices that run Android 12 or later at the time the device enrolled with Intune. Devices that enrolled prior to upgrade to Android 12 can still receive certificates so long as Intune previously obtained the devices hardware identifiers. > - >For more information about this and other changes introduced with Android 12, see the [Android Day Zero Support for Microsoft Endpoint Manager](https://techcommunity.microsoft.com/t5/intune-customer-success/android-12-day-zero-support-with-microsoft-endpoint-manager/ba-p/2621665) blog post. + >For more information about this and other changes introduced with Android 12, see the [Android Day Zero Support for Microsoft Endpoint Manager](https://techcommunity.microsoft.com/t5/intune-customer-success/android-12-day-zero-support-with-microsoft-endpoint-manager/ba-p/2621665) blog post. - **User certificate type** - With the *User* certificate type, you can use any of the user or device certificate variables described above in the Subject Name section. + With the *user* certificate type, you can use any of the user or device certificate variables described above in the Subject Name section. + + For example, user certificate types can include the user principal name (UPN) in the subject alternative name. If a client certificate is used to authenticate to a Network Policy Server, set the subject alternative name to the UPN. - For example, user certificate types can include the user principal name (UPN) in the subject alternative name. If a client certificate is used to authenticate to a Network Policy Server, set the subject alternative name to the UPN. + Microsoft Intune also supports *OnPremisesSecurityIdentifier*, a variable that's compliant with the Key Distribution Center's (KDC) strong mapping requirements for certificate-based authentication. You should add the variable to user certificates that authenticate with the KDC. You can add the variable, formatted as **{{OnPremisesSecurityIdentifier}}**, to new and existing profiles in the Microsoft Intune admin center. This variable is supported in user certificates for macOS, iOS, and Windows 10/11, and only works with the URI attribute. - **Device certificate type** - With the *Device* certificate type, you can use any of the variables described in the *Device certificate type* section for Subject Name. + With the *device* certificate type, you can use any of the variables described in the *Device certificate type* section for Subject Name. - To specify a value for an attribute, include the variable name with curly brackets, followed by the text for that variable. For example, a value for the DNS attribute can be added **{{AzureADDeviceId}}.domain.com** where *.domain.com* is the text. For a user named *User1* an Email address might appear as {{FullyQualifiedDomainName}}User1@Contoso.com. + To specify a value for an attribute, include the variable name with curly brackets, followed by the text for that variable. For example, a value for the DNS attribute can be added **{{AzureADDeviceId}}.domain.com** where *.domain.com* is the text. For a user named *User1* an Email address might appear as {{FullyQualifiedDomainName}}User1@Contoso.com. + + By using a combination of one or many of these variables and static text strings, you can create a custom subject alternative name format, such as **{{UserName}}-Home**. + + Microsoft Intune also supports *OnPremisesSecurityIdentifier*, a variable that's compliant with the Key Distribution Center's (KDC) strong mapping requirements for certificate-based authentication. You should add the variable to device certificates that authenticate with the KDC. You can add the variable, formatted as **{{OnPremisesSecurityIdentifier}}**, to new and existing profiles in the Microsoft Intune admin center. This variable is supported in device certificates for Microsoft Entra hybrid joined devices, and only works with the URI attribute. - By using a combination of one or many of these variables and static text strings, you can create a custom subject alternative name format, such as: - - **{{UserName}}-Home** > [!IMPORTANT] > > - When using a device certificate variable, enclose the variable name in double curly brackets {{ }}. > - Don't use curly brackets **{ }**, pipe symbols **|**, and semicolons **;**, in the text that follows the variable. > - Device properties used in the *subject* or *SAN* of a device certificate, like **IMEI**, **SerialNumber**, and **FullyQualifiedDomainName**, are properties that could be spoofed by a person with access to the device. - > - A device must support all variables specified in a certificate profile for that profile to install on that device. For example, if **{{IMEI}}** is used in the SAN of a SCEP profile and is assigned to a device that doesn't have an IMEI number, the profile fails to install. + > - A device must support all variables specified in a certificate profile for that profile to install on that device. For example, if **{{IMEI}}** is used in the SAN of a SCEP profile and is assigned to a device that doesn't have an IMEI number, the profile fails to install. - **Certificate validity period**: @@ -261,7 +294,7 @@ Devices that run Android Enterprise might require a PIN before SCEP can provisio For example, if the certificate validity period in the certificate template is two years, you can enter a value of one year, but not a value of five years. The value must also be lower than the remaining validity period of the issuing CA's certificate. - Plan to use a validity period of five days or greater. When the validity period is less than five days, there is a high likelihood of the certificate entering a near-expiry or expired state, which can cause the MDM agent on devices to reject the certificate before it’s installed. + Plan to use a validity period of five days or greater. When the validity period is less than five days, there's a high likelihood of the certificate entering a near-expiry or expired state, which can cause the MDM agent on devices to reject the certificate before it’s installed. - **Key storage provider (KSP)**: @@ -330,7 +363,7 @@ Devices that run Android Enterprise might require a PIN before SCEP can provisio Enter one or more URLs for the NDES Servers that issue certificates via SCEP. For example, enter something like `https://ndes.contoso.com/certsrv/mscep/mscep.dll`. - To allow devices on the internet to get certificates, you must specify the NDES URL external to your corporate network. + To allow devices on the internet to get certificates, you must specify the NDES URL external to your corporate network. The URL can be HTTP or HTTPS. However, to support the following devices, the SCEP Server URL must use HTTPS: - Android device administrator - Android Enterprise device owner @@ -381,7 +414,7 @@ When your subject name includes one of the special characters, use one of the fo - Encapsulate the CN value that contains the special character with quotes. - Remove the special character from the CN value. -**For example**, you have a Subject Name that appears as *Test user (TestCompany, LLC)*. A CSR that includes a CN that has the comma between *TestCompany* and *LLC* presents a problem. The problem can be avoided by placing quotes around the entire CN, or by removing of the comma from between *TestCompany* and *LLC*: +**For example**, you have a Subject Name that appears as *Test user (TestCompany, LLC)*. A CSR that includes a CN that has the comma between *TestCompany* and *LLC* presents a problem. The problem can be avoided by placing quotes around the entire CN, or by removing of the comma from between *TestCompany* and *LLC*: - **Add quotes**: *CN="Test User (TestCompany, LLC)",OU=UserAccounts,DC=corp,DC=contoso,DC=com* - **Remove the comma**: *CN=Test User (TestCompany LLC),OU=UserAccounts,DC=corp,DC=contoso,DC=com* diff --git a/memdocs/intune/protect/certificates-trusted-root.md b/memdocs/intune/protect/certificates-trusted-root.md index 93ee5b1de9f..b87b0792deb 100644 --- a/memdocs/intune/protect/certificates-trusted-root.md +++ b/memdocs/intune/protect/certificates-trusted-root.md @@ -7,7 +7,7 @@ keywords: author: lenewsad ms.author: lanewsad manager: dougeby -ms.date: 09/11/2023 +ms.date: 09/23/2024 ms.topic: how-to ms.service: microsoft-intune ms.subservice: protect @@ -42,19 +42,19 @@ You deploy the trusted certificate profile to the same devices and users that re ## Export the trusted root CA certificate -To use PKCS, SCEP, and PKCS imported certificates, devices must trust your root Certification Authority. To establish trust, export the Trusted Root CA certificate, and any intermediate or issuing Certification Authority certificates, as a public certificate (.cer). You can get these certificates from the issuing CA, or from any device that trusts your issuing CA. +To use PKCS, SCEP, and PKCS imported certificates, devices must trust your root Certification Authority. To establish trust, export the Trusted Root CA certificate, and any intermediate or issuing Certification Authority certificates, as a public certificate (`.cer`). You can get these certificates from the issuing CA, or from any device that trusts your issuing CA. -To export the certificate, refer to the documentation for your Certification Authority. You'll need to export the public certificate as a DER-encoded .cer file. Don't export the private key, a .pfx file. +To export the certificate, refer to the documentation for your Certification Authority. You need to export the public certificate as a DER-encoded `.cer` file. Don't export the private key, a `.pfx` file. -You'll use this .cer file when you [create trusted certificate profiles](#create-trusted-certificate-profiles) to deploy that certificate to your devices. +You use this `.cer` file when you [create trusted certificate profiles](#create-trusted-certificate-profiles) to deploy that certificate to your devices. ## Create trusted certificate profiles -Create and deploy a trusted certificate profile before you create a SCEP, PKCS, or PKCS imported certificate profile. Deploying a trusted certificate profile to the same groups that receive the other certificate profile types ensures that each device can recognize the legitimacy of your CA. This includes profiles like those for VPN, Wi-Fi, and email. +Before you create a SCEP, PKCS, or PKCS imported certificate profile, create and deploy a trusted certificate profile. Deploy the trusted certificate profile to the same groups that receive the other certificate profile types. This step makes sure that each device can recognize the legitimacy of your CA, including profiles VPN, Wi-Fi, and email profiles. -SCEP certificate profiles directly reference a trusted certificate profile. PKCS certificate profiles don't directly reference the trusted certificate profile but do directly reference the server that hosts your CA. PKCS imported certificate profiles don't directly reference the trusted certificate profile but can use it on the device. Deploying a trusted certificate profile to devices ensures this trust is established. When a device doesn't trust the root CA, the SCEP or PKCS certificate profile policy will fail. +SCEP certificate profiles directly reference a trusted certificate profile. PKCS certificate profiles don't directly reference the trusted certificate profile but do directly reference the server that hosts your CA. PKCS imported certificate profiles don't directly reference the trusted certificate profile but can use it on the device. Deploying a trusted certificate profile to devices ensures this trust is established. When a device doesn't trust the root CA, the SCEP or PKCS certificate profile policy fails. -Create a separate trusted certificate profile for each device platform you want to support, just as you'll do for SCEP, PKCS, and PKCS imported certificate profiles. +Create a separate trusted certificate profile for each device platform you want to support, just as you do for SCEP, PKCS, and PKCS imported certificate profiles. > [!IMPORTANT] > Trusted root profiles that you create for the platform *Windows 10 and later*, display in the Microsoft Intune admin center as profiles for the platform *Windows 8.1 and later*. @@ -66,19 +66,22 @@ Create a separate trusted certificate profile for each device platform you want ### Trusted certificate profiles for Android device administrator - [!INCLUDE [android_device_administrator_support](../includes/android-device-administrator-support.md)] +[!INCLUDE [android_device_administrator_support](../includes/android-device-administrator-support.md)] -Beginning with Android 11, you can no longer use a trusted certificate profile to deploy a trusted root certificate to devices that are enrolled as *Android device administrator*. This limitation doesn't apply to Samsung Knox. +This feature applies to: + +- Android 10 and earlier on non-KNOX devices +- Android 12 and earlier on Samsung KNOX devices Because SCEP certificate profiles require both the trusted root certificate be installed on a device, and must reference a trusted certificate profile that in turn references that certificate, use the following steps to work around this limitation: 1. Manually provision the device with the trusted root certificate. For sample guidance, see the following section. -2. Deploy to the device, a trusted root certificate profile that references the trusted root certificate that you’ve installed on the device. +2. Deploy to the device, a trusted root certificate profile that references the trusted root certificate that you installed on the device. 3. Deploy a SCEP certificate profile to the device that references the trusted root certificate profile. -This issue isn’t limited to SCEP certificate profiles. Therefore, plan to manually install the trusted root certificate on applicable devices should your use of PKCS certificate profiles, or PKCS Imported certificate profiles require it. +This issue isn't limited to SCEP certificate profiles. Therefore, plan to manually install the trusted root certificate on applicable devices should your use of PKCS certificate profiles, or PKCS Imported certificate profiles require it. Learn more about [changes in support for Android device administrator](https://techcommunity.microsoft.com/t5/intune-customer-success/decreasing-support-for-android-device-administrator/ba-p/1441935) from techcommunity.microsoft.com. @@ -86,15 +89,15 @@ Learn more about [changes in support for Android device administrator](https://t The following guidance can help you manually provision devices with a trusted root certificate. -1. Download or transfer the trusted root certificate to the Android device. For example, you might use email to distribute the certificate to device users, or have users download it from a secure location. After the certificate is on the device, it must be opened, named, and saved. Saving the certificate adds it to the User certificate store on the device. +1. Download or transfer the trusted root certificate to the Android device. For example, you might use email to distribute the certificate to device users, or have users download it from a secure location. After the certificate is on the device, it must be opened, named, and saved. Saving the certificate adds it to the User certificate store on the device. 1. To open the certificate on the device, a user must locate and tap (open) the certificate. For example, after sending the certificate by email, a device user can tap on or open the certificate attachment. 2. When the certificate opens, the user must provide their PIN or otherwise authenticate to the device before they can manage the certificate. -2. After authentication, the certificate opens and must be named before it can be saved to the Users certificate store. The certificate name must match the certificate name that’s specified in the Trusted Root Certificate profile that will be sent to the device. -After naming the certificate, it can be saved. +2. After authentication, the certificate opens and must be named before it can be saved to the Users certificate store. The certificate name must match the certificate name that's in the Trusted Root Certificate profile that is sent to the device. +After you name the certificate, it can be saved. -3. After being saved the certificate is ready for use. A user can confirm the certificate is in the correct location on the device: +3. After being saved, the certificate is ready for use. A user can confirm the certificate is in the correct location on the device: 1. Open **Settings** > **Security** > **Trusted credentials**. The actual path to *Trusted credentials* can vary by device. 2. Open the **User** tab and locate the certificate. 3. If present in the list of User certificates, the certificate is installed correctly. @@ -112,7 +115,7 @@ After naming the certificate, it can be saved. ![Navigate to Intune and create a new profile for a trusted certificate](./media/certificates-trusted-root/certificates-configure-profile-new.png) 3. Enter the following properties: - - **Platform**: Choose the platform of the devices that will receive this profile. + - **Platform**: Choose the platform of the devices that should receive this profile. - **Profile**: Depending on your chosen platform, select **Trusted certificate** or select **Templates** > **Trusted certificate**. [!INCLUDE [windows-phone-81-windows-10-mobile-support](../includes/windows-phone-81-windows-10-mobile-support.md)] @@ -125,7 +128,7 @@ After naming the certificate, it can be saved. 6. Select **Next**. -7. In **Configuration settings**, specify the .cer file for the trusted Root CA Certificate you previously exported. +7. In **Configuration settings**, specify the `.cer` file for the trusted Root CA Certificate you previously exported. For Windows 8.1 and Windows 10/11 devices only, select the **Destination Store** for the trusted certificate from: @@ -138,7 +141,7 @@ After naming the certificate, it can be saved. 8. Select **Next**. -9. In **Assignments**, select the user or groups that will receive your profile. For more information on assigning profiles, see [Assign user and device profiles](../configuration/device-profile-assign.md). +9. In **Assignments**, select the user or groups that should receive your profile. For more information on assigning profiles, see [Assign user and device profiles](../configuration/device-profile-assign.md). Select **Next**. diff --git a/memdocs/intune/protect/compliance-policy-create-android-for-work.md b/memdocs/intune/protect/compliance-policy-create-android-for-work.md index b26d0e1a056..db02bedb17d 100644 --- a/memdocs/intune/protect/compliance-policy-create-android-for-work.md +++ b/memdocs/intune/protect/compliance-policy-create-android-for-work.md @@ -42,9 +42,9 @@ This feature applies to: As an Intune administrator, use these compliance settings to help protect your organizational resources. To learn more about compliance policies, and what they do, see [get started with device compliance](device-compliance-get-started.md). > [!IMPORTANT] -> Android compliance policies should only be targeted at groups of devices, not users. Compliance policies will be evaluated against the device and will appropriately reflect the compliance state in Intune. To allow users on dedicated devices to sign-in to resources protected by Conditional Access policies, consider using Android Enterprise dedicated devices with [*Microsoft Entra shared device mode*](../enrollment/android-kiosk-enroll.md). +> It's important to target compliance policies for dedicated devices at groups of devices, not users. Compliance policies will be evaluated against the device and will appropriately reflect the compliance state in Intune. To allow users on dedicated devices to sign in to resources protected by Conditional Access policies, consider using Android Enterprise dedicated devices with [*Microsoft Entra shared device mode*](../enrollment/android-kiosk-enroll.md). In scenarios with fully managed devices, or personal and corporate-owned work profiles, you can target compliance policies at groups of users or devices. > -> On Android Enterprise dedicated devices that are enrolled without Microsoft Entra shared device mode, users of the device will be unable to sign into resources protected by Conditional Access policies, even if the device is compliant in Intune. To learn more about shared device mode, see [*Overview of shared device mode*](/azure/active-directory/develop/msal-shared-devices) in the Microsoft Entra documentation. +> Users on dedicated devices enrolled without Microsoft Entra shared device mode can't sign into resources protected by Conditional Access policies, even if the device is compliant in Intune. To learn more about shared device mode, see [*Overview of shared device mode*](/azure/active-directory/develop/msal-shared-devices) in the Microsoft Entra documentation. diff --git a/memdocs/intune/protect/compliance-policy-create-android.md b/memdocs/intune/protect/compliance-policy-create-android.md index b5b180caa71..6391a5acd98 100644 --- a/memdocs/intune/protect/compliance-policy-create-android.md +++ b/memdocs/intune/protect/compliance-policy-create-android.md @@ -7,7 +7,7 @@ keywords: author: lenewsad ms.author: lanewsad manager: dougeby -ms.date: 09/25/2023 +ms.date: 09/23/2024 ms.topic: conceptual ms.service: microsoft-intune ms.subservice: protect @@ -67,22 +67,22 @@ As an Intune administrator, use these compliance settings to help protect your o *Device administrator* capabilities are superseded by Android Enterprise. - **Not configured** (*default*) - - **Block** - Blocking device administrator will guide users to move to Android Enterprise Personally-Owned and Corporate-Owned Work Profile management to regain access. + - **Block** - Blocking device administrator guides users to move to Android Enterprise Personally Owned and Corporate Owned Work Profile management to regain access. - **Rooted devices** Prevent rooted devices from having corporate access. (This compliance check is supported for Android 4.0 and above.) - - **Not configured** (*default*) - This setting isn't evaluated for compliance or non-compliance. + - **Not configured** (*default*) - This setting isn't evaluated for compliance or noncompliance. - **Block** - Mark rooted devices as not compliant. - **Require the device to be at or under the Device Threat Level** Use this setting to take the risk assessment from a connected Mobile Threat Defense service as a condition for compliance. - - **Not configured** (*default*) - This setting isn't evaluated for compliance or non-compliance. - - **Secured** - This option is the most secure, as the device can't have any threats. If the device is detected with any level of threats, it's evaluated as noncompliant. + - **Not configured** (*default*) - This setting isn't evaluated for compliance or noncompliance. + - **Secured** - This option is the most secure, as the device can't have any threats. If the device is detected with any level of threats, the device is evaluated as noncompliant. - **Low** - The device is evaluated as compliant if only low-level threats are present. Anything higher puts the device in a noncompliant status. - - **Medium** - The device is evaluated as compliant if existing threats on the device are low or medium level. If the device is detected to have high-level threats, it's determined to be noncompliant. - - **High** - This option is the least secure, and allows all threat levels. It may be useful if you're using this solution only for reporting purposes. + - **Medium** - The device is evaluated as compliant if existing threats on the device are low or medium level. If the device is detected to have high-level threats, the device is determined to be noncompliant. + - **High** - This option is the least secure, and allows all threat levels. It can be useful if you're using this solution only for reporting purposes. ### Google Play Protect @@ -92,17 +92,17 @@ As an Intune administrator, use these compliance settings to help protect your o - **Google Play Services is configured** Google Play services allows security updates, and is a base-level dependency for many security features on certified-Google devices. - - **Not configured** (*default*) - This setting isn't evaluated for compliance or non-compliance. + - **Not configured** (*default*) - This setting isn't evaluated for compliance or noncompliance. - **Require** - Require that the Google Play services app is installed and enabled. - **Up-to-date security provider** - - **Not configured** (*default*) - This setting isn't evaluated for compliance or non-compliance. + - **Not configured** (*default*) - This setting isn't evaluated for compliance or noncompliance. - **Require** - Require that an up-to-date security provider can protect a device from known vulnerabilities. - **Threat scan on apps** - - **Not configured** (*default*) - This setting isn't evaluated for compliance or non-compliance. + - **Not configured** (*default*) - This setting isn't evaluated for compliance or noncompliance. - **Require** - Require that the Android **Verify Apps** feature is enabled. > [!NOTE] @@ -111,7 +111,7 @@ As an Intune administrator, use these compliance settings to help protect your o - **Play integrity verdict** Enter the level of Google's [Play Integrity](https://developer.android.com/google/play/integrity) that must be met. Your options: - - **Not configured** (*default*) - This setting isn't evaluated for compliance or non-compliance. + - **Not configured** (*default*) - This setting isn't evaluated for compliance or noncompliance. - **Check basic integrity** - **Check basic integrity & device integrity** @@ -123,7 +123,7 @@ As an Intune administrator, use these compliance settings to help protect your o ### Operating System Version - **Minimum OS version** - When a device doesn't meet the minimum OS version requirement, it's reported as noncompliant. A link with information about how to upgrade is shown. The end user can choose to upgrade their device, and then get access to company resources. + When a device doesn't meet the minimum OS version requirement, the devices is reported as noncompliant. A link with information about how to upgrade is shown. The end user can choose to upgrade their device, and then get access to company resources. *By default, no version is configured*. @@ -137,9 +137,9 @@ As an Intune administrator, use these compliance settings to help protect your o ### Encryption - **Require encryption of data storage on device** - *Supported on Android 4.0 and later, or KNOX 4.0 and later.* + *Supported on Android 11 and earlier, or Samsung KNOX Android 14 and earlier*. - - **Not configured** (*default*) - This setting isn't evaluated for compliance or non-compliance. + - **Not configured** (*default*) - This setting isn't evaluated for compliance or noncompliance. - **Require** - Encrypt data storage on your devices. Devices are encrypted when you choose the **Require a password to unlock mobile devices** setting. ### Device Security @@ -147,7 +147,7 @@ As an Intune administrator, use these compliance settings to help protect your o - **Block apps from unknown sources** *Supported on Android 4.0 to Android 7.x. Not supported by Android 8.0 and later* - - **Not configured** (*default*) - this setting isn't evaluated for compliance or non-compliance. + - **Not configured** (*default*) - this setting isn't evaluated for compliance or noncompliance. - **Block** - Block devices with **Security > Unknown Sources** enabled sources (*supported on Android 4.0 through Android 7.x. Not supported on Android 8.0 and later.*). To side-load apps, unknown sources must be allowed. If you're not side-loading Android apps, then set this feature to **Block** to enable this compliance policy. @@ -156,7 +156,7 @@ As an Intune administrator, use these compliance settings to help protect your o > Side-loading applications require that the **Block apps from unknown sources** setting is enabled. Enforce this compliance policy only if you're not side-loading Android apps on devices. - **Company portal app runtime integrity** - - **Not configured** (*default*) - This setting isn't evaluated for compliance or non-compliance. + - **Not configured** (*default*) - This setting isn't evaluated for compliance or noncompliance. - **Require** - Choose *Require* to confirm the Company Portal app meets all the following requirements: - Has the default runtime environment installed @@ -166,7 +166,7 @@ As an Intune administrator, use these compliance settings to help protect your o - **Block USB debugging on device** *(Supported on Android 4.2 or later)* - - **Not configured** (*default*) - This setting isn't evaluated for compliance or non-compliance. + - **Not configured** (*default*) - This setting isn't evaluated for compliance or noncompliance. - **Block** - Prevent devices from using the USB debugging feature. - **Minimum security patch level** @@ -177,19 +177,11 @@ As an Intune administrator, use these compliance settings to help protect your o *By default, no date is configured*. - **Restricted apps** - Enter the **App name** and **App bundle ID** for apps that should be restricted, and then select **Add**. A device with at least one restricted app installed is marked as non-compliant. + Enter the **App name** and **App bundle ID** for apps that should be restricted, and then select **Add**. A device with at least one restricted app installed is marked as noncompliant. To get the bundle ID of an app added to Intune, [you can use the Intune admin center](../apps/get-app-bundle-id-intune-admin-center.md). -### Password - -The available settings for passwords vary by the version of Android on the device. - -#### All Android devices - -*The following settings are supported on Android 4.0 or later, and Knox 4.0 and later.* - -- **Maximum minutes of inactivity before password is required** +- **Maximum minutes of inactivity before password is required (Samsung KNOX Android 12 and earlier)​** This setting specifies the length of time without user input after which the mobile device screen is locked. Options range from *1 Minute* to *8 Hours*. The recommended value is *15 Minutes*. - **Not configured** *(default)* @@ -198,7 +190,11 @@ The available settings for passwords vary by the version of Android on the devic This setting specifies whether to require users to enter a password before access is granted to information on their mobile devices. Recommended value: *Require* (This compliance check is supported for devices with OS versions Android 4.0 and above, or KNOX 4.0 and above.) - - **Not configured** *(default)* + - **Not configured** *(default)* - This setting isn't evaluated for compliance or noncompliance. + - **Require** - Users must enter a password before they can access their device. When set to **require**, also configure: + + - **Password complexity** + - **Required password type** #### Android 10 and later @@ -222,19 +218,11 @@ The available settings for passwords vary by the version of Android on the devic - Alphabetic, with a minimum length of 6. - Alphanumeric, with a minimum length of 6. -#### Android 9 and earlier or Samsung Knox - -*The following settings are supported on Android 9.0 and earlier, and any version of Samsung Knox.* - -- **Require a password to unlock mobile devices** - This setting specifies whether to require users to enter a password before access is granted to information on their mobile devices. Recommended value: Require +#### Android 9 and earlier, or Samsung Knox Android 15 and earlier - - **Not configured** (*default*) - This setting isn't evaluated for compliance or non-compliance. - - **Require** - Users must enter a password before they can access their device. - - When set to *Require*, the following setting can be configured: +*The following settings are supported on Android 9.0 and earlier, and any Android OS version 15 and earlier.* - **Required password type** +- **Required password type** Choose if a password should include only numeric characters, or a mix of numerals and other characters. - **Device Default** - To evaluate password compliance, be sure to select a password strength other than **Device default**. @@ -251,7 +239,7 @@ The available settings for passwords vary by the version of Android on the devic Enter the minimum number of digits or characters that the user's password must have. - **Maximum minutes of inactivity before password is required** - Enter the idle time before the user must reenter their password. When you choose **Not configured** (default), this setting isn't evaluated for compliance or non-compliance. + Enter the idle time before the user must reenter their password. When you choose **Not configured** (default), this setting isn't evaluated for compliance or noncompliance. - **Number of days until password expires** Select the number of days before the password expires and the user must create a new password. diff --git a/memdocs/intune/protect/conditional-access-exchange-create.md b/memdocs/intune/protect/conditional-access-exchange-create.md index 4bb3f36e327..b8fed4d7100 100644 --- a/memdocs/intune/protect/conditional-access-exchange-create.md +++ b/memdocs/intune/protect/conditional-access-exchange-create.md @@ -94,13 +94,13 @@ Before you can configure Conditional Access, verify the following configurations 5. Select **Android enterprise** in **Platform**, select **Email** in **Profile type**. - 6. Configure the [email profile settings](/intune/configuration/email-settings-android-enterprise#android-enterprise). + 6. Configure the [email profile settings](/mem/intune/configuration/email-settings-android-enterprise#android-enterprise). 7. When you're done, select **OK** > **Create** to save your changes. - 8. After you create the email profile, [assign it to groups](/intune/device-profile-assign). + 8. After you create the email profile, [assign it to groups](/mem/intune/configuration/device-profile-assign). - 9. Set up [device-based conditional access](/intune/protect/conditional-access-intune-common-ways-use#device-based-conditional-access). + 9. Set up [device-based conditional access](/mem/intune/protect/conditional-access-intune-common-ways-use#device-based-conditional-access). > [!NOTE] > Microsoft Outlook for Android and iOS/iPadOS is not supported via the Exchange on-premises connector. If you want to leverage Microsoft Entra Conditional Access policies and Intune App Protection Policies with Outlook for iOS/iPadOS and Android for your on-premises mailboxes, please see [Using hybrid Modern Authentication with Outlook for iOS/iPadOS and Android](/Exchange/clients/outlook-for-ios-and-android/use-hybrid-modern-auth). @@ -176,4 +176,4 @@ Before you can use the following procedure to set up Exchange on-premises access Next, create a compliance policy and assign it to the users for Intune to evaluate their mobile devices, See [Get started with device compliance](device-compliance-get-started.md). -[Troubleshooting Intune on-premises Exchange connector in Microsoft Intune](https://support.microsoft.com/help/4471887) +[Troubleshooting Intune on-premises Exchange connector in Microsoft Intune](/troubleshoot/mem/intune/device-protection/troubleshoot-exchange-connector) diff --git a/memdocs/intune/protect/create-conditional-access-intune.md b/memdocs/intune/protect/create-conditional-access-intune.md index 3a8a1136801..bf7f35120d7 100644 --- a/memdocs/intune/protect/create-conditional-access-intune.md +++ b/memdocs/intune/protect/create-conditional-access-intune.md @@ -119,4 +119,4 @@ To take advantage of device compliance status, configure Conditional Access poli ## Next steps - [App-based Conditional Access with Intune](app-based-conditional-access-intune.md) -- [Troubleshooting Intune Conditional Access](https://support.microsoft.com/help/4456106) +- [Troubleshooting Intune Conditional Access](/troubleshoot/mem/intune/device-protection/troubleshoot-conditional-access) diff --git a/memdocs/intune/protect/derived-credentials.md b/memdocs/intune/protect/derived-credentials.md index 09774fae6e3..bbcb6d33ddc 100644 --- a/memdocs/intune/protect/derived-credentials.md +++ b/memdocs/intune/protect/derived-credentials.md @@ -120,7 +120,7 @@ Depending on the issuer you choose, you might need staff to be available at the For example, you might use conditional access to block access to email for noncompliant devices. If you rely on email notifications to inform the user to start the derived credential enrollment process, your users might not receive those instructions until they're compliant with policy. -Similarly, some derived credential request workflows require the use of the device camera to scan an on-screen QR code. This code links that device to the authentication request that occurred against the derived credential issuer with the user's smart card credentials. If device configuration polices block camera use, the user can't complete the derived credential enrollment request. +Similarly, some derived credential request workflows require the use of the device camera to scan an on-screen QR code. This code links that device to the authentication request that occurred against the derived credential issuer with the user's smart card credentials. If device configuration policies block camera use, the user can't complete the derived credential enrollment request. **General information**: @@ -141,7 +141,7 @@ The following are key considerations for each supported partner. Become familiar Review the platform-specific user workflow for the devices you'll use with derived credentials. -- [iOS and iPadOS](/intune-user-help/enroll-ios-device-disa-purebred) +- [iOS and iPadOS](/mem/intune/user-help/enroll-ios-device-disa-purebred) - [Android Enterprise](../user-help/enroll-android-device-disa-purebred.md) - *Corporate-Owned Work Profile* or *Fully managed devices* **Key requirements include**: @@ -167,7 +167,7 @@ For information getting and configuring the DISA Purebred app, see [Deploy the D Review the platform-specific user workflow for the devices you'll use with derived credentials. -- [iOS and iPadOS](/intune-user-help/enroll-ios-device-entrust-datacard) +- [iOS and iPadOS](/mem/intune/user-help/enroll-ios-device-entrust-datacard) - [Android Enterprise](../user-help/enroll-android-device-entrust-datacard.md)- *Corporate-Owned Work Profile* or *Fully managed devices* **Key requirements include**: @@ -191,7 +191,7 @@ Review the platform-specific user workflow for the devices you'll use with deriv Review the platform-specific user workflow for the devices you'll use with derived credentials. -- [iOS and iPadOS](/intune-user-help/enroll-ios-device-intercede) +- [iOS and iPadOS](/mem/intune/user-help/enroll-ios-device-intercede) - [Android Enterprise](../user-help/enroll-android-device-intercede.md) - *Corporate-Owned Work Profile* or *Fully managed devices* **Key requirements include**: @@ -320,7 +320,7 @@ Use derived credentials for certificate-based authentication to web sites and ap **For Android Enterprise**: - - For *Platform*. select **Android Enterprise**, and then for *Profile type*, under *Fully Managed, Dedicated, and Corporate-Owned Work Profile*, select Derived credential**. Select **Create** to continue. + - For *Platform*. select **Android Enterprise**, and then for *Profile type*, under *Fully Managed, Dedicated, and Corporate-Owned Work Profile*, select **Derived credential**. Select **Create** to continue. - For *Name*, enter a descriptive name for the profile. Name your profiles so you can easily identify them later. For example, a good profile name is **Derived credential for Android Enterprise devices profile**. - For *Description*, enter a description that gives an overview of the setting, and any other important details. - On the *Apps* page, configure **Certificate access** to manage how certificate access is granted to applications. Choose from: @@ -390,4 +390,4 @@ After you delete an issuer and then add a new one, device users must request a n ## Next steps -[Create device configuration profiles](../configuration/device-profile-create.md). \ No newline at end of file +[Create device configuration profiles](../configuration/device-profile-create.md) diff --git a/memdocs/intune/protect/device-protect.md b/memdocs/intune/protect/device-protect.md index 144fc42c2ce..f1363a8f6ad 100644 --- a/memdocs/intune/protect/device-protect.md +++ b/memdocs/intune/protect/device-protect.md @@ -75,8 +75,8 @@ Following are a few of the security settings and tasks you can manage through av - Android *firmware* updates: - [Firmware Over-the-Air (FOTA)](../protect/fota-updates-android.md) - Supported by some OEMs, you can use FOTA to remotely update firmware of devices. - [Zebra LifeGuard Over-the-Air (LG OTA)](../protect/zebra-lifeguard-ota-integration.md) - Manage firmware updates for supported Zebra devices through the Intune admin center. - - [iOS](../protect/software-updates-ios.md) - Manage device operating system versions, and when devices check for and install updates. - - [macOS](../protect/software-updates-macos.md) - Manage software updates for macOS devices that enrolled as supervised devices. + - [iOS](/mem/intune/protect/managed-software-updates-ios-macos) - Manage device operating system versions, and when devices check for and install updates. + - [macOS](/mem/intune/protect/managed-software-updates-ios-macos) - Manage software updates for macOS devices that enrolled as supervised devices. - [Windows](../protect/windows-update-for-business-configure.md)- To manage the Windows Update experience for devices, you can configure when devices scan or install updates, hold a set of your managed devices at specific feature versions, and more. - **Security baselines** – Deploy [security baselines](../protect/security-baselines.md) to establish a core security posture on your Windows devices. Security baselines are preconfigured groups of Windows settings that come recommended by the relevant product teams. You can use baselines as provided or edit instances of them to meet your security goals for targeted groups of devices. @@ -115,7 +115,7 @@ Following are examples of actions you can run that help secure devices and data: **Devices managed by Intune**: - BitLocker key rotation (Windows only) -- Disable Activation Lock (iOS only) +- Disable Activation Lock (Apple devices only, see how to [turn off Activation Lock using Apple Business Manager](https://techcommunity.microsoft.com/t5/intune-customer-success/support-tip-turn-off-activation-lock-in-apple-business-manager/ba-p/4204553)) - Full or Quick scan (Windows only) - Remote lock - Retire (which removes your organization's data from the device while leaving personal data intact) diff --git a/memdocs/intune/protect/encrypt-devices-filevault.md b/memdocs/intune/protect/encrypt-devices-filevault.md index 1d0b5bb4cc8..21766c3a71b 100644 --- a/memdocs/intune/protect/encrypt-devices-filevault.md +++ b/memdocs/intune/protect/encrypt-devices-filevault.md @@ -1,24 +1,24 @@ --- # required metadata -title: Encrypt macOS devices with FileVault disk encryption with Intune +title: Encrypt macOS FileVault disk encryption with Intune policy titleSuffix: Microsoft Intune -description: Use Microsoft Intune encryption policy to encrypt macOS devices with FileVault, and manage recovery keys for encrypted macOS devices from within the Microsoft Intune admin center. +description: Use Microsoft Intune policy to configure FileVault on macOS devices, and use the admin center to manage their recovery keys. keywords: author: brenduns ms.author: brenduns manager: dougeby -ms.date: 06/21/2024 +ms.date: 10/25/2024 ms.topic: how-to ms.service: microsoft-intune ms.subservice: protect ms.localizationpriority: high -ms.assetid: +ms.assetid: # optional metadata #audience: -ms.reviewer: annovich; aanavath +ms.reviewer: beflamm; aanavath ms.suite: ems search.appverid: MET150 #ms.tgt_pltfrm: @@ -30,7 +30,7 @@ ms.collection: --- -# Use FileVault disk encryption for macOS with Intune +# Use FileVault disk encryption for macOS with Intune Use Microsoft Intune to configure and manage macOS FileVault disk encryption. FileVault is a whole-disk encryption program that is included with macOS. With Intune you can deploy policies that configure FileVault, and then manage recovery keys on devices that run **macOS 10.13 or later**. @@ -66,62 +66,18 @@ You can add this permission and right to your own [custom RBAC roles](../fundame - Help Desk Operator - Endpoint Security Administrator -## Create device configuration policy for FileVault - -1. Sign in to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431). - -2. Select **Devices** > **Manage devices** > **Configuration** > On the *Policies* tab, select **+ Create**. - -3. On the **Create a profile** page, set the following options, and then select **Create**: - - **Platform**: macOS - - **Profile type**: Templates - - **Template name**: Endpoint protection - - :::image type="content" source="./media/encrypt-devices-filevault/select-macos-filevault-dc.png" alt-text="Select the Endpoint protection profile."::: - -4. On the **Basics** page, enter the following properties: - - - **Name**: Enter a descriptive name for the policy. Name your policies so you can easily identify them later. For example, a good policy name might include the profile type and platform. - - - **Description**: Enter a description for the policy. This setting is optional, but recommended. - -5. On the **Configuration settings** page, select **FileVault** to expand the available settings: - - :::image type="content" source="./media/encrypt-devices-filevault/filevault-settings.png" alt-text="FileVault settings."::: - -6. Configure the following settings: - - - For *Enable FileVault*, select **Yes**. - - - For *Recovery key type*, select **Personal key**. - - - For *Escrow location description of personal recovery key*, add a message to help guide users on [how to retrieve the recovery key](#retrieve-a-personal-recovery-key) for their device. This information can be useful for your users when you use the setting for Personal recovery key rotation, which can automatically generate a new recovery key for a device periodically. - - For example: To retrieve a lost or recently rotated recovery key, sign in to the Intune Company Portal website from any device. In the portal, go to *Devices* and select the device that has FileVault enabled, and then select *Get recovery key*. The current recovery key is displayed. - - Configure the remaining [FileVault settings](endpoint-protection-macos.md#filevault) to meet your business needs, and then select **Next**. - -7. If applicable, on the **Scope (Tags)** page, choose **Select scope tags** to open the Select tags pane to assign scope tags to the profile. - - Select **Next** to continue. - -8. On the **Assignments** page, select groups to receive this profile. For more information on assigning profiles, see Assign user and device profiles. -Select **Next**. - -9. On the **Review + create** page, when you're done, choose **Create**. The new profile is displayed in the list when you select the policy type for the profile you created. - ## Create endpoint security policy for FileVault 1. Sign in to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431). 2. Select **Endpoint security** > **Disk encryption** > **Create Policy**. -1. On the **Basics** page, enter the following properties, and then choose **Next**. -- **Platform**: macOS -- **Profile**: FileVault +3. On the **Basics** page, enter the following properties, and then choose **Next**. + - **Platform**: macOS + - **Profile**: FileVault ![Select the FileVault profile](./media/encrypt-devices-filevault/select-macos-filevault-es.png) - + 4. On the **Configuration settings** page: 1. Set *Enable FileVault* to **Yes**. 2. For *Recovery key type*, only **Personal Recovery Key** is supported. @@ -172,7 +128,7 @@ Select **Next**. 7. If applicable, on the **Scope (Tags)** page, choose **Select scope tags** to open the *Select tags* pane to assign scope tags to the profile. Select **Next** to continue. -8. On the **Assignments** page, select the groups that will receive this profile. For more information on assigning profiles, see Assign user and device profiles. Select **Next**. +8. On the **Assignments** page, select the groups that receive this profile. For more information on assigning profiles, see Assign user and device profiles. Select **Next**. 9. On the **Review + create** page, when you're done, select **Create**. The new profile is displayed in the list when you select the policy type for the profile you created. @@ -187,16 +143,61 @@ For devices that run macOS 14 and later, your settings catalog policy can also e - When *Await final Configuration* set to *Yes* for a device, you can then add the following Full Disk Encryption setting for FileVault in your settings catalog profile - FileVault > **Force Enable in Setup Assistant** – Set to **Enabled**. - + The following image shows the settings catalog profile configured with the core settings to enable FileVault and use the Setup Assistant to enforce encryption. In this example, the Location setting uses the simple name of our domain, *Contoso*: - - > [!IMPORTANT] > The **Defer** setting must be configured to **Enabled** to successfully enable FileVault in Setup Assistant for devices running macOS 14.4. - + :::image type="content" source="./media/encrypt-devices-filevault/filevault-setup-assistant-configuration.png" alt-text="Screenshot of the settings needed to enable File Vault in Setup Assistant."::: +## Create device configuration policy for FileVault (Deprecated) + +> [!NOTE] +> The macOS template for Endpoint Protection is deprecated and no longer supports creating new profiles. Instead, use the [Endpoint security](#create-endpoint-security-policy-for-filevault) or the [settings catalog](#create-settings-catalog-policy-for-filevault) to configure and manage new FileVault profiles. + +1. Sign in to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431). + +2. Select **Devices** > **Manage devices** > **Configuration** > On the *Policies* tab, select **+ Create**. + +3. On the **Create a profile** page, set the following options, and then select **Create** > **New policy**: + - **Platform**: macOS + - **Profile type**: Templates + - **Template name**: Endpoint protection (Deprecated) + + :::image type="content" source="./media/encrypt-devices-filevault/select-macos-filevault-dc.png" alt-text="Screen shot that displays the the Endpoint protection profile."::: + +4. On the **Basics** page, enter the following properties: + + - **Name**: Enter a descriptive name for the policy. Name your policies so you can easily identify them later. For example, a good policy name might include the profile type and platform. + + - **Description**: Enter a description for the policy. This setting is optional, but recommended. + +5. On the **Configuration settings** page, select **FileVault** to expand the available settings: + + :::image type="content" source="./media/encrypt-devices-filevault/filevault-settings.png" alt-text="Screen shot that displays FileVault settings."::: + +6. Configure the following settings: + + - For *Enable FileVault*, select **Yes**. + + - For *Recovery key type*, select **Personal key**. + + - For *Escrow location description of personal recovery key*, add a message to help guide users on [how to retrieve the recovery key](#retrieve-a-personal-recovery-key) for their device. This information can be useful for your users when you use the setting for Personal recovery key rotation, which can automatically generate a new recovery key for a device periodically. + + For example: To retrieve a lost or recently rotated recovery key, sign in to the Intune Company Portal website from any device. In the portal, go to *Devices* and select the device that has FileVault enabled, and then select *Get recovery key*. The current recovery key is displayed. + + Configure the remaining [FileVault settings](endpoint-protection-macos.md#filevault) to meet your business needs, and then select **Next**. + +7. If applicable, on the **Scope (Tags)** page, choose **Select scope tags** to open the Select tags pane to assign scope tags to the profile. + + Select **Next** to continue. + +8. On the **Assignments** page, select groups to receive this profile. For more information on assigning profiles, see Assign user and device profiles. +Select **Next**. + +9. On the **Review + create** page, when you're done, choose **Create**. The new profile is displayed in the list when you select the policy type for the profile you created. + ## Manage FileVault To view information about devices that receive FileVault policy, see [Monitor disk encryption](../protect/encryption-monitor.md). @@ -224,7 +225,7 @@ Intune can’t manage FileVault disk encryption on a macOS device that is encryp - [Upload a personal recovery key to Intune](#upload-a-personal-recovery-key) – Use this method when the user knows their personal recovery key. - [The user generates a new recovery key on the device](#generate-a-new-recovery-key-on-the-device) – Use this method if the personal recovery key isn’t known by the user. -Both methods require that the device has active policy from Intune that manages FileVault encryption. To deliver this policy, you can use an [endpoint security disk encryption profile](#create-endpoint-security-policy-for-filevault), or a [device configuration endpoint protection profile](#create-device-configuration-policy-for-filevault) to encrypt devices with FileVault. +Both methods require that the device has active policy from Intune that manages FileVault encryption. To deliver this policy, use an [endpoint security disk encryption profile](#create-endpoint-security-policy-for-filevault). #### Upload a personal recovery key @@ -238,7 +239,7 @@ Upon upload, Intune rotates the key to create a new personal recovery key. Intun Before Intune can assume management of encryption of a user-encrypted device, that device must receive an Intune FileVault policy for disk encryption. - Use either an [endpoint security disk encryption profile](#create-endpoint-security-policy-for-filevault), or a [device configuration endpoint protection profile](#create-device-configuration-policy-for-filevault) to encrypt devices with FileVault. + Use an [endpoint security disk encryption profile](#create-endpoint-security-policy-for-filevault), to encrypt devices with FileVault. - **The user who encrypted the device must have access to their personal recovery key for the device and be directed to upload it to Intune.** @@ -271,7 +272,7 @@ To enable Intune to manage FileVault on a previously encrypted device, the user Before Intune can assume management of encryption of a user-encrypted device, that device must receive an Intune FileVault policy for disk encryption. - Use either an [endpoint security disk encryption profile](#create-endpoint-security-policy-for-filevault), or a [device configuration endpoint protection profile](#create-device-configuration-policy-for-filevault) to encrypt devices with FileVault. + Use an [endpoint security disk encryption profile](#create-endpoint-security-policy-for-filevault) to encrypt devices with FileVault. - **The device user must have access to the Terminal app on the encrypted device.** diff --git a/memdocs/intune/protect/encrypt-devices.md b/memdocs/intune/protect/encrypt-devices.md index db31d243e90..d132ce9ac01 100644 --- a/memdocs/intune/protect/encrypt-devices.md +++ b/memdocs/intune/protect/encrypt-devices.md @@ -1,13 +1,13 @@ --- # required metadata -title: Encrypt Windows devices with BitLocker in Intune +title: Encrypt Windows devices with Intune titleSuffix: Microsoft Intune -description: Use policy from Microsoft Intune admin center to encrypt devices with the BitLocker built-in encryption method, and manage the recovery keys for those encrypted devices. +description: Use Microsoft Intune policy to manage encryption of Windows devices with either BitLocker or Personal Data Encryption. keywords: author: brenduns ms.author: brenduns manager: dougeby -ms.date: 06/26/2024 +ms.date: 09/23/2024 ms.topic: how-to ms.service: microsoft-intune ms.subservice: protect @@ -28,19 +28,23 @@ ms.collection: - sub-secure-endpoints --- -# Manage BitLocker policy for Windows devices with Intune +# Manage Disk Encryption policy for Windows devices with Intune -Use Intune to configure BitLocker Drive Encryption on devices that run Windows 10/11. +Use Intune to configure BitLocker encryption on devices that run Windows 10 or later, and Personal Data Encryption (PDE) on devices that run Windows 11 Version 22H2 or later. -BitLocker is available on devices that run Windows 10/11. Some settings for BitLocker require the device have a supported TPM. +> [!TIP] +> +> Some settings for BitLocker require the device have a supported TPM. + +To configure encryption on your managed devices, use one of the following policy types: -Use one of the following policy types to configure BitLocker on your managed devices: +- **[Endpoint security > Windows encryption policy](#create-an-endpoint-security-policy-for-windows)**. Choose from the following profiles: -- **[Endpoint security disk encryption policy for BitLocker](#create-an-endpoint-security-policy-for-bitlocker)**. The BitLocker profile in *Endpoint security* is a focused group of settings that is dedicated to configuring BitLocker. + - *BitLocker* - A focused group of settings that are dedicated to configuring BitLocker. For more information, see the [BitLocker CSP](/windows/client-management/mdm/bitlocker-csp). - View the BitLocker settings that are available in [BitLocker profiles from disk encryption policy](../protect/endpoint-security-disk-encryption-profile-settings.md#bitlocker). + - *Personal Data Encryption* - [Personal Data Encryption](/windows/security/operating-system-security/data-protection/personal-data-encryption/) (PDE) differs from BitLocker in that it encrypts files instead of whole volumes and disks. PDE occurs in addition to other encryption methods like BitLocker. Unlike BitLocker that releases data encryption keys at boot, PDE doesn't release data encryption keys until a user signs in using Windows Hello for Business. For more information, see the [PDE CSP](/windows/client-management/mdm/personaldataencryption-csp). -- **[Device configuration profile for endpoint protection for BitLocker](#create-an-endpoint-security-policy-for-bitlocker)**. BitLocker settings are one of the available settings categories for Windows 10/11 endpoint protection. +- **[Device configuration profile for endpoint protection for BitLocker](#create-an-endpoint-security-policy-for-windows)**. BitLocker settings are one of the available settings categories for Windows 10/11 endpoint protection. View the BitLocker settings that are available for [BitLocker in endpoint protection profiles from device configuration policy](../protect/endpoint-protection-windows-10.md#windows-settings). @@ -51,7 +55,7 @@ Use one of the following policy types to configure BitLocker on your managed dev > [!IMPORTANT] > -> Before enabling BitLocker, understand and plan for *recovery options* that meet your organizations needs. For more information, start with [**BitLocker recovery overview**](/windows/security/operating-system-security/data-protection/bitlocker/recovery-overview) in the Windows security documentation. +> Before enabling BitLocker, understand and plan for *recovery options* that meet your organizations needs. For more information, start with [**BitLocker recovery overview**](/windows/security/operating-system-security/data-protection/bitlocker/recovery-overview) in the Windows security documentation. ## Role-based access controls to manage BitLocker @@ -66,19 +70,19 @@ You can add this permission and right to your own [custom RBAC roles](../fundame Use one of the following procedures to create the policy type you prefer. -### Create an endpoint security policy for BitLocker +### Create an endpoint security policy for Windows 1. Sign in to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431). 2. Select **Endpoint security** > **Disk encryption** > **Create Policy**. 3. Set the following options: - 1. **Platform**: Windows 10/11 - 2. **Profile**: BitLocker + 1. **Platform**: Windows + 2. **Profile**: Choose either *BitLocker* or *Personal Data Encryption* - ![Select the BitLocker profile](./media/encrypt-devices/select-windows-bitlocker-es.png) + :::image type="content" source="./media/encrypt-devices/select-windows-encpryption-profile.png" alt-text="Screen capture of the Windows encryption profile selection surface."::: -4. On the **Configuration settings** page, configure settings for BitLocker to meet your business needs. +4. On the **Configuration settings** page, configure settings for BitLocker to meet your business needs. Select **Next**. @@ -86,13 +90,17 @@ Use one of the following procedures to create the policy type you prefer. Select **Next** to continue. -6. On the **Assignments** page, select the groups that will receive this profile. For more information on assigning profiles, see Assign user and device profiles. +6. On the **Assignments** page, select the groups that receive this profile. For more information on assigning profiles, see Assign user and device profiles. Select **Next**. 7. On the **Review + create** page, when you're done, choose **Create**. The new profile is displayed in the list when you select the policy type for the profile you created. -### Create a device configuration profile for BitLocker +### Create a device configuration profile for Windows encryption + +> [!TIP] +> +> The following procedure configures BitLocker through a device configuration template for Endpoint protection. To configure Personal Data Encryption, use the device configuration [settings catalog](../configuration/settings-catalog.md) and the *PDE* category. 1. Sign in to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431). @@ -114,7 +122,7 @@ Use one of the following procedures to create the policy type you prefer. 6. Select **Next** to continue. -7. Complete configuration of additional settings, and then save the profile. +7. Complete configuration of other settings, and then save the profile. ## Manage BitLocker @@ -196,17 +204,17 @@ Following are the relevant settings for each profile type: > > If you deploy this baseline to devices on which you want to silently enable BitLocker, review your baseline configurations for possible conflicts. To remove conflicts, either reconfigure the settings in the baselines to remove the conflict, or remove applicable devices from receiving the baseline instances that configure TPM settings that block silent enablement of BitLocker. - ### Full disk vs Used Space only encryption -Three settings determine whether an OS drive will be encrypted by encrypting the used space only, or by full disk encryption: +Three settings determine whether an OS drive is encrypted by encrypting the used space only, or by full disk encryption: + - Whether the hardware of the device is [modern standby](/windows-hardware/design/device-experiences/modern-standby) capable - Whether silent enablement has been configured for BitLocker - ('Warning for other disk encryption' = Block or 'Hide prompt about third-party encryption' = Yes) - Configuration of the [SystemDrivesEncryptionType](/windows/client-management/mdm/bitlocker-csp) - (Enforce drive encryption type on operating system drives) -Assuming that SystemDrivesEncryptionType isn't configured, the following behavior is expected. When silent enablement is configured on a modern standby device, the OS drive is encrypted using the used space only encryption. When silent enablement is configured on a device that isn't capable of modern standby, the OS drive is encrypted using full disk encryption. The result is the same whether you're using an [Endpoint Security disk encryption policy for BitLocker](#create-an-endpoint-security-policy-for-bitlocker) or a [Device Configuration profile for endpoint protection for BitLocker](#create-an-endpoint-security-policy-for-bitlocker). If a different end state is required, the encryption type can be controlled by configuring the SystemDrivesEncryptionType using settings catalog. +Assuming that SystemDrivesEncryptionType isn't configured, the following behavior is expected. When silent enablement is configured on a modern standby device, the OS drive is encrypted using the used space only encryption. When silent enablement is configured on a device that isn't capable of modern standby, the OS drive is encrypted using full disk encryption. The result is the same whether you're using an [Endpoint Security disk encryption policy for BitLocker](#create-an-endpoint-security-policy-for-windows) or a [Device Configuration profile for endpoint protection for BitLocker](#create-a-device-configuration-profile-for-windows-encryption). If a different end state is required, the encryption type can be controlled by configuring the SystemDrivesEncryptionType using settings catalog. To verify whether the hardware is modern standby capable, run the following command from a command prompt: @@ -226,6 +234,7 @@ To verify the encryption type, run the following command from an elevated (admin ```console manage-bde -status c: ``` + The 'Conversion Status' field reflects the encryption type as either Used Space Only encrypted or Fully Encrypted. :::image type="content" source="./media/encrypt-devices/docs_bl_usedspaceonly.png" alt-text="Screenshot of administrative command prompt showing output of manage-bde with conversion status reflecting fully encrypted."::: @@ -234,7 +243,7 @@ The 'Conversion Status' field reflects the encryption type as either Used Space To change the disk encryption type between full disk encryption and used space only encryption, use the'Enforce drive encryption type on operating system drives' setting within settings catalog. -:::image type="content" source="./media/encrypt-devices/docs_bl_settingscatalog_control_encryption.png" alt-text="Screenshot of Intune settings catalog displaying Enforce drive encryption type on operating system drives setting and drop-down list to select from full or used space only encryption types."::: +:::image type="content" source="./media/encrypt-devices/docs_bl_settingscatalog_control_encryption.png" alt-text="Screenshot of Intune settings catalog displaying Enforce drive encryption type on operating system drives"::: ### View details for recovery keys @@ -249,13 +258,13 @@ To be accessible, the device must have its keys escrowed to Microsoft Entra. 3. Select a device from the list, and then under *Monitor*, select **Recovery keys**. 4. Hit **Show Recovery Key**. Selecting this option generates an audit log entry under 'KeyManagement' activity. - + When keys are available in Microsoft Entra, the following information is available: - BitLocker Key ID - BitLocker Recovery Key - Drive Type - When keys aren't in Microsoft Entra, Intune will display *No BitLocker key found for this device*. + When keys aren't in Microsoft Entra, Intune displays *No BitLocker key found for this device*. > [!NOTE] > Currently, Microsoft Entra ID supports a maximum of 200 BitLocker recovery keys per device. If you reach this limit, silent encryption will fail due to the failing backup of recovery keys before starting encryption on the device. @@ -271,7 +280,7 @@ All BitLocker recovery key accesses are audited. For more information on Audit L ### View recovery keys for tenant-attached devices -When you've configured the tenant attach scenario, Microsoft Intune can display recovery key data for tenant attached devices. +When you use the tenant attach scenario, Microsoft Intune can display recovery key data for tenant attached devices. - To support the display of recovery keys for tenant attached devices, your Configuration Manager sites must run version 2107 or later. For sites that run 2107, you must install an update rollup to support Microsoft Entra joined devices: See [KB11121541](../../configmgr/hotfix/2107/11121541.md). @@ -301,7 +310,7 @@ For information about BitLocker deployments and requirements, see the [BitLocker 2. Select **Devices** > **All devices**. -3. In the list of devices that you manage, select a device, and then select the **BitLocker key rotation** device remote action. If this option should be available but isn't visible, select the ellipsis (...) and then *BitLocker key rotation*. +3. In the list of devices that you manage, select a device, and then select the **BitLocker key rotation** remote action. If this option should be available but isn't visible, select the ellipsis (...) and then *BitLocker key rotation*. 4. On the **Overview** page of the device, select the **BitLocker key rotation**. If you don't see this option, select the ellipsis (**…**) to show all options, and then select the **BitLocker key rotation** device remote action. @@ -309,21 +318,22 @@ For information about BitLocker deployments and requirements, see the [BitLocker ### Self service recovery keys -To help end users get their recovery keys without calling the company helpdesk, Intune has enabled [self service scenarios for the end user through the Company Portal app](../user-help/get-recovery-key-windows.md). +To help end users get their recovery keys without calling the company helpdesk, Intune enables [self service scenarios for the end user through the Company Portal app](../user-help/get-recovery-key-windows.md). -While Intune helps configure policy to define the escrow of BitLocker recovery keys, these keys are stored within Entra ID. These are the capabilities within Entra ID that are helpful to use in conjunction with self-service BitLocker recovery key access for end users. +While Intune helps configure policy to define the escrow of BitLocker recovery keys, these keys are stored within Entra ID. These are the capabilities within Entra ID that are helpful to use with self-service BitLocker recovery key access for end users. -1. **Tenant-wide toggle to prevent recovery key access for non-admin users**: This setting determines if users can self-service to recover their BitLocker key(s). The default value is 'No' which allows all users to recover their BitLocker key(s). 'Yes' restricts non-admin users from being able to see the BitLocker key(s) for their own devices if there are any. [Learn more about this control in Entra ID](/entra/identity/devices/manage-device-identities#configure-device-settings). +1. **Tenant-wide toggle to prevent recovery key access for non-admin users**: This setting determines if users can use self-service to recover their BitLocker keys. The default value is 'No' which allows all users to recover their BitLocker keys. 'Yes' restricts non-admin users from being able to see the BitLocker keys for their own devices if there are any. [Learn more about this control in Entra ID](/entra/identity/devices/manage-device-identities#configure-device-settings). -3. **Auditing for recovery key access**: Audit Logs within the Entra ID portal show the history of activities within the tenant. Any user recovery key accesses made through the Company Portal website will be logged in Audit Logs under the Key Management category as a “Read BitLocker key” activity type. The user’s User Principal Name and additional info such as key ID is also logged. [Learn more about audit logs in Entra ID](/entra/identity/monitoring-health/concept-audit-logs). +2. **Auditing for recovery key access**: Audit Logs within the Entra ID portal show the history of activities within the tenant. Any user recovery key accesses made through the Company Portal website will be logged in Audit Logs under the Key Management category as a “Read BitLocker key” activity type. The user’s User Principal Name and other info such as key ID is also logged. [Learn more about audit logs in Entra ID](/entra/identity/monitoring-health/concept-audit-logs). -4. **Entra Conditional Access policy requiring a compliant device to access BitLocker Recovery Key**: With Conditional Access policy (CA), you can restrict the access to certain corporate resources if a device is not compliant with the “Require compliant device” setting. If this is set up within your organization, and a device fails to meet the Compliance requirements configured in the Intune Compliance policy, that device cannot be used to access the BitLocker Recovery Key as it is considered a corporate resource which is access controlled by CA. +3. **Entra Conditional Access policy requiring a compliant device to access BitLocker Recovery Key**: With Conditional Access policy (CA), you can restrict the access to certain corporate resources if a device isn't compliant with the “Require compliant device” setting. If this is set up within your organization, and a device fails to meet the Compliance requirements configured in the Intune Compliance policy, that device can't be used to access the BitLocker Recovery Key as it is considered a corporate resource which is access controlled by CA. ## Next steps -- [Manage FileVault policy](../protect/encrypt-devices-filevault.md) +- [Manage FileVault policy](../protect/encrypt-devices-filevault.md) - [Monitor disk encryption](../protect/encryption-monitor.md) - [Troubleshooting BitLocker policy](/troubleshoot/mem/intune/troubleshoot-bitlocker-policies) - [Known issues for Enforcing BitLocker policies with Intune](/windows/security/information-protection/bitlocker/ts-bitlocker-intune-issues) - [BitLocker management for enterprises](/windows/security/information-protection/bitlocker/bitlocker-management-for-enterprises), in the Windows security documentation +- [Personal Data Encryption overview](/windows/security/operating-system-security/data-protection/personal-data-encryption/) - [Self service scenarios for the end user through the Company Portal app](../user-help/get-recovery-key-windows.md) diff --git a/memdocs/intune/protect/encryption-monitor.md b/memdocs/intune/protect/encryption-monitor.md index e9a1291db8f..ce2c1926234 100644 --- a/memdocs/intune/protect/encryption-monitor.md +++ b/memdocs/intune/protect/encryption-monitor.md @@ -7,7 +7,7 @@ keywords: author: brenduns ms.author: brenduns manager: dougeby -ms.date: 01/18/2024 +ms.date: 10/14/2024 ms.topic: how-to ms.service: microsoft-intune ms.subservice: protect @@ -55,7 +55,7 @@ The encryption report supports reporting on devices that run the following opera ### Report details -The Encryption report pane displays a list of the devices you manage with high-level details about those devices. You can select a device from the list to drill-in and view additional details from the devices [Device encryption status](#device-encryption-status) pane. +The Encryption report pane displays a list of the devices you manage with high-level details about those devices. You can select a device from the list to drill-in and view more details from the devices [Device encryption status](#device-encryption-status) pane. - **Device name** - The name of the device. - **OS** – The device platform, such as Windows or macOS. @@ -76,7 +76,7 @@ The Encryption report pane displays a list of the devices you manage with high For more information on Windows prerequisites for encryption, see the [BitLocker configuration service provider (CSP)](/windows/client-management/mdm/bitlocker-csp) in the Windows documentation. - - **Not ready**: The device doesn't have full encryption capabilities, but may still support encryption. + - **Not ready**: The device doesn't have full encryption capabilities, but might still support encryption. - **Not applicable**: There isn't enough information to classify this device. - **Encryption status** – Whether the OS drive is encrypted. @@ -166,7 +166,7 @@ When you select a device from the Encryption report, Intune displays the **Devic - Recovery key backup failed. - *Consider: Check the Event log on device to see why the recovery key backup failed. You may need to run the **manage-bde** command to manually escrow recovery keys.* + *Consider: Check the devices Event log to see why the recovery key backup failed. You might need to run the **manage-bde** command to manually escrow recovery keys.* - A fixed drive is unprotected. @@ -178,15 +178,15 @@ When you select a device from the Encryption report, Intune displays the **Devic - Windows Recovery Environment (WinRE) isn't configured. - *Consider: Need to run command line to configure the WinRE on separate partition; as that was not detected. For more information, see [REAgentC command-line options](/windows-hardware/manufacture/desktop/reagentc-command-line-options).* + *Consider: Need to run command line to configure the WinRE on separate partition; as that wasn't detected. For more information, see [REAgentC command-line options](/windows-hardware/manufacture/desktop/reagentc-command-line-options).* - A TPM isn't available for BitLocker, either because it isn't present, it's been made unavailable in the Registry, or the OS is on a removable drive. - *Consider: The BitLocker policy applied to this device requires a TPM, but on this device, the BitLocker CSP has detected that the TPM may be disabled at the BIOS level.* + *Consider: The BitLocker policy applied to this device requires a TPM, but on this device, the BitLocker CSP detects that the TPM might be disabled at the BIOS level.* - The TPM isn't ready for BitLocker. - *Consider: The BitLocker CSP sees that this device has an available TPM, but the TPM may need to be initialized. Consider running **intialize-tpm** on the machine to initialize the TPM.* + *Consider: The BitLocker CSP sees that this device has an available TPM, but the TPM might need to be initialized. Consider running **intialize-tpm** on the machine to initialize the TPM.* - The network isn't available, which is required for recovery key backup. @@ -200,7 +200,7 @@ This report can be of use in identifying problems for groups of devices. For exa ## Manage recovery keys -For details on managing recovery keys, see the following in the Intune documentation: +For details on managing recovery keys, see the following Intune documentation: macOS FileVault: diff --git a/memdocs/intune/protect/endpoint-protection-configure.md b/memdocs/intune/protect/endpoint-protection-configure.md index eebdaa93549..eb3770b8e69 100644 --- a/memdocs/intune/protect/endpoint-protection-configure.md +++ b/memdocs/intune/protect/endpoint-protection-configure.md @@ -7,7 +7,7 @@ keywords: author: lenewsad ms.author: lanewsad manager: dougeby -ms.date: 11/14/2023 +ms.date: 09/19/2024 ms.topic: how-to ms.service: microsoft-intune ms.subservice: protect @@ -47,7 +47,10 @@ Before you create a profile, review the following articles that detail the Endpo ## Create a device profile containing Endpoint protection settings -1. Sign in to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431). +> [!IMPORTANT] +> The macOS endpoint protection template has been deprecated. Existing policies remain unchanged, but you can no longer create new policies using this template. We recommend using the settings catalog to create new configuration policies for FileVault, Firewall, and System Policy Control (Gatekeeper) payloads. For more information, see [macOS settings catalog](../configuration/settings-catalog.md). + +1. Sign in to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431). 2. Select **Devices** > **Manage devices** > **Configuration** > **Create**. diff --git a/memdocs/intune/protect/endpoint-protection-macos.md b/memdocs/intune/protect/endpoint-protection-macos.md index c4c6115f1f0..3f6f0889110 100644 --- a/memdocs/intune/protect/endpoint-protection-macos.md +++ b/memdocs/intune/protect/endpoint-protection-macos.md @@ -7,7 +7,7 @@ keywords: author: lenewsad ms.author: lanewsad manager: dougeby -ms.date: 08/15/2022 +ms.date: 10/25/2024 ms.topic: reference ms.service: microsoft-intune ms.subservice: protect @@ -31,6 +31,11 @@ ms.collection: # macOS endpoint protection settings in Intune +> [!IMPORTANT] +> The macOS endpoint protection template has been deprecated. Existing policies remain unchanged, but you can no longer create new policies using this template. > Instead, use one of the following options: +> - Use Endpoint security policies like [disk encryption](../protect/endpoint-security-disk-encryption-policy.md) for Filevault, or [Firewall](../protect/endpoint-security-firewall-policy.md) policy. +> - Use the Settings catalog to create new configuration policies for FileVault, Firewall, and System Policy Control (Gatekeeper) payloads. For more information, see [macOS settings catalog](../configuration/settings-catalog.md). + This article shows you the endpoint protection settings that you can configure for devices that run macOS. You configure these settings by using a macOS device configuration profile for [endpoint protection](endpoint-protection-configure.md) in Intune. ## Before you begin diff --git a/memdocs/intune/protect/endpoint-security-account-protection-policy.md b/memdocs/intune/protect/endpoint-security-account-protection-policy.md index 728137004e5..f6de6b49570 100644 --- a/memdocs/intune/protect/endpoint-security-account-protection-policy.md +++ b/memdocs/intune/protect/endpoint-security-account-protection-policy.md @@ -2,12 +2,12 @@ # required metadata title: Manage account protection settings with endpoint security policies in Microsoft Intune -description: Deploy policies for endpoint security account protection policies to devices you manage with in Microsoft Intune. +description: Use Microsoft Intune endpoint security account protection policies to protect the identity and accounts of users. keywords: author: brenduns ms.author: brenduns manager: dougeby -ms.date: 08/19/2024 +ms.date: 10/10/2024 ms.topic: conceptual ms.service: microsoft-intune ms.subservice: protect @@ -57,10 +57,13 @@ For guidance on assigning the right level of permissions and rights to manage In ## Account protection profiles -Platform: **Windows**: +Platform: + +- **Windows** Profiles: -- **Account protection** – Settings for account protection policies help you protect user credentials. The account protection policy is focused on settings for Windows Hello for Business that include both *device-scoped* and *user-scoped* settings, and Credential Guard, which is part of Windows identity and access management. + +- **Account protection** – Settings for account protection policies help you to protect user credentials. The account protection policy focuses on *device-scoped* and *user-scoped* settings for Windows Hello for Business, and on Credential Guard. Credential Guard is part of Windows identity and access management. - *Windows Hello for Business* replaces passwords with strong two-factor authentication on PCs and mobile devices. - *Credential Guard* helps protect credentials and secrets that you use with your devices. @@ -134,7 +137,7 @@ As devices check in and apply the policy, the admin center displays the status o Because the policy can contain multiple rules, consider the following points: -- When processing the policy for devices, the per-setting status view displays a status for the group of rules as if it’s a single setting. +- When Intune processes the policy for devices, the per-setting status view displays a status for the group of rules as if it’s a single setting. - Each rule in the policy that results in an error is skipped, and not sent to devices. - Each rule that is successful is sent to devices to be applied. diff --git a/memdocs/intune/protect/endpoint-security-antivirus-policy.md b/memdocs/intune/protect/endpoint-security-antivirus-policy.md index 846d315fe68..e3468915edb 100644 --- a/memdocs/intune/protect/endpoint-security-antivirus-policy.md +++ b/memdocs/intune/protect/endpoint-security-antivirus-policy.md @@ -168,6 +168,11 @@ The following profiles are supported for devices you manage with Intune: These CSPs for antivirus exclusion are also managed by *Microsoft Defender Antivirus* policy, which includes identical settings for exclusions. Settings from both policy types (*Antivirus* and *Antivirus exclusions*) are subject to [policy merge](#policy-merge-for-settings), and create a super set of exclusions for applicable devices and users. + > [!WARNING] + > **Defining exclusions lowers the protection offered by Microsoft Defender Antivirus**. Always evaluate the risks that are associated with implementing exclusions. Only exclude files you know aren't malicious. + > + > For more information, see [Exclusions overview](/defender-endpoint/navigate-defender-endpoint-antivirus-exclusions) in the Microsoft Defender documentation. + - Profile: **Windows Security experience** - Manage the Windows Security app settings that end users can view in the Microsoft Defender Security center and the notifications they receive. The Windows security app is used by a number of Windows security features to provide notifications about the health and security of the machine. Security app notifications include firewalls, antivirus products, Windows Defender SmartScreen, and others. diff --git a/memdocs/intune/protect/endpoint-security-app-control-policy.md b/memdocs/intune/protect/endpoint-security-app-control-policy.md index 861bba1adf8..ba79d597475 100644 --- a/memdocs/intune/protect/endpoint-security-app-control-policy.md +++ b/memdocs/intune/protect/endpoint-security-app-control-policy.md @@ -218,13 +218,13 @@ To run this script, you can use Intune to run [PowerShell scripts](../apps/intun #### Remove all AppLocker policies from a device (optional) -To remove *all* Windows AppLocker policies from a device, you can use the **CatCleanAll.ps1** PowerShell script. This script removes not only the Intune Management Extension as a managed installer, but *all* managed installers and *all* policies based on Windows AppLocker from a device. Before using this script, be sure you understand your organizations use of AppLocker policies. +To remove *all* Windows AppLocker policies from a device, you can use the **CatCleanAll.ps1** PowerShell script. This script removes not only the Intune Management Extension as a managed installer, but *all* policies based on Windows AppLocker from a device. Before using this script, be sure you understand your organizations use of AppLocker policies. 1. Download the **CatCleanAll.ps1** PowerShell script. This script is available at [https://aka.ms/intune_WDAC/CatCleanAll]( https://aka.ms/intune_WDAC/CatCleanAll) from *download.microsoft.com*. -2. Run this script on devices that have the Intune Management Extension set as a managed installer. This script removes only the Intune Management Extension as a managed installer. +2. Run this script on devices that have the Intune Management Extension set as a managed installer. This script removes the Intune Management Extension as a managed installer and AppLocker policies from the device. -3. Restart the Intune Management Extension service for the above changes to take effect. +3. Restart the Intune Management Extension service for the above changes to take effect. To run this script, you can use Intune to run [PowerShell scripts](../apps/intune-management-extension.md), or other methods of your choice. diff --git a/memdocs/intune/protect/endpoint-security-asr-policy.md b/memdocs/intune/protect/endpoint-security-asr-policy.md index a8e0ed0adf9..c21937acd2c 100644 --- a/memdocs/intune/protect/endpoint-security-asr-policy.md +++ b/memdocs/intune/protect/endpoint-security-asr-policy.md @@ -43,7 +43,7 @@ You can use attack surface reduction (ASR) policies to reduce the attack surface For more information, see [Overview of attack surface reduction]( /windows/security/threat-protection/microsoft-defender-atp/overview-attack-surface-reduction) in the Windows Threat protection documentation. - Attack surface reduction polices are found in the **Endpoint security** node of the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431). + Attack surface reduction policies are found in the **Endpoint security** node of the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431). Applies to: diff --git a/memdocs/intune/protect/endpoint-security-disk-encryption-policy.md b/memdocs/intune/protect/endpoint-security-disk-encryption-policy.md index 2b471c34208..0f4fc189b04 100644 --- a/memdocs/intune/protect/endpoint-security-disk-encryption-policy.md +++ b/memdocs/intune/protect/endpoint-security-disk-encryption-policy.md @@ -7,7 +7,7 @@ keywords: author: brenduns ms.author: brenduns manager: dougeby -ms.date: 08/19/2024 +ms.date: 09/23/2024 ms.topic: conceptual ms.service: microsoft-intune ms.subservice: protect @@ -32,7 +32,7 @@ ms.reviewer: aanavath # Disk encryption policy for endpoint security in Intune -Endpoint security Disk encryption profiles focus on only the settings that are relevant for a devices built-in encryption method, like FileVault or BitLocker. This focus makes it easy for security admins to manage disk encryption settings without having to navigate a host of unrelated settings. +Endpoint security Disk encryption profiles focus on only the settings that are relevant for a devices built-in encryption method, like FileVault, BitLocker, and Personal Data Encryption (for Windows). This focus makes it easy for security admins to manage disk encryption settings without having to navigate a host of unrelated settings. While you can configure the same device settings by using *Endpoint Protection* profiles for device configuration, the device configuration profiles include other categories of settings. These other settings are unrelated to disk encryption and can complicate the task of configuring only disk encryption. @@ -66,21 +66,28 @@ For guidance on assigning the right level of permissions and rights to manage In > > Beginning on June 19, 2023, the BitLocker profile for Windows was updated to use the settings format as found in the Settings Catalog. The new profile format includes the same settings as the older profile. With this change you can no longer create new versions of the old profiles. Your existing instances of the old profile remain available to use and edit. > - > With the new profile format, we no longer publish a dedicated list of settings as found in the profile. Instead, use the *Learn more* link in the UI while viewing information for a setting, to open [BitLocker CSP](/windows/client-management/mdm/bitlocker-csp) in the Windows documentation, where the setting is detailed in full. + > With the new profile format, we no longer publish a dedicated list of settings as found in the profile. Instead, use the *Learn more* link in the UI while viewing information for a setting, to open [BitLocker CSP](/windows/client-management/mdm/bitlocker-csp) in the Windows documentation, where the setting is detailed in full. > > You can continue to find a list of settings in the original BitLocker profiles created before June 19, 2023, at [BitLocker settings](../protect/endpoint-security-disk-encryption-profile-settings.md#bitlocker) in the Intune documentation. - To create a BitLocker profile, see [Use BitLocker disk encryption for Windows](../protect/encrypt-devices.md). +- **Personal Data Encryption** - Personal Data Encryption (PDE) encrypts data at the folder level and is available for devices that run Windows 11 version 22H2 or later. PDE differs from BitLocker in that it encrypts files instead of whole volumes and disks. PDE occurs in addition to other encryption methods such as BitLocker. Unlike BitLocker that releases data encryption keys at boot, PDE doesn't release data encryption keys until a user signs in using Windows Hello for Business. PDE uses the [PDE CSP](/windows/client-management/mdm/personaldataencryption-csp). + + For more information about PDE, including prerequisites, related requirements, and recommendations, see the following articles in the Windows security documentation: + - [PDE overview](/windows/security/operating-system-security/data-protection/personal-data-encryption/) + - [Configure PDE](/windows/security/operating-system-security/data-protection/personal-data-encryption/configure) + - [PDE frequently asked questions (FAQ)](/windows/security/operating-system-security/data-protection/personal-data-encryption/faq) + +To create a BitLocker or Personal Data Encryption profile, see [Use disk encryption for Windows](../protect/encrypt-devices.md). ## Manage device encryption After you deploy policy to encrypt a device disk, see the following articles for information on managing encryption: -- [Manage BitLocker](../protect/encrypt-devices.md#manage-bitlocker) -- [Manage FileVault](../protect/encrypt-devices-filevault.md#manage-filevault) +- [Manage encryption on Windows](../protect/encrypt-devices.md) +- [Manage encryption on macOS](../protect/encrypt-devices-filevault.md#manage-filevault) - [Monitor device encryption](../protect/encryption-monitor.md) ## Next steps -- [To create a FileVault profile](../protect/encrypt-devices-filevault.md#create-endpoint-security-policy-for-filevault) -- [To create a BitLocker profile](../protect/encrypt-devices.md#create-an-endpoint-security-policy-for-bitlocker) +- [To create a macOS encryption profile](../protect/encrypt-devices-filevault.md#create-endpoint-security-policy-for-filevault) +- [To create a Windows encryption profile](../protect/encrypt-devices.md#create-an-endpoint-security-policy-for-windows) diff --git a/memdocs/intune/protect/endpoint-security-edr-policy.md b/memdocs/intune/protect/endpoint-security-edr-policy.md index 1bdb6ee5708..7949fbcc36b 100644 --- a/memdocs/intune/protect/endpoint-security-edr-policy.md +++ b/memdocs/intune/protect/endpoint-security-edr-policy.md @@ -61,7 +61,7 @@ Based on the platform a policy targets, EDR policies for devices you manage with > [!TIP] > In addition to EDR policy, you can use [device configuration](../protect/advanced-threat-protection-configure.md) policy to onboard devices to Microsoft Defender for Endpoint. However, device configuration policies don't support tenant attached devices. > -> When using multiple polices or policy types like *device configuration* policy and *endpoint detection and response* policy to manage the same device settings (such as onboarding to Defender for Endpoint), you can create policy conflicts for devices. To learn more about conflicts, see [Manage conflicts](../protect/endpoint-security-policy.md#manage-conflicts) in the *Manage security policies* article. +> When using multiple policies or policy types like *device configuration* policy and *endpoint detection and response* policy to manage the same device settings (such as onboarding to Defender for Endpoint), you can create policy conflicts for devices. To learn more about conflicts, see [Manage conflicts](../protect/endpoint-security-policy.md#manage-conflicts) in the *Manage security policies* article. ## Prerequisites for EDR policies @@ -78,7 +78,7 @@ Based on the platform a policy targets, EDR policies for devices you manage with To set up tenant attach, including the synchronization of Configuration Manager collections to the Microsoft Intune admin center and enabling them to work with policies for endpoint security, see [Configure tenant attach to support endpoint protection policies](../protect/tenant-attach-intune.md). - For more information about using EDR polices with tenant attached devices, see [Set up Configuration Manager to support EDR policy](#set-up-configuration-manager-to-support-edr-policy) in this article. + For more information about using EDR policies with tenant attached devices, see [Set up Configuration Manager to support EDR policy](#set-up-configuration-manager-to-support-edr-policy) in this article. ## Role-based access controls (RBAC) diff --git a/memdocs/intune/protect/endpoint-security-firewall-policy.md b/memdocs/intune/protect/endpoint-security-firewall-policy.md index 5546622d8eb..a84dc1f2990 100644 --- a/memdocs/intune/protect/endpoint-security-firewall-policy.md +++ b/memdocs/intune/protect/endpoint-security-firewall-policy.md @@ -7,7 +7,7 @@ keywords: author: brenduns ms.author: brenduns manager: dougeby -ms.date: 06/17/2024 +ms.date: 09/18/2024 ms.topic: reference ms.service: microsoft-intune ms.subservice: protect @@ -72,7 +72,8 @@ For guidance on assigning the right level of permissions and rights to manage In For information about configuring settings in the following profiles, see the [Firewall configuration service provider (CSP)](/windows/client-management/mdm/firewall-csp). -> [!NOTE] +> [!NOTE] +> > Beginning on April 5, 2022, the *Windows 10 and later* platform was replaced by the *Windows 10, Windows 11, and Windows Server* platform that is now named more simply as *Windows*. > > The *Windows* platform supports devices communicating through Microsoft Intune or Microsoft Defender for Endpoint. These profiles also add support for the Windows Server platform which is not supported through Microsoft Intune natively. @@ -83,8 +84,9 @@ For guidance on assigning the right level of permissions and rights to manage In - **Windows Firewall rules** - Define granular Firewall rules, including specific ports, protocols, applications and networks, and to allow or block network traffic. Each instance of this profile supports up to 150 custom rules. - > [!TIP] - > Use of the **Policy App Id** setting, which is described in the [*MdmStore/FirewallRules/{FirewallRuleName}/PolicyAppId*](/windows/client-management/mdm/Firewall-csp?WT.mc_id=Portal-fx#mdmstorefirewallrulesfirewallrulenamepolicyappid) CSP, requires that your environment use *Windows Defender Application Control* (WDAC) tagging. For more information see the following Windows Defender articles: + > [!TIP] + > + > Use of the **Policy App Id** setting, which is described in the [*MdmStore/FirewallRules/{FirewallRuleName}/PolicyAppId*](/windows/client-management/mdm/Firewall-csp?WT.mc_id=Portal-fx#mdmstorefirewallrulesfirewallrulenamepolicyappid) CSP, requires that your environment use *Windows Defender Application Control* (WDAC) tagging. For more information, see the following Windows Defender articles: > - [About application control for Windows](/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control) > - [WDAC Application ID (AppId) Tagging guide](/windows/security/threat-protection/windows-defender-application-control/appidtagging/windows-defender-application-control-appid-tagging-guide) @@ -104,7 +106,11 @@ The following firewall rule profile settings are available in reusable settings When you configure a firewall rule to add one or more reusable settings groups, you’ll also configure the rules Action to define how the settings in those groups are used. -Each rule you add to the profile can include both reusable settings groups and individual settings that are added directly to the rule. However, consider using each rule for either reusable settings groups or to manage settings you add directly to the rule. This separation can help simplify future configurations or changes you might make. +Each rule you add to the profile can include both reusable settings groups and individual settings that are added directly to the rule. However, consider using each rule for either reusable settings groups or to manage settings you add directly to the rule. This separation can help simplify future configurations or changes you might make. + +> [!NOTE] +> +> Inbound FQDN rules aren’t natively supported. However, it’s possible to use *pre-hydration* scripts to generate inbound IP entries for the rule. For more information, see [Windows Firewall dynamic keywords](/windows/security/operating-system-security/network-security/windows-firewall/dynamic-keywords) in the Windows Firewall documentation. For prerequisites and guidance on configuring reusable groups, and then adding them to this profile, see [Use reusable groups of settings with Intune policies](../protect/reusable-settings-groups.md). @@ -122,7 +128,7 @@ Plan for Firewall policies to be applied to a device using only one policy. Use When you use **Windows Firewall rules** profiles, you can apply multiple rules profiles to the same device. However, when different rules exist for the same thing with different configurations, both are sent to the device and create a conflict, on that device. -- For example, if one rule blocks *Teams.exe* through the firewall and a second rule allows *Teams.exe*, both rules are delivered to the client. This result is different from conflicts created through other policies for Firewall settings. +- For example, if one rule blocks *Teams.exe* through the firewall and a second rule allows *Teams.exe*, both rules are delivered to the client. This result is different from conflicts created through other policies for Firewall settings. When rules from multiple rules profiles don't conflict with each other, devices merge the rules from each profile to create a combined firewall rule configuration on the device. This behavior enables you to deploy more than the 150 rules that each individual profile supports to a device. @@ -130,7 +136,7 @@ When rules from multiple rules profiles don't conflict with each other, devices ## Firewall policy reports -The reports for Firewall policy display status details about the firewall status for your managed devices. Firewall reports support managed devices that run the following operating systems. +The reports for Firewall policy display status details about the firewall status for your managed devices. Firewall reports support managed devices that run the following operating systems. - Windows 10/11 @@ -145,7 +151,7 @@ This view provides: ### MDM devices running Windows 10 or later with firewall off -This report is located in the Endpoint security node. Open the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431), and then go to **Endpoint security** > **Firewall** > **MDM devices running Windows 10 or later with firewall off**. +This report is located in the Endpoint security node. Open the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431), and then go to **Endpoint security** > **Firewall** > **MDM devices running Windows 10 or later with firewall off**. Data is reported through the Windows [DeviceStatus CSP](/windows/client-management/mdm/devicestatus-csp), and identifies each device where the Firewall is off. By default, visible details include: @@ -162,7 +168,7 @@ Data is reported through the Windows [DeviceStatus CSP](/windows/client-manageme *This organizational report is also described in [Intune Reports](../fundamentals/reports.md#mdm-firewall-status-for-windows-10-and-later-organizational)*. -As an organizational report, this report is available from the **Reports** node. Open the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431), and then go to **Reports** > **Firewall** > **MDM Firewall status for Windows 10 and later**. +As an organizational report, this report is available from the **Reports** node. Open the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431), and then go to **Reports** > **Firewall** > **MDM Firewall status for Windows 10 and later**. > [!div class="mx-imgBorder"] > ![Select firewall reports](media/endpoint-security-firewall-policy/select-firewall-reports.png) @@ -194,7 +200,7 @@ Additional common firewall rule issues: > [!div class="mx-imgBorder"] > ![RemotePortRangesFailure](media/endpoint-security-firewall-policy/remoteportrangeparameterincorrect.png) - Verify configured ranges are ascending (Example: 1-5 is correct, 5-1 will cause this error) -- Verify configured ranges are within the overall port range of 0-65535 +- Verify configured ranges are within the overall port range of 0-65535 - If either remote port ranges or local port ranges are configured in a rule, protocol **must** also be configured with 6 (TCP) **or** 17 (UDP) **Event Viewer: "...Name), Result: (The parameter is incorrect)"** diff --git a/memdocs/intune/protect/endpoint-security-policy.md b/memdocs/intune/protect/endpoint-security-policy.md index 81dea9f6b3f..98bf07acf07 100644 --- a/memdocs/intune/protect/endpoint-security-policy.md +++ b/memdocs/intune/protect/endpoint-security-policy.md @@ -7,7 +7,7 @@ keywords: author: brenduns ms.author: brenduns manager: dougeby -ms.date: 06/17/2024 +ms.date: 09/23/2024 ms.topic: how-to ms.service: microsoft-intune ms.subservice: protect @@ -58,7 +58,7 @@ Following are brief descriptions of each endpoint security policy type. To learn - [Attack surface reduction](../protect/endpoint-security-asr-policy.md) - When Defender antivirus is in use on your Windows 10/11 devices, use Intune endpoint security policies for Attack surface reduction to manage those settings for your devices. -- [Disk encryption](../protect/endpoint-security-disk-encryption-policy.md) - Endpoint security Disk encryption profiles focus on only the settings that are relevant for a devices built-in encryption method, like FileVault or BitLocker. This focus makes it easy for security admins to manage disk encryption settings without having to navigate a host of unrelated settings. +- [Disk encryption](../protect/endpoint-security-disk-encryption-policy.md) - Endpoint security Disk encryption profiles focus on only the settings that are relevant for a devices built-in encryption method, like FileVault, BitLocker, and Personal Data Encryption (for Windows). This focus makes it easy for security admins to manage disk or folder level encryption settings without having to navigate a host of unrelated settings. - [Endpoint detection and response](../protect/endpoint-security-edr-policy.md) - When you integrate Microsoft Defender for Endpoint with Intune, use the endpoint security policies for endpoint detection and response (EDR) to manage the EDR settings and onboard devices to Microsoft Defender for Endpoint. @@ -72,7 +72,7 @@ To manage Intune endpoint security policies, you must use an account that includ > [!NOTE] > -> Before June of 2024, Intune endpoint security polices were managed through rights provided by the *Security baselines* permission. Beginning in June of 2024, Intune began to release granular permissions to manage individual endpoint security workloads. +> Before June of 2024, Intune endpoint security policies were managed through rights provided by the *Security baselines* permission. Beginning in June of 2024, Intune began to release granular permissions to manage individual endpoint security workloads. > > Each time a new granular permission for an endpoint security workload is added to Intune, those same rights are removed from the *Security baselines* permission. If you use custom roles with the *Security baselines* permission, the new RBAC permission is assigned automatically to your custom roles with the same rights that were granted through the *Security baseline* permission. This auto-assignment ensures your admins continue to have the same permissions they have today. @@ -183,8 +183,9 @@ After creating the new policy, review and edit the policy to make changes to its ### To duplicate a policy 1. Sign in to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431). -2. Select the policy that you want to copy. Next, select **Duplicate**. If *Duplicate* isn't available, select the ellipsis (**…**) to the right of the policy and then select **Duplicate**. -3. Provide a **New name** for the policy, and then select **Save**. +2. Locate the policy that you want to copy from the policy list, and then select the ellipsis (**…**) for that line to open the *Context menu*. +3. Select **Duplicate**. +4. Provide a **New name** for the policy, and then select **Save**. ### To edit a policy diff --git a/memdocs/intune/protect/epm-data-collection.md b/memdocs/intune/protect/epm-data-collection.md index e797baf6ca8..a4a0ea0f2c4 100644 --- a/memdocs/intune/protect/epm-data-collection.md +++ b/memdocs/intune/protect/epm-data-collection.md @@ -5,8 +5,8 @@ keywords: author: brenduns ms.author: brenduns manager: dougeby -ms.date: 11/9/2023 -ms.topic: how-to +ms.date: 10/08/2024 +ms.topic: conceptual ms.service: microsoft-intune ms.subservice: protect ms.localizationpriority: high @@ -16,7 +16,7 @@ ms.localizationpriority: high #ROBOTS: #audience: -ms.reviewer: mattcall +ms.reviewer: mikedano ms.suite: ems search.appverid: MET150 #ms.tgt_pltfrm: @@ -49,7 +49,7 @@ Endpoint Privilege Management on devices can be configured to report on the foll - Diagnostic data - Usage data -When configuring EPM, you configure the *Send elevation data for reporting* and *Reporting scope* settings in an Intune [Windows elevation settings policy](../protect/epm-policies.md#about-windows-elevation-settings-policy) to determine which data is reported to Microsoft. +When configuring EPM, you configure the *Send elevation data for reporting* and *Reporting scope* settings in an Intune [Windows elevation settings policy](../protect/epm-policies.md#about-windows-elevation-settings-policy) to determine which data Intune reports to Microsoft. ## Diagnostic Data @@ -57,7 +57,7 @@ Diagnostic data is event data that is used by Microsoft to monitor the health of ## Usage Data -Usage data is elevation data that is used by customers to determine what elevations have occurred in their environment. This data is stored with your Intune infrastructure and is used to populate the [elevation reports](../protect/epm-reports.md). When configuring *reporting scope*, you configure what scope of data is collected and can choose between: +Usage data is elevation data that is used by customers to determine what elevations occur in their environment. This data is stored with your Intune infrastructure and is used to populate the [elevation reports](../protect/epm-reports.md). When configuring *reporting scope*, you configure what scope of data is collected and can choose between: - *Diagnostic data* only - *Diagnostic data and all endpoint elevations* that take place on a device @@ -101,7 +101,7 @@ Usage data is elevation data that is used by customers to determine what elevati ||Operation Type|Type of policy application, used for policy application operations | ||Cancellation Action Type|Type of cancellation generated by the Administrator| -## Next steps +## Related content - [Learn about Endpoint Privilege Management](../protect/epm-overview.md) - [Guidance for creating Elevation Rules](../protect/epm-guidance-for-creating-rules.md) diff --git a/memdocs/intune/protect/includes/mtd-mam-note.md b/memdocs/intune/protect/includes/mtd-mam-note.md new file mode 100644 index 00000000000..347500c4abc --- /dev/null +++ b/memdocs/intune/protect/includes/mtd-mam-note.md @@ -0,0 +1,29 @@ +--- +author: brenduns +ms.author: brenduns +ms.reviewer: demerson + +ms.service: microsoft-intune +ms.subservice: protect +ms.topic: include +ms.date: 08/20/2024 + +--- + + + +> [!NOTE] +> +> This article applies to all Mobile Threat Defense partners that support app protection policies: +> +> - Better Mobile (Android, iOS/iPadOS) +> - BlackBerry Mobile (CylancePROTECT for Android, iOS/iPadOS) +> - Check Point Harmony Mobile (Android, iOS/iPadOS) +> - Jamf (Android, iOS/iPadOS) +> - Lookout for Work (Android, iOS/iPadOS) +> - Microsoft Defender for Endpoint (Android, iOS/iPadOS, Windows) +> - SentinelOne (Android, iOS/iPadOS) +> - Symantec Endpoint Security (Android, iOS/iPadOS) +> - Trellix Mobile Security (Android, iOS/iPadOS) +> - Windows Security Center (Windows) - *For information about the Windows versions that support this connector, see [Data protection for Windows MAM](../../apps/protect-mam-windows.md).* +> - Zimperium (Android, iOS/iPadOS) \ No newline at end of file diff --git a/memdocs/intune/protect/lookout-mtd-connector-integration.md b/memdocs/intune/protect/lookout-mtd-connector-integration.md index 8a7641565c9..a654e1d033a 100644 --- a/memdocs/intune/protect/lookout-mtd-connector-integration.md +++ b/memdocs/intune/protect/lookout-mtd-connector-integration.md @@ -75,7 +75,7 @@ To enable your Lookout Mobile Endpoint Security subscription integration with In :::image type="content" source="./media/lookout-mtd-connector-integration/azure-ad-group-id.png" alt-text="Microsoft Entra group Object ID"::: - After you gather this information, contact Lookout support (email: enterprisesupport@lookout.com). Lookout Support works with your primary contact to onboard your subscription and create your Lookout Enterprise account, using the information that you provide. + After you gather this information, contact Lookout support. Lookout Support works with your primary contact to onboard your subscription and create your Lookout Enterprise account, using the information that you provide. ## Configure your Lookout subscription diff --git a/memdocs/intune/protect/mde-security-integration.md b/memdocs/intune/protect/mde-security-integration.md index 5a1eabaab21..a2a6bf9e890 100644 --- a/memdocs/intune/protect/mde-security-integration.md +++ b/memdocs/intune/protect/mde-security-integration.md @@ -7,7 +7,7 @@ keywords: author: brenduns ms.author: brenduns manager: dougeby -ms.date: 07/03/2024 +ms.date: 09/30/2024 ms.topic: how-to ms.service: microsoft-intune ms.subservice: protect @@ -70,6 +70,18 @@ When a supported device onboards to Microsoft Defender for Endpoint: Security settings management isn't yet supported with Government clouds. For more information, see [Feature parity with commercial](/microsoft-365/security/defender-endpoint/gov#feature-parity-with-commercial) in *Microsoft Defender for Endpoint for US Government customers*. +### Government cloud support + +As a public preview, the Defender for Endpoint security settings management scenario is supported in the following tenants: + +- US Government Community (GCC) High +- Department of Defense (DoD) + +For more information, see: + +- [Intune US Government service description](../fundamentals/intune-govt-service-description.md) +- [Microsoft Defender for Endpoint for US Government customers](/microsoft-365/security/defender-endpoint/gov) + ### Connectivity requirements Devices must have access to the following endpoint: @@ -90,14 +102,15 @@ With [Microsoft Defender for Endpoint for Linux](/microsoft-365/security/defende - Debian 9 or higher  - SUSE Linux Enterprise Server 12 or higher  - Oracle Linux 7.2 or higher  -- Amazon Linux 2  +- Amazon Linux 2 +- Amazon Linux 2023 - Fedora 33 or higher To confirm the version of the Defender agent, in the Defender portal go to the devices page, and on the devices *Inventories* tab, search for *Defender for Linux*. For guidance on updating the agent version, see [Deploy updates for Microsoft Defender for Endpoint on Linux](/microsoft-365/security/defender-endpoint/linux-updates). *Known issue*: With the Defender agent version **101.23052.0009**, Linux devices fail to enroll when they're missing the following filepath: `/sys/class/dmi/id/board_vendor`. -*Known issue*: When a Linux device performs synthetic registration the Device Entra ID (formerly known as Device AAD ID) will not be visible in the Defender portal. This information can be viewed from the Intune or Entra portals. Administrators will still be able to manage devices with policies in this manner. +*Known issue*: When a Linux device performs synthetic registration, the Device Entra ID (formerly known as Device AAD ID) isn't visible in the Defender portal. This information can be viewed from the Intune or Microsoft Entra portals. Administrators can still manage devices with policies in this manner. **macOS**: @@ -113,7 +126,7 @@ To confirm the version of the Defender agent, in the Defender portal go to the d *Known issue*: With the Defender agent version **101.23052.0004**, macOS devices that are registered in Microsoft Entra ID before enrolling with security settings management receive a duplicate Device ID in Microsoft Entra ID, which is a synthetic registration. When you create a Microsoft Entra group for targeting policy, you must use the synthetic Device ID created by security settings management. In Microsoft Entra ID, the *Join Type* column for the synthetic Device ID is blank. -*Known issue*: When a macOS device performs synthetic registration the Device Entra ID (formerly known as Device AAD ID) will not be visible in the Defender portal. This information can be viewed from the Intune or Entra portals. Administrators will still be able to manage devices with policies in this manner. +*Known issue*: When a macOS device performs synthetic registration, the Device Entra ID (formerly known as Device AAD ID) isn't visible in the Defender portal. This information can be viewed from the Intune or Microsoft Entra portals. Administrators can still manage devices with policies in this manner. **Windows**: @@ -122,19 +135,16 @@ To confirm the version of the Defender agent, in the Defender portal go to the d - Windows Server 2012 R2 with [Microsoft Defender for Down-Level Devices](/defender-endpoint/configure-server-endpoints#new-functionality-in-the-modern-unified-solution-for-windows-server-2012-r2-and-2016-preview) - Windows Server 2016 with [Microsoft Defender for Down-Level Devices](/defender-endpoint/configure-server-endpoints#new-functionality-in-the-modern-unified-solution-for-windows-server-2012-r2-and-2016-preview) - Windows Server 2019 (with [KB5025229](https://support.microsoft.com/topic/april-11-2023-kb5025229-os-build-17763-4252-e8ead788-2cd3-4c9b-8c77-d677e2d8744f)) -- Windows Server 2022 (with [KB5025230](https://support.microsoft.com/topic/april-11-2023-security-update-kb5025230-5048ddfb-7bf3-4e6c-b29a-7b44b789d282)) +- Windows Server 2022, including Server Core (with [KB5025230](https://support.microsoft.com/topic/april-11-2023-security-update-kb5025230-5048ddfb-7bf3-4e6c-b29a-7b44b789d282)) +- Domain controllers (preview). See important information in [Use of security settings management on domain controllers](#use-of-security-settings-management-on-domain-controllers) (in this article). Security settings management doesn't work on and isn't supported with the following devices: +- Windows Server Core 2019 and earlier - Non-persistent desktops, like Virtual Desktop Infrastructure (VDI) clients - Azure Virtual Desktop (AVD and formerly Windows Virtual Desktop, WVD) -- Domain Controllers - 32-bit versions of Windows -> [!IMPORTANT] -> -> In some cases, Domain Controllers that run a down level server operating system (2012 R2 or 2016) can unintentionally be managed by Microsoft Defender for Endpoint. In order to ensure that this doesn't happen in your environment, we recommend making sure your domain controllers are neither tagged "MDE-Management" or managed by MDE. - ### Licensing and subscriptions To use security settings management, you need: @@ -178,7 +188,7 @@ The following diagram is a conceptual representation of the Microsoft Defender f ### What to expect in the Microsoft Defender portal -You can use the Microsoft Defender XDR *Device inventory* to confirm a device is using the security settings management capability in Defender for Endpoint, by reviewing the devices status in the **Managed by** column. The *Managed by* information is also available on the devices side-panel or device page. *Managed by* should consistently indicate that its managed by **MDE**.  +You can use the Microsoft Defender for Endpoint *Device inventory* to confirm a device is using the security settings management capability in Defender for Endpoint, by reviewing the devices status in the **Managed by** column. The *Managed by* information is also available on the devices side-panel or device page. *Managed by* should consistently indicate that its managed by **MDE**.  You can also confirm a device is enrolled in *security settings management* successfully by confirming that the device-side panel or device page display **MDE Enrollment status** as **Success**. @@ -251,24 +261,25 @@ The following policy types support the *macOS* platform. | Antivirus | Microsoft Defender Antivirus exclusions | ![Supported](./media/mde-security-integration/green-check.png) | ![Supported](./media/mde-security-integration/green-check.png) | | Endpoint detection and response | Endpoint detection and response | ![Supported](./media/mde-security-integration/green-check.png) | ![Supported](./media/mde-security-integration/green-check.png) | -### Windows 10, Windows 11, and Windows Server +### Windows -To support use with Microsoft Defender security settings management, your policies for Windows devices must use the *Windows 10, Windows 11, and Windows Server* platform. Each profile for the *Windows 10, Windows 11, and Windows Server* platform can apply to devices that are managed by Intune and to devices that are managed by security settings management. +To support use with Microsoft Defender security settings management, your policies for Windows devices must use the *Windows* platform. Each profile for the *Windows* platform can apply to devices that are managed by Intune and to devices that are managed by security settings management. | Endpoint security policy | Profile | Defender for Endpoint security settings management | Microsoft Intune | |---------|----------|-----------|----------| -| Antivirus | Defender Update controls | ![Supported](./media/mde-security-integration/green-check.png) | ![Supported](./media/mde-security-integration/green-check.png) | +| Antivirus | Defender Update controls | ![Supported](./media/mde-security-integration/green-check.png) | ![Supported](./media/mde-security-integration/green-check.png) | | Antivirus | Microsoft Defender Antivirus | ![Supported](./media/mde-security-integration/green-check.png) | ![Supported](./media/mde-security-integration/green-check.png) | -| Antivirus | Microsoft Defender Antivirus exclusions| ![Supported](./media/mde-security-integration/green-check.png) | ![Supported](./media/mde-security-integration/green-check.png) | -| Antivirus | Windows Security Experience | *Note 1* | ![Supported](./media/mde-security-integration/green-check.png) | -| Attack Surface Reduction | Attack Surface Reduction Rules | ![Supported](./media/mde-security-integration/green-check.png) | ![Supported](./media/mde-security-integration/green-check.png) | -| Endpoint detection and response | Endpoint detection and response | ![Supported](./media/mde-security-integration/green-check.png) | ![Supported](./media/mde-security-integration/green-check.png) | -| Firewall | Firewall | ![Supported](./media/mde-security-integration/green-check.png) | ![Supported](./media/mde-security-integration/green-check.png) | -| Firewall | Firewall Rules | ![Supported](./media/mde-security-integration/green-check.png) | ![Supported](./media/mde-security-integration/green-check.png) | +| Antivirus | Microsoft Defender Antivirus exclusions| ![Supported](./media/mde-security-integration/green-check.png) | ![Supported](./media/mde-security-integration/green-check.png) | +| Antivirus | Windows Security Experience | *Note 1* | ![Supported](./media/mde-security-integration/green-check.png) | +| Attack Surface Reduction | Attack Surface Reduction Rules | ![Supported](./media/mde-security-integration/green-check.png) | ![Supported](./media/mde-security-integration/green-check.png) | +|Attack Surface Reduction|Device Control | *Note 1* | ![Supported](./media/mde-security-integration/green-check.png) | +| Endpoint detection and response | Endpoint detection and response | ![Supported](./media/mde-security-integration/green-check.png)| ![Supported](./media/mde-security-integration/green-check.png)| +| Firewall | Firewall | ![Supported](./media/mde-security-integration/green-check.png) | ![Supported](./media/mde-security-integration/green-check.png) | +| Firewall | Firewall Rules | ![Supported](./media/mde-security-integration/green-check.png) | ![Supported](./media/mde-security-integration/green-check.png) | -***1*** - The *Windows Security Experience* profile is available in the Defender portal but only applies to devices managed by Intune. It isn't supported for devices managed by Microsoft Defender security settings management. +***1*** - This profile is visible in the Defender portal but isn't supported for devices managed only by Microsoft Defender through the Microsoft Defender security settings management scenario. This profile is supported only for devices managed by Intune. -**Each Intune endpoint security policy** is a discrete group of settings intended for use by security admins who focus on protecting devices in your organization. The following are descriptions of the policies that support security settings management: +**Each Intune endpoint security profile** is a discrete group of settings intended for use by security admins who focus on protecting devices in your organization. The following are descriptions of the profiles that are supported by the security settings management scenario: - **[Antivirus](endpoint-security-antivirus-policy.md)** policies manage the security configurations found in Microsoft Defender for Endpoint. @@ -301,15 +312,15 @@ The following sections guide you through that process. ### Configure Microsoft Defender for Endpoint -In Microsoft Defender for Endpoint portal, as a security administrator: +In the Microsoft Defender portal, as a security administrator: -1. Sign in to [Microsoft Defender portal](https://security.microsoft.com/) and go to **Settings** > **Endpoints** > **Configuration Management** > **Enforcement Scope** and enable the platforms for security settings management. +1. Sign in to the [Microsoft Defender portal](https://security.microsoft.com/) and go to **Settings** > **Endpoints** > **Configuration Management** > **Enforcement Scope** and enable the platforms for security settings management. :::image type="content" source="./media/mde-security-integration/enable-mde-settings-management-defender.png" alt-text="Enable Microsoft Defender for Endpoint settings management in the Microsoft Defender portal." lightbox="./media/mde-security-integration/enable-mde-settings-management-defender.png#lightbox"::: > [!NOTE] > - > If you have the *Manage security settings in Security Center* permission in the Microsoft Defender for Endpoint portal, and are simultaneously enabled to view devices from all Device Groups (no [role-based access control](/microsoft-365/security/defender-endpoint/rbac) limits on your user permissions), you can also perform this action. + > If you have the *Manage security settings in Security Center* permission in the Microsoft Defender portal, and are simultaneously enabled to view devices from all Device Groups (no [role-based access control](/microsoft-365/security/defender-endpoint/rbac) limits on your user permissions), you can also perform this action. 2. Initially, we recommend testing the feature for each platform by selecting the platforms option for **On tagged devices**, and then tagging the devices with the `MDE-Management` tag. @@ -331,7 +342,7 @@ In Microsoft Defender for Endpoint portal, as a security administrator: > [!TIP] > - > To ensure your Microsoft Defender for Endpoint portal users have consistent permissions across portals, if not already provided, request that your IT administrator grant them the Microsoft Intune **Endpoint Security Manager** [built-in RBAC role](../fundamentals/role-based-access-control.md). + > To ensure your Microsoft Defender portal users have consistent permissions across portals, if not already provided, request that your IT administrator grant them the Microsoft Intune **Endpoint Security Manager** [built-in RBAC role](../fundamentals/role-based-access-control.md). ### Configure Intune @@ -479,9 +490,9 @@ You can manually sync a device on-demand from the [Microsoft Defender portal](ht The Policy sync button only appears for devices that are successfully managed by Microsoft Defender for Endpoint. -### Devices protected by Tamper Protection +### Devices protected by tamper protection -If a device has Tamper Protection turned on, it isn't possible to edit the values of [Tamper Protected settings](/microsoft-365/security/defender-endpoint/prevent-changes-to-security-settings-with-tamper-protection#what-happens-when-tamper-protection-is-turned-on) without disabling Tamper Protection first. +If a device has tamper protection turned on, it isn't possible to edit the values of [Tamper-protected settings](/microsoft-365/security/defender-endpoint/prevent-changes-to-security-settings-with-tamper-protection#what-happens-when-tamper-protection-is-turned-on) without disabling Tamper Protection first. ### Assignment Filters and security settings management @@ -517,15 +528,12 @@ The following security settings are pending deprecation. The Defender for Endpoi ### Use of security settings management on domain controllers -Because a Microsoft Entra ID trust is required, domain controllers aren't currently supported. We're looking at ways to add this support. - -> [!IMPORTANT] -> -> In some cases, Domain Controllers that are run a down level server Operating system (2012 R2 or 2016) can unintentionally be managed by Microsoft Defender for Endpoint. In order to ensure that this doesn't happen in your environment, we recommend making sure your domain controllers are neither tagged "MDE-Management" or managed by MDE. - -### Server Core installation +Currently in preview, security settings management is now supported on domain controllers. To manage security settings on domain controllers, you must enable it in the enforcement scope page (go to **Settings** > **Endpoints** **Enforcement scope**). Windows Server devices must be enabled before you can enable configuration of domain controllers. Additionally, if the *on tagged devices* option is selected for Windows Servers, configuration of domain controllers is limited to tagged devices, too. -Security settings management doesn't support Server core installations due to Server core platform limitations. +> [!CAUTION] +> - Misconfiguration of domain controllers could have a negative impact on both your security posture and operational continuity. +> - If configuration of domain controllers is enabled in your tenant, make sure to review all Windows policies to make sure you're not unintentionally targeting Microsoft Entra device groups that contain domain controllers. To minimize risk to productivity, firewall policies aren't supported on domain controllers. +> - We recommend reviewing all policies targeted to domain controllers before unenrolling those devices. Make any required configurations first, and then unenroll your domain controllers. Defender for Endpoint configuration is maintained on each device after the device is unenrolled. ### PowerShell restrict mode @@ -533,9 +541,9 @@ PowerShell needs to be enabled. Security settings management doesn't work for a device that has PowerShell *LanguageMode* configured with *ConstrainedLanguage* mode `enabled`. For more information, see [about_Language_Modes](/powershell/module/microsoft.powershell.core/about/about_language_modes) in the PowerShell documentation. -### Managing security through MDE if you were previously using a third party security tool +### Managing security through Defender for Endpoint if you were previously using a third-party security tool -If you previously had a third-party security tool on the machine and are now managing it with MDE, you might see some impact on MDE's capability to manage Security settings in rare cases. In such cases, as a troubleshooting measure, uninstall and reinstall the latest version of MDE on your machine. +If you previously had a third-party security tool on the machine and are now managing it with Defender for Endpoint, you might see some impact on Defender for Endpoint's capability to manage Security settings in rare cases. In such cases, as a troubleshooting measure, uninstall and reinstall the latest version of Defender for Endpoint on your machine. ## Next steps diff --git a/memdocs/intune/protect/media/certificates-profile-scep/scep-configuration-settings.png b/memdocs/intune/protect/media/certificates-profile-scep/scep-configuration-settings.png new file mode 100644 index 00000000000..0ef183f3884 Binary files /dev/null and b/memdocs/intune/protect/media/certificates-profile-scep/scep-configuration-settings.png differ diff --git a/memdocs/intune/protect/media/certificates-profile-scep/scep-san-add.png b/memdocs/intune/protect/media/certificates-profile-scep/scep-san-add.png new file mode 100644 index 00000000000..f4c8e0840db Binary files /dev/null and b/memdocs/intune/protect/media/certificates-profile-scep/scep-san-add.png differ diff --git a/memdocs/intune/protect/media/encrypt-devices-filevault/select-macos-filevault-dc.png b/memdocs/intune/protect/media/encrypt-devices-filevault/select-macos-filevault-dc.png index 508706d6685..5ed1319e5ad 100644 Binary files a/memdocs/intune/protect/media/encrypt-devices-filevault/select-macos-filevault-dc.png and b/memdocs/intune/protect/media/encrypt-devices-filevault/select-macos-filevault-dc.png differ diff --git a/memdocs/intune/protect/media/encrypt-devices/select-windows-bitlocker-es.png b/memdocs/intune/protect/media/encrypt-devices/select-windows-bitlocker-es.png deleted file mode 100644 index c8c013782bb..00000000000 Binary files a/memdocs/intune/protect/media/encrypt-devices/select-windows-bitlocker-es.png and /dev/null differ diff --git a/memdocs/intune/protect/media/encrypt-devices/select-windows-encpryption-profile.png b/memdocs/intune/protect/media/encrypt-devices/select-windows-encpryption-profile.png new file mode 100644 index 00000000000..99c48e416c6 Binary files /dev/null and b/memdocs/intune/protect/media/encrypt-devices/select-windows-encpryption-profile.png differ diff --git a/memdocs/intune/protect/microsoft-tunnel-conditional-access.md b/memdocs/intune/protect/microsoft-tunnel-conditional-access.md index a91cc114923..419931c07f8 100644 --- a/memdocs/intune/protect/microsoft-tunnel-conditional-access.md +++ b/memdocs/intune/protect/microsoft-tunnel-conditional-access.md @@ -5,7 +5,7 @@ keywords: author: brenduns ms.author: brenduns manager: dougeby -ms.date: 11/13/2023 +ms.date: 10/10/2024 ms.topic: how-to ms.service: microsoft-intune ms.subservice: protect @@ -13,7 +13,7 @@ ms.localizationpriority: high # optional metadata #ROBOTS: - + ms.reviewer: ochukwunyere ms.suite: ems search.appverid: MET150 @@ -61,7 +61,7 @@ If you'll use Conditional Access policy to limit user access, we recommend confi 3. To configure user and group access, below *Assignments*, select **Users and groups**. 1. Select **Include** > **All users**. - 2. Next, select **Exclude** and configure the groups you want to *grant access to*, and then save the user and Group configuration. + 2. Next, select **Exclude**, and then configure the groups you want to *grant access to*, and then save the user and Group configuration. 4. Under **Cloud apps or actions** > **Select apps**, select the **Microsoft Tunnel Gateway app**. @@ -73,6 +73,6 @@ If you'll use Conditional Access policy to limit user access, we recommend confi For more information about creating policies for Conditional Access, see [Create a device-based Conditional Access policy](../protect/create-conditional-access-intune.md). -## Next steps +## Related content [Monitor Microsoft Tunnel](microsoft-tunnel-monitor.md) diff --git a/memdocs/intune/protect/microsoft-tunnel-configure.md b/memdocs/intune/protect/microsoft-tunnel-configure.md index 0ca70672298..4b03dd64f99 100644 --- a/memdocs/intune/protect/microsoft-tunnel-configure.md +++ b/memdocs/intune/protect/microsoft-tunnel-configure.md @@ -5,7 +5,7 @@ keywords: author: brenduns ms.author: brenduns manager: dougeby -ms.date: 03/19/2024 +ms.date: 09/26/2024 ms.topic: how-to ms.service: microsoft-intune ms.subservice: protect @@ -137,11 +137,11 @@ However, if you plan to install the Microsoft Tunnel Gateway to a rootless Podma For example, to use **wget** and log details to *mstunnel-setup* during the download, run `wget --output-document=mstunnel-setup https://aka.ms/microsofttunneldownload` -2. To start the server installation, run the script as **root**. For example, you might use the following command line: `sudo chmod +x ./mstunnel-setup`. The script always installs the [most recent version](microsoft-tunnel-upgrade.md#microsoft-tunnel-update-history) of Microsoft Tunnel. +2. To start the server installation, run the script as **root**. For example, you might use the following command line: `sudo ./mstunnel-setup`. The script always installs the [most recent version](microsoft-tunnel-upgrade.md#microsoft-tunnel-update-history) of Microsoft Tunnel. > [!IMPORTANT] > - > If you are installing Tunnel to a [rootless Podman container](#use-a-rootless-podman-container), use the the following modified command-line to start the script: `chmod mst_rootless_mode=1 ./mstunnel-setup` + > If you are installing Tunnel to a [rootless Podman container](#use-a-rootless-podman-container), use the the following modified command-line to start the script: `mst_rootless_mode=1 ./mstunnel-setup` To see detailed console output during the tunnel and installation agent enrollment process: @@ -152,7 +152,7 @@ However, if you plan to install the Microsoft Tunnel Gateway to a rootless Podma > [!IMPORTANT] > **For the U.S. government cloud**, the command line must reference the government cloud environment. To do so, run the following commands to add *intune_env=FXP* to the command line: > - > 1. Run `sudo chmod +x ./mstunnel-setup` + > 1. Run `sudo ./mstunnel-setup` > 2. Run `sudo intune_env=FXP ./mstunnel-setup` > [!TIP] @@ -205,17 +205,18 @@ However, if you plan to install the Microsoft Tunnel Gateway to a rootless Podma 8. If you're using RHEL 8.4 or later, be sure to restart the Tunnel Gateway server by entering `mst-cli server restart` before you attempt to connect clients to it. -## Add trusted root certificates to Tunnel containers +## Add trusted root certificates to Tunnel containers + Trusted root certificates must be added to the Tunnel containers when: - The outgoing server traffic requires SSL proxy inspection. - The endpoints accessed by the Tunnel containers are not exempt from proxy inspection. **Steps:** + 1. Copy the trusted root certificate(s) with .crt extension to /etc/mstunnel/ca-trust 2. Restart Tunnel containers using "mst-cli server restart" and "mst-cli agent restart" - ## Deploy the Microsoft Tunnel client app To use the Microsoft Tunnel, devices need access to a Microsoft Tunnel client app. Microsoft Tunnel uses Microsoft Defender for Endpoint as the Tunnel client app: @@ -456,7 +457,6 @@ With prerequisites in place, you can then use the [installation script procedure Use of a rootless Podman container requires your environment meet the following prerequisites, which are in *addition* to the default [Microsoft Tunnel prerequisites](microsoft-tunnel-prerequisites.md): - **Supported platform**: - The Linux server must run Red Hat (RHEL) 8.8 or later. @@ -465,10 +465,12 @@ Use of a rootless Podman container requires your environment meet the following - The rootless container must be installed under the **/home** folder. - The **/home** folder must have a minimum of 10 GB of free space. -**Throughput** - - The peak throughput should not exceed 230Mbps +**Throughput**: + +- The peak throughput should not exceed 230Mbps **Network**: + The following network settings, which are not available in a rootless namespace, must be set in **/etc/sysctl.conf**: - `net.core.somaxconn=8192` @@ -484,6 +486,7 @@ For example, to specify port 443, use the following entry: `net.ipv4.ip_unprivil After editing **sysctl.conf**, you must reboot the Linux server before the new configurations take effect. **Outbound proxy for the rootless user**: + To support an outbound proxy for the rootless user, edit **/etc/profile.d/http_proxy.sh** and add the following two lines. In the following lines, *10.10.10.1:3128* is an example *address:port* entry. When you add these lines, replace *10.10.10.1:3128* with the values for your proxy IP address and port: - `export http_proxy=http://10.10.10.1:3128` @@ -497,11 +500,9 @@ To install Microsoft Tunnel to a rootless Podman container, use the following co ## Uninstall the Microsoft Tunnel -To uninstall the product, run **mst-cli uninstall** from the Linux server as root. - -After the product is uninstalled, delete the corresponding server record in the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431) under **Tenant administration** > **Microsoft Tunnel Gateway** > **Servers**. +To uninstall the product, run **mst-cli uninstall** from the Linux server as root. This will also remove the server from the Intune admin center. -## Next steps +## Related content [Use Conditional Access with the Microsoft Tunnel](microsoft-tunnel-conditional-access.md) [Monitor Microsoft Tunnel](microsoft-tunnel-monitor.md) diff --git a/memdocs/intune/protect/microsoft-tunnel-mam-android.md b/memdocs/intune/protect/microsoft-tunnel-mam-android.md index 4394fa8fa22..b40f957f9c8 100644 --- a/memdocs/intune/protect/microsoft-tunnel-mam-android.md +++ b/memdocs/intune/protect/microsoft-tunnel-mam-android.md @@ -67,7 +67,7 @@ Users of devices that aren't enrolled with Intune must install the following app **Line of Business apps**: -For your Line of Business (LOB) apps, integrate them with the MAM SDK. Later, you can [add your LOB apps](#configure-line-of-business-applications) to your app protection policy and app configuration polices for MAM Tunnel. See [Getting started with MAM for Android](../developer/app-sdk-android-phase3.md). +For your Line of Business (LOB) apps, integrate them with the MAM SDK. Later, you can [add your LOB apps](#configure-line-of-business-applications) to your app protection policy and app configuration policies for MAM Tunnel. See [Getting started with MAM for Android](../developer/app-sdk-android-phase3.md). > [!NOTE] > Make sure your Android LOB applications support direct proxy or Proxy Auto-Configuration (PAC) for both MDM and MAM. @@ -106,7 +106,7 @@ Create an App configuration policy to configure Microsoft Defender for Endpoint > [!NOTE] > Ensure only a single Defender app configuration policy targets the unenrolled device. Targeting more than 1 app configuration policy with different tunnel settings for Defender for Endpoint will create tunnel connection issues on the device. -1. Sign in to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431) and go to **Apps** > **App Configuration polices** > **Add** > **Managed Apps**. +1. Sign in to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431) and go to **Apps** > **App Configuration policies** > **Add** > **Managed Apps**. 2. On the *Basics* tab: @@ -156,7 +156,7 @@ The new policy appears in the list of App configuration policies. Create an App configuration policy for Microsoft Edge. This policy configures Microsoft Edge to support identity-switch, providing the ability to automatically connect the VPN Tunnel when signing-in or switching to a Microsoft "Work or school" account, and automatically disconnect the VPN tunnel when switching to a Microsoft personal account. -1. Sign in to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431) and go to **Apps** > **App Configuration polices** > **Add** > **Managed Apps**. +1. Sign in to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431) and go to **Apps** > **App Configuration policies** > **Add** > **Managed Apps**. 2. On the *Basics* tab: diff --git a/memdocs/intune/protect/microsoft-tunnel-mam-ios.md b/memdocs/intune/protect/microsoft-tunnel-mam-ios.md index 71c59fe7a43..27385a16ee2 100644 --- a/memdocs/intune/protect/microsoft-tunnel-mam-ios.md +++ b/memdocs/intune/protect/microsoft-tunnel-mam-ios.md @@ -100,7 +100,7 @@ Microsoft Tunnel for MAM iOS uses the following Intune policies and profiles: Create an app configuration policy for apps that use Tunnel for MAM. This policy configures an app to use a specific Microsoft Tunnel Gateway Site, proxy, and trusted certificate(s) for Edge and line-of-business (LOB) apps. These resources are used when connecting to on-premises resources. -1. Sign in to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431) and go to **Apps** > **App Configuration polices** > **Add** > **Managed Apps**. +1. Sign in to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431) and go to **Apps** > **App Configuration policies** > **Add** > **Managed Apps**. 2. On the *Basics* tab, enter a *Name* for the policy and a *Description* (optional). @@ -161,7 +161,7 @@ Create an App configuration policy for Microsoft Edge. This policy configures Ed > [!NOTE] > If you already have an app configuration policy created for your LOB App, you can edit that policy to include Edge and the required *key/value pair* settings. -1. In the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431), go to **Apps** > **App Configuration polices** > **Add** > **Managed Apps**. +1. In the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431), go to **Apps** > **App Configuration policies** > **Add** > **Managed Apps**. 2. On the *Basics* tab: diff --git a/memdocs/intune/protect/microsoft-tunnel-mam.md b/memdocs/intune/protect/microsoft-tunnel-mam.md index 9a6e1938dba..082e64d6e2e 100644 --- a/memdocs/intune/protect/microsoft-tunnel-mam.md +++ b/memdocs/intune/protect/microsoft-tunnel-mam.md @@ -1,12 +1,12 @@ --- title: Learn about using Microsoft Tunnel with Mobile Application Management -description: Use Microsoft Tunnel for MAM with Android and iOS devices. Tunnel support for MAM expands access to your organizational resources for devices that can't or haven't enrolled with Microsoft Intune. +description: Use Microsoft Tunnel for MAM with Android and iOS devices. Tunnel for MAM expands access to your organizational resources for devices that aren't or can't enroll with Microsoft Intune. keywords: author: brenduns ms.author: brenduns manager: dougeby -ms.date: 11/01/2023 -ms.topic: how-to +ms.date: 10/10/2024 +ms.topic: conceptual ms.service: microsoft-intune ms.subservice: protect ms.localizationpriority: high @@ -30,7 +30,7 @@ ms.collection: [!INCLUDE [intune-add-on-note](../includes/intune-plan2-suite-note.md)] -When you use the Microsoft Tunnel VPN Gateway, you can extend Tunnel support by adding Tunnel for Mobile Application Management (MAM). Tunnel for MAM extends the Microsoft Tunnel VPN gateway to support devices that run Android or iOS, and that aren't enrolled with Microsoft Intune. With this solution, your users can use a single device that hasn't enrolled with Intune to gain secure access to the organizations on-premises apps and resources using modern authentication, Single Sign On and conditional access. With Tunnel for MAM, your users can use their own device (BYOD) for both work and personal use, without having to grant the organization's IT department control over that device. +When you use the Microsoft Tunnel VPN Gateway, you can extend Tunnel support by adding Tunnel for Mobile Application Management (MAM). Tunnel for MAM extends the Microsoft Tunnel VPN gateway to support devices that run Android or iOS, and that aren't enrolled with Microsoft Intune. With this solution, your users can use a single device that isn't enrolled with Intune to gain secure access to the organizations on-premises apps and resources using modern authentication, single sign-on, and Conditional Access. With Tunnel for MAM, your users can use their own device (BYOD) for both work and personal use, without having to grant the organization's IT department control over that device. Applies to: @@ -39,7 +39,7 @@ Applies to: ## Platform requirements and feature overview -Before you begin, you must already have deployed the Microsoft Tunnel gateway. To learn more about Microsoft Tunnel gateway and how to install and configure it, see: +Before you begin, you must already have deployed the Microsoft Tunnel gateway. To learn more about Microsoft Tunnel gateway and how to install and configure it, see: - [Learn about the Microsoft Tunnel VPN solution for Microsoft Intune](../protect/microsoft-tunnel-overview.md) - [Identify the prerequisites to install and use the Microsoft Tunnel VPN solution for Microsoft Intune](../protect/microsoft-tunnel-prerequisites.md) @@ -57,17 +57,17 @@ The following table identifies key features for the supported platforms: | Requirements: | - Company Portal app (sign-in not required)

                        - Defender for Endpoint app | - No Company Portal app or Defender for Endpoint app requirement | | Features: | - VPN is provided via the Defender for Endpoint app:
                        --- Per App VPN
                        --- Device-wide VPN

                        - *Auto-launch*: VPN automatically starts on app launch | - VPN is provided via Tunnel for MAM SDK for iOS integration

                        - Per-App VPN. Tunnel connection is restricted to each targeted app

                        - *Auto-launch*: VPN automatically starts on app launch

                        - No Device-wide VPN

                        - Trusted root certificate support for on-premises CA trust

                        | | Line of Business app requirements| - Intune App SDK for Android

                        - Microsoft Authentication Library (MSAL) integration | - Intune App SDK for iOS

                        - Microsoft Authentication Library (MSAL) integration
                        --- Microsoft Entra App registration

                        - Tunnel for MAM SDK for iOS | -| Microsoft Edge browser support:| - *Strict Tunnel Mode*: When users sign into Edge with an organization account, if the VPN isn't connected, then **Strict Tunnel Mode** blocks internet traffic. When the VPN reconnects, internet browsing is available again.

                        - *Identity switch*: VPN connects when using a work or school account and disconnects when switching to a personal account or in-Private browsing

                        - Device-wide and Per-App VPN support | - *Strict Tunnel Mode*: When users sign into Edge with an organization account, if the VPN isn't connected, then **Strict Tunnel Mode** blocks internet traffic. When the VPN reconnects, internet browsing is available again.

                        - *Identity switch*: VPN connects when using a work/school account and disconnects when switching to a personal account or in-Private browsing | +| Microsoft Edge browser support:| - *Strict Tunnel Mode*: When users sign into Microsoft Microsoft Edge with an organization account, if the VPN isn't connected, then **Strict Tunnel Mode** blocks internet traffic. When the VPN reconnects, internet browsing is available again.

                        - *Identity switch*: VPN connects when using a work or school account and disconnects when switching to a personal account or in-Private browsing.

                        - Device-wide and Per-App VPN support | - *Strict Tunnel Mode*: When users sign into Microsoft Edge with an organization account, if the VPN isn't connected, then **Strict Tunnel Mode** blocks internet traffic. When the VPN reconnects, internet browsing is available again.

                        - *Identity switch*: VPN connects when using a work/school account and disconnects when switching to a personal account or in-Private browsing. | | Third-party browser support: | - Only with device-wide VPN enabled | - None | ## Try the interactive demos -Try the following interactive demos to discover how Tunnel for MAM extends Microsoft Tunnel VPN Gateway to support Android and iOS devices that are not enrolled with Intune. +Try the following interactive demos to discover how Tunnel for MAM extends Microsoft Tunnel VPN Gateway to support Android and iOS devices that aren't enrolled with Intune. - [Microsoft Tunnel for Mobile Application Management for Android]( https://regale.cloud/Microsoft/viewer/1896/microsoft-tunnel-for-mobile-application-management-for-android/index.html#/0/0) - [Microsoft Tunnel for Mobile Application Management for iOS/iPadOS]( https://regale.cloud/Microsoft/viewer/1976/microsoft-tunnel-for-mobile-application-management-for-ios-ipados/index.html#/0/0) -## Next steps +## Related content - [Learn about the Microsoft Tunnel VPN solution for Microsoft Intune](../protect/microsoft-tunnel-overview.md) - [Use MAM Tunnel for Android](../protect/microsoft-tunnel-mam-android.md) diff --git a/memdocs/intune/protect/microsoft-tunnel-monitor.md b/memdocs/intune/protect/microsoft-tunnel-monitor.md index 2a8478be6ba..7bc3069cca5 100644 --- a/memdocs/intune/protect/microsoft-tunnel-monitor.md +++ b/memdocs/intune/protect/microsoft-tunnel-monitor.md @@ -1,11 +1,11 @@ --- -title: Monitor the status of the Microsoft Tunnel VPN solution for Microsoft Intune -description: Monitor the status of Microsoft Tunnel Gateway, a VPN server that runs on Linux. With the Microsoft Tunnel, cloud-based devices you manage with Intune can reach your on-premises infrastructure. +title: Monitor the Microsoft Tunnel VPN solution for Microsoft Intune +description: Monitor the status of Microsoft Tunnel Gateway, a VPN server that runs on Linux. Microsoft Tunnel enables your Intune managed cloud-based devices to reach your on-premises infrastructure. keywords: author: brenduns ms.author: brenduns manager: dougeby -ms.date: 1/23/2024 +ms.date: 10/14/2024 ms.topic: how-to ms.service: microsoft-intune ms.subservice: protect @@ -96,7 +96,7 @@ Default values for server health metrics: Plan to replace a revoked TLS certificate. - To learn more about Online Certificate Status Protocol (OCSP), see [Online Certificate Status Protocol](https://en.wikipedia.org/wiki/Online_Certificate_Status_Protocol) at wikipedia.org. + To learn more about Online Certificate Status Protocol (OCSP), see [Online Certificate Status Protocol](https://en.wikipedia.org/wiki/Online_Certificate_Status_Protocol) at wikipedia.org. - **Internal network accessibility** – Status from the most recent check of the internal URL. You configure the URL as part of a [Tunnel Site configuration](../protect/microsoft-tunnel-configure.md#to-create-a-site-configuration). - *Healthy* - The server can access the URL specified in the site properties. @@ -124,7 +124,7 @@ Default values for server health metrics: - **Server logs** – Determines if logs have been uploaded to the server within the last 60 minutes. - *Healthy* - Server logs were uploaded within the last 60 minutes. - - *Unhealthy* - Server logs were uploaded within the last 60 minutes. + - *Unhealthy* - Server logs haven't been uploaded in the last 60 minutes. ## Manage health status thresholds @@ -188,7 +188,7 @@ Microsoft Tunnel logs information to the Linux server logs in the *syslog* forma - **mstunnel-agent**: Display agent logs. - **mstunnel_monitor**: Display monitoring task logs. -- **ocserv** - Display server logs. +- **ocserv** - Display server logs. - **ocserv-access** - Display access logs. By default, access logging is disabled. Enabling access logs can reduce performance, depending on the number of active connections and usage patterns on the server. Logging for DNS connections increases the verbosity of the logs, which can become noisy. @@ -210,7 +210,7 @@ Microsoft Tunnel logs information to the Linux server logs in the *syslog* forma - **OCSERV_TELEMETRY** - Display telemetry details for connections to Tunnel. - Telemetry logs have the following format, with the values for *bytes_in*, *bytes_out*, and *duration* being used only for disconnect operations: `` For example: + Telemetry logs have the following format, with the values for *bytes_in*, *bytes_out*, and *duration* being used only for disconnect operations: `` For example: - *Oct 20 19:32:15 mstunnel ocserv[4806]: OCSERV_TELEMETRY,connect,31258,73.20.85.75,172.17.0.3,169.254.0.1,169.254.107.209,3780e1fc-3ac2-4268-a1fd-dd910ca8c13c, 5A683ECC-D909-4E5F-9C67-C0F595A4A70E,MobileAccess iOS 1.1.34040102* @@ -255,7 +255,7 @@ Each set of logs that Intune collects and uploads is identified as a separate se - A *start* and *end* time of the log collection - When the upload was generated - The log sets *verbosity level* -- An *Incident ID* that can be used to identify that specific log set +- An *Incident ID* that can be used to identify that specific log set :::image type="content" source="./media/microsoft-tunnel-monitor/send-server-logs-tab.png" alt-text="Screen capture that shows the Send verbose server logs interface."::: @@ -282,13 +282,13 @@ The following are known issues for Microsoft Tunnel. #### Clients can successfully use the Tunnel when Server health status shows as offline -**Issue**: On the [Tunnel *Health status* tab](../protect/microsoft-tunnel-monitor.md), a server’s health status reports as offline indicating that it's disconnected, even though users can reach the tunnel server and connect to the organization’s resources. +**Issue**: On the [Tunnel *Health status* tab](../protect/microsoft-tunnel-monitor.md), a server’s health status reports as offline indicating that it's disconnected, even though users can reach the tunnel server and connect to the organization’s resources. **Solution**: To resolve this issue, you must reinstall Microsoft Tunnel, which re-enrolls the Tunnel server agent with Intune. To prevent this issue, install updates for the Tunnel agent and server soon after they're released. Use the Tunnel server health metrics in the Microsoft Intune admin center to monitor server health. #### With Podman, you see “Error executing checkup” in the mstunnel_monitor log -**Issue**: Podman fails to identify or see the active containers are running, and reports “Error executing checkup” in the [mstunnel_monitor log](../protect/microsoft-tunnel-monitor.md#view-microsoft-tunnel-logs) of the Tunnel server. The following are examples of the errors: +**Issue**: Podman fails to identify or see the active containers are running, and reports “Error executing checkup” in the [mstunnel_monitor log](../protect/microsoft-tunnel-monitor.md#view-microsoft-tunnel-logs) of the Tunnel server. The following are examples of the errors: - Agent: ``` @@ -316,14 +316,14 @@ The following are known issues for Microsoft Tunnel. **Solution**: To resolve this issue, manually [restart the Podman containers](https://docs.podman.io/en/latest/markdown/podman-restart.1.html). Podman should then be able to identify the containers. If the problem persists, or returns, consider using ***cron*** to create a job that automatically restarts the containers when this issue is seen. -#### With Podman, you see System.DateTime errors in the mstunnel-agent log +#### With Podman, you see System.DateTime errors in the mstunnel-agent log **Issue**: When you use Podman, the mstunnel-agent log might contain errors similar to the following entries: - `Failed to parse version-info.json for version information.` - `System.Text.Json.JsonException: The JSON value could not be converted to System.DateTime` -This issue occurs due to differences in formatting dates between Podman and Tunnel Agent. These errors don't indicate a fatal issue or prevent connectivity. Beginning with containers released after October 2022, the formatting issues should be resolved. +This issue occurs due to differences in formatting dates between Podman and Tunnel Agent. These errors don't indicate a fatal issue or prevent connectivity. Beginning with containers released after October 2022, the formatting issues should be resolved. **Solution**: To resolve these issues, update the agent container (Podman or Docker) to the latest version. As new sources of these errors are discovered, we'll continue to fix them in subsequent version updates. @@ -339,6 +339,6 @@ For guidance on viewing Tunnel logs, see [View Microsoft Tunnel logs](#view-micr If this issue persists, consider automating the restart command by using the cron scheduling utility. See [How to use cron on Linux](https://opensource.com/article/21/7/cron-linux) at *opensource.com*. -## Next steps +## Related content [Reference for Microsoft Tunnel](../protect/microsoft-tunnel-reference.md) diff --git a/memdocs/intune/protect/microsoft-tunnel-overview.md b/memdocs/intune/protect/microsoft-tunnel-overview.md index 1d9a883444b..16a03027771 100644 --- a/memdocs/intune/protect/microsoft-tunnel-overview.md +++ b/memdocs/intune/protect/microsoft-tunnel-overview.md @@ -1,12 +1,12 @@ --- title: Learn about the Microsoft Tunnel VPN solution for Microsoft Intune -description: Learn about the Microsoft Tunnel Gateway, a VPN server for Intune that runs on Linux. With the Microsoft Tunnel, cloud-based devices you manage with Intune can reach your on-premises infrastructure. +description: Learn about the Microsoft Tunnel Gateway, a VPN server for Intune that runs on Linux. With Microsoft Tunnel, cloud-based devices you manage with Intune can reach your on-premises infrastructure. keywords: author: brenduns ms.author: brenduns manager: dougeby -ms.date: 11/14/2023 -ms.topic: how-to +ms.date: 10/10/2024 +ms.topic: conceptual ms.service: microsoft-intune ms.subservice: protect ms.localizationpriority: high @@ -37,7 +37,7 @@ This article introduces the core Microsoft Tunnel, how it works, and its archite If you're ready to deploy the Microsoft Tunnel, see [Prerequisites for the Microsoft Tunnel](microsoft-tunnel-prerequisites.md), and then [Configure the Microsoft Tunnel](microsoft-tunnel-configure.md). -After you've deployed Microsoft Tunnel, you can choose to add [Microsoft Tunnel for Mobile Application Management](../protect/microsoft-tunnel-mam.md) (Tunnel for MAM). Tunnel for MAM extends the Microsoft Tunnel VPN gateway to support devices that run Android or iOS, and that aren't enrolled with Microsoft Intune. Tunnel for MAM is available when you add *Microsoft Intune Plan 2* or *Microsoft Intune Suite* as an [add-on license](../fundamentals/intune-add-ons.md) to your Tenant. +After you deploy Microsoft Tunnel, you can choose to add [Microsoft Tunnel for Mobile Application Management](../protect/microsoft-tunnel-mam.md) (Tunnel for MAM). Tunnel for MAM extends the Microsoft Tunnel VPN gateway to support devices that run Android or iOS, and that aren't enrolled with Microsoft Intune. Tunnel for MAM is available when you add *Microsoft Intune Plan 2* or *Microsoft Intune Suite* as an [add-on license](../fundamentals/intune-add-ons.md) to your Tenant. > [!NOTE] > @@ -73,10 +73,10 @@ Features of the VPN profiles for the tunnel include: - A friendly name for the VPN connection that is visible to your end users. - The site that the VPN client connects to. - Per-app VPN configurations that define which apps the VPN profile is used for, and if it's always-on or not. When always-on, the VPN automatically connects and is used only for the apps you define. If no apps are defined, the always-on connection provides tunnel access for all network traffic from the device. -- For iOS devices that have the Microsoft Defender for Endpoint configured to support per-app VPNs and *TunnelOnly* mode set to *True*, users don’t need to open or sign-in to Microsoft Defender on their device for the Tunnel to be used. Instead, with the user signed-in to the Company Portal on the device or to any other app that uses multifactor authentication that has a valid token for access, the Tunnel per-app VPN is used automatically. *TunnelOnly* mode is supported for iOS/iPadOS, and disables the Defender functionality, leaving only the Tunnel capabilities. +- For iOS devices that have Microsoft Defender for Endpoint configured to support per-app VPNs and *TunnelOnly* mode set to *True*, users don’t need to open or sign-in to Microsoft Defender on their device for the Tunnel to be used. Instead, with the user signed-in to the Company Portal on the device or to any other app that uses multifactor authentication that has a valid token for access, the Tunnel per-app VPN is used automatically. *TunnelOnly* mode is supported for iOS/iPadOS, and disables the Defender functionality, leaving only the Tunnel capabilities. - Manual connections to the tunnel when a user launches the VPN and selects *Connect*. -- On-demand VPN rules that allow use of the VPN when conditions are met for specific FQDNs or IP addresses. (iOS/iPadOS) -- Proxy support (iOS/iPadOS, Android 10+) +- On-demand VPN rules that allow use of the VPN when conditions are met for specific FQDNs or IP addresses. *(iOS/iPadOS)* +- Proxy support. *(iOS/iPadOS, Android 10+)* Server configurations include: @@ -97,10 +97,10 @@ To use the Microsoft Tunnel, devices must install the Microsoft Defender for End ## Architecture -The Microsoft Tunnel Gateway runs in containers that run on Linux servers. +The Microsoft Tunnel Gateway runs in containers that run on Linux servers. ![Drawing of the Microsoft Tunnel Gateway architecture](./media/microsoft-tunnel-overview/tunnel-architecture.png) - + **Components**: - **A** – Microsoft Intune. @@ -120,11 +120,11 @@ The Microsoft Tunnel Gateway runs in containers that run on Linux servers. - **1** - Intune administrator configures *Server configurations* and *Sites*, Server configurations are associated with Sites. - **2** - Intune administrator installs Microsoft Tunnel Gateway and the authentication plugin authenticates Microsoft Tunnel Gateway with Microsoft Entra. Microsoft Tunnel Gateway server is assigned to a site. -- **3** - Management Agent communicates to Intune to retrieve your server configuration policies, and to send telemetry logs to Intune. -- **4** - Intune administrator creates and deploys VPN profiles and the Defender app to devices. -- **5** - Device authenticates to Microsoft Entra. Conditional Access policies are evaluated. -- **6** - With split tunnel: - - **6.a** - Some traffic goes directly to the public internet. +- **3** - Management Agent communicates to Intune to retrieve your server configuration policies, and to send telemetry logs to Intune. +- **4** - Intune administrator creates and deploys VPN profiles and the Defender app to devices. +- **5** - Device authenticates to Microsoft Entra. Conditional Access policies are evaluated. +- **6** - With split tunnel: + - **6.a** - Some traffic goes directly to the public internet. - **6.b** - Some traffic goes to your public facing IP address for the Tunnel. The VPN channel will use TCP, TLS, UDP, and DTLS over port 443. This traffic requires inbound and outbound [Firewall ports](../protect/microsoft-tunnel-prerequisites.md#firewall) to be open. - **7** - The Tunnel routes traffic to your internal proxy (optional) and/or your corporate network. IT Admins must ensure that traffic from the Tunnel Gateway server internal interface can successfully route to internal corporate resource (IP address ranges and ports). @@ -143,7 +143,7 @@ The following information outlines where break and inspect isn't supported. Refe - **Break and inspect is not supported in the following areas**: - Tunnel Gateway doesn't support SSL break and inspect, TLS break and inspect, or deep packet inspection for client connections. - - The Use of firewalls, proxies, load balancers, or any technology that terminates and inspects the client sessions that go into the Tunnel Gateway isn't supported and causes client connections to fail. (Refer to **F**, **D**, and **C** in the Architecture diagram). + - The use of firewalls, proxies, load balancers, or any technology that terminates and inspects the client sessions that go into the Tunnel Gateway isn't supported and causes client connections to fail. (Refer to **F**, **D**, and **C** in the Architecture diagram). - If Tunnel Gateway uses an outbound proxy for internet access, the proxy server can't perform break and inspect. This is because Tunnel Gateway Management Agent uses TLS mutual authentication when connecting to Intune (Refer to **3** in the Architecture diagram). If break and inspect is enabled on the proxy server, network admins that manage the proxy server must add the Tunnel Gateway server IP address and Fully Qualified Domain Name (FQDN) to an approve-list to these [Intune endpoints](../fundamentals/intune-endpoints.md#access-for-managed-devices). **Additional details**: @@ -152,7 +152,7 @@ The following information outlines where break and inspect isn't supported. Refe - The Management Agent is authorized against Microsoft Entra ID using Azure app ID/secret keys. -## Next steps +## Related content - [Prerequisites for the Microsoft Tunnel in Intune](microsoft-tunnel-prerequisites.md) - [Learn about Microsoft Tunnel for Mobile Application Management](../protect/microsoft-tunnel-mam.md) diff --git a/memdocs/intune/protect/microsoft-tunnel-prerequisites.md b/memdocs/intune/protect/microsoft-tunnel-prerequisites.md index f16f3120c2d..31dbf62708b 100644 --- a/memdocs/intune/protect/microsoft-tunnel-prerequisites.md +++ b/memdocs/intune/protect/microsoft-tunnel-prerequisites.md @@ -5,7 +5,7 @@ keywords: author: brenduns ms.author: brenduns manager: dougeby -ms.date: 03/19/2024 +ms.date: 10/24/2024 ms.topic: how-to ms.service: microsoft-intune ms.subservice: protect @@ -34,6 +34,8 @@ At a high level, the Microsoft Tunnel requires: - An Azure subscription. - A *Microsoft Intune Plan 1* subscription. + > [!NOTE] + > This prerequisite is for *Microsoft Tunnel*, and does not include [Microsoft Tunnel for Mobile Application Management](../protect/microsoft-tunnel-mam.md), which is an [Intune add-on](../fundamentals/intune-add-ons.md) that requires a *Microsoft Intune Plan 2* subscription. - A Linux server that runs containers. The server can be on-premises or in the cloud, and supports one of the following container types: - **Podman** for Red Hat Enterprise Linux (RHEL). See the [Linux server](#linux-server) requirements. - **Docker** for all other Linux distributions. @@ -48,7 +50,6 @@ The following sections detail the prerequisites for the Microsoft Tunnel, and pr > [!NOTE] > Tunnel and Global Secure Access (GSA) cannot be use simultaneously on the same device. - ## Linux server Set up a Linux based virtual machine or a physical server on which to install the Microsoft Tunnel Gateway. @@ -111,7 +112,7 @@ Set up a Linux based virtual machine or a physical server on which to install th - [Install Podman on Red Hat Enterprise Linux 8.4 and later (scroll down to RHEL8)](https://podman.io/get-started). - These versions of RHEL don't support Docker. Instead, these versions use Podman, and *podman* is part of a module called "container-tools". In this context, a module is a set of RPM packages that represent a component and that usually install together. A typical module contains packages with an application, packages with the application-specific dependency libraries, packages with documentation for the application, and packages with helper utilities. For more information, see [Introduction to modules](https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/installing_managing_and_removing_user-space_components/introduction-to-modules_using-appstream) in the Red Hat documentation. + These versions of RHEL don't support Docker. Instead, these versions use Podman, and *podman* is part of a module called "container-tools". In this context, a module is a set of RPM packages that represent a component and that usually install together. A typical module contains packages with an application, packages with the application-specific dependency libraries, packages with documentation for the application, and packages with helper utilities. For more information, see [Introduction to modules](https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/8/html/installing_managing_and_removing_user-space_components/managing-versions-of-appstream-content_using-appstream) in the Red Hat documentation. > [!NOTE] > @@ -134,6 +135,11 @@ Set up a Linux based virtual machine or a physical server on which to install th - The TLS certificate can be in **PEM** or **pfx** format. - To support the *TLS certificate revocation* health check, ensure the Online Certificate Status Protocol (OCSP) or certificate revocation list (CRL) address as defined by the TLS certificate is accessible from the server. + + - Configure the Tunnel clients certificate with a key that is 2048-bits or larger. We recommend larger keys to help your deployment stay in support for future and evolving SSL/TLS requirements by various SSL/TLS library solutions. + + > [!TIP] + > Periodically review the requirements of your chosen SSL/TLS library to ensure your infrastructure and certificates remain supported and in compliance to recent changes for that library, and reissue Tunnel client certificates when necessary to stay current with your solutions evolving requirements. - **TLS version**: By default, connections between Microsoft Tunnel clients and servers use TLS 1.3. When TLS 1.3 isn't available, the connection can fall back to use TLS 1.2. @@ -204,6 +210,24 @@ Podman uses the file **/etc/cni/net.d as 87-podman-bridge.conflist** to configur For more information, see [Configuring container networking with Podman](https://www.redhat.com/sysadmin/container-networking-podman) in the Red Hat documentation. +### Linux system auditing + +Linux system auditing can help identify security-relevant information or security violations on a Linux server that hosts Microsoft Tunnel. Linux system auditing is recommended for Microsoft Tunnel, but not required. To use system auditing, a Linux server must have the **auditd** package installed to `/etc/audit/auditd.conf`. + +Details on how to implement auditing depend on the Linux platform you use: + +- **Red Hat**: Versions of Red Had Enterprise Linux 7 and later install the *auditd* package by default. However, if the package isn't installed, you can use the following command line on the Linux server to install it: `sudo dnf install audit audispd-plugins` + + Typically, the *auditd* package is available from the default repository of each REHL version. + + For more information about using system auditing on RHEL, see [Configure Linux system auditing with auditd](https://www.redhat.com/blog/configure-linux-auditing-auditd) in the Red Hat Blog. + +- **Ubuntu**: To use system auditing with Ubuntu you must manually install the *auditd* package. To do so, use the following command line on the Linux server: `sudo apt install auditd audispd-plugins` + + Typically, the *auditd* package is available from the default repository of each Ubuntu version. + + For more information about using system auditing on Ubuntu, see [How to setup and Install Auditd on Ubuntu](https://dev.to/ajaykdl/how-to-setup-auditd-on-ubuntu-jfk), an article that is available on the dev.to website that was originally published at kubefront.com. + ## Network - **Enable packet forwarding for IPv4**: Each Linux server that hosts the Tunnel server software must have IP forwarding for IPv4 enabled. To check on the status of IP forwarding, on the server run one of the following generic commands as *root* or *sudo*. Both commands return a value of **0** for *disabled* and a value of **1** for *enabled*: @@ -257,14 +281,14 @@ When creating the Server configuration for the tunnel, you can specify a differe **More requirements**: -- To access the security token service and Azure storage for logs, provide access to the following FQDNs: - - - Security Token Service: `*.sts.windows.net` - - Azure storage for tunnel logs: `*.blob.core.windows.net` - - Other storage endpoint urls: `*.blob.storage.azure.net` - -- The Tunnel shares the same requirements as [Network endpoints for Microsoft Intune](../fundamentals/intune-endpoints.md), with the addition of port TCP 22, and graph.microsoft.com. +To access the security token service and Azure storage for logs, provide access to the following FQDNs: +- Security Token Service: `*.sts.windows.net` +- Azure storage for tunnel logs: `*.blob.core.windows.net` +- Other storage endpoint urls: `*.blob.storage.azure.net` +- Microsoft Intune: `*.manage.microsoft.com` +- Microsoft authentication: `login.microsoftonline.com` +- Microsoft Graph: `graph.microsoft.com` - Configure firewall rules to support the configurations detailed in [Microsoft Artifact Registry (MAR) Client Firewall Rules Configuration](https://github.com/microsoft/containerregistry/blob/main/docs/client-firewall-rules.md). ## Proxy @@ -486,7 +510,7 @@ To use the readiness tool: 2. To validate your network and Linux configuration, run the script with the following commands. These commands set the run permissions for the script, validate the Tunnel can connect to the correct endpoints, and then check for the presence of utilities that Tunnel uses: - - `sudo chmod +x ./mst-readiness` + - `sudo ./mst-readiness` - `sudo ./mst-readiness network` - This command runs the following actions and then reports success or error for both: diff --git a/memdocs/intune/protect/microsoft-tunnel-upgrade.md b/memdocs/intune/protect/microsoft-tunnel-upgrade.md index 8dcd28b8398..a0e1dd50474 100644 --- a/memdocs/intune/protect/microsoft-tunnel-upgrade.md +++ b/memdocs/intune/protect/microsoft-tunnel-upgrade.md @@ -129,6 +129,47 @@ The Microsoft Tunnel version for a server isn’t available in the Intune UI at > > Container releases take place in stages. If you notice that your container images are not the most recent, please be assured that they will be updated and delivered within the following week. + +### October 2, 2024 + +Image hash values: + +- **agentImageDigest**: sha256:7921c2e97217fa17de4ab69396d943e4975d323417b8b813211e2f8b639f64e1 + +- **serverImageDigest**: sha256:0efab5013351bcd81f186973e75ed5d9f91bbe6271e3be481721500f946fc9ec + +Changes in this release: +-Upgrade from .NET 6 to .NET 8 +- Upgrade ocserv to version 1.3.0 +- Fix rootless container bug in installer + +### September 12, 2024 + +Image hash values: + +- **agentImageDigest**: sha256:17158c73750ff2c7157e979c2f4ff4e175318730c16aa8d0ee6526a969c37c59 + +- **serverImageDigest**: sha256:6484d311d1bd6cbe55d71306595715bafa6a20a000be6fd6f9e530716cef6c16 + +Changes in this release: +- Add diagnostic tools for host troubleshooting +- Upgrade Azure Linux image to 2.0.20240829 + + +### August 12, 2024 + +Image hash values: + +- **agentImageDigest**: sha256:4d16b1f458c69c3423626906b0b577cb42c8d22f4240205299355c6217e08a6b + +- **serverImageDigest**: sha256:66559e142d489491ca8f090b50f4a444a3394f850a5ec09fb9f3e6f986d93c46 + +Changes in this release: +- Support customizing container registry during installation +- Support customizing container creation options during installation +- Security updates on the base image + + ### June 20, 2024 Image hash values: diff --git a/memdocs/intune/protect/mobile-threat-defense.md b/memdocs/intune/protect/mobile-threat-defense.md index bcfbcf3977c..263e4c7410c 100644 --- a/memdocs/intune/protect/mobile-threat-defense.md +++ b/memdocs/intune/protect/mobile-threat-defense.md @@ -130,18 +130,18 @@ Access is granted when the device is remediated:
                        Learn how to protect access to company resource based on device, network, and application risk with: -- [Better Mobile](better-mobile-threat-defense-connector.md) -- [BlackBerry Protect Mobile](blackberry-mobile-threat-defense-connector.md) -- [Check Point Harmony Mobile](checkpoint-sandblast-mobile-mobile-threat-defense-connector.md) -- [CrowdStrike Falcon for Mobile](crowdstrike-falcon-defense-connector.md) -- [Jamf Mobile Threat Defense](jamf-mtd-connector.md) -- [Lookout for Work](lookout-mobile-threat-defense-connector.md) -- [Microsoft Defender for Endpoint](../protect/advanced-threat-protection.md) -- [Pradeo](pradeo-mobile-threat-defense-connector.md) -- [SentinelOne](Sentinelone-mobile-threat-defense-connector.md) -- [Sophos Mobile](sophos-mtd-connector.md) -- [Symantec Endpoint Protection Mobile](skycure-mobile-threat-defense-connector.md) -- [Trellix Mobile Security](trellix-mobile-threat-defense-connector.md) -- [Trend Micro Mobile Security as a Service](trend-micro-mobile-threat-defense-connector.md) -- [Windows Security Center](../apps/protect-mam-windows.md) *(Supports integration with Windows MAM)* -- [Zimperium](zimperium-mobile-threat-defense-connector.md) \ No newline at end of file +- [Better Mobile](better-mobile-threat-defense-connector.md) - *(Android, iOS/iPadOS)* +- [BlackBerry Protect Mobile](blackberry-mobile-threat-defense-connector.md) - *(Android, iOS/iPadOS)* +- [Check Point Harmony Mobile](checkpoint-sandblast-mobile-mobile-threat-defense-connector.md) - *(Android, iOS/iPadOS)* +- [CrowdStrike Falcon for Mobile](crowdstrike-falcon-defense-connector.md) - *(Android, iOS/iPadOS)* +- [Jamf Mobile Threat Defense](jamf-mtd-connector.md) - *(Android, iOS/iPadOS)* +- [Lookout for Work](lookout-mobile-threat-defense-connector.md) - *(Android, iOS/iPadOS)* +- [Microsoft Defender for Endpoint](../protect/advanced-threat-protection.md) - *(Android, iOS/iPadOS, Windows)* +- [Pradeo](pradeo-mobile-threat-defense-connector.md) - *(Android, iOS/iPadOS)* +- [SentinelOne](Sentinelone-mobile-threat-defense-connector.md) - *(Android, iOS/iPadOS)* +- [Sophos Mobile](sophos-mtd-connector.md) - *(Android, iOS/iPadOS)* +- [Symantec Endpoint Protection Mobile](skycure-mobile-threat-defense-connector.md) - *(Android, iOS/iPadOS)* +- [Trellix Mobile Security](trellix-mobile-threat-defense-connector.md) - *(Android, iOS/iPadOS)* +- [Trend Micro Mobile Security as a Service](trend-micro-mobile-threat-defense-connector.md) - *(Android, iOS/iPadOS)* +- [Windows Security Center](../apps/protect-mam-windows.md) - *(Windows)* - *For information about the Windows versions that support this connector, see [Data protection for Windows MAM](../apps/protect-mam-windows.md).* +- [Zimperium](zimperium-mobile-threat-defense-connector.md) - *(Android, iOS/iPadOS)* diff --git a/memdocs/intune/protect/mtd-add-apps-unenrolled-devices.md b/memdocs/intune/protect/mtd-add-apps-unenrolled-devices.md index 7f9dff51636..69e05bbab1f 100644 --- a/memdocs/intune/protect/mtd-add-apps-unenrolled-devices.md +++ b/memdocs/intune/protect/mtd-add-apps-unenrolled-devices.md @@ -8,7 +8,7 @@ keywords: author: brenduns ms.author: brenduns manager: dougeby -ms.date: 01/23/2024 +ms.date: 08/20/2024 ms.topic: how-to ms.service: microsoft-intune ms.subservice: protect @@ -20,7 +20,7 @@ ms.assetid: #ROBOTS: #audience: -ms.reviewer: aanavath +ms.reviewer: demerson ms.suite: ems search.appverid: MET150 #ms.tgt_pltfrm: @@ -39,19 +39,7 @@ End users need the Microsoft Authenticator (iOS) to register their device, and t Optionally, you can use Intune to add and deploy the Microsoft Authenticator, and Mobile Threat Defense (MTD) apps as well. -> [!NOTE] -> This article applies to all Mobile Threat Defense partners that support app protection policies: -> -> - Microsoft Defender for Endpoint (Android, iOS/iPadOS) -> - Better Mobile (Android, iOS/iPadOS) -> - BlackBerry Mobile (CylancePROTECT for Android, iOS/iPadOS) -> - Check Point Harmony Mobile (Android, iOS/iPadOS) -> - Jamf (Android, iOS/iPadOS) -> - Lookout for Work (Android, iOS/iPadOS) -> - SentinelOne (Android, iOS/iPadOS) -> - Symantec Endpoint Security (Android, iOS/iPadOS) -> - Trellix Mobile Security (Android, iOS/iPadOS) -> - Zimperium (Android, iOS/iPadOS) +[!INCLUDE [mtd-mam-note](../../intune/protect/includes/mtd-mam-note.md)] > > For unenrolled devices, you **do not need an iOS app configuration policy** that sets up the Mobile Threat Defense for iOS app you use with Intune. This is a key difference compared to Intune enrolled devices. @@ -142,21 +130,6 @@ However, should you wish to make the app available to end users via the Intune C - **iOS** - See the instructions for [adding iOS store apps to Microsoft Intune](../apps/store-apps-ios.md). Use this [Zimperium - App Store URL](https://itunes.apple.com/us/app/zimperium-zips/id1030924459?mt=8) when completing the **Configure app information** section. - - - - - ## Next steps - [Enable the Mobile Threat Defense connector in Intune for unenrolled devices](mtd-enable-unenrolled-devices.md) diff --git a/memdocs/intune/protect/mtd-app-protection-policy.md b/memdocs/intune/protect/mtd-app-protection-policy.md index 649eaab817b..af25f09e869 100644 --- a/memdocs/intune/protect/mtd-app-protection-policy.md +++ b/memdocs/intune/protect/mtd-app-protection-policy.md @@ -8,7 +8,7 @@ keywords: author: brenduns ms.author: brenduns manager: dougeby -ms.date: 01/23/2024 +ms.date: 08/20/2024 ms.topic: how-to ms.service: microsoft-intune ms.subservice: protect @@ -20,7 +20,7 @@ ms.assetid: #ROBOTS: #audience: -ms.reviewer: aanavath +ms.reviewer: demerson ms.suite: ems search.appverid: MET150 #ms.tgt_pltfrm: @@ -35,21 +35,8 @@ ms.collection: Intune with Mobile Threat Defense (MTD) helps you detect threats and assess risk on mobile and Windows devices. You can create an Intune app protection policy that assesses risk to determine if the application is allowed to access corporate data or not. -> [!NOTE] -> This article applies to all Mobile Threat Defense partners that support app protection policies: -> -> - Better Mobile (Android, iOS/iPadOS) -> - BlackBerry Mobile (Android, iOS/iPadOS) -> - Check Point Harmony Mobile (Android, iOS/iPadOS) -> - Jamf (Android, iOS/iPadOS) -> - Microsoft Defender for Endpoint (Android, iOS/iPadOS) -> - Lookout for Work (Android, iOS/iPadOS) -> - Trellix Mobile Security (Android, iOS/iPadOS) -> - SentinelOne (Android, iOS/iPadOS) -> - Symantec Endpoint Security (Android, iOS/iPadOS) -> - Windows Security Center (Windows) -> - Zimperium (Android, iOS/iPadOS) - +[!INCLUDE [mtd-mam-note](../../intune/protect/includes/mtd-mam-note.md)] + ## Before you begin As part of the MTD setup, in the MTD partner console, you created a policy that classifies various threats as high, medium, and low. You now need to set the Mobile Threat Defense level in the Intune app protection policy. diff --git a/memdocs/intune/protect/mtd-apps-ios-app-configuration-policy-add-assign.md b/memdocs/intune/protect/mtd-apps-ios-app-configuration-policy-add-assign.md index de94afb7430..760eeaf4080 100644 --- a/memdocs/intune/protect/mtd-apps-ios-app-configuration-policy-add-assign.md +++ b/memdocs/intune/protect/mtd-apps-ios-app-configuration-policy-add-assign.md @@ -176,7 +176,7 @@ Use the same Microsoft Entra account previously configured in the [Symantec Endp ### Sophos Mobile app configuration policy -Create the iOS app configuration policy as described in the [using iOS app configuration policy](../apps/app-configuration-policies-use-ios.md) article. For more information, see [Sophos Intercept X for Mobile iOS - Available managed settings](https://support.sophos.com/support/s/article/KB-000038801) in the Sophos knowledge base. +Create the iOS app configuration policy as described in the [using iOS app configuration policy](../apps/app-configuration-policies-use-ios.md) article. For more information, see [Sophos Intercept X for Mobile iOS - Available managed settings](https://support.sophos.com/support/s/article/KBA-000006738) in the Sophos knowledge base. ### Trellix Mobile Security app configuration policy diff --git a/memdocs/intune/protect/mtd-device-compliance-policy-create.md b/memdocs/intune/protect/mtd-device-compliance-policy-create.md index b01e390470e..4c8087e5834 100644 --- a/memdocs/intune/protect/mtd-device-compliance-policy-create.md +++ b/memdocs/intune/protect/mtd-device-compliance-policy-create.md @@ -1,14 +1,14 @@ --- # required metadata -title: Create a Mobile Threat Defense (MTD) device compliance policy with Microsoft Intune +title: Create Mobile Threat Defense compliance policies in Intune titleSuffix: Microsoft Intune description: Create an Intune device compliance policy that uses your MTD partner threat levels to determine if a mobile device can access company resources. keywords: author: brenduns ms.author: brenduns manager: dougeby -ms.date: 08/22/2024 +ms.date: 09/30/2024 ms.topic: how-to ms.service: microsoft-intune ms.subservice: protect @@ -94,6 +94,6 @@ Your Mobile Threat Defense partner can send a risk score for each device for whi > > Conditional Access policies for Microsoft 365 or other services also evaluate device compliance results, which include the threat-level configuration. Any noncompliant device can be blocked from accessing corporate resources until that devices threat-level is remediated to bring the device into compliance with your policies and that status is successfully reported to Intune via the MTD vendor. -## Next steps +## Related content -[Enable MTD with Intune](mtd-connector-enable.md) +[Enable a Mobile Threat Defense connector](mtd-connector-enable.md) diff --git a/memdocs/intune/protect/mtd-enable-unenrolled-devices.md b/memdocs/intune/protect/mtd-enable-unenrolled-devices.md index 8b8cc2be3a2..4348ba1e34f 100644 --- a/memdocs/intune/protect/mtd-enable-unenrolled-devices.md +++ b/memdocs/intune/protect/mtd-enable-unenrolled-devices.md @@ -8,7 +8,7 @@ keywords: author: brenduns ms.author: brenduns manager: dougeby -ms.date: 07/09/2024 +ms.date: 08/20/2024 ms.topic: how-to ms.service: microsoft-intune ms.subservice: protect @@ -20,7 +20,7 @@ ms.assetid: #ROBOTS: #audience: -ms.reviewer: aanavath +ms.reviewer: demerson ms.suite: ems search.appverid: MET150 #ms.tgt_pltfrm: @@ -35,18 +35,7 @@ ms.collection: During Mobile Threat Defense (MTD) setup, you've configured a policy for classifying threats in your Mobile Threat Defense partner console and you've created the app protection policy in Intune. If you've already configured the Intune connector in the MTD partner console, you can now enable the MTD connection for MTD partner applications. -> [!NOTE] -> This article applies to all Mobile Threat Defense partners that support app protection policies: -> -> - BlackBerry Mobile (Android, iOS/iPadOS) -> - Better Mobile (Android,iOS/iPadOS) -> - Check Point Harmony Mobile Protect (Android, iOS/iPadOS) -> - Jamf (Android, iOS/iPadOS) -> - Lookout for Work (Android, iOS/iPadOS) -> - SentinelOne (Android,iOS/iPadOS) -> - Symantec Endpoint Security (Android, iOS/iPadOS) -> - Trellix Mobile Security (Android,iOS/iPadOS) -> - Zimperium (Android,iOS/iPadOS) +[!INCLUDE [mtd-mam-note](../../intune/protect/includes/mtd-mam-note.md)] ## Classic conditional access policies for Mobile Threat Defense (MTD) apps diff --git a/memdocs/intune/protect/reusable-settings-groups.md b/memdocs/intune/protect/reusable-settings-groups.md index ad90f4b98ec..977838ef69c 100644 --- a/memdocs/intune/protect/reusable-settings-groups.md +++ b/memdocs/intune/protect/reusable-settings-groups.md @@ -7,7 +7,7 @@ keywords: author: brenduns ms.author: brenduns manager: dougeby -ms.date: 08/19/2024 +ms.date: 09/18/2024 ms.topic: how-to ms.service: microsoft-intune ms.subservice: protect @@ -116,6 +116,10 @@ When you edit the configuration of a reusable group, each profile that uses that Add reusable settings groups to profiles while editing or creating the profile. On the profiles Configuration settings page, use an option that supports adding one or more previously created groups. +> [!NOTE] +> +> Inbound FQDN rules aren’t natively supported. However, it’s possible to use *pre-hydration* scripts to generate inbound IP entries for the rule. For more information, see [Windows Firewall dynamic keywords](/windows/security/operating-system-security/network-security/windows-firewall/dynamic-keywords) in the Windows Firewall documentation. + 1. In the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431), create a new profile or select and edit an existing profile. 2. On the *Configuration settings* page, select **Add** to add a new rule, or **Edit rule** to manage a previously created rule. diff --git a/memdocs/intune/protect/security-baseline-settings-defender.md b/memdocs/intune/protect/security-baseline-settings-defender.md index 96e14b68150..63c246d31b5 100644 --- a/memdocs/intune/protect/security-baseline-settings-defender.md +++ b/memdocs/intune/protect/security-baseline-settings-defender.md @@ -7,7 +7,7 @@ description: View the settings in the Microsoft Intune security baseline for Mic author: brenduns ms.author: brenduns manager: dougeby -ms.date: 07/01/2024 +ms.date: 09/10/2024 ms.topic: reference ms.service: microsoft-intune ms.subservice: protect @@ -86,12 +86,12 @@ This baseline is optimized for physical devices and isn't recommended for use on Baseline default: *Enabled* [Learn more](/windows/client-management/mdm/policy-csp-deviceinstallation?WT.mc_id=Portal-fx#preventinstallationofmatchingdevicesetupclasses) + - **Prevented Classes** + Baseline default: *d48179be-ec20-11d1-b6b8-00c04fa372a7* + - **Also apply to matching devices that are already installed.** Baseline default: *False* - - **Prevented Classes** - Baseline default: *d48179be-ec20-11d1-b6b8-00c04fa372a7* - ### Windows Components > BitLocker Drive Encryption - **Choose drive encryption method and cipher strength (Windows 10 [Version 1511] and later)** @@ -161,22 +161,22 @@ This baseline is optimized for physical devices and isn't recommended for use on - **Omit recovery options from the BitLocker setup wizard** Baseline default: *True* + - **Allow data recovery agent** + Baseline default: *True* + Value: *Allow 256-bit recovery key* - - **Save BitLocker recovery information to AD DS for operating system drives** - Baseline default: *True* + - **Configure storage of BitLocker recovery information to AD DS:** + Baseline default: *Store recovery passwords and key packages* - **Do not enable BitLocker until recovery information is stored to AD DS for operating system drives** Baseline default: *True* - - **Configure user storage of BitLocker recovery information:** - Baseline default: *Allow 48-digit recovery password* - - - **Allow data recovery agent** + - **Save BitLocker recovery information to AD DS for operating system drives** Baseline default: *True* - - **Configure storage of BitLocker recovery information to AD DS:** - Baseline default: *Store recovery passwords and key packages* + - **Configure user storage of BitLocker recovery information:** + Baseline default: *Allow 48-digit recovery password* - **Enable use of BitLocker authentication requiring preboot keyboard input on slates** Baseline default: *Enabled* @@ -196,12 +196,12 @@ This baseline is optimized for physical devices and isn't recommended for use on - **Configure TPM startup key and PIN:** Baseline default: *Do not allow startup key and PIN with TPM* - - **Allow BitLocker without a compatible TPM (requires a password or a startup key on a USB flash drive)** - Baseline default: *False* - - **Configure TPM startup:** Baseline default: *Allow TPM* + - **Allow BitLocker without a compatible TPM (requires a password or a startup key on a USB flash drive)** + Baseline default: *False* + - **Configure TPM startup PIN:** Baseline default: *Allow startup PIN with TPM* @@ -340,40 +340,40 @@ This baseline is optimized for physical devices and isn't recommended for use on Baseline default: *Block* [Learn more](/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction?WT.mc_id=Portal-fx) - - **Block JavaScript or VBScript from launching downloaded executable content** + - **Block Adobe Reader from creating child processes** Baseline default: *Block* [Learn more](/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction?WT.mc_id=Portal-fx) - - **Block Webshell creation for Servers** + - **Block credential stealing from the Windows local security authority subsystem** Baseline default: *Block* [Learn more](/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction?WT.mc_id=Portal-fx) - - **Block untrusted and unsigned processes that run from USB** + - **Block JavaScript or VBScript from launching downloaded executable content** Baseline default: *Block* [Learn more](/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction?WT.mc_id=Portal-fx) - - **Block Adobe Reader from creating child processes** + - **Block Webshell creation for Servers** Baseline default: *Block* [Learn more](/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction?WT.mc_id=Portal-fx) - - **Block credential stealing from the Windows local security authority subsystem** + - **Block untrusted and unsigned processes that run from USB** Baseline default: *Block* [Learn more](/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction?WT.mc_id=Portal-fx) - - **Block abuse of exploited vulnerable signed drivers (Device)** - Baseline default: *Block* + - **Block persistence through WMI event subscription** + Baseline default: *Audit* [Learn more](/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction?WT.mc_id=Portal-fx) - - **Block persistence through WMI event subscription** + - **[PREVIEW] Block use of copied or impersonated system tools** Baseline default: *Block* [Learn more](/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction?WT.mc_id=Portal-fx) - - **[PREVIEW] Block use of copied or impersonated system tools** + - **Block abuse of exploited vulnerable signed drivers (Device)** Baseline default: *Block* [Learn more](/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction?WT.mc_id=Portal-fx) - **Block process creations originating from PSExec and WMI commands** - Baseline default: *Block* + Baseline default: *Audit* [Learn more](/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction?WT.mc_id=Portal-fx) - **Block Office applications from creating executable content** @@ -490,29 +490,29 @@ This baseline is optimized for physical devices and isn't recommended for use on Baseline default: *True* [Learn more](/windows/client-management/mdm/firewall-csp?WT.mc_id=Portal-fx#mdmstoredomainprofileenablefirewall) - - **Disable Stealth Mode Ipsec Secured Packet Exemption** + - **Allow Local Ipsec Policy Merge** Baseline default: *True* - [Learn more](/windows/client-management/mdm/firewall-csp?WT.mc_id=Portal-fx#mdmstoredomainprofiledisablestealthmodeipsecsecuredpacketexemption) + [Learn more](/windows/client-management/mdm/firewall-csp?WT.mc_id=Portal-fx#mdmstoredomainprofileallowlocalipsecpolicymerge) - **Disable Stealth Mode** Baseline default: *False* [Learn more](/windows/client-management/mdm/firewall-csp?WT.mc_id=Portal-fx#mdmstoredomainprofiledisablestealthmode) - - **Allow Local Ipsec Policy Merge** - Baseline default: *True* - [Learn more](/windows/client-management/mdm/firewall-csp?WT.mc_id=Portal-fx#mdmstoredomainprofileallowlocalipsecpolicymerge) - - **Disable Inbound Notifications** Baseline default: *True* [Learn more](/windows/client-management/mdm/firewall-csp?WT.mc_id=Portal-fx#mdmstoredomainprofiledisableinboundnotifications) + - **Disable Unicast Responses To Multicast Broadcast** + Baseline default: *False* + [Learn more](/windows/client-management/mdm/firewall-csp?WT.mc_id=Portal-fx#mdmstoredomainprofiledisableunicastresponsestomulticastbroadcast) + - **Global Ports Allow User Pref Merge** Baseline default: *True* [Learn more](/windows/client-management/mdm/firewall-csp?WT.mc_id=Portal-fx#mdmstoredomainprofileglobalportsallowuserprefmerge) - - **Disable Unicast Responses To Multicast Broadcast** - Baseline default: *False* - [Learn more](/windows/client-management/mdm/firewall-csp?WT.mc_id=Portal-fx#mdmstoredomainprofiledisableunicastresponsestomulticastbroadcast) + - **Disable Stealth Mode Ipsec Secured Packet Exemption** + Baseline default: *True* + [Learn more](/windows/client-management/mdm/firewall-csp?WT.mc_id=Portal-fx#mdmstoredomainprofiledisablestealthmodeipsecsecuredpacketexemption) - **Allow Local Policy Merge** Baseline default: *True* @@ -520,6 +520,7 @@ This baseline is optimized for physical devices and isn't recommended for use on - **Enable Packet Queue** Baseline default: *Configured* + Value: *Disabled* [Learn more](/windows/client-management/mdm/firewall-csp?WT.mc_id=Portal-fx#mdmstoreglobalenablepacketqueue) - **Enable Private Network Firewall** @@ -527,7 +528,7 @@ This baseline is optimized for physical devices and isn't recommended for use on [Learn more](/windows/client-management/mdm/firewall-csp?WT.mc_id=Portal-fx#mdmstoreprivateprofileenablefirewall) - **Default Inbound Action for Private Profile** - Baseline default: *True* + Baseline default: *Block* [Learn more](/windows/client-management/mdm/firewall-csp?WT.mc_id=Portal-fx#mdmstoreprivateprofiledefaultinboundaction) - **Disable Unicast Responses To Multicast Broadcast** @@ -550,6 +551,10 @@ This baseline is optimized for physical devices and isn't recommended for use on Baseline default: *True* [Learn more](/windows/client-management/mdm/firewall-csp?WT.mc_id=Portal-fx#mdmstoreprivateprofiledisablestealthmodeipsecsecuredpacketexemption) + - **Disable Inbound Notifications** + Baseline default: *True* + [Learn more](/windows/client-management/mdm/firewall-csp?WT.mc_id=Portal-fx#mdmstoreprivateprofiledisableinboundnotifications) + - **Allow Local Policy Merge** Baseline default: *True* [Learn more](/windows/client-management/mdm/firewall-csp?WT.mc_id=Portal-fx#mdmstoreprivateprofileallowlocalpolicymerge) @@ -562,10 +567,6 @@ This baseline is optimized for physical devices and isn't recommended for use on Baseline default: *True* [Learn more](/windows/client-management/mdm/firewall-csp?WT.mc_id=Portal-fx#mdmstoreprivateprofileauthappsallowuserprefmerge) - - **Disable Inbound Notifications** - Baseline default: *True* - [Learn more](/windows/client-management/mdm/firewall-csp?WT.mc_id=Portal-fx#mdmstoreprivateprofiledisableinboundnotifications) - - **Enable Public Network Firewall** Baseline default: *True* [Learn more](/windows/client-management/mdm/firewall-csp?WT.mc_id=Portal-fx#mdmstorepublicprofileenablefirewall) @@ -586,30 +587,30 @@ This baseline is optimized for physical devices and isn't recommended for use on Baseline default: *True* [Learn more](/windows/client-management/mdm/firewall-csp?WT.mc_id=Portal-fx#mdmstorepublicprofiledisablestealthmodeipsecsecuredpacketexemption) - - **Default Inbound Action for Public Profile** - Baseline default: *Block* - [Learn more](/windows/client-management/mdm/firewall-csp?WT.mc_id=Portal-fx#mdmstorepublicprofiledefaultinboundaction) - - - **Global Ports Allow User Pref Merge** - Baseline default: *True* - [Learn more](/windows/client-management/mdm/firewall-csp?WT.mc_id=Portal-fx#mdmstorepublicprofileglobalportsallowuserprefmerge) - - **Allow Local Policy Merge** Baseline default: *True* [Learn more](/windows/client-management/mdm/firewall-csp?WT.mc_id=Portal-fx#mdmstorepublicprofileallowlocalpolicymerge) - - **Allow Local Ipsec Policy Merge** - Baseline default: *True* - [Learn more](/windows/client-management/mdm/firewall-csp?WT.mc_id=Portal-fx#mdmstorepublicprofileallowlocalipsecpolicymerge) - - **Auth Apps Allow User Pref Merge** Baseline default: *True* [Learn more](/windows/client-management/mdm/firewall-csp?WT.mc_id=Portal-fx#mdmstorepublicprofileauthappsallowuserprefmerge) + - **Default Inbound Action for Public Profile** + Baseline default: *Block* + [Learn more](/windows/client-management/mdm/firewall-csp?WT.mc_id=Portal-fx#mdmstorepublicprofiledefaultinboundaction) + - **Disable Unicast Responses To Multicast Broadcast** Baseline default: *False* [Learn more](/windows/client-management/mdm/firewall-csp?WT.mc_id=Portal-fx#mdmstorepublicprofiledisableunicastresponsestomulticastbroadcast) + - **Global Ports Allow User Pref Merge** + Baseline default: *True* + [Learn more](/windows/client-management/mdm/firewall-csp?WT.mc_id=Portal-fx#mdmstorepublicprofileglobalportsallowuserprefmerge) + + - **Allow Local Ipsec Policy Merge** + Baseline default: *True* + [Learn more](/windows/client-management/mdm/firewall-csp?WT.mc_id=Portal-fx#mdmstorepublicprofileallowlocalipsecpolicymerge) + - **Preshared Key Encoding** Baseline default: *UTF8* [Learn more](/windows/client-management/mdm/firewall-csp?WT.mc_id=Portal-fx#mdmstoreglobalpresharedkeyencoding) diff --git a/memdocs/intune/protect/security-baseline-settings-mdm-all.md b/memdocs/intune/protect/security-baseline-settings-mdm-all.md index 21d98b083a9..31c02051079 100644 --- a/memdocs/intune/protect/security-baseline-settings-mdm-all.md +++ b/memdocs/intune/protect/security-baseline-settings-mdm-all.md @@ -110,7 +110,7 @@ The settings in this baseline are taken from the **version 23H2** of the Group P Baseline default: *Enabled* [Learn more](/windows/client-management/mdm/policy-csp-msslegacy?WT.mc_id=Portal-fx#ipsourceroutingprotectionlevel) - **DisableIPSourceRouting (Device)** - Baseline default: *Enabled* *Highest protection, source routing is completely disabled* + Baseline default: *Highest protection, source routing is completely disabled* - **MSS: (EnableCMPRedirect) Allow ICMP redirects to override OSPF generated routes** Baseline default: *Disabled* @@ -1698,87 +1698,87 @@ The settings in this baseline are taken from the **version 23H2** of the Group P - **Access From Network** Baseline default: *Configured* - Values: *Administrators*, *Remote Desktop Users* + Values: *Administrators* (*S-1-5-32-544), *Remote Desktop Users* (*S-1-5-32-555) [Learn more](/windows/client-management/mdm/policy-csp-UserRights?WT.mc_id=Portal-fx#accessfromnetwork) - **Allow Local Log On** Baseline default: *Configured* - Values: *Administrators*, *Users* + Values: *Administrators* (*S-1-5-32-544), *Users* (*S-1-5-32-545) [Learn more](/windows/client-management/mdm/policy-csp-UserRights?WT.mc_id=Portal-fx#allowlocallogon) - **Backup Files And Directories** Baseline default: *Configured* - Value: *Administrators* + Value: *Administrators* (*S-1-5-32-544) [Learn more](/windows/client-management/mdm/policy-csp-UserRights?WT.mc_id=Portal-fx#backupfilesanddirectories) - **Create Global Objects** Baseline default: *Configured* - Values: *Administrators*, *LOCAL SERVICE*, *NETWORK SERVICE*, *SERVICE* + Values: *Administrators* (*S-1-5-32-544), *Local Service* (*S-1-5-19), *Network Service* (*S-1-5-20), *Service* (*S-1-5-6) [Learn more](/windows/client-management/mdm/policy-csp-UserRights?WT.mc_id=Portal-fx#createglobalobjects) - **Create Page File** Baseline default: *Configured* - Value: *Administrators* + Value: *Administrators* (*S-1-5-32-544) [Learn more](/windows/client-management/mdm/policy-csp-UserRights?WT.mc_id=Portal-fx#createpagefile) - **Debug Programs** Baseline default: *Configured* - Value: *Administrators* + Value: *Administrators* (*S-1-5-32-544) [Learn more](/windows/client-management/mdm/policy-csp-UserRights?WT.mc_id=Portal-fx#debugprograms) - **Deny Access From Network** Baseline default: *Configured* - Value: *NT AUTHORITY\Local Account* + Value: *NT AUTHORITY\Local Account* (*S-1-5-113) [Learn more](/windows/client-management/mdm/policy-csp-UserRights?WT.mc_id=Portal-fx#denyaccessfromnetwork) - **Deny Remote Desktop Services Log On** Baseline default: *Configured* - Value: *NT AUTHORITY\Local Account* + Value: *NT AUTHORITY\Local Account* (*S-1-5-113) [Learn more](/windows/client-management/mdm/policy-csp-UserRights?WT.mc_id=Portal-fx#denyremotedesktopserviceslogon) - **Impersonate Client** Baseline default: *Configured* - Values: *Administrators*, *SERVICE*, *Local Service*, *Network Service* + Values: *Administrators* (*S-1-5-32-544), *Service* (*S-1-5-6), *Local Service* (*S-1-5-19), *Network Service* (*S-1-5-20) [Learn more](/windows/client-management/mdm/policy-csp-UserRights?WT.mc_id=Portal-fx#impersonateclient) - **Load Unload Device Drivers** Baseline default: *Configured* - Value: *Administrators* + Value: *Administrators* (*S-1-5-32-544) [Learn more](/windows/client-management/mdm/policy-csp-UserRights?WT.mc_id=Portal-fx#loadunloaddevicedrivers) - **Manage Auditing And Security Log** Baseline default: *Configured* - Value: *Administrators* + Value: *Administrators* (*S-1-5-32-544) [Learn more](/windows/client-management/mdm/policy-csp-UserRights?WT.mc_id=Portal-fx#manageauditingandsecuritylog) - **Manage Volume** Baseline default: *Configured* - Value: *Administrators* + Value: *Administrators* (*S-1-5-32-544) [Learn more](/windows/client-management/mdm/policy-csp-UserRights?WT.mc_id=Portal-fx#managevolume) - **Modify Firmware Environment** Baseline default: *Configured* - Value: *Administrators* + Value: *Administrators* (*S-1-5-32-544) [Learn more](/windows/client-management/mdm/policy-csp-UserRights?WT.mc_id=Portal-fx#modifyfirmwareenvironment) - **Profile Single Process** Baseline default: *Configured* - Value: *Administrators* + Value: *Administrators* (*S-1-5-32-544) [Learn more](/windows/client-management/mdm/policy-csp-UserRights?WT.mc_id=Portal-fx#profilesingleprocess) - **Remote Shutdown** Baseline default: *Configured* - Value: *Administrators* + Value: *Administrators* (*S-1-5-32-544) [Learn more](/windows/client-management/mdm/policy-csp-UserRights?WT.mc_id=Portal-fx#remoteshutdown) - **Restore Files And Directories** Baseline default: *Configured* - Value: *Administrators* + Value: *Administrators* (*S-1-5-32-544) [Learn more](/windows/client-management/mdm/policy-csp-UserRights?WT.mc_id=Portal-fx#restorefilesanddirectories) - **Take Ownership** Baseline default: *Configured* - Value: *Administrators* + Value: *Administrators* (*S-1-5-32-544) [Learn more](/windows/client-management/mdm/policy-csp-UserRights?WT.mc_id=Portal-fx#takeownership) ## Virtualization Based Technology diff --git a/memdocs/intune/protect/security-baseline-settings-windows-365.md b/memdocs/intune/protect/security-baseline-settings-windows-365.md index 790d37d095c..d1527ba5f08 100644 --- a/memdocs/intune/protect/security-baseline-settings-windows-365.md +++ b/memdocs/intune/protect/security-baseline-settings-windows-365.md @@ -7,7 +7,7 @@ description: View a list of the settings in the Microsoft Intune security baseli author: brenduns ms.author: brenduns manager: dougeby -ms.date: 07/19/2024 +ms.date: 09/10/2024 ms.topic: reference ms.service: microsoft-intune ms.subservice: protect @@ -174,10 +174,11 @@ The settings in this baseline apply to Windows devices managed through Intune. W - **Prevent installation of devices using drivers that match these device setup classes** Baseline default: *Enabled* [Learn more](/windows/client-management/mdm/policy-csp-deviceinstallation?WT.mc_id=Portal-fx#preventinstallationofmatchingdevicesetupclasses) + - **Prevented Classes** + Baseline default: *{d48179be-ec20-11d1-b6b8-00c04fa372a7}* + - **Also apply to matching devices that are already installed** Baseline default: *True* - - **Prevented Classes** - Baseline default: *{d48179be-ec20-11d1-b6b8-00c04fa372a7}* ### System > Early Launch Antimalware @@ -200,7 +201,7 @@ The settings in this baseline apply to Windows devices managed through Intune. W ### System > Internet Communication Management > Internet Communication settings -- **Turn off downloading of print drivers** +- **Turn off downloading of print drivers over HTTP** Baseline default: *Enabled* [Learn more](/windows/client-management/mdm/policy-csp-connectivity?WT.mc_id=Portal-fx#disabledownloadingofprintdriversoverhttp) @@ -208,24 +209,6 @@ The settings in this baseline apply to Windows devices managed through Intune. W Baseline default: *Enabled* [Learn more](/windows/client-management/mdm/policy-csp-connectivity?WT.mc_id=Portal-fx#disableinternetdownloadforwebpublishingandonlineorderingwizards) -### System > Power Management > Sleep Settings - -- **Allow standby states (S1-S3) when sleeping (on battery)** - Baseline default: *Disabled* - [Learn more](/windows/client-management/mdm/policy-csp-power?WT.mc_id=Portal-fx#allowstandbystateswhensleepingonbattery) - -- **Allow standby states (S1-S3) when sleeping (plugged in)** - Baseline default: *Disabled* - [Learn more](/windows/client-management/mdm/policy-csp-power?WT.mc_id=Portal-fx#allowstandbywhensleepingpluggedin) - -- **Require a password when a computer wakes (on battery)** - Baseline default: *Enabled* - [Learn more](/windows/client-management/mdm/policy-csp-power?WT.mc_id=Portal-fx#requirepasswordwhencomputerwakesonbattery) - -- **Require a password when a computer wakes (plugged in)** - Baseline default: *Enabled* - [Learn more](/windows/client-management/mdm/policy-csp-power?WT.mc_id=Portal-fx#requirepasswordwhencomputerwakespluggedin) - ### System > Remote Assistance - **Configure Solicited Remote Assistance** @@ -264,28 +247,6 @@ The settings in this baseline apply to Windows devices managed through Intune. W - **Turn off Autoplay on:** Baseline default: *All drives* -### Windows Components > BitLocker Drive Encryption > Fixed Data Drives - -> [!NOTE] -> -> The default configuration of the following setting will apply to all managed Windows 365 PCs as Windows 365 PC’s do no support use of BitLocker as an encryption option. For more information, see [Data encryption in Windows 365](/windows-365/enterprise/encryption) in the Windows Security documentation. - -- **Deny write access to fixed drives not protected by BitLocker** - Baseline default: *Disabled* - [Learn more](/windows/client-management/mdm/bitlocker-csp?WT.mc_id=Portal-fx#fixeddrivesrequireencryption) - -### Windows Components > BitLocker Drive Encryption > Removable Data Drives - -> [!NOTE] -> -> The default configuration of the following setting will apply to all managed Windows 365 PCs as Windows 365 PC’s do no support use of BitLocker as an encryption option. For more information, see [Data encryption in Windows 365](/windows-365/enterprise/encryption) in the Windows Security documentation. - -- **Deny write access to removable drives not protected by BitLocker** - Baseline default: *Enabled* - [Learn more](/windows/client-management/mdm/bitlocker-csp?WT.mc_id=Portal-fx#removabledrivesrequireencryption) - - **Do not allow write access to devices configured in another organization** - Baseline default: *False* - ### Windows Components > Credential User Interface - **Enumerate administrator accounts on elevation** @@ -1222,28 +1183,6 @@ The settings in this baseline apply to Windows devices managed through Intune. W Baseline default: *Success+ Failure* [Learn more](/windows/client-management/mdm/policy-csp-Audit?WT.mc_id=Portal-fx#system_auditsystemintegrity) -## Browser - -- **Allow Password Manager** - Baseline default: *Block* - [Learn more](/windows/client-management/mdm/policy-csp-Browser?WT.mc_id=Portal-fx#allowpasswordmanager) - -- **Allow Smart Screen** - Baseline default: *Allow* - [Learn more](/windows/client-management/mdm/policy-csp-Browser?WT.mc_id=Portal-fx#allowsmartscreen) - -- **Prevent Cert Error Overrides** - Baseline default: *Enabled* - [Learn more](/windows/client-management/mdm/policy-csp-Browser?WT.mc_id=Portal-fx#preventcerterroroverrides) - -- **Prevent Smart Screen Prompt Override** - Baseline default: *Enabled* - [Learn more](/windows/client-management/mdm/policy-csp-Browser?WT.mc_id=Portal-fx#preventsmartscreenpromptoverride) - -- **Prevent Smart Screen Prompt Override For Files** - Baseline default: *Enabled* - [Learn more](/windows/client-management/mdm/policy-csp-Browser?WT.mc_id=Portal-fx#preventsmartscreenpromptoverrideforfiles) - ## Data Protection - **Allow Direct Memory Access** @@ -1283,36 +1222,47 @@ The settings in this baseline apply to Windows devices managed through Intune. W - **Allow Script Scanning** Baseline default: *Allowed.* [Learn more](/windows/client-management/mdm/policy-csp-defender?WT.mc_id=Portal-fx#allowscriptscanning) + - **Block execution of potentially obfuscated scripts** Baseline default: *Block* [Learn more](/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction?WT.mc_id=Portal-fx) + - **Block Win32 API calls from Office macros** Baseline default: *Block* [Learn more](/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction?WT.mc_id=Portal-fx) + - **Block Office communication application from creating child processes** Baseline default: *Block* [Learn more](/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction?WT.mc_id=Portal-fx) + - **Block all Office applications from creating child processes** Baseline default: *Block* - [Learn more](/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction?WT.mc_id=Portal-fx) - - **Block JavaScript or VBScript from launching downloaded executable content** + [Learn more](/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction?WT.mc_id=Portal-fx) + + - **Block Adobe Reader from creating child processes** Baseline default: *Block* [Learn more](/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction?WT.mc_id=Portal-fx) - - **Block untrusted and unsigned processes that run from USB** + + - **Block credential stealing from the Windows local security authority subsystem** Baseline default: *Block* [Learn more](/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction?WT.mc_id=Portal-fx) - - **Block Adobe Reader from creating child processes** + + - **Block JavaScript or VBScript from launching downloaded executable content** Baseline default: *Block* [Learn more](/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction?WT.mc_id=Portal-fx) - - **Block credential stealing from the Windows local security authority subsystem** + + - **Block untrusted and unsigned processes that run from USB** Baseline default: *Block* [Learn more](/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction?WT.mc_id=Portal-fx) + - **Block Office applications from creating executable content** Baseline default: *Block* [Learn more](/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction?WT.mc_id=Portal-fx) + - **Block Office applications from injecting code into other processes** Baseline default: *Block* [Learn more](/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction?WT.mc_id=Portal-fx) + - **Block executable content from email client and webmail** Baseline default: *Block* [Learn more](/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction?WT.mc_id=Portal-fx) @@ -1377,10 +1327,12 @@ The settings in this baseline apply to Windows devices managed through Intune. W - **Device Password Enabled** Baseline default: *Enabled* [Learn more](/windows/client-management/mdm/policy-csp-devicelock?WT.mc_id=Portal-fx#devicepasswordenabled) + - **Device Password History** Baseline default: *Configured* Value: *24* [Learn more](/windows/client-management/mdm/policy-csp-devicelock?WT.mc_id=Portal-fx#devicepasswordhistory) + - **Min Device Password Length** Baseline default: *Configured* Value: *14* @@ -1397,9 +1349,11 @@ The settings in this baseline apply to Windows devices managed through Intune. W - **Allow Windows Spotlight (User)** Baseline default: *Allow* [Learn more](/windows/client-management/mdm/policy-csp-Experience?WT.mc_id=Portal-fx#allowwindowsspotlight) + - **Allow Windows Consumer Features** Baseline default: *Allow* [Learn more](/windows/client-management/mdm/policy-csp-experience?WT.mc_id=Portal-fx#allowwindowsconsumerfeatures) + - **Allow Third Party Suggestions In Windows Spotlight (User)** Baseline default: *Block* [Learn more](/windows/client-management/mdm/policy-csp-Experience?WT.mc_id=Portal-fx#allowthirdpartysuggestionsinwindowsspotlight) @@ -1409,74 +1363,94 @@ The settings in this baseline apply to Windows devices managed through Intune. W - **Enable Domain Network Firewall** Baseline default: *True* [Learn more](/windows/client-management/mdm/firewall-csp?WT.mc_id=Portal-fx#mdmstoredomainprofileenablefirewall) - - **Enable Log Success Connections** - Baseline default: *Enable Logging Of Successful Connections* - [Learn more](/windows/client-management/mdm/Firewall-csp/?WT.mc_id=Portal-fx#mdmstoredomainprofileenablelogsuccessconnections) - - **Default Outbound Action** - Baseline default: *Allow* - [Learn more](/windows/client-management/mdm/firewall-csp?WT.mc_id=Portal-fx#mdmstoredomainprofiledefaultoutboundaction) + - **Enable Log Dropped Packets** Baseline default: *Enable Logging Of Dropped Packets* [Learn more](/windows/client-management/mdm/Firewall-csp/?WT.mc_id=Portal-fx#mdmstoredomainprofileenablelogdroppedpackets) + + - **Default Outbound Action** + Baseline default: *Allow* + [Learn more](/windows/client-management/mdm/firewall-csp?WT.mc_id=Portal-fx#mdmstoredomainprofiledefaultoutboundaction) + - **Disable Inbound Notifications** Baseline default: *True* [Learn more](/windows/client-management/mdm/firewall-csp?WT.mc_id=Portal-fx#mdmstoredomainprofiledisableinboundnotifications) + - **Log Max File Size** Baseline default: *Configured* Value: *16384* [Learn more](/windows/client-management/mdm/Firewall-csp/?WT.mc_id=Portal-fx#mdmstoredomainprofilelogmaxfilesize) + - **Default Inbound Action for Domain Profile** Baseline default: *Block* [Learn more](/windows/client-management/mdm/firewall-csp?WT.mc_id=Portal-fx#mdmstoredomainprofiledefaultinboundaction) + - **Enable Log Success Connections** + Baseline default: *Enable Logging Of Successful Connections* + [Learn more](/windows/client-management/mdm/Firewall-csp/?WT.mc_id=Portal-fx#mdmstoredomainprofileenablelogsuccessconnections) + - **Enable Private Network Firewall** Baseline default: *True* [Learn more](/windows/client-management/mdm/firewall-csp?WT.mc_id=Portal-fx#mdmstoreprivateprofileenablefirewall) + - **Log Max File Size** Baseline default: *Configured* Value: *16384* [Learn more](/windows/client-management/mdm/firewall-csp?WT.mc_id=Portal-fx#mdmstoreprivateprofilelogmaxfilesize) + - **Default Inbound Action for Private Profile** Baseline default: *Block* [Learn more](/windows/client-management/mdm/firewall-csp?WT.mc_id=Portal-fx#mdmstoreprivateprofiledefaultinboundaction) + - **Enable Log Success Connections** Baseline default: *Enable Logging Of Successful Connections* [Learn more](/windows/client-management/mdm/firewall-csp?WT.mc_id=Portal-fx#mdmstoreprivateprofileenablelogsuccessconnections) + - **Enable Log Dropped Packets** Baseline default: *Enable Logging Of Dropped Packets* [Learn more](/windows/client-management/mdm/firewall-csp?WT.mc_id=Portal-fx#mdmstoreprivateprofileenablelogdroppedpackets) - - **Default Outbound Action** - Baseline default: *Allow* - [Learn more](/windows/client-management/mdm/firewall-csp?WT.mc_id=Portal-fx#mdmstoreprivateprofiledefaultoutboundaction) + - **Disable Inbound Notifications** Baseline default: *True* [Learn more](/windows/client-management/mdm/firewall-csp?WT.mc_id=Portal-fx#mdmstoreprivateprofiledisableinboundnotifications) + - **Default Outbound Action** + Baseline default: *Allow* + [Learn more](/windows/client-management/mdm/firewall-csp?WT.mc_id=Portal-fx#mdmstoreprivateprofiledefaultoutboundaction) + - **Enable Public Network Firewall** Baseline default: *True* [Learn more](/windows/client-management/mdm/firewall-csp?WT.mc_id=Portal-fx#mdmstorepublicprofileenablefirewall) + - **Enable Log Dropped Packets** Baseline default: *Enable Logging Of Dropped Packets* [Learn more](/windows/client-management/mdm/firewall-csp?WT.mc_id=Portal-fx#mdmstorepublicprofileenablelogdroppedpackets) + - **Log Max File Size** Baseline default: *Configured* Value: *16384* [Learn more](/windows/client-management/mdm/firewall-csp?WT.mc_id=Portal-fx#mdmstorepublicprofilelogmaxfilesize) + - **Default Outbound Action** Baseline default: *Allow* [Learn more](/windows/client-management/mdm/firewall-csp?WT.mc_id=Portal-fx#mdmstorepublicprofiledefaultoutboundaction) + - **Disable Inbound Notifications** Baseline default: *True* [Learn more](/windows/client-management/mdm/firewall-csp?WT.mc_id=Portal-fx#mdmstorepublicprofiledisableinboundnotifications) - - **Default Inbound Action for Public Profile** - Baseline default: *Block* - [Learn more](/windows/client-management/mdm/firewall-csp?WT.mc_id=Portal-fx#mdmstorepublicprofiledefaultinboundaction) + - **Allow Local Policy Merge** Baseline default: *False* [Learn more](/windows/client-management/mdm/firewall-csp?WT.mc_id=Portal-fx#mdmstorepublicprofileallowlocalpolicymerge) + + - **Default Inbound Action for Public Profile** + Baseline default: *Block* + [Learn more](/windows/client-management/mdm/firewall-csp?WT.mc_id=Portal-fx#mdmstorepublicprofiledefaultinboundaction) + - **Enable Log Success Connections** Baseline default: *Enable Logging Of Successful Connections* [Learn more](/windows/client-management/mdm/firewall-csp?WT.mc_id=Portal-fx#mdmstorepublicprofileenablelogsuccessconnections) + - **Allow Local Ipsec Policy Merge** Baseline default: *False* [Learn more](/windows/client-management/mdm/firewall-csp?WT.mc_id=Portal-fx#mdmstorepublicprofileallowlocalipsecpolicymerge) @@ -1487,94 +1461,6 @@ The settings in this baseline apply to Windows devices managed through Intune. W Baseline default: *Disabled* [Learn more](/windows/client-management/mdm/policy-csp-LanmanWorkstation?WT.mc_id=Portal-fx#enableinsecureguestlogons) -## Local Policies Security Options - -- **Accounts Limit Local Account Use Of Blank Passwords To Console Logon Only** - Baseline default: *Enabled* - [Learn more](/windows/client-management/mdm/policy-csp-LocalPoliciesSecurityOptions?WT.mc_id=Portal-fx#accounts_limitlocalaccountuseofblankpasswordstoconsolelogononly) - -- **Interactive Logon Machine Inactivity Limit** - Baseline default: *Configured* - Value: *900* - [Learn more](/windows/client-management/mdm/policy-csp-LocalPoliciesSecurityOptions?WT.mc_id=Portal-fx#interactivelogon_machineinactivitylimit) - -- **Interactive Logon Smart Card Removal Behavior** - Baseline default: *Lock Workstation* - [Learn more](/windows/client-management/mdm/policy-csp-LocalPoliciesSecurityOptions?WT.mc_id=Portal-fx#interactivelogon_smartcardremovalbehavior) - -- **Microsoft Network Client Digitally Sign Communications Always** - Baseline default: *Enable* - [Learn more](/windows/client-management/mdm/policy-csp-LocalPoliciesSecurityOptions?WT.mc_id=Portal-fx#microsoftnetworkclient_digitallysigncommunicationsalways) - -- **Microsoft Network Client Send Unencrypted Password To Third Party SMB Servers** - Baseline default: *Disable* - [Learn more](/windows/client-management/mdm/policy-csp-LocalPoliciesSecurityOptions?WT.mc_id=Portal-fx#microsoftnetworkclient_sendunencryptedpasswordtothirdpartysmbservers) - -- **Microsoft Network Server Digitally Sign Communications Always** - Baseline default: *Enable* - [Learn more](/windows/client-management/mdm/policy-csp-LocalPoliciesSecurityOptions?WT.mc_id=Portal-fx#microsoftnetworkserver_digitallysigncommunicationsalways) - -- **Network Access Do Not Allow Anonymous Enumeration Of SAM Accounts** - Baseline default: *Enabled* - [Learn more](/windows/client-management/mdm/policy-csp-LocalPoliciesSecurityOptions?WT.mc_id=Portal-fx#networkaccess_donotallowanonymousenumerationofsamaccounts) - -- **Network Access Do Not Allow Anonymous Enumeration Of Sam Accounts And Shares** - Baseline default: *Enabled* - [Learn more](/windows/client-management/mdm/policy-csp-LocalPoliciesSecurityOptions?WT.mc_id=Portal-fx#networkaccess_donotallowanonymousenumerationofsamaccountsandshares) - -- **Network Access Restrict Anonymous Access To Named Pipes And Shares** - Baseline default *Enable* - [Learn more](/windows/client-management/mdm/policy-csp-LocalPoliciesSecurityOptions?WT.mc_id=Portal-fx#networkaccess-restrictanonymousaccesstonamedpipesandshares) - -- **Network Access Restrict Clients Allowed To Make Remote Calls To SAM** - Baseline default: *Configured* - Value: *O:BAG:BAD:(A;;RC;;;BA)* - [Learn more](/windows/client-management/mdm/policy-csp-LocalPoliciesSecurityOptions?WT.mc_id=Portal-fx#networkaccess_restrictclientsallowedtomakeremotecallstosam) - -- **Network Security Do Not Store LAN Manager Hash Value On Next Password Change** - Baseline default: *Enable* - [Learn more](/windows/client-management/mdm/policy-csp-LocalPoliciesSecurityOptions?WT.mc_id=Portal-fx#networksecurity_donotstorelanmanagerhashvalueonnextpasswordchange) - -- **Network Security LAN Manager Authentication Level** - Baseline default: *Send LM and NTLMv2 responses only. Refuse LM and NTLM* - [Learn more](/windows/client-management/mdm/policy-csp-LocalPoliciesSecurityOptions?WT.mc_id=Portal-fx#networksecurity_lanmanagerauthenticationlevel) - -- **Network Security Minimum Session Security For NTLMSSP Based Clients** - Baseline default: *Require NTLM and 128-bit encryption* - [Learn more](/windows/client-management/mdm/policy-csp-LocalPoliciesSecurityOptions?WT.mc_id=Portal-fx#networksecurity_minimumsessionsecurityforntlmsspbasedclients) - -- **Network Security Minimum Session Security For NTLMSSP Based Servers** - Baseline default: *Require NTLM and 128-bit encryption* - [Learn more](/windows/client-management/mdm/policy-csp-LocalPoliciesSecurityOptions?WT.mc_id=Portal-fx#networksecurity_minimumsessionsecurityforntlmsspbasedservers) - -- **User Account Control Behavior Of The Elevation Prompt For Administrators** - Baseline default: *Prompt for consent on the secure desktop* - [Learn more](/windows/client-management/mdm/policy-csp-LocalPoliciesSecurityOptions?WT.mc_id=Portal-fx#useraccountcontrol_behavioroftheelevationpromptforadministrators) - -- **User Account Control Behavior Of The Elevation Prompt For Standard Users** - Baseline default: *Automatically deny elevation requests* - [Learn more](/windows/client-management/mdm/policy-csp-LocalPoliciesSecurityOptions?WT.mc_id=Portal-fx#useraccountcontrol_behavioroftheelevationpromptforstandardusers) - -- **User Account Control Detect Application Installations And Prompt For Elevation** - Baseline default: *Enable* - [Learn more](/windows/client-management/mdm/policy-csp-LocalPoliciesSecurityOptions?WT.mc_id=Portal-fx#useraccountcontrol-detectapplicationinstallationsandpromptforelevation) - -- **User Account Control Only Elevate UI Access Applications That Are Installed In Secure Locations** - Baseline default: *Enabled: Application runs with UIAccess integrity only if it resides in secure location.* - [Learn more](/windows/client-management/mdm/policy-csp-LocalPoliciesSecurityOptions?WT.mc_id=Portal-fx#useraccountcontrol-onlyelevateuiaccessapplicationsthatareinstalledinsecurelocations) - -- **User Account Control Run All Administrators In Admin Approval Mode** - Baseline default: *Enabled* - [Learn more](/windows/client-management/mdm/policy-csp-LocalPoliciesSecurityOptions?WT.mc_id=Portal-fx#useraccountcontrol_runalladministratorsinadminapprovalmode) - -- **User Account Control Use Admin Approval Mode** - Baseline default: *Enable* - [Learn more](/windows/client-management/mdm/policy-csp-LocalPoliciesSecurityOptions?WT.mc_id=Portal-fx#useraccountcontrol_useadminapprovalmode) - -- **User Account Control Virtualize File And Registry Write Failures To Per User Locations** - Baseline default: *Enabled* - [Learn more](/windows/client-management/mdm/policy-csp-LocalPoliciesSecurityOptions?WT.mc_id=Portal-fx#useraccountcontrol_virtualizefileandregistrywritefailurestoperuserlocations) - ## Local Security Authority - **Configure Lsa Protected Process** @@ -1607,11 +1493,13 @@ The settings in this baseline apply to Windows devices managed through Intune. W - **Minimum TLS version enabled** Baseline default: *Enabled* + - **Minimum TLS version enabled (Device)** Baseline default: *TlS 1.2* - **Minimum TLS version enabled (User)** Baseline default: *Enabled* + - **Minimum TLS version enabled (User)** Baseline default: *TLS 1.2* @@ -1659,30 +1547,6 @@ The settings in this baseline apply to Windows devices managed through Intune. W - **Service Enabled** Baseline default: *Enabled* -## System Services - -- **Configure Xbox Accessory Management Service Startup Mode** - Baseline default: *Disabled* - [Learn more](/windows/client-management/mdm/policy-csp-SystemServices?WT.mc_id=Portal-fx#configurexboxaccessorymanagementservicestartupmode) - -- **Configure Xbox Live Auth Manager Service Startup Mode** - Baseline default: *Disabled* - [Learn more](/windows/client-management/mdm/policy-csp-SystemServices?WT.mc_id=Portal-fx#configurexboxliveauthmanagerservicestartupmode) - -- **Configure Xbox Live Game Save Service Startup Mode** - Baseline default: *Disabled* - [Learn more](/windows/client-management/mdm/policy-csp-SystemServices?WT.mc_id=Portal-fx#configurexboxlivegamesaveservicestartupmode) - -- **Configure Xbox Live Networking Service Startup Mode** - Baseline default: *Disabled* - [Learn more](/windows/client-management/mdm/policy-csp-SystemServices?WT.mc_id=Portal-fx#configurexboxlivenetworkingservicestartupmode) - -## Task Scheduler - -- **Enable Xbox Game Save Task** - Baseline default: *Disabled* - [Learn more](/windows/client-management/mdm/policy-csp-TaskScheduler?WT.mc_id=Portal-fx#enablexboxgamesavetask) - ## User Rights - **Access From Network** @@ -1801,22 +1665,99 @@ The settings in this baseline apply to Windows devices managed through Intune. W Baseline default: *(Enabled with UEFI lock) Turns on Hypervisor-Protected Code Integrity with UEFI lock.* [Learn more](/windows/client-management/mdm/policy-csp-VirtualizationBasedTechnology?WT.mc_id=Portal-fx#hypervisorenforcedcodeintegrity) -## Wi-Fi Settings - -- **Allow Auto Connect To Wi Fi Sense Hotspots** - Baseline default: *Block* - [Learn more](/windows/client-management/mdm/policy-csp-wifi?WT.mc_id=Portal-fx#allowautoconnecttowifisensehotspots) - -- **Allow Internet Sharing** - Baseline default: *Block* - [Learn more](/windows/client-management/mdm/policy-csp-wifi?WT.mc_id=Portal-fx#allowinternetsharing) - ## Windows Ink Workspace - **Allow Windows Ink Workspace** Baseline default: *Ink workspace is enabled (feature is turned on), but the user cannot access it above the lock screen.* [Learn more](/windows/client-management/mdm/policy-csp-WindowsInkWorkspace?WT.mc_id=Portal-fx#allowwindowsinkworkspace) +## Local Policies Security Options + +- **Accounts Limit Local Account Use Of Blank Passwords To Console Logon Only** + Baseline default: *Enabled* + [Learn more](/windows/client-management/mdm/policy-csp-LocalPoliciesSecurityOptions?WT.mc_id=Portal-fx#accounts_limitlocalaccountuseofblankpasswordstoconsolelogononly) + +- **Interactive Logon Machine Inactivity Limit** + Baseline default: *Configured* + Value: *900* + [Learn more](/windows/client-management/mdm/policy-csp-LocalPoliciesSecurityOptions?WT.mc_id=Portal-fx#interactivelogon_machineinactivitylimit) + +- **Interactive Logon Smart Card Removal Behavior** + Baseline default: *Lock Workstation* + [Learn more](/windows/client-management/mdm/policy-csp-LocalPoliciesSecurityOptions?WT.mc_id=Portal-fx#interactivelogon_smartcardremovalbehavior) + +- **Microsoft Network Client Digitally Sign Communications Always** + Baseline default: *Enable* + [Learn more](/windows/client-management/mdm/policy-csp-LocalPoliciesSecurityOptions?WT.mc_id=Portal-fx#microsoftnetworkclient_digitallysigncommunicationsalways) + +- **Microsoft Network Client Send Unencrypted Password To Third Party SMB Servers** + Baseline default: *Disable* + [Learn more](/windows/client-management/mdm/policy-csp-LocalPoliciesSecurityOptions?WT.mc_id=Portal-fx#microsoftnetworkclient_sendunencryptedpasswordtothirdpartysmbservers) + +- **Microsoft Network Server Digitally Sign Communications Always** + Baseline default: *Enable* + [Learn more](/windows/client-management/mdm/policy-csp-LocalPoliciesSecurityOptions?WT.mc_id=Portal-fx#microsoftnetworkserver_digitallysigncommunicationsalways) + +- **Network Access Do Not Allow Anonymous Enumeration Of SAM Accounts** + Baseline default: *Enabled* + [Learn more](/windows/client-management/mdm/policy-csp-LocalPoliciesSecurityOptions?WT.mc_id=Portal-fx#networkaccess_donotallowanonymousenumerationofsamaccounts) + +- **Network Access Do Not Allow Anonymous Enumeration Of Sam Accounts And Shares** + Baseline default: *Enabled* + [Learn more](/windows/client-management/mdm/policy-csp-LocalPoliciesSecurityOptions?WT.mc_id=Portal-fx#networkaccess_donotallowanonymousenumerationofsamaccountsandshares) + +- **Network Access Restrict Anonymous Access To Named Pipes And Shares** + Baseline default *Enable* + [Learn more](/windows/client-management/mdm/policy-csp-LocalPoliciesSecurityOptions?WT.mc_id=Portal-fx#networkaccess-restrictanonymousaccesstonamedpipesandshares) + +- **Network Access Restrict Clients Allowed To Make Remote Calls To SAM** + Baseline default: *Configured* + Value: *O:BAG:BAD:(A;;RC;;;BA)* + [Learn more](/windows/client-management/mdm/policy-csp-LocalPoliciesSecurityOptions?WT.mc_id=Portal-fx#networkaccess_restrictclientsallowedtomakeremotecallstosam) + +- **Network Security Do Not Store LAN Manager Hash Value On Next Password Change** + Baseline default: *Enable* + [Learn more](/windows/client-management/mdm/policy-csp-LocalPoliciesSecurityOptions?WT.mc_id=Portal-fx#networksecurity_donotstorelanmanagerhashvalueonnextpasswordchange) + +- **Network Security LAN Manager Authentication Level** + Baseline default: *Send LM and NTLMv2 responses only. Refuse LM and NTLM* + [Learn more](/windows/client-management/mdm/policy-csp-LocalPoliciesSecurityOptions?WT.mc_id=Portal-fx#networksecurity_lanmanagerauthenticationlevel) + +- **Network Security Minimum Session Security For NTLMSSP Based Clients** + Baseline default: *Require NTLM and 128-bit encryption* + [Learn more](/windows/client-management/mdm/policy-csp-LocalPoliciesSecurityOptions?WT.mc_id=Portal-fx#networksecurity_minimumsessionsecurityforntlmsspbasedclients) + +- **Network Security Minimum Session Security For NTLMSSP Based Servers** + Baseline default: *Require NTLM and 128-bit encryption* + [Learn more](/windows/client-management/mdm/policy-csp-LocalPoliciesSecurityOptions?WT.mc_id=Portal-fx#networksecurity_minimumsessionsecurityforntlmsspbasedservers) + +- **User Account Control Behavior Of The Elevation Prompt For Administrators** + Baseline default: *Prompt for consent on the secure desktop* + [Learn more](/windows/client-management/mdm/policy-csp-LocalPoliciesSecurityOptions?WT.mc_id=Portal-fx#useraccountcontrol_behavioroftheelevationpromptforadministrators) + +- **User Account Control Behavior Of The Elevation Prompt For Standard Users** + Baseline default: *Automatically deny elevation requests* + [Learn more](/windows/client-management/mdm/policy-csp-LocalPoliciesSecurityOptions?WT.mc_id=Portal-fx#useraccountcontrol_behavioroftheelevationpromptforstandardusers) + +- **User Account Control Detect Application Installations And Prompt For Elevation** + Baseline default: *Enable* + [Learn more](/windows/client-management/mdm/policy-csp-LocalPoliciesSecurityOptions?WT.mc_id=Portal-fx#useraccountcontrol-detectapplicationinstallationsandpromptforelevation) + +- **User Account Control Only Elevate UI Access Applications That Are Installed In Secure Locations** + Baseline default: *Enabled: Application runs with UIAccess integrity only if it resides in secure location.* + [Learn more](/windows/client-management/mdm/policy-csp-LocalPoliciesSecurityOptions?WT.mc_id=Portal-fx#useraccountcontrol-onlyelevateuiaccessapplicationsthatareinstalledinsecurelocations) + +- **User Account Control Run All Administrators In Admin Approval Mode** + Baseline default: *Enabled* + [Learn more](/windows/client-management/mdm/policy-csp-LocalPoliciesSecurityOptions?WT.mc_id=Portal-fx#useraccountcontrol_runalladministratorsinadminapprovalmode) + +- **User Account Control Use Admin Approval Mode** + Baseline default: *Enable* + [Learn more](/windows/client-management/mdm/policy-csp-LocalPoliciesSecurityOptions?WT.mc_id=Portal-fx#useraccountcontrol_useadminapprovalmode) + +- **User Account Control Virtualize File And Registry Write Failures To Per User Locations** + Baseline default: *Enabled* + [Learn more](/windows/client-management/mdm/policy-csp-LocalPoliciesSecurityOptions?WT.mc_id=Portal-fx#useraccountcontrol_virtualizefileandregistrywritefailurestoperuserlocations) ::: zone-end ::: zone pivot="win365-nov21" @@ -2791,6 +2732,11 @@ View the full list of [Internet Explorer CSPs](/windows/client-management/mdm/po ## Microsoft Defender Antivirus Exclusions +> [!WARNING] +> **Defining exclusions lowers the protection offered by Microsoft Defender Antivirus**. Always evaluate the risks that are associated with implementing exclusions. Only exclude files you know aren't malicious. +> +> For more information, see [Exclusions overview](/defender-endpoint/navigate-defender-endpoint-antivirus-exclusions) in the Microsoft Defender documentation. + - **Defender Processes to exclude** Baseline defaults: *Not configured by default. Manually add one or more entries.* diff --git a/memdocs/intune/protect/security-baseline-v2-edge-settings.md b/memdocs/intune/protect/security-baseline-v2-edge-settings.md index 5743ec5c363..f61d7cb1fd1 100644 --- a/memdocs/intune/protect/security-baseline-v2-edge-settings.md +++ b/memdocs/intune/protect/security-baseline-v2-edge-settings.md @@ -7,7 +7,7 @@ description: View a list of the settings in the Microsoft Intune security baseli author: brenduns ms.author: brenduns manager: dougeby -ms.date: 12/11/2023 +ms.date: 09/17/2024 ms.topic: reference ms.service: microsoft-intune ms.subservice: protect @@ -48,7 +48,7 @@ zone_pivot_groups: dcv2-edge-baselines This article is a reference for the settings that are available in the Microsoft Edge security baseline for Microsoft Intune and applies to versions of that baseline that released in May 2023 or later. -If you use a security baseline for Edge version 85 or earlier, see [List of the settings in the Microsoft Edge security baseline in Intune](../protect/security-baseline-settings-edge.md). +If you use a security baseline for Microsoft Edge version 85 or earlier, see [List of the settings in the Microsoft Edge security baseline in Intune](../protect/security-baseline-settings-edge.md). > [!NOTE] > Beginning in May 2023, all new security baseline versions use a new settings format that replaces previous versions. While the last version instance for a baseline that uses the older setting format remains available to use, the older format will no longer receive updates for new settings, or updated default configurations. diff --git a/memdocs/intune/protect/security-baseline-v2-office-settings.md b/memdocs/intune/protect/security-baseline-v2-office-settings.md index 87fe27268ab..2417c6ae4e1 100644 --- a/memdocs/intune/protect/security-baseline-v2-office-settings.md +++ b/memdocs/intune/protect/security-baseline-v2-office-settings.md @@ -7,7 +7,7 @@ description: View a list of the settings in the Microsoft Intune security baseli author: brenduns ms.author: brenduns manager: dougeby -ms.date: 11/10/2023 +ms.date: 09/13/2024 ms.topic: reference ms.service: microsoft-intune ms.subservice: protect @@ -46,7 +46,7 @@ Pivot yml: title: May 2023 --> -# Microsoft 365 Apps for Enterprise security baseline settings reference for Microsoft Intune +# Microsoft 365 Apps for Enterprise security baseline settings reference for Microsoft Intune This article is a reference for the settings that are available in the Microsoft 365 Apps for Enterprise security baseline for Microsoft Intune. @@ -72,41 +72,94 @@ To learn more about using security baselines, see: ::: zone pivot="office-may-2023" -**Microsoft 365 Apps for Enterprise security baseline for May 2023** +**Microsoft 365 Apps for Enterprise security baseline for May 2023** + +This baseline version was first made available in May of 2023. It was replaced by the Baseline *Version 2306* For more information about the following settings that are included in this baseline, download the [Microsoft Security Compliance Toolkit 1.0](https://www.microsoft.com/download/details.aspx?id=55319) from the Microsoft Download Center, and review the *Microsoft 365 Apps for Enterprise-2206-FINAL.zip* file. ::: zone-end ::: zone pivot="v2306" -**Microsoft 365 Apps for Enterprise for security baseline version 2306** +**Microsoft 365 Apps for Enterprise for security baseline version 2306** + +This baseline version was first made available in November 2023, and replaces the *May 2023* version. For more information about the following settings that are included in this baseline, download the [Security Compliance Toolkit and Baselines](https://www.microsoft.com/download/details.aspx?id=55319) from the Microsoft Download Center, and then review the *Microsoft 365 Apps for Enterprise 2306.zip* file. ::: zone-end +::: zone pivot="office-may-2023,v2306" -## Microsoft 365 Apps for Enterprise +## Administrative Templates + +*MS Security Guide* + +- **Block Flash activation in Office documents** + Baseline default: *Enabled* + - **Block Flash player in Office (Device)** + Baseline default: Block all activation* + +- **Restrict legacy JScript execution for Office** + Baseline default: *Enabled* + + - **Excel: (Device)** + Baseline default: *69632* + + - **PowerPoint: (Device)** + Baseline default: *69632* + + - **OneNote: (Device)** + Baseline default: *69632* + + - **Publisher: (Device)** + Baseline default: *69632* + + - **Access: (Device)** + Baseline default: *69632* + + - **Project: (Device)** + Baseline default: *69632* + + - **Visio: (Device)** + Baseline default: *69632* + + - **Outlook: (Device)** + Baseline default: *69632* + + + - **Word: (Device)** + Baseline default: *69632* -::: zone pivot="office-may-2023,v2306" -### Microsoft Access 2016 + +## Microsoft Access 2016 *Application Settings > Security > Trust Center* - **Block macros from running in Office files from the Internet (User)** - Baseline default: *Enabled* + Baseline default: *Enabled* + +- **Disable Trust Bar Notification for unsigned application add-ins and block them (User)** + Baseline default: *Enabled* + +::: zone-end +::: zone pivot="v2306" + + +- **Require that application add-ins are signed by Trusted Publisher (User)** + Baseline default: *Enabled* + +::: zone-end +::: zone pivot="office-may-2023,v2306" - **VBA Macro Notification Settings (User)** Baseline default: *Enabled* - Baseline default: *Disable all with notification* -- **Disable Trust Bar Notification for unsigned application add-ins and block them (User)** - Baseline default: *Enabled* - *Application Settings > Security > Trust Center > Trusted Locations* - **Allow Trusted Locations on the network (User)** - Baseline default: *Disabled* + Baseline default: *Disabled* ### Microsoft Excel 2016 @@ -152,31 +205,40 @@ For more information about the following settings that are included in this base *Excel Options > Security > Trust Center* +::: zone-end +::: zone pivot="v2306" + + +- **Block Excel XLL Add-ins that come from an untrusted source (User)** + Baseline default: *Enabled* + - Baseline default: *Block* + +::: zone-end +::: zone pivot="office-may-2023,v2306" + - **Block macros from running in Office files from the Internet (User)** Baseline default: *Enabled* -- **Prevent Excel from running XLM macros (User)** +::: zone-end +::: zone pivot="v2306" +- **Disable Trust Bar Notification for unsigned application add-ins and block them (User) (Deprecated)** Baseline default: *Enabled* -- **Require that application add-ins are signed by Trusted Publisher (User)** +::: zone-end +::: zone pivot="office-may-2023,v2306" + +- **Prevent Excel from running XLM macros (User)** Baseline default: *Enabled* -- **Disable Trust Bar Notification for unsigned application add-ins and block them (User)** +- **Require that application add-ins are signed by Trusted Publisher (User)** + Baseline default: *Enabled* + - **Disable Trust Bar Notification for unsigned application add-ins and block them (User)** Baseline default: *Enabled* - **VBA Macro Notification Settings (User)** Baseline default: *Enabled* - Baseline default: *Disable all except digitally signed macros* -::: zone-end -::: zone pivot="v2306" - -- **Block Excel XLL Add-ins that come from an untrusted source** - Baseline default: *Block* - -::: zone-end -::: zone pivot="office-may-2023,v2306" - *Excel Options > Security > Trust Center > External Content* - **Always prevent untrusted Microsoft Query files from opening (User)** @@ -184,6 +246,7 @@ For more information about the following settings that are included in this base ::: zone-end ::: zone pivot="office-may-2023" + - **Don’t allow Dynamic Data Exchange (DDE) server launch in Excel (User)** Baseline default: *Enabled* @@ -277,8 +340,7 @@ For more information about the following settings that are included in this base Baseline default: *Disabled* - **Set document behavior if file validation fails (User)** - Baseline default: *Enabled* - + Baseline default: *Enabled* - **Checked: Allow edit. Unchecked: Do not allow edit. (User)** Baseline default: *False* - Baseline default: *Open in Protected View* @@ -289,22 +351,17 @@ For more information about the following settings that are included in this base *Excel Options > Security > Trust Center > Trusted Locations* - **Allow Trusted Locations on the network (User)** - Baseline default: *Disabled*+ + Baseline default: *Disabled* -::: zone-end -::: zone pivot="office-may-2023" -### Microsoft Lync Feature Policies +## Microsoft Lync Feature Policies -- **Configure SIP security mode** +- **Configure SIP security mode** Baseline default: *Enabled* -- **Disable HTTP fallback for SIP connection** +- **Disable HTTP fallback for SIP connection** Baseline default: *Enabled* -::: zone-end -::: zone pivot="office-may-2023,v2306" - -### Microsoft Office 2016 +## Microsoft Office 2016 *Customize* @@ -317,12 +374,6 @@ For more information about the following settings that are included in this base - **Disallow in Publisher (User)** Baseline default: *True* - - **Disallow in Visio (User)** - Baseline default: *True* - - - **Disallow in InfoPath (User)** - Baseline default: *True* - - **Disallow in Outlook (User)** Baseline default: *True* @@ -332,24 +383,30 @@ For more information about the following settings that are included in this base - **Disallow in Access (User)** Baseline default: *True* + - **Disallow in InfoPath (User)** + Baseline default: *True* + - **Disallow in Word (User)** Baseline default: *True* - **Disallow in Excel (User)** Baseline default: *True* + - **Disallow in Visio (User)** + Baseline default: *True* + *Security Settings* - **ActiveX Control Initialization (User)** - Baseline default: *Enabled* - - - **ActiveX Control Initialization: (User)** + Baseline default: *Enabled* + -**ActiveX Control Initialization: (User)** Baseline default: *6* ::: zone-end ::: zone pivot="v2306" + -- **Allow Basic Authentication prompts from network proxies** +- **Allow Basic Authentication prompts from network proxies (User)** Baseline default: *Disabled* ::: zone-end @@ -378,10 +435,11 @@ For more information about the following settings that are included in this base ::: zone-end ::: zone pivot="v2306" + -- **Encryption mode for Information Rights Management (IRM)** +- **Encryption mode for Information Rights Management (IRM) (User)** Baseline default: *Enabled* - - **Encryption type: (User)** + - **IRM Encryption Mode: (User)** Baseline default: *Cipher Block Chaining (CBC)* ::: zone-end @@ -424,10 +482,7 @@ For more information about the following settings that are included in this base - **Disable Smart Document's use of manifests (User)** Baseline default: *Enabled* -::: zone-end -::: zone pivot="office-may-2023" - -### Microsoft Office 2016 (Machine) +## Microsoft Office 2016 (Machine) *Security Settings > IE Security* @@ -446,9 +501,15 @@ For more information about the following settings that are included in this base - **powerpnt.exe (Device)** Baseline default: *True* + - **excel.exe (Device)** + Baseline default: *True* + - **visio.exe (Device)** Baseline default: *True* + - **onent.exe (Device)** + Baseline default: *True* + - **outlook.exe (Device)** Baseline default: *True* @@ -458,21 +519,15 @@ For more information about the following settings that are included in this base - **winword.exe (Device)** Baseline default: *True* - - **excel.exe (Device)** + - **exprwd.exe (Device)** Baseline default: *True* - - **onent.exe (Device)** + - **spDesign.exe (Device)** Baseline default: *True* - **winproj.exe (Device)** Baseline default: *True* - - **exprwd.exe (Device)** - Baseline default: *True* - - - **spDesign.exe (Device)** - Baseline default: *True* - - **groove.exe (Device)** Baseline default: *True* @@ -488,34 +543,34 @@ For more information about the following settings that are included in this base - **spDesign.exe (Device)** Baseline default: *True* + - **onent.exe (Device)** + Baseline default: *True* + - **outlook.exe (Device)** Baseline default: *True* - - **mspub.exe (Device)** + - **pptview.exe (Device)** Baseline default: *True* - - **visio.exe (Device)** + - **mspub.exe (Device)** Baseline default: *True* - - **onent.exe (Device)** - Baseline default: *True* - - - **pptview.exe (Device)** + - **visio.exe (Device)** Baseline default: *True* - **winproj.exe (Device)** Baseline default: *True* - - **powerpnt.exe (Device)** + - **msaccess.exe (Device)** Baseline default: *True* - - **mse7.exe (Device)** + - **powerpnt.exe (Device)** Baseline default: *True* - - - **msaccess.exe (Device)** + + - **groove.exe (Device)** Baseline default: *True* - - **groove.exe (Device)** + - **mse7.exe (Device)** Baseline default: *True* - **winword.exe (Device)** @@ -524,9 +579,9 @@ For more information about the following settings that are included in this base - **Disable user name and password** Baseline default: *Enabled* - - **pptview.exe (Device)** + - **excel.exe (Device)** Baseline default: *True* - + - **groove.exe (Device)** Baseline default: *True* @@ -536,7 +591,7 @@ For more information about the following settings that are included in this base - **mse7.exe (Device)** Baseline default: *True* - - **excel.exe (Device)** + - **mspub.exe (Device)** Baseline default: *True* - **visio.exe (Device)** @@ -545,16 +600,13 @@ For more information about the following settings that are included in this base - **exprwd.exe (Device)** Baseline default: *True* - - **spDesign.exe (Device)** - Baseline default: *True* - - - **winword.exe (Device)** + - **msaccess.exe (Device)** Baseline default: *True* - - **mspub.exe (Device)** + - **spDesign.exe (Device)** Baseline default: *True* - - **msaccess.exe (Device)** + - **winword.exe (Device)** Baseline default: *True* - **powerpnt.exe (Device)** @@ -566,6 +618,9 @@ For more information about the following settings that are included in this base - **winproj.exe (Device)** Baseline default: *True* + - **pptview.exe (Device)** + Baseline default: *True* + - **Information Bar** Baseline default: *Enabled* @@ -581,25 +636,19 @@ For more information about the following settings that are included in this base - **msaccess.exe (Device)** Baseline default: *True* - - **outlook.exe (Device)** - Baseline default: *True* - - - **winproj.exe (Device)** + - **onent.exe (Device)** Baseline default: *True* - - **spDesign.exe (Device)** + - **outlook.exe (Device)** Baseline default: *True* - - **onent.exe (Device)** + - **winproj.exe (Device)** Baseline default: *True* - **powerpnt.exe (Device)** Baseline default: *True* - - **winword.exe (Device)** - Baseline default: *True* - - - **exprwd.exe (Device)** + - **spDesign.exe (Device)** Baseline default: *True* - **groove.exe (Device)** @@ -611,8 +660,14 @@ For more information about the following settings that are included in this base - **mse7.exe (Device)** Baseline default: *True* + - **winword.exe (Device)** + Baseline default: *True* + + - **exprwd.exe (Device)** + Baseline default: *True* + - **Local Machine Zone Lockdown Security** - Baseline default: *Enabled* + Baseline default: *Enabled* - **mse7.exe (Device)** Baseline default: *True* @@ -638,9 +693,6 @@ For more information about the following settings that are included in this base - **groove.exe (Device)** Baseline default: *True* - - **visio.exe (Device)** - Baseline default: *True* - - **winword.exe (Device)** Baseline default: *True* @@ -650,6 +702,9 @@ For more information about the following settings that are included in this base - **spDesign.exe (Device)** Baseline default: *True* + - **visio.exe (Device)** + Baseline default: *True* + - **onent.exe (Device)** Baseline default: *True* @@ -683,9 +738,6 @@ For more information about the following settings that are included in this base - **outlook.exe (Device)** Baseline default: *True* - - **pptview.exe (Device)** - Baseline default: *True* - - **mspub.exe (Device)** Baseline default: *True* @@ -695,25 +747,22 @@ For more information about the following settings that are included in this base - **msaccess.exe (Device)** Baseline default: *True* - - **spDesign.exe (Device)** + - **pptview.exe (Device)** Baseline default: *True* - **winproj.exe (Device)** Baseline default: *True* -- **Navigate URL** - Baseline default: *Enabled* - - - **powerpnt.exe (Device)** + - **spDesign.exe (Device)** Baseline default: *True* - - **visio.exe (Device)** - Baseline default: *True* +- **Navigate URL** + Baseline default: *Enabled* - - **mse7.exe (Device)** + - **groove.exe (Device)** Baseline default: *True* - - **groove.exe (Device)** + - **spDesign.exe (Device)** Baseline default: *True* - **onent.exe (Device)** @@ -722,58 +771,55 @@ For more information about the following settings that are included in this base - **pptview.exe (Device)** Baseline default: *True* - - **spDesign.exe (Device)** - Baseline default: *True* - - **outlook.exe (Device)** Baseline default: *True* - **winproj.exe (Device)** Baseline default: *True* - - **excel.exe (Device)** - Baseline default: *True* - - - **exprwd.exe (Device)** - Baseline default: *True* - - **msaccess.exe (Device)** Baseline default: *True* - **winword.exe (Device)** Baseline default: *True* - - **mspub.exe (Device)** + - **excel.exe (Device)** Baseline default: *True* -- **Object Caching Protection** - Baseline default: *Enabled* + - **mspub.exe (Device)** + Baseline default: *True* - - **excel.exe (Device)** + - **exprwd.exe (Device)** Baseline default: *True* - - **pptview.exe (Device)** + - **powerpnt.exe (Device)** Baseline default: *True* - - **winproj.exe (Device)** + - **visio.exe (Device)** Baseline default: *True* - - **exprwd.exe (Device)** + - **mse7.exe (Device)** Baseline default: *True* +- **Object Caching Protection** + Baseline default: *Enabled* + - **winword.exe (Device)** Baseline default: *True* - - **spDesign.exe (Device)** + - **powerpnt.exe (Device)** Baseline default: *True* + - **spDesign.exe (Device)** + Baseline default: *True* + - **mse7.exe (Device)** Baseline default: *True* - **mspub.exe (Device)** Baseline default: *True* - - **powerpnt.exe (Device)** + - **msaccess.exe (Device)** Baseline default: *True* - **onent.exe (Device)** @@ -782,30 +828,33 @@ For more information about the following settings that are included in this base - **outlook.exe (Device)** Baseline default: *True* - - **msaccess.exe (Device)** + - **groove.exe (Device)** Baseline default: *True* - - **visio.exe (Device)** + - **excel.exe (Device)** Baseline default: *True* - - **groove.exe (Device)** + - **visio.exe (Device)** Baseline default: *True* -- **Protection From Zone Elevation** - Baseline default: *Enabled* - - - **msaccess.exe (Device)** + - **pptview.exe (Device)** Baseline default: *True* - - **spDesign.exe (Device)** + - **winproj.exe (Device)** Baseline default: *True* - - **groove.exe (Device)** + - **exprwd.exe (Device)** Baseline default: *True* +- **Protection From Zone Elevation** + Baseline default: *Enabled* + - **winproj.exe (Device)** Baseline default: *True* + - **groove.exe (Device)** + Baseline default: *True* + - **outlook.exe (Device)** Baseline default: *True* @@ -827,13 +876,19 @@ For more information about the following settings that are included in this base - **winword.exe (Device)** Baseline default: *True* - - **onent.exe (Device)** + - **exprwd.exe (Device)** Baseline default: *True* - - **pptview.exe (Device)** + - **msaccess.exe (Device)** Baseline default: *True* - - **exprwd.exe (Device)** + - **spDesign.exe (Device)** + Baseline default: *True* + + - **onent.exe (Device)** + Baseline default: *True* + + - **pptview.exe (Device)** Baseline default: *True* - **Restrict ActiveX Install** @@ -851,9 +906,6 @@ For more information about the following settings that are included in this base - **onent.exe (Device)** Baseline default: *True* - - **pptview.exe (Device)** - Baseline default: *True* - - **excel.exe (Device)** Baseline default: *True* @@ -869,6 +921,9 @@ For more information about the following settings that are included in this base - **outlook.exe (Device)** Baseline default: *True* + - **pptview.exe (Device)** + Baseline default: *True* + - **winproj.exe (Device)** Baseline default: *True* @@ -929,31 +984,34 @@ For more information about the following settings that are included in this base - **Saved from URL** Baseline default: *Enabled* + - **mspub.exe (Device)** + Baseline default: *True* + - **visio.exe (Device)** Baseline default: *True* - - **mspub.exe (Device)** + - **winword.exe (Device)** Baseline default: *True* - - **outlook.exe (Device)** + - **msaccess.exe (Device)** Baseline default: *True* - - **winword.exe (Device)** + - **onent.exe (Device)** Baseline default: *True* - - **excel.exe (Device)** + - **outlook.exe (Device)** Baseline default: *True* - - **msaccess.exe (Device)** + - **groove.exe (Device)** Baseline default: *True* - - **powerpnt.exe (Device)** + - **excel.exe (Device)** Baseline default: *True* - - **onent.exe (Device)** + - **powerpnt.exe (Device)** Baseline default: *True* - - **groove.exe (Device)** + - **pptview.exe (Device)** Baseline default: *True* - **exprwd.exe (Device)** @@ -965,9 +1023,6 @@ For more information about the following settings that are included in this base - **spDesign.exe (Device)** Baseline default: *True* - - **pptview.exe (Device)** - Baseline default: *True* - - **winproj.exe (Device)** Baseline default: *True* @@ -980,46 +1035,43 @@ For more information about the following settings that are included in this base - **onent.exe (Device)** Baseline default: *True* + - **winproj.exe (Device)** + Baseline default: *True* + - **winword.exe (Device)** Baseline default: *True* - **exprwd.exe (Device)** Baseline default: *True* - - **mspub.exe (Device)** + - **mse7.exe (Device)** Baseline default: *True* - - **outlook.exe (Device)** + - **mspub.exe (Device)** Baseline default: *True* - - **powerpnt.exe (Device)** + - **outlook.exe (Device)** Baseline default: *True* - - **groove.exe (Device)** + - **msaccess.exe (Device)** Baseline default: *True* - - **mse7.exe (Device)** + - **powerpnt.exe (Device)** Baseline default: *True* - - **msaccess.exe (Device)** + - **groove.exe (Device)** Baseline default: *True* - **excel.exe (Device)** Baseline default: *True* - - **spDesign.exe (Device)** - Baseline default: *True* - - **pptview.exe (Device)** Baseline default: *True* - - **winproj.exe (Device)** + - **spDesign.exe (Device)** Baseline default: *True* -::: zone-end -::: zone pivot="office-may-2023,v2306" - -### Microsoft Outlook 2016 +## Microsoft Outlook 2016 *Security > Security Form Settings* @@ -1032,6 +1084,23 @@ The "Outlook Security Mode" policy controls how security settings in Outlook are - **Guard behavior: (User)** Baseline default: *Automatically Deny* + - **Prevent users from customizing attachment security settings (User)** + Baseline default: *Enabled* + + - **Retrieving CRLs (Certificate Revocation Lists) (User)** + Baseline default: *Enabled* + - Baseline default: *When online always retrieve the CRL* + +::: zone-end +::: zone pivot="office-may-2023" + + + - **Junk E-mail protection level (User)** + Baseline default: *Disabled* + +::: zone-end +::: zone pivot="office-may-2023,v2306" + - **Configure Outlook object model prompt When accessing the Formula property of a UserProperty object (User)** Baseline default: *Enabled* - **Guard behavior: (User)** @@ -1042,17 +1111,17 @@ The "Outlook Security Mode" policy controls how security settings in Outlook are - **Select the authentication with Exchange server. (User)** Baseline default: *Kerberos Password Authentication* - - **Configure Outlook object model prompt when reading address information (User)** - Baseline default: *Enabled* - - **Guard behavior: (User)** - Baseline default: *Automatically Deny* - - - **Enable RPC encryption (User)** + - **Enable RPC encryption (User)** Baseline default: *Enabled* - **Allow hyperlinks in suspected phishing e-mail messages (User)** Baseline default: *Disabled* + - **Configure Outlook object model prompt when reading address information (User)** + Baseline default: *Enabled* + - **Guard behavior: (User)** + Baseline default: *Automatically Deny* + - **Configure Outlook object model prompt when sending mail (User)** Baseline default: *Enabled* @@ -1067,21 +1136,17 @@ The "Outlook Security Mode" policy controls how security settings in Outlook are - **Allow scripts in one-off Outlook forms (User)** Baseline default: *Disabled* - - **Prevent users from customizing attachment security settings (User)** - Baseline default: *Enabled* - - **Remove file extensions blocked as Level 2 (User)** Baseline default: *Enabled* - **Removed Extensions: (User)** Baseline default: *;* - - **Retrieving CRLs (Certificate Revocation Lists) (User)** - Baseline default: *Enabled* - - Baseline default: *When online always retrieve the CRL* + - **Use Unicode format when dragging e-mail message to file system (User)** + Baseline default: *Disabled* - - **Configure Outlook object model prompt when accessing an address book (User)** + - **Set Outlook object model custom actions execution prompt (User)** Baseline default: *Enabled* - - **Guard behavior: (User)** + - **When executing a custom action: (User)** Baseline default: *Automatically Deny* - **Do not allow Outlook object model scripts to run for public folders (User)** @@ -1090,19 +1155,6 @@ The "Outlook Security Mode" policy controls how security settings in Outlook are - **Include Internet in Safe Zones for Automatic Picture Download (User)** Baseline default: *Disabled* - - **Signature Warning (User)** - Baseline default: *Enabled* - - **Signature Warning (User)** - Baseline default: *Always warn about invalid signatures* - - - **Use Unicode format when dragging e-mail message to file system (User)** - Baseline default: *Disabled* - - - **Set Outlook object model custom actions execution prompt (User)** - Baseline default: *Enabled* - - **When executing a custom action: (User)** - Baseline default: *Automatically Deny* - - **Security setting for macros (User)** Baseline default: *Enabled* - **Security Level (User)** @@ -1113,44 +1165,58 @@ The "Outlook Security Mode" policy controls how security settings in Outlook are - **Removed Extensions: (User)** Baseline default: *;* -::: zone-end -::: zone pivot="office-may-2023" - - - **Junk E-mail protection level (User)** - Baseline default: *Disabled* - -::: zone-end -::: zone pivot="office-may-2023,v2306" + - **Signature Warning (User)** + Baseline default: *Enabled* + - **Signature Warning (User)** + Baseline default: *Always warn about invalid signatures* - - **Display Level 1 attachments (User)** - Baseline default: *Disabled* +- **Display Level 1 attachments (User)** + Baseline default: *Disabled* - - **Minimum encryption settings (User)** - Baseline default: *Enabled* - - **Minimum key size (in bits): (User)** - Baseline default: *168* +- **Minimum encryption settings (User)** + Baseline default: *Enabled* + - **Minimum key size (in bits): (User)** + Baseline default: *168* - - **Do not allow Outlook object model scripts to run for shared folders (User)** - Baseline default: *Enabled* +- **Do not allow Outlook object model scripts to run for shared folders (User)** + Baseline default: *Enabled* - - **Configure Outlook object model prompt when executing Save As (User)** +- **Configure Outlook object model prompt when executing Save As (User)** + Baseline default: *Enabled* + - **Guard behavior: (User)** + Baseline default: *Automatically Deny* + - **Configure Outlook object model prompt when reading address information (User)** Baseline default: *Enabled* - **Guard behavior: (User)** Baseline default: *Automatically Deny* - - **Configure Outlook object model prompt when responding to meeting and task requests (User)** - Baseline default: *Enabled* - - **Guard behavior: (User)** - Baseline default: *Automatically Deny* +- **Configure Outlook object model prompt when responding to meeting and task requests (User)** + Baseline default: *Enabled* + - **Guard behavior: (User) + Baseline default: *Automatically Deny* -### Microsoft PowerPoint 2016 +## Microsoft PowerPoint 2016 *PowerPoint Options > Security* +::: zone-end +::: zone pivot="v2306" + + +- **Run Programs (User)** + Baseline default: *Disabled* + +::: zone-end +::: zone pivot="office-may-2023" + + - **Run Programs (User)** Baseline default: *Enabled* - *disable (don't run any programs)* +::: zone-end +::: zone pivot="office-may-2023,v2306" + - **Scan encrypted macros in PowerPoint Open XML presentations (User)** Baseline default: *Enabled* - Baseline default: *Scan encrypted macros (default)* @@ -1163,10 +1229,19 @@ The "Outlook Security Mode" policy controls how security settings in Outlook are - **Block macros from running in Office files from the Internet (User**) Baseline default: *Enabled* +::: zone-end +::: zone pivot="v2306" + + +- **Disable Trust Bar Notification for unsigned application add-ins and block them (User) (Deprecated)** + Baseline default: *Enabled* + +::: zone-end +::: zone pivot="office-may-2023,v2306" + - **Require that application add-ins are signed by Trusted Publisher (User)** Baseline default: *Enabled* - -- **Disable Trust Bar Notification for unsigned application add-ins and block them (User)** + - **Disable Trust Bar Notification for unsigned application add-ins and block them (User)** Baseline default: *Enabled* - **VBA Macro Notification Settings (User)** @@ -1193,10 +1268,11 @@ The "Outlook Security Mode" policy controls how security settings in Outlook are Baseline default: *Disabled* - **Set document behavior if file validation fails (User)** - Baseline default: *Enabled* - - Baseline default: *Open in Protected View* + Baseline default: *Enabled* + - **Checked: Allow edit. Unchecked: Do not allow edit. (User)** Baseline default: *False* + - Baseline default: *Open in Protected View* - **Turn off Protected View for attachments opened from Outlook (User)** Baseline default: *Disabled* @@ -1206,24 +1282,33 @@ The "Outlook Security Mode" policy controls how security settings in Outlook are - **Allow Trusted Locations on the network (User)** Baseline default: *Disabled* -### Microsoft Project 2016 +## Microsoft Project 2016 *Project Options > Security > Trust Center* - **Allow Trusted Locations on the network (User)** Baseline default: *Disabled* -- **Require that application add-ins are signed by Trusted Publisher (User)** - Baseline default: *Enabled* +::: zone-end +::: zone pivot="v2306" + -- **Disable Trust Bar Notification for unsigned application add-ins and block them (User)** +- **Disable Trust Bar Notification for unsigned application add-ins and block them (User) (Deprecated)** Baseline default: *Enabled* +::: zone-end +::: zone pivot="office-may-2023,v2306" + +- **Require that application add-ins are signed by Trusted Publisher (User)** + Baseline default: *Enabled* + - **Disable Trust Bar Notification for unsigned application add-ins and block them (User)** + Baseline default: *Enabled* + - **VBA Macro Notification Settings (User)** Baseline default: *Enabled* - Baseline default: *Disable all except digitally signed macros* -### Microsoft Publisher 2016 +## Microsoft Publisher 2016 *Security* @@ -1234,9 +1319,13 @@ The "Outlook Security Mode" policy controls how security settings in Outlook are *Security > Trust Center* ::: zone-end -::: zone pivot="office-may-2023,v2306" +::: zone pivot="v2306" + -- **Block macros from running in Office files from the internet** +- **Block macros from running in Office files from the internet (User)** + Baseline default: *Enabled* + +- **Disable Trust Bar Notification for unsigned application add-ins (User) (Deprecated)** Baseline default: *Enabled* ::: zone-end @@ -1245,29 +1334,38 @@ The "Outlook Security Mode" policy controls how security settings in Outlook are - **Require that application add-ins are signed by Trusted Publisher (User)** Baseline default: *Enabled* -- **Disable Trust Bar Notification for unsigned application add-ins and block them(User)** - Baseline default: *Enabled* + - **Disable Trust Bar Notification for unsigned application add-ins (User)** + Baseline default: Enabled* - **VBA Macro Notification Settings (User)** Baseline default: *Enabled* - Baseline default: *Disable all except digitally signed macros* -### Microsoft Visio 2016 +## Microsoft Visio 2016 *Visio Options > Security > Trust Center* - **Allow Trusted Locations on the network (User)** Baseline default: *Disabled* -- **Block macros from running in Office files from the internet (User)** +- **Block macros from running in Office files from the Internet (User)** Baseline default: *Enabled* -- **Require that application add-ins are signed by Trusted Publisher (User)** - Baseline default: *Enabled* -- **Disable Trust Bar Notification for unsigned application add-ins and block them (User)** +::: zone-end +::: zone pivot="v2306" + +- **Disable Trust Bar Notification for unsigned application add-ins and block them (User) (Deprecated)** Baseline default: *Enabled* +::: zone-end +::: zone pivot="office-may-2023,v2306" + +- **Require that application add-ins are signed by Trusted Publisher (User)** + Baseline default: *Enabled* + - **Disable Trust Bar Notification for unsigned application add-ins and block them (User)** + Baseline default: *Enabled* + - **VBA Macro Notification Settings (User)** Baseline default: *Enabled* - Baseline default: *Disable all except digitally signed macros* @@ -1289,20 +1387,29 @@ The "Outlook Security Mode" policy controls how security settings in Outlook are - **File block setting: (User)** Baseline default: *Open/Save blocked* -### Microsoft Word 2016 +## Microsoft Word 2016 *Word Options > Security > Trust Center* -- **Block macros from running in Office files from the internet (User)** +- **Block macros from running in Office files from the Internet (User)** Baseline default: *Enabled* +::: zone-end +::: zone pivot="v2306" + +- **Disable Trust Bar Notification for unsigned application add-ins and block them (User) (Deprecated)** + Baseline default: *Enabled* + +::: zone-end +::: zone pivot="office-may-2023,v2306" + - **Dynamic Data Exchange (User)** Baseline default: *Disabled* - **Require that application add-ins are signed by Trusted Publisher (User)** Baseline default: *Enabled* -- **Disable Trust Bar Notification for unsigned application add-ins and block them (User)** + - **Disable Trust Bar Notification for unsigned application add-ins and block them (User)** Baseline default: *Enabled* - **Scan encrypted macros in Word Open XML documents (User)** @@ -1361,7 +1468,7 @@ The "Outlook Security Mode" policy controls how security settings in Outlook are *Word Options > Security > Trust Center > Protected View* -- **Do not open files from the internet zone in Protected View (User)** +- **Do not open files from the Internet zone in Protected View (User)** Baseline default: *Disabled* - **Do not open files in unsafe locations in Protected View (User)** @@ -1369,6 +1476,7 @@ The "Outlook Security Mode" policy controls how security settings in Outlook are - **Set document behavior if file validation fails (User)** Baseline default: *Enabled* + - Baseline default: *Open in Protected View* - **Checked: Allow edit. Unchecked: Do not allow edit. (User)** @@ -1377,57 +1485,15 @@ The "Outlook Security Mode" policy controls how security settings in Outlook are - **Turn off Protected View for attachments opened from Outlook (User)** Baseline default: *Disabled* -*Word Options > Security > Trust Center > Trusted Locations* - -- **Allow Trusted Locations on the network (User)** - Baseline default: *Disabled* - *Word Options > Security* - **Turn off file validation (User)** Baseline default: *Disabled* -::: zone-end -::: zone pivot="office-may-2023" - -### Administrative Templates - -*MS Security Guide* - -- **Block Flash activation in Office documents** - Baseline default: *Enabled* - - **Block Flash player in Office (Device)** - Baseline default: Block all activation* - -- **Restrict legacy JScript execution for Office** - Baseline default: *Enabled* - - - **Outlook: (Device)** - Baseline default: *69632* - - - **Excel: (Device)** - Baseline default: *69632* - - - **PowerPoint: (Device)** - Baseline default: *69632* - - - **OneNote: (Device)** - Baseline default: *69632* - - - **Publisher: (Device)** - Baseline default: *69632* - - - **Access: (Device)** - Baseline default: *69632* - - - **Visio: (Device)** - Baseline default: *69632* +*Word Options > Security > Trust Center > Trusted Locations* - - **Project: (Device)** - Baseline default: *69632* - - - **Word: (Device)** - Baseline default: *69632* +- **Allow Trusted Locations on the network (User)** + Baseline default: *Disabled* ::: zone-end diff --git a/memdocs/intune/protect/sentinelone-mobile-threat-defense-connector.md b/memdocs/intune/protect/sentinelone-mobile-threat-defense-connector.md index 257df17d45a..6b8dbd05d31 100644 --- a/memdocs/intune/protect/sentinelone-mobile-threat-defense-connector.md +++ b/memdocs/intune/protect/sentinelone-mobile-threat-defense-connector.md @@ -8,7 +8,7 @@ keywords: author: brenduns ms.author: brenduns manager: dougeby -ms.date: 01/10/2024 +ms.date: 10/14/2024 ms.topic: how-to ms.service: microsoft-intune ms.subservice: protect @@ -35,7 +35,7 @@ ms.collection: You can control mobile device access to corporate resources using Conditional Access based on risk assessment conducted by SentinelOne, a Mobile Threat Defense (MTD) solution that integrates with Microsoft Intune. Risk is assessed based on telemetry collected from devices running the SentinelOne app. -You can configure Conditional Access policies based on SentinelOne risk assessment enabled through Intune device compliance policies for enrolled devices, which you can use to allow or block noncompliant devices to access corporate resources based on detected threats. For unenrolled devices, you can use app protection policies to enforce a block or selective wipe based on detected threats. +You can configure Conditional Access policies that are based on SentinelOne risk assessment, enabled through Intune device compliance policies for enrolled devices. You can use these policies to allow or block noncompliant devices access to corporate resources based on detected threats. For unenrolled devices, you can use app protection policies to enforce a block or selective wipe based on detected threats. ## Supported platforms @@ -51,7 +51,7 @@ You can configure Conditional Access policies based on SentinelOne risk assessme ## How do Intune and SentinelOne help protect your company resources? -The SentinelOne app for Android and iOS/iPadOS captures file system, network stack, device, and application telemetry where available, then sends the telemetry data to the SentinelOne cloud service to assess the device's risk for mobile threats. +For Android and iOS/iPadOS The SentinelOne app captures file system, network stack, device, and application telemetry where available. Then the app sends the data to the SentinelOne cloud service to assess the device's risk for mobile threats. - **Support for enrolled devices** - Intune device compliance policy includes a rule for Mobile Threat Defense (MTD), which can use risk assessment information from SentinelOne. When the MTD rule is enabled, Intune evaluates device compliance with the policy that you enabled. If the device is found noncompliant, users are blocked access to corporate resources like Exchange Online and SharePoint Online. Users also receive guidance from the SentinelOne app installed in their devices to resolve the issue and regain access to corporate resources. To support using SentinelOne with enrolled devices: diff --git a/memdocs/intune/protect/sentinelone-mtd-connector-integration.md b/memdocs/intune/protect/sentinelone-mtd-connector-integration.md index e22e62d05d3..01a74013c71 100644 --- a/memdocs/intune/protect/sentinelone-mtd-connector-integration.md +++ b/memdocs/intune/protect/sentinelone-mtd-connector-integration.md @@ -8,12 +8,12 @@ keywords: author: brenduns ms.author: brenduns manager: dougeby -ms.date: 11/17/2023 +ms.date: 10/10/2024 ms.topic: how-to ms.service: microsoft-intune ms.subservice: protect ms.localizationpriority: high -ms.assetid: +ms.assetid: # optional metadata @@ -60,11 +60,11 @@ The SentinelOne app authorization process follows: - Allow SentinelOne Management Console to use Microsoft Entra single sign-on (SSO). - Allow the SentinelOne app to sign in using Microsoft Entra SSO. -For more information about consent and Microsoft Entra applications, see [Introduction to permissions and consent](/azure/active-directory/develop/permissions-consent-overview#request-the-permissions-from-a-directory-admin) in the Microsoft Entra documentation. +For more information about consent and Microsoft Entra applications, see [Introduction to permissions and consent](/entra/identity-platform/permissions-consent-overview#request-the-permissions-from-a-directory-admin) in the Microsoft Entra documentation. ## To set up SentinelOne integration -1. Go to [SentinelOne Management Console]( https://console.mobile.sentinelone.net) and sign in with your credentials. To perform the SentinelOne integration setup process, you must sign in with a Microsoft Entra user who has the Global Administrator role. This one-time setup operation uses the Global Administrator rights to grant permission in your organization for the SentinelOne apps to communicate with Intune. +1. Go to [SentinelOne Management Console]( https://console.mobile.sentinelone.net) and sign in with your credentials. To perform the SentinelOne integration setup process, you must sign in with a Microsoft Entra user who has the Global Administrator role. This one-time setup operation uses the Global Administrator rights to grant permission in your organization for the SentinelOne apps to communicate with Intune. 2. Choose **Management** from the left menu. @@ -86,7 +86,7 @@ For more information about consent and Microsoft Entra applications, see [Introd 9. Sign out of the SentinelOne MTD console. -## Next steps +## Next step - [Set up SentinelOne apps for enrolled devices](mtd-apps-ios-app-configuration-policy-add-assign.md) - [Set up SentinelOne apps for unenrolled devices](mtd-add-apps-unenrolled-devices.md) diff --git a/memdocs/intune/protect/tenant-attach-intune.md b/memdocs/intune/protect/tenant-attach-intune.md index d3e33627a21..f82731d14c2 100644 --- a/memdocs/intune/protect/tenant-attach-intune.md +++ b/memdocs/intune/protect/tenant-attach-intune.md @@ -7,7 +7,7 @@ keywords: author: brenduns ms.author: brenduns manager: dougeby -ms.date: 07/19/2024 +ms.date: 10/10/2024 ms.topic: how-to ms.service: microsoft-intune ms.subservice: protect @@ -49,6 +49,9 @@ To support using Intune endpoint security policies with Configuration Manager de - **Permissions to Microsoft Entra ID** - To complete setup of tenant attach, your account must have Global Administrator permissions to your Azure subscription. + > [!IMPORTANT] + > Microsoft recommends that you use roles with the fewest permissions. Using lower permissioned accounts helps improve security for your organization. Global Administrator is a highly privileged role that should be limited to emergency scenarios when you can't use an existing role. + - **Tenant for Microsoft Defender for Endpoint** – Your Microsoft Defender for Endpoint tenant must be integrated with your Microsoft Intune tenant (Microsoft Intune Plan 1 subscription). See [Use Microsoft Defender for Endpoint](advanced-threat-protection.md) in the Intune documentation. ### Configuration Manager version requirements for Intune endpoint security policies diff --git a/memdocs/intune/protect/windows-10-feature-updates.md b/memdocs/intune/protect/windows-10-feature-updates.md index 3c27dbd421f..a2259010983 100644 --- a/memdocs/intune/protect/windows-10-feature-updates.md +++ b/memdocs/intune/protect/windows-10-feature-updates.md @@ -7,7 +7,7 @@ keywords: author: Smritib17 ms.author: smbhardwaj manager: dougeby -ms.date: 07/15/2024 +ms.date: 09/10/2024 ms.topic: how-to ms.service: microsoft-intune ms.subservice: protect @@ -203,7 +203,6 @@ For more information about WPJ limitations for Intune Windows Update policies, s 5. Under **Review + create**, review the settings. When ready to save the Feature updates policy, select **Create**. - ## Upgrade devices to Windows 11 You can use policy for *Feature updates for Windows 10 and later* to upgrade devices that run Windows 10 to Windows 11. @@ -245,7 +244,7 @@ You cannot set the checkbox for an existing policy because changing the checkbox - Deploying an older Windows version to a device won't downgrade the device. Devices only install an update when it's newer than the devices current version. - Deploying a Windows 11 update to a Windows 10 device that supports Windows 11, [upgrades that device](#upgrade-devices-to-windows-11). -## Update behavior when multiple policies target a device: +## Update behavior when multiple policies target a device Consider the following points when feature update policies target a device with more than one update policy, or target a Windows 10 device with an update for Windows 11: @@ -257,6 +256,9 @@ Consider the following points when feature update policies target a device with - Using the checkbox **When a device isn't capable of running Windows 11, install the latest Windows 10 feature update** when using multiple policies avoids the problems mentioned in this section and configures the service to detect when the Windows 11 is not eligible for a device and instead offers the latest Windows 10 feature update. +> [!NOTE] +> If you create two policies with the same device/s, where one is set to **Required** and the other set to **Optional** and both policies target the same feature update version, then the update is offered as **Required**. + ## Manage Feature updates for Windows 10 and later policy In the admin center, go to **Devices** > **By platform** > **Windows** > **Manage updates** > **Windows 10 and later updates** > **Feature updates** tab to view your profiles. diff --git a/memdocs/intune/protect/windows-driver-updates-overview.md b/memdocs/intune/protect/windows-driver-updates-overview.md index 5153051df3d..523c4f1e63f 100644 --- a/memdocs/intune/protect/windows-driver-updates-overview.md +++ b/memdocs/intune/protect/windows-driver-updates-overview.md @@ -7,7 +7,7 @@ keywords: author: Smritib17 ms.author: smbhardwaj manager: dougeby -ms.date: 07/15/2024 +ms.date: 09/10/2024 ms.topic: how-to ms.service: microsoft-intune ms.subservice: protect @@ -250,6 +250,7 @@ To help avoid issues that require rolling back a driver from large numbers of de ### Why do my devices have driver updates installed that didn't pass through an updates policy? - These are likely *extension* drivers, which are "sub drivers" that a main driver can reference to be installed when the main driver is installed or updated. Extension drivers show up in the installed drivers or update history on the device, but aren't directly manageable. Because extension drivers don't function without base drivers, it's safe to allow them to install. +- Plug and Play can also install drivers automatically. When Windows detects new hardware or software (such as a mouse, keyboard, or webcam) without an existing driver, it installs the latest driver to ensure the component functions immediately. After the initial installation, any future updates to these drivers will require approval. ### How quickly are paused updates actually paused? diff --git a/memdocs/intune/protect/windows-hello.md b/memdocs/intune/protect/windows-hello.md index 55bb9442044..21a991bdf89 100644 --- a/memdocs/intune/protect/windows-hello.md +++ b/memdocs/intune/protect/windows-hello.md @@ -40,7 +40,7 @@ For Windows 10/11 devices, use of [Windows Hello for Business](/windows/security After device enrollment, or when you choose not to use the tenant-wide enrollment policy, Intune supports the following methods to manage Windows Hello on discrete groups of devices: -- [**Endpoint security Account protection policy**](../protect/endpoint-security-account-protection-policy.md): To manage Windows Hello on devices after they have enrolled with Intune, use the Intune *Account protection* profile, which is part of endpoint security Account protection policy. +- [**Endpoint security Account protection policy**](../protect/endpoint-security-account-protection-policy.md): To manage settings for Windows Hello on devices after they have enrolled with Intune, use the Intune *Account protection* profile, which is part of endpoint security Account protection policy. - [**Security baselines**](../protect/security-baselines.md): Some settings for Windows Hello can be managed by security baselines like the baselines for *Microsoft Defender for Endpoint security* or *Security Baseline for Windows 10 and later*. diff --git a/memdocs/intune/protect/windows-laps-policy.md b/memdocs/intune/protect/windows-laps-policy.md index 0eb91c319ec..e189e3f8725 100644 --- a/memdocs/intune/protect/windows-laps-policy.md +++ b/memdocs/intune/protect/windows-laps-policy.md @@ -49,13 +49,13 @@ Applies to: ## About Intune LAPS policy -Intune’s provides support to configure Windows LAPS on devices through the **Local admin password solution (Windows LAPS)** profile, available through endpoint security policies for [account protection](../protect/endpoint-security-account-protection-policy.md). +Intune supports configuration of Windows LAPS on devices through the **Local admin password solution (Windows LAPS)** profile for endpoint security [account protection](../protect/endpoint-security-account-protection-policy.md) policy. Intune policies manage LAPS by using the Windows LAPS configuration service provider (CSP). Windows LAPS CSP configurations [take precedence](/windows-server/identity/laps/laps-management-policy-settings#supported-policy-roots) over, and overwrite, any existing configurations from other LAPS sources, like GPOs or the [Legacy Microsoft LAPS](https://www.microsoft.com/en-us/download/details.aspx?id=46899) tool. Windows LAPS allows for the management of a single local administrator account per device. Intune policy can specify which local admin account it applies to by use of the policy setting **Administrator Account Name**. If the account name specified in the policy isn’t present on the device, no account is managed. However, when **Administrator Account Name** is left blank, the policy defaults to the devices built-in local admin account that is identified by its well-known relative identifier (RID). -> [!NOTE] +> [!NOTE] > Ensure the [prerequisites](../protect/windows-laps-overview.md#prerequisites) for Intune to support Windows LAPS in your tenant are met before creating policies. > > Intune’s LAPS policies do not create new accounts or passwords. Instead, they manage an account that’s already on the device. @@ -143,7 +143,7 @@ For more information, see [Role based access controls for LAPS](../protect/windo 2. On the devices Overview pane, below *Monitor* select **Local admin password**. If your account has sufficient permissions, the Local admin password pane for the device opens, which is the same view that’s available from within the Azure portal. - :::image type="content" source="./media/windows-laps-policy/view-password.png" alt-text="Screen shot that shows the local admin password pane for a Windows device." lightbox="./media/windows-laps-policy/view-password.png"::: + :::image type="content" source="./media/windows-laps-policy/view-password.png" alt-text="Screen shot that shows the local admin password pane for a Windows device." lightbox="./media/windows-laps-policy/view-password.png"::: The following information can be viewed from within the admin center. However, the *Local admin password* can only be viewed when the account was backed up to Microsoft Entra. It can’t be viewed for an account that’s backed up to an on-premises Active Directory (Windows Server Active Directory): @@ -170,7 +170,7 @@ To use this device action, your account must have the following three Intune per - Managed devices: **Read** - Organization: **Read** -- Remote tasks: **Rotate Local Admin Password** +- Remote tasks: **Rotate Local Admin Password** See [Role based access controls for LAPS](../protect/windows-laps-overview.md#role-based-access-controls-for-laps). @@ -218,7 +218,7 @@ When a device that doesn’t have a LAPS policy then receives two conflicting po To resolve conflicts, you must either remove policy assignments from the device, or reconfigure settings in applicable policies until no more conflicts remain. -## Next steps +## Related content - [Introduction to Intune policy for LAPS](../protect/windows-laps-overview.md) - [View reports for LAPS](../protect/windows-laps-reports.md) diff --git a/memdocs/intune/protect/zimperium-mobile-threat-defense-connector.md b/memdocs/intune/protect/zimperium-mobile-threat-defense-connector.md index c10af4b062e..a94db3b9238 100644 --- a/memdocs/intune/protect/zimperium-mobile-threat-defense-connector.md +++ b/memdocs/intune/protect/zimperium-mobile-threat-defense-connector.md @@ -8,7 +8,7 @@ keywords: author: brenduns ms.author: brenduns manager: dougeby -ms.date: 11/17/2023 +ms.date: 09/30/2024 ms.topic: how-to ms.service: microsoft-intune ms.subservice: protect @@ -57,7 +57,7 @@ The Zimperium app for Android and iOS/iPadOS captures file system, network stack - **Support for enrolled devices** - Intune device compliance policy includes a rule for Mobile Threat Defense (MTD), which can use risk assessment information from Zimperium. When the MTD rule is enabled, Intune evaluates device compliance with the policy that you enabled. If the device is found noncompliant, users are blocked access to corporate resources like Exchange Online and SharePoint Online. Users also receive guidance from the Zimperium app installed in their devices to resolve the issue and regain access to corporate resources. To support using Zimperium with enrolled devices: - [Add MTD apps to devices](../protect/mtd-apps-ios-app-configuration-policy-add-assign.md) - [Create a device compliance policy that supports MTD](../protect/mtd-device-compliance-policy-create.md) - - [Enable the MTD connector in Intune](../protect/mtd-connector-enable.md) + - [Enable a Mobile Threat Defense connector](../protect/mtd-connector-enable.md) - **Support for unenrolled devices** - Intune can use the risk assessment data from the Zimperium app on unenrolled devices when you use Intune app protection policies. Admins can use this combination to help protect corporate data within a [Microsoft Intune protected app](../apps/apps-supported-intune-apps.md), Admins can also issue a block or selective wipe for corporate data on those unenrolled devices. To support using Zimperium with unenrolled devices: - [Add the MTD app to unenrolled devices](../protect/mtd-add-apps-unenrolled-devices.md) @@ -118,14 +118,9 @@ Access is granted on remediation: :::image type="content" source="./media/zimperium-mobile-threat-defense-connector/zimperium-mobile-app-policy-remediated.png" alt-text="Product flow for App protection policies to grant access after malware is remediated."::: -## Next steps +## Related content - [Integrate Zimperium with Intune](zimperium-mtd-connector-integration.md) - - [Set up Zimperium apps](mtd-apps-ios-app-configuration-policy-add-assign.md) - - [Create Zimperium device compliance policy](mtd-device-compliance-policy-create.md) - -- [Enable Zimperium MTD connector](mtd-connector-enable.md) - - [Create an MTD app protection policy](../protect/mtd-app-protection-policy.md) diff --git a/memdocs/intune/enrollment/chrome-enterprise-device-details.md b/memdocs/intune/remote-actions/chrome-enterprise-device-details.md similarity index 79% rename from memdocs/intune/enrollment/chrome-enterprise-device-details.md rename to memdocs/intune/remote-actions/chrome-enterprise-device-details.md index 2c0ae58e449..fb1fe06bb7f 100644 --- a/memdocs/intune/enrollment/chrome-enterprise-device-details.md +++ b/memdocs/intune/remote-actions/chrome-enterprise-device-details.md @@ -40,17 +40,17 @@ You can view synced devices in the **Devices** > **All devices** list and throug ## Prerequisites -To view ChromeOS devices and device details, you must be assigned a role that has read permission for *Chrome Enterprise*. +To view ChromeOS devices and device details, you must be assigned a role with *read* permission for *Chrome Enterprise*. Devices must be enrolled before you can see them in the admin center. Enrollment for ChromeOS devices is done in the Google Admin center. You can create the connection before or after you enroll devices. For more information, see [Enroll ChromeOS devices](https://support.google.com/chrome/a/answer/1360534) (opens Chrome Enterprise and Education Help). ## View ChromeOS devices -Sign in to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431) and go to **Devices** > **All devices** to view an aggregated list of all devices in Intune, including those running ChromeOS. The following information is shown for ChromeOS devices: +Sign in to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431) and go to **Devices** > **All devices** to view an aggregated list of all devices in Intune, including those running ChromeOS. The following information is shown for ChromeOS devices: * **Device name**: Device names for ChromeOS devices appear as `Chrome- {serialNumber}`. * **Managed by**: ChromeOS devices are managed by **Intune**. * **Ownership**: ChromeOS devices are always marked as **Corporate**. -* **Compliance**: Compliance policies are not supported with ChromeOS devices in Intune so they'll appear in this column as **Not evaluated**. +* **Compliance**: Compliance policies aren't supported with ChromeOS devices in Intune, so they appear in this column as **Not evaluated**. Select **Filter** to filter the device list by platform. You can also go to the navigation menu and select **ChromeOS** for an exclusive view of ChromeOS devices. @@ -78,15 +78,15 @@ You can create dynamic device groups based on a [Google Admin organizational uni 1. For **Membership type**, select **Dynamic Device**. 2. Select **Add a dynamic query**. 3. For **Property**, select **enrollmentProfileName**. Select the **Operator**, depending on how you want the rule to work. For **Value**, enter the name of a Google Admin organizational unit. -2. Create a scope tag for an Intune RBAC role. The scope tag determines the level of access for the Intune role. When you get to **Assignments**, include the dynamic device group you previously created. For more information, see [Use role-based access (RBAC) and scope tags for distributed IT](../fundamentals/scope-tags.md#to-create-a-scope-tag). +2. Create a scope tag for an Intune RBAC role. The scope tag determines the level of access for the Intune role. When you get to **Assignments**, include the dynamic device group you previously created. For more information, see [Use role-based access (RBAC) and scope tags for distributed IT](../fundamentals/scope-tags.md#to-create-a-scope-tag). -After you save the scope tag, it's applied to every device that's part of the dynamic device group. The organizational unit's information syncs with the *enrollmentProfileName* device object property in Microsoft Entra ID, using the full path format that's shown in [System info](#system-info). + After you save the scope tag, it applies to every device that's part of the dynamic device group. The organizational unit's information syncs with the *enrollmentProfileName* device object property in Microsoft Entra ID, using the full path format shown in [System info](#system-info). -For example: `/OU Level1/OU Level2`. + For example: `/OU Level1/OU Level2`. -The maximum length of the string is 255 characters. Intune truncates the first part of the string if it exceeds the max number of characters. + The maximum length of the string is 255 characters. Intune truncates the first part of the string if it exceeds the max number of characters. -For example: `/OU Level1/OU Level2/.../OU Level18` becomes `evel1/OU Level2/.../OU Level18`. + For example: `/OU Level1/OU Level2/.../OU Level18` becomes `evel1/OU Level2/.../OU Level18`. ## Next steps diff --git a/memdocs/intune/remote-actions/chrome-enterprise-remote-actions.md b/memdocs/intune/remote-actions/chrome-enterprise-remote-actions.md new file mode 100644 index 00000000000..450454aadce --- /dev/null +++ b/memdocs/intune/remote-actions/chrome-enterprise-remote-actions.md @@ -0,0 +1,88 @@ +--- +# required metadata + +title: Remote actions for ChromeOS devices | Microsoft Intune +description: Remotely run Microsoft Intune device actions on ChromeOS devices in the Microsoft Intune admin center. +keywords: +author: Lenewsad +ms.author: lanewsad +manager: dougeby +ms.date: 10/09/2024 +ms.topic: how-to +ms.service: microsoft-intune +ms.subservice: protect +ms.localizationpriority: high + +# optional metadata + +#ROBOTS: +#audience: + +ms.reviewer: shsivak +ms.suite: ems +search.appverid: MET150 +#ms.tgt_pltfrm: +ms.custom: intune-azure +ms.collection: +- tier2 +- M365-identity-device-management +--- + +# Remote device actions for ChromeOS + +Remotely run device actions on ChromeOS devices synced with Microsoft Intune. There are four remote actions supported on ChromeOS devices: + +- Deprovision +- Lost mode, known in Chrome Enterprise as *disabling a device* +- Wipe +- Restart (only for kiosk devices and managed guest session devices) + +To access remote actions, select a device in your **Chrome Enterprise** list or go to **Devices** > **All devices** and select a device. This article describes the remote actions, and provides information about required permissions and known issues. + +## Prerequisites + +[Set up the Chrome Enterprise connector](../enrollment/chrome-enterprise-connector-configure.md) with Microsoft Intune, and enroll devices using the Google Admin console. + +Permission requirements are provided in the sections that follow. + +## Deprovision + +Select **Deprovision** to remove Google Admin policies from devices your organization no longer uses. To deprovision a ChromeOS device, you must be assigned a role that has the *Remote tasks: Retire* permission. + +After you deprovision a device, it remains in the Intune admin center and the Google Admin console. Then on the admin center **System info** page, the device status changes to **DEPROVISIONED**. The device can't be enrolled again until you restore it to factory settings. For more information about the deprovision action, such as how to select the best reason for deprovisioning, see the [Chrome Enterprise and Education Help documentation](https://support.google.com/chrome/a/answer/3523633?). + +## Lost mode + +Select **Lost mode** to prevent other people from using a lost or stolen ChromeOS device. Devices in lost mode display the contact information and message you configured in the Google Admin console. To deprovision a device, you must be assigned a role that has the following permissions: + +- *Remote tasks: Enable lost mode* +- *Remote tasks: Disable lost mode* + +>[!TIP] +> Chrome Enterprise and the Google Admin console refer to devices in lost mode as *disabled*. For more information about how to disable a device, see the Chrome Enterprise and Education Help documentation. + +## Wipe + +Select **Wipe** to remove data from a device. With this action, you can either: + +- **Remove user profiles only**: This option removes all user account data. Device and enrollment policies remain on the device. +- **Factory reset (powerwash)**: This option fully restores a device to its factory state, removing all personal and work data. Before using this action, [deprovision](chrome-enterprise-remote-actions.md#deprovision) the device. Otherwise, once it connects to Wi-Fi, it will automatically enroll again. + +To wipe a device, you must be assigned a role that has the *Remote tasks: Wipe* permission. For more information about wiping ChromeOS devices, see [Wipe ChromeOS device data](https://support.google.com/chrome/a/answer/1360642) (opens Google Chrome Enterprise Help). + +## Restart + +Select **Restart** to restart a device. To restart a device, you must be assigned a role that has the *Remote tasks: Reboot now* permission. + +>[!IMPORTANT] +> Device users aren't automatically notified of restarts, and might lose unsaved work if you don't tell them about it ahead of time. + +Restart is only available for kiosk devices and managed guest session devices. The restart fails on any other type of device. For more information, see [Kiosk apps, managed guest sessions, and smart cards](https://support.google.com/chrome/a/topic/6128720?) (opens Google Chrome Enterprise Help). + +## Bulk device actions + +You can issue all of these remote actions as part of a bulk device action. For more information about how to do that, see [Use bulk device actions](bulk-device-actions.md). + +## Known issues + +In some cases, device commands remain in a pending state, even if they’ve already completed or failed. diff --git a/memdocs/intune/remote-actions/collect-diagnostics.md b/memdocs/intune/remote-actions/collect-diagnostics.md index 6135ce25eb5..5dad0d2b000 100644 --- a/memdocs/intune/remote-actions/collect-diagnostics.md +++ b/memdocs/intune/remote-actions/collect-diagnostics.md @@ -8,7 +8,7 @@ keywords: author: Smritib17 ms.author: smbhardwaj manager: dougeby -ms.date: 02/06/2024 +ms.date: 10/10/2024 ms.topic: how-to ms.service: microsoft-intune ms.subservice: remote-actions @@ -41,7 +41,7 @@ The **Collect diagnostics** remote action lets you collect and download managed ## Collect diagnostics for Microsoft 365 remote applications -The Microsoft 365 remote application diagnostics allows Intune admins to request Intune app protection logs and Microsoft 365 application logs (where applicable) directly from the Intune console. Admins can find this report in the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431) by selecting **Troubleshooting + support** > **Troubleshoot** > *select a user* > **Summary** > *App protection**. This feature is exclusive to applications that are under Intune app protection management. If supported, the application specific logs are gathered and stored within dedicated storage solutions for each application. +The Microsoft 365 remote application diagnostics allows Intune admins to request Intune app protection logs and Microsoft 365 application logs (where applicable) directly from the Intune console. Admins can find this report in the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431) by selecting **Troubleshooting + support** > **Troubleshoot** > *select a user* > **Summary** > *App protection**. This feature is exclusive to applications that are under Intune app protection management. If supported, the application specific logs are gathered and stored within dedicated storage solutions for each application. ### Collect diagnostics from a M365 Application @@ -93,12 +93,12 @@ The *Collect diagnostics* remote action is supported for: - Devices that are online and able to communicate with the service during diagnostics > [!NOTE] -> For diagnostics to be able to upload successfully from the client, make sure that the following URLs are not blocked on the network: -> `lgmsapeweu.blob.core.windows.net` -> `lgmsapewus2.blob.core.windows.net` -> `lgmsapesea.blob.core.windows.net` -> `lgmsapeaus.blob.core.windows.net` -> `lgmsapeind.blob.core.windows.net` +> For diagnostics to be able to upload successfully from the client, make sure that the URL for your region is not blocked on the network: +> - `Europe - lgmsapeweu.blob.core.windows.net` +> - `Americas - lgmsapewus2.blob.core.windows.net` +> - `East Asia - lgmsapesea.blob.core.windows.net` +> - `Australia - lgmsapeaus.blob.core.windows.net` +> - `India - lgmsapeind.blob.core.windows.net` ### Collect diagnostics @@ -148,6 +148,7 @@ Registry Keys: - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\LogonUI - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall +- HKLM\SOFTWARE\Microsoft\DeviceInventory - HKLM\SOFTWARE\Policies - HKLM\SOFTWARE\Policies\Microsoft\Cryptography\Configuration\SSL - HKLM\SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection @@ -200,6 +201,7 @@ Files: - %ProgramData%\Microsoft\DiagnosticLogCSP\Collectors\\*.etl - %ProgramFiles%\Microsoft EPM Agent\Logs\\\*.* +- %Program Files%\Microsoft Device Inventory Agent\Logs - %ProgramData%\Microsoft\IntuneManagementExtension\Logs\\\*.* - %ProgramData%\Microsoft\Windows Defender\Support\MpSupportFiles.cab - %ProgramData%\Microsoft\Windows\WlanReport\wlan-report-latest.html diff --git a/memdocs/intune/remote-actions/device-activation-lock-disable.md b/memdocs/intune/remote-actions/device-activation-lock-disable.md index 50d1d397331..b534fac2854 100644 --- a/memdocs/intune/remote-actions/device-activation-lock-disable.md +++ b/memdocs/intune/remote-actions/device-activation-lock-disable.md @@ -32,6 +32,8 @@ ms.collection: # Disable Activation Lock on Apple devices with Intune +> [!TIP] +> You can now turn off Activation Lock directly in Apple Business Manager and Apple School Manager. Learn more on [Apple's User Guide site.](https://support.apple.com/guide/apple-business-manager/axm812df1dd8/web) Microsoft Intune can help you manage Activation Lock, a feature of the Find My iPhone app for iOS/iPadOS and macOS devices. Activation Lock is enabled automatically when a user sets up the Find My iPhone app on a device. After it's enabled, the user's Apple ID and password must be entered before anyone can: - Turn off Find My iPhone @@ -61,7 +63,7 @@ You can read more about Activation Lock on [Apple's web site](https://support.ap There are two methods to disabling Activation Lock on devices: - - Manually entering the Activation Lock bypass code on the device +- Manually entering the Activation Lock bypass code on the device - Using the Disable Activation Lock device action diff --git a/memdocs/intune/toc.yml b/memdocs/intune/toc.yml index 258112b2c92..6850eb4bfd6 100644 --- a/memdocs/intune/toc.yml +++ b/memdocs/intune/toc.yml @@ -338,6 +338,30 @@ items: - name: Step 6. Use app protection actions href: /microsoft-365/solutions/apps-protect-step-6?toc=%2Fmem%2Fintune%2Ftoc.json&bc=%2Fmem%2Fintune%2Fbreadcrumb%2Ftoc.json + - name: Assign and deploy apps using Microsoft Intune + items: + - name: Overview + href: /microsoft-365/solutions/apps-assign-overview?toc=%2Fmem%2Fintune%2Ftoc.json&bc=%2Fmem%2Fintune%2Fbreadcrumb%2Ftoc.json + displayName: assign, deploy, app, apps, monitor, troubleshoot + - name: Understand app management + href: /microsoft-365/solutions/apps-assign-management?toc=%2Fmem%2Fintune%2Ftoc.json&bc=%2Fmem%2Fintune%2Fbreadcrumb%2Ftoc.json + - name: Understand app assignments + href: /microsoft-365/solutions/apps-assign-assignments?toc=%2Fmem%2Fintune%2Ftoc.json&bc=%2Fmem%2Fintune%2Fbreadcrumb%2Ftoc.json + - name: Understand app deployment + href: /microsoft-365/solutions/apps-assign-deployment?toc=%2Fmem%2Fintune%2Ftoc.json&bc=%2Fmem%2Fintune%2Fbreadcrumb%2Ftoc.json + - name: Assign apps to your organization + items: + - name: Assign apps overview + href: /microsoft-365/solutions/apps-assign-steps-overview?toc=%2Fmem%2Fintune%2Ftoc.json&bc=%2Fmem%2Fintune%2Fbreadcrumb%2Ftoc.json + - name: Step 1. Confirm users, devices, or groups + href: /microsoft-365/solutions/apps-assign-step-1?toc=%2Fmem%2Fintune%2Ftoc.json&bc=%2Fmem%2Fintune%2Fbreadcrumb%2Ftoc.json + - name: Step 2. Assign apps to users, devices, or groups + href: /microsoft-365/solutions/apps-assign-step-2?toc=%2Fmem%2Fintune%2Ftoc.json&bc=%2Fmem%2Fintune%2Fbreadcrumb%2Ftoc.json + - name: Step 3. Verify and monitor app assignments + href: /microsoft-365/solutions/apps-assign-step-3?toc=%2Fmem%2Fintune%2Ftoc.json&bc=%2Fmem%2Fintune%2Fbreadcrumb%2Ftoc.json + - name: Step 4. Troubleshoot app deployment issues + href: /microsoft-365/solutions/apps-assign-step-4?toc=%2Fmem%2Fintune%2Ftoc.json&bc=%2Fmem%2Fintune%2Fbreadcrumb%2Ftoc.json + - name: Secure your corporate data using Edge for Business items: - name: Overview @@ -1169,7 +1193,7 @@ items: - name: Domain Join on Windows href: ./configuration/domain-join-configure.md displayName: enrollment, active directory, azure ad joined, join domain - - name: Update Windows + - name: Delivery Optimization href: ./configuration/delivery-optimization-windows.md displayName: delivery optimization, windows updates - name: Upgrade Windows and S mode @@ -1476,6 +1500,9 @@ items: - name: Get Apple MDM push certificate href: ./enrollment/apple-mdm-push-certificate-get.md displayName: digital; certificates; notifications; token; PEM; automated device enrollment; user enrollment; device enrollment + - name: Configure Chrome Enterprise connector + href: ./enrollment/chrome-enterprise-connector-configure.md + displayName: chrome os; connector; device management; google admin - name: Add corporate identifiers href: ./enrollment/corporate-identifiers-add.md displayName: COD; corporate owned; IMEI; device ownership; serial @@ -1506,14 +1533,6 @@ items: href: ./enrollment/create-device-platform-restrictions.md - name: Create device limit restrictions href: ./enrollment/create-device-limit-restrictions.md - - name: Configure Chrome Enterprise connector - items: - - name: Configure Chrome Enterprise connector - href: ./enrollment/chrome-enterprise-connector-configure.md - - name: View ChromeOS device information in Intune - href: ./enrollment/chrome-enterprise-device-details.md - - name: Remote device actions for ChromeOS - href: ./enrollment/chrome-enterprise-remote-actions.md - name: Set up Windows enrollment items: @@ -1711,6 +1730,8 @@ items: href: ./remote-actions/find-primary-user.md - name: Other actions items: + - name: Remote actions for ChromeOS + href: ./remote-actions/chrome-enterprise-remote-actions.md - name: Locate device href: ./remote-actions/device-locate.md - name: Rename device @@ -1723,6 +1744,8 @@ items: href: ./remote-actions/device-sync.md - name: Examine device inventory href: ./remote-actions/device-inventory.md + - name: View ChromeOS device information + href: ./remote-actions/chrome-enterprise-device-details.md - name: Collect diagnostics href: ./remote-actions/collect-diagnostics.md - name: Remove apps and configuration @@ -1842,6 +1865,16 @@ items: href: ./industry/education/tutorial-school-deployment/common-config-settings-catalog-start-menu.md - name: OneDrive Known Folder Move href: ./industry/education/tutorial-school-deployment/common-config-settings-catalog-onedrive-knownfoldermove.md + - name: Intune policies for iPads in Education + items: + - name: Device restrictions + href: ./industry/education/tutorial-school-deployment/common-config-ipads-device-restrictions.md + - name: Apple Intelligence + href: ./industry/education/tutorial-school-deployment/common-config-ipads-ai.md + - name: iPads with no user affinity + href: ./industry/education/tutorial-school-deployment/common-config-ipads-nouser.md + - name: Optional restrictions + href: ./industry/education/tutorial-school-deployment/common-config-ipads-optional.md - name: Intune for Education docs href: /intune-education/ @@ -2038,6 +2071,30 @@ items: - name: Step 6. Use app protection actions href: /microsoft-365/solutions/apps-protect-step-6?toc=%2Fmem%2Fintune%2Ftoc.json&bc=%2Fmem%2Fintune%2Fbreadcrumb%2Ftoc.json + - name: Assign and deploy apps using Microsoft Intune + items: + - name: Overview + href: /microsoft-365/solutions/apps-assign-overview?toc=%2Fmem%2Fintune%2Ftoc.json&bc=%2Fmem%2Fintune%2Fbreadcrumb%2Ftoc.json + displayName: assign, deploy, app, apps, monitor, troubleshoot + - name: Understand app management + href: /microsoft-365/solutions/apps-assign-management?toc=%2Fmem%2Fintune%2Ftoc.json&bc=%2Fmem%2Fintune%2Fbreadcrumb%2Ftoc.json + - name: Understand app assignments + href: /microsoft-365/solutions/apps-assign-assignments?toc=%2Fmem%2Fintune%2Ftoc.json&bc=%2Fmem%2Fintune%2Fbreadcrumb%2Ftoc.json + - name: Understand app deployment + href: /microsoft-365/solutions/apps-assign-deployment?toc=%2Fmem%2Fintune%2Ftoc.json&bc=%2Fmem%2Fintune%2Fbreadcrumb%2Ftoc.json + - name: Assign apps to your organization + items: + - name: Assign apps overview + href: /microsoft-365/solutions/apps-assign-steps-overview?toc=%2Fmem%2Fintune%2Ftoc.json&bc=%2Fmem%2Fintune%2Fbreadcrumb%2Ftoc.json + - name: Step 1. Confirm users, devices, or groups + href: /microsoft-365/solutions/apps-assign-step-1?toc=%2Fmem%2Fintune%2Ftoc.json&bc=%2Fmem%2Fintune%2Fbreadcrumb%2Ftoc.json + - name: Step 2. Assign apps to users, devices, or groups + href: /microsoft-365/solutions/apps-assign-step-2?toc=%2Fmem%2Fintune%2Ftoc.json&bc=%2Fmem%2Fintune%2Fbreadcrumb%2Ftoc.json + - name: Step 3. Verify and monitor app assignments + href: /microsoft-365/solutions/apps-assign-step-3?toc=%2Fmem%2Fintune%2Ftoc.json&bc=%2Fmem%2Fintune%2Fbreadcrumb%2Ftoc.json + - name: Step 4. Troubleshoot app deployment issues + href: /microsoft-365/solutions/apps-assign-step-4?toc=%2Fmem%2Fintune%2Ftoc.json&bc=%2Fmem%2Fintune%2Fbreadcrumb%2Ftoc.json + - name: Secure your corporate data using Edge for Business items: - name: Overview diff --git a/memdocs/intune/user-help/TOC.yml b/memdocs/intune/user-help/TOC.yml index 5da28582683..6b7e5fa91b7 100644 --- a/memdocs/intune/user-help/TOC.yml +++ b/memdocs/intune/user-help/TOC.yml @@ -86,16 +86,6 @@ items: href: use-microsoft-tunnel-android.md - name: Installing Company Portal app in China href: install-company-portal-android-china.md - - name: Resolve a threat in MTD app - items: - - name: Lookout for Work - href: you-need-to-resolve-a-threat-found-by-lookout-for-work-android.md - - name: Symantec Endpoint Protection Mobile - href: you-need-to-resolve-a-threat-found-by-skycure-android.md - - name: Harmony Mobile Protect - href: you-need-to-resolve-a-threat-found-by-checkpoint-android.md - - name: Zimperium zIPS - href: you-need-to-resolve-a-threat-found-by-zips-android.md - name: Get help items: - name: Report a problem @@ -124,7 +114,7 @@ items: items: - name: Migrate account to new iPhone href: set-up-migrate-iphone-for-work.md - - name: Manually sync iOS/iPadOS device + - name: Check device status href: sync-your-device-manually-ios.md - name: Reset iOS/iPadOS device href: effects-of-device-reset-company-portal-ios.md @@ -140,16 +130,6 @@ items: href: use-managed-apps-on-your-device-ios.md - name: Use Microsoft Tunnel for iOS href: use-microsoft-tunnel-iOS.md - - name: Resolve a threat in MTD app - items: - - name: Lookout for Work - href: you-need-to-resolve-a-threat-found-by-lookout-for-work-ios.md - - name: Symantec Endpoint Protection Mobile - href: you-need-to-resolve-a-threat-found-by-skycure-ios.md - - name: Harmony Mobile Protect - href: you-need-to-resolve-a-threat-found-by-checkpoint-ios.md - - name: Zimperium zIPS - href: you-need-to-resolve-a-threat-found-by-zips-ios.md - name: Get help items: - name: Retrieve app logs @@ -200,6 +180,8 @@ items: href: enroll-windows-10-device.md - name: Unenroll device href: unenroll-your-device-from-intune-windows.md + - name: Enrollment dialog FAQs + href: sso-dialog-faqs.yml - name: Company Portal app for Windows items: diff --git a/memdocs/intune/user-help/check-device-access-windows-cpapp.md b/memdocs/intune/user-help/check-device-access-windows-cpapp.md index 4c24642d19e..af4d67761b5 100644 --- a/memdocs/intune/user-help/check-device-access-windows-cpapp.md +++ b/memdocs/intune/user-help/check-device-access-windows-cpapp.md @@ -7,7 +7,7 @@ keywords: author: lenewsad ms.author: lanewsad manager: dougeby -ms.date: 05/15/2024 +ms.date: 10/16/2024 ms.topic: end-user-help ms.service: microsoft-intune ms.subservice: end-user @@ -30,26 +30,36 @@ ms.collection: # Check access from Company Portal app for Windows -Verify that your device has access to work or school resources. +Verify that your device has access to work or school resources. The *check access* action in Company Portal evaluates your device's settings and its access status. -Organizations enforce requirements–such as encryption and password limits– to make sure only secure, trusted devices access their data. Managed devices must meet and maintain these requirements to access the organization's resources. - -The **Check access** action evaluates your device's settings and its access status. The **Device details** page lists the settings you need to adjust to regain access. - -Complete the steps in this article to check access from the Company Portal app for Windows. +Organizations enforce requirements, such as encryption and password limits, to make sure only secure, trusted devices access their internal resources. Your device must meet and maintain these requirements to gain access. Complete the steps in this article to check access from the Company Portal app for Windows. > [!NOTE] > If you don't have the Company Portal app installed, you can still [use the Company Portal website to check access](check-status-company-portal-website.md). -## Check access from Device details page +## Check access + 1. Open the Company Portal app for Windows and go to **Devices**. + + > [!div class="mx-imgBorder"] + > ![Screenshot of the Company Portal app for Windows highlighting the "Devices" option.](./media/check-device-access-windows-cpapp/company-portal-windows-devices.png) + 2. Select a device. -3. Under **Device status**, select **Check access**. The app syncs your device with your organization's current requirements and checks to make sure your device matches them. This check can take a few minutes. + +3. Under **Device status**, select **Check access**. + + > [!div class="mx-imgBorder"] + > ![Image of the Company Portal app Devices page highlighting the "Check access" button ](./media/check-device-access-windows-cpapp/company-portal-windows-check-access.png) + + + The app syncs your device with your organization's current requirements and checks to make sure your device matches them. This check can take a few minutes. + 4. Look at the status update. - **Can access company resources**: No other action needed. - - **Cannot access company resources**: Take the required remediation actions to regain access to company resources. After you update flagged settings, select **Check access** to recheck access. - - **Can access company resources, but action required**: Take the required remediation actions by the specified date or lose access to company resources. After you update flagged settings, select **Check access** to recheck access. -5. When applicable, the status message shows Microsoft Learn help links and remediation actions. Select one or more of these options to start troubleshooting right away. The resolve, check access, and contact actions in the following list are only visible when you're using Company Portal on the affected device. + - **Cannot access company resources**: Take the required remediation actions to regain access to company resources. After you update flagged settings, select **Check access** to recheck access. + - **Can access company resources, but action required**: Take the required remediation actions by the specified date or lose access to company resources. After you update flagged settings, select **Check access** to recheck access. + +5. When applicable, the status message shows Microsoft Learn help links and remediation actions. To start troubleshooting right away, select one or more of the options. The *resolve*, *check access*, and *contact* actions in the following list are only visible when you're using Company Portal on the affected device. * **How to resolve this** opens a relevant help article, if available. * **Resolve** redirects you to the setting on your device. diff --git a/memdocs/intune/user-help/check-status-linux.md b/memdocs/intune/user-help/check-status-linux.md index 5cb7ad25f89..3119602cb36 100644 --- a/memdocs/intune/user-help/check-status-linux.md +++ b/memdocs/intune/user-help/check-status-linux.md @@ -7,7 +7,7 @@ keywords: author: lenewsad ms.author: lanewsad manager: dougeby -ms.date: 11/29/2023 +ms.date: 10/08/2024 ms.topic: end-user-help ms.service: microsoft-intune ms.subservice: end-user @@ -28,14 +28,18 @@ ms.collection: - tier2 --- -# Check status in Microsoft Intune app for Linux -You can use the Microsoft Intune app for Linux to resolve access and compliance issues for enrolled devices. This article describes how to: +# Check status in Microsoft Intune app for Linux + +You can use the Microsoft Intune app for Linux to resolve access and compliance issues for enrolled devices. This article describes how to: * View the status of a device + * View and resolve compliance issues with your device settings -* Refresh device status + +* Refresh device status ## View device status + The Intune app routinely checks in with your device to verify that it complies with setting requirements. Check-ins occur at the time of enrollment, and thereafter whenever you're using your device for work. The status reveals the result of the last check-in. To view the status of a device, sign in to the Intune app and select the device. There are three statuses in the Intune app: @@ -50,17 +54,20 @@ There are three statuses in the Intune app: To view compliance issues: -1. Sign in to the Intune app. -2. Select a device. -3. On the device details page, select **View Issues**. This option is only available when issues are present. -The app shows you the: +1. Sign in to the Intune app. + +2. Select a device. + +3. On the device details page, select **View Issues**. This option is only available when issues are present. + +The app shows you the following information: - * Action required, such as *Upgrade your operating system*. + * The action required, such as *Upgrade your operating system*. - * Reason for noncompliance, such as *This device’s operating system is not supported*. + * The reason for noncompliance, such as *This device’s operating system is not supported*. - * **How to resolve this** link that, when available, points to a help article on learn.microsoft.com. + * The **How to resolve this** link that, when available, points to a help article on learn.microsoft.com. ### Operating system and version When OS and version requirements are enforced, devices running Linux flavors or versions that aren't supported are marked as noncompliant. To resolve this issue, upgrade to or install a version that’s supported by your organization. @@ -82,4 +89,4 @@ Not all filesystem partitions need to be encrypted: * The */boot* or */boot/efi* partitions are ignored. -Intune supports all encryption systems that use the [*dm-crypt* subsystem](https://gitlab.com/cryptsetup/cryptsetup/-/wikis/DMCrypt), the standard underlying infrastructure for Linux systems. We recommend setting up dm-crypt by using the *LUKS format* with the *cryptsetup tool*. \ No newline at end of file +Intune supports all encryption systems that use the [*dm-crypt* subsystem](https://gitlab.com/cryptsetup/cryptsetup/-/wikis/DMCrypt), the standard underlying infrastructure for Linux systems. We recommend setting up dm-crypt by using the *LUKS format* with the *cryptsetup tool*. diff --git a/memdocs/intune/user-help/device-little-different-jamf.md b/memdocs/intune/user-help/device-little-different-jamf.md index b12cc775ea3..5159ac6b27b 100644 --- a/memdocs/intune/user-help/device-little-different-jamf.md +++ b/memdocs/intune/user-help/device-little-different-jamf.md @@ -7,7 +7,7 @@ keywords: Mac OS X, macOS, OS X author: lenewsad ms.author: lanewsad manager: dougeby -ms.date: 11/03/2023 +ms.date: 10/08/2024 ms.topic: end-user-help ms.service: microsoft-intune ms.subservice: end-user diff --git a/memdocs/intune/user-help/effects-of-device-reset-company-portal-ios.md b/memdocs/intune/user-help/effects-of-device-reset-company-portal-ios.md index c645f8a44ab..60e191a20ab 100644 --- a/memdocs/intune/user-help/effects-of-device-reset-company-portal-ios.md +++ b/memdocs/intune/user-help/effects-of-device-reset-company-portal-ios.md @@ -37,7 +37,7 @@ If your device is only set up to access work or school email, your email account ## Availability of factory reset option -The factory reset option isn't available for all iOS devices. If you're an IT support person and want to find out more about these limitations, see [Remove devices by using wipe, retire, or manually unenrolling the device](/intune/devices-wipe). +The factory reset option isn't available for all iOS devices. If you're an IT support person and want to find out more about these limitations, see [Remove devices by using wipe, retire, or manually unenrolling the device](/mem/intune/remote-actions/devices-wipe). ## Factory reset device To reset a device to its original, out-of-box settings: diff --git a/memdocs/intune/user-help/enroll-company-device-macos.md b/memdocs/intune/user-help/enroll-company-device-macos.md index a445ddb913c..31175865ca7 100644 --- a/memdocs/intune/user-help/enroll-company-device-macos.md +++ b/memdocs/intune/user-help/enroll-company-device-macos.md @@ -38,7 +38,7 @@ To begin management setup, power on your device and sign in with your work or sc ## What is Apple's Automated Device Enrollment? -Your organization might have purchased their devices through an Apple program called *Automated Device Enrollment* (formerly referred to as their device enrollment program or *DEP*). Automated Device Enrollment lets organizations buy large amounts of iOS, iPadOS or macOS devices. Organizations can then configure and manage those devices within their preferred mobile device management provider, such as Intune. If you're an administrator and want more information about Apple ADE, see [Automatically enroll macOS devices with Apple's Automated Device Enrollment with ABM/ASM](/intune/enrollment/device-enrollment-program-enroll-macos). +Your organization might have purchased their devices through an Apple program called *Automated Device Enrollment* (formerly referred to as their device enrollment program or *DEP*). Automated Device Enrollment lets organizations buy large amounts of iOS, iPadOS or macOS devices. Organizations can then configure and manage those devices within their preferred mobile device management provider, such as Intune. If you're an administrator and want more information about Apple ADE, see [Automatically enroll macOS devices with Apple's Automated Device Enrollment with ABM/ASM](/mem/intune/enrollment/device-enrollment-program-enroll-macos). ## Get your device managed diff --git a/memdocs/intune/user-help/enroll-device-aosp.md b/memdocs/intune/user-help/enroll-device-aosp.md index 32d41eada66..3280643f764 100644 --- a/memdocs/intune/user-help/enroll-device-aosp.md +++ b/memdocs/intune/user-help/enroll-device-aosp.md @@ -7,7 +7,7 @@ keywords: author: lenewsad ms.author: lanewsad manager: dougeby -ms.date: 07/01/2024 +ms.date: 09/24/2024 ms.topic: end-user-help ms.service: microsoft-intune ms.subservice: end-user @@ -48,16 +48,21 @@ Additionally, you need the enrollment QR code that's provided by your organizati Complete these steps to set up and enroll your device. 1. Turn on your new or factory-reset device. -2. If prompted to, connect to Wi-Fi. Then tap **NEXT**. -3. Scan the QR code provided by your organization. -4. Follow the onscreen prompts to enroll your device. -5. If prompted to, review the device terms and conditions. Then select **ACCEPT & CONTINUE**. -6. The Microsoft Intune app opens. The next step depends on the type of device you're using. Complete the step that matches the screen shown on your device: +1. If prompted to, connect to Wi-Fi. Then tap **NEXT**. +1. When you receive the QR code, stop. Then make sure that: + + - The QR code comes from a trusted source, via a trusted channel. + + - You're enrolling your device into the right organization. +1. Scan the QR code. +1. Follow the onscreen prompts to enroll your device. +1. If prompted to, review the device terms and conditions. Then select **ACCEPT & CONTINUE**. +1. The Microsoft Intune app opens. The next step depends on the type of device you're using. Complete the step that matches the screen shown on your device: - Tap **START** to begin enrollment. - Sign in with your work account. 1. Enter your email, and then tap **NEXT**. 2. Enter your password, and then tap **SIGN IN** to begin enrollment. -7. When you see the message that your device is ready, tap **DONE**. +1. When you see the message that your device is ready, tap **DONE**. If after enrolling you have trouble accessing your organization's resources, go to the Microsoft Intune app to verify that all of your device settings meet your organization's requirements. For more information about checking compliance, see [Check compliance on your AOSP device](check-compliance-aosp.md). diff --git a/memdocs/intune/user-help/enroll-windows-10-device.md b/memdocs/intune/user-help/enroll-windows-10-device.md index bcfd9756c8d..6f547f14c29 100644 --- a/memdocs/intune/user-help/enroll-windows-10-device.md +++ b/memdocs/intune/user-help/enroll-windows-10-device.md @@ -98,7 +98,7 @@ For a non-exhaustive list of error messages and resolutions, see [Troubleshoot W ## Support for IT administrators -If you're an IT administrator and run into problems while enrolling devices, see [Troubleshooting Windows device enrollment problems in Microsoft Intune](https://support.microsoft.com/help/4469913). This article lists common errors, their causes, and steps to resolve them. +If you're an IT administrator and run into problems while enrolling devices, see [Troubleshooting Windows device enrollment problems in Microsoft Intune](/troubleshoot/mem/intune/device-enrollment/troubleshoot-windows-enrollment-errors). This article lists common errors, their causes, and steps to resolve them. ## Next steps If you need more help setting up your device or using Company Portal, contact your support person. Sign in to the [Company Portal website](https://go.microsoft.com/fwlink/?linkid=2010980) for your organization's contact information. diff --git a/memdocs/intune/user-help/help-support-windows-cpapp.md b/memdocs/intune/user-help/help-support-windows-cpapp.md index d6278fabdca..98fb338cc85 100644 --- a/memdocs/intune/user-help/help-support-windows-cpapp.md +++ b/memdocs/intune/user-help/help-support-windows-cpapp.md @@ -7,7 +7,7 @@ keywords: author: lenewsad ms.author: lanewsad manager: dougeby -ms.date: 11/21/2023 +ms.date: 10/16/2024 ms.topic: end-user-help ms.service: microsoft-intune ms.subservice: end-user @@ -30,7 +30,12 @@ ms.collection: # Get help and support in Company Portal app for Windows -Go to **Help & support** in the Intune Company Portal app for Windows to troubleshoot app and access problems. You can: +Go to **Help & support** in the Intune Company Portal app for Windows to troubleshoot app and access problems. + + > [!div class="mx-imgBorder"] + > ![Example screenshot of the Company Portal app highlighting the "Help & support" option and "Help & support" page.](./media/help-support-windows-cpapp/company-portal-windows-support.png) + +From Help & support, you can: * Request help and send logs * Report problems with the app @@ -41,20 +46,20 @@ If the problem you're experiencing prevents you from accessing help and support ## Request help and send logs -Email your organization about any problems you experience in Company Portal. Select **Upload logs & contact support** to open the email template in your preferred mail app. In the body of the email, describe the problem. For more information, see [Send logs to your company support from the Company Portal app for Windows](send-logs-to-your-it-admin-cp-windows.md). +Email your organization about problems you experience in Company Portal. Select **Upload Logs** to open the email template in your preferred mail app. In the body of the email, describe the problem. For more information, see [Send logs to your company support from the Company Portal app for Windows](send-logs-to-your-it-admin-cp-windows.md). ## Report app problems to Microsoft -Select **Report problem to Microsoft**. On the **Feedback for Microsoft** page, choose from the following options: +If you experience trouble in the app, select **Report problem to Microsoft**. Then on the **Feedback for Microsoft** page, choose from the following options: * Report a problem or bug that you see in the app * Send a suggestion or idea you have for the app * Leave a review for the app in Microsoft Store ## View helpdesk contact details -Use your organization's helpdesk details, such as phone number, emails, and website to quickly troubleshoot work or school access. +Use your organization's contact information to quickly troubleshoot work or school access. ## Find answers to frequently asked questions -Under **Frequently asked questions** find answers to the most common questions people ask when enrolling their devices. Select a question to go to the relevant help article on Microsoft Learn. +Under **Frequently asked questions** find the most common questions people ask when enrolling their devices. Select a question to go to the relevant help article on Microsoft Learn. ## IT pro and administrator documentation For help and support documentation for IT pros and Intune administrators, see: diff --git a/memdocs/intune/user-help/install-a-new-version-of-the-company-portal-app.md b/memdocs/intune/user-help/install-a-new-version-of-the-company-portal-app.md index 93a03fbe42b..e7fa580cca2 100644 --- a/memdocs/intune/user-help/install-a-new-version-of-the-company-portal-app.md +++ b/memdocs/intune/user-help/install-a-new-version-of-the-company-portal-app.md @@ -7,7 +7,7 @@ keywords: author: lenewsad ms.author: lanewsad manager: dougeby -ms.date: 11/29/2023 +ms.date: 10/08/2024 ms.topic: end-user-help ms.service: microsoft-intune ms.subservice: end-user @@ -54,37 +54,56 @@ Google Play Store notifies you when a new version of the Company Portal is avail ## Update on iOS device -Check for available Company Portal updates in the App Store. For more information, see the Apple Support article for [How to manually update apps on your Apple device](https://support.apple.com/en-us/HT202180). After you install updates, sync your device in Company Portal. +Check for available Company Portal updates in the App Store. For more information, see the Apple Support article for [How to manually update apps on your Apple device](https://support.apple.com/en-us/HT202180). + +After you install the updates, run a status check on your device in Company Portal. 1. Open Company Portal and go to **Devices**. + 2. Select the device that you're currently using. -3. Select **Check Status** to sync your changes. + +3. Select **Check Status**. > [!NOTE] > The minimum supported version of the Company Portal app for iOS/iPadOS is v5.2311.1. If you're running an older version, you will be prompted to update the Company Portal app when you sign in. ## Update on macOS device -To view and install available updates on a macOS device: +To view available updates for Company Portal on a macOS device: 1. Open Company Portal and go to **Help**. -2. Select **Check for updates**, and then select the available update to begin installation. -4. When the update is complete, return to Company Portal > **Devices**. -5. Select the device that you're currently using. -6. Select **More [...]** and then choose **Check Status** to sync your device. -To turn on automatic app updates: +1. Select **Check for updates**, and then select the available update to begin installation. + +1. After you install the updates, run a status check on your device in Company Portal. Go to **Devices**. + +1. Select the device that you're currently using. + +1. Select **More [...]** and then choose **Check Status**. + +To turn on automatic app updates: + 1. Open Company Portal and go to **Help**. -2. Select **Check for updates**. + +2. Select **Check for updates**. + 3. On the Microsoft AutoUpdate screen, select **Automatically download and install**. ## Update on Windows device -To view available updates for Company Portal for Windows 10/11, open the Microsoft Store and select **Get Updates**. -1. Open Company Portal and go to **Devices**. -2. Select the device you're currently using. -3. Select **Check access** to sync your device. -You can turn on automatic updates to ensure that you don't miss updates. For more information, see [Turn on automatic app updates](https://support.microsoft.com/windows/turn-on-automatic-app-updates-70634d32-4657-dc76-632b-66048978e51b). Your organization can disable automatic app updates. If automatic app updates are unavailable, use the first set of Windows 10/11 instructions (Microsoft Store > **Get Updates**) in the Microsoft Support article to update your app. +To view available app updates on devices running Windows 10/11: + +1. Open the Microsoft Store app and go to **Downloads**. + +1. Select **Get Updates**. + +1. After you install the updates, run a status check on your device in Company Portal. Go to **Devices**. + +1. Select the device you're currently using. + +1. Select **Check access**. + +Optionally, turn on automatic updates to ensure that you don't miss updates. For more information, see [Turn on automatic app updates](https://support.microsoft.com/windows/turn-on-automatic-app-updates-70634d32-4657-dc76-632b-66048978e51b). Your organization can disable automatic app updates on devices used for work, so this option might be unavailable. ## Next steps diff --git a/memdocs/intune/user-help/install-apps-cpapp-windows.md b/memdocs/intune/user-help/install-apps-cpapp-windows.md index 2a8251b5d6e..7d42b772bef 100644 --- a/memdocs/intune/user-help/install-apps-cpapp-windows.md +++ b/memdocs/intune/user-help/install-apps-cpapp-windows.md @@ -7,7 +7,7 @@ keywords: author: lenewsad ms.author: lanewsad manager: dougeby -ms.date: 06/28/2024 +ms.date: 10/07/2024 ms.topic: end-user-help ms.service: microsoft-intune ms.subservice: end-user @@ -48,20 +48,22 @@ Required apps are necessary for work and school and are deployed directly to you To find out which installed apps are required: 1. Sign into the Company Portal app with your work or school account. -2. Go to **Downloads & updates**. +2. Go to **Downloads & updates**. + ![Screenshot of the Downloads & updates page for the Company Portal app for Windows. ](./media/windows-companyportal-02.png) 3. In the table, look under the column **Required by your organization**. A *yes* means that the app is required on your enrolled device. ## Install apps Before you begin, install [Intune Company Portal for Windows from the Microsoft Store](https://apps.microsoft.com/detail/9WZDNCRFJ3PZ). -1. Sign in to the Company Portal app on your work or school device. +1. Sign in to the Company Portal app on your work or school device. You'll see the latest notifications on the Home page. + ![Screenshot of the Home page with notifications in the Company Portal app for Windows.](./media/windows-companyportal-03.png) 2. You can access available apps from the following places in Company Portal: * **Home**: Go to **Home** to view your organization's featured apps. * **Apps**: Go to **Apps** to view, sort, and filter through all available apps. * **App categories**: Go to **App categories** to browse apps by type or function. Apps in this area are sorted into categories picked by your organization, like *featured*, *education*, and *productivity*. * **Search for apps**: Use the static search bar in the navigation pane to search apps by name or publisher. -3. Select an app, and then choose **Install**. The app's installation status changes to *Installed* when installation is done. Select **Retry** if a required app fails to install and the option to retry is available. It could take up to ten minutes for the installation status to update itself. +3. Select an app, and then choose **Install**. The app's installation status changes to *Installing* while the app installation occurs, then *Installed* when installation is done. Select **Retry** if a required app fails to install and the option to retry is available. It could take up to ten minutes for the installation status to update itself. > [!TIP] > To select and install more than one app at a time, go to **Apps** and switch the layout view to multi-select mode. Then select the checkbox next to each app you want to install. Choose **Install selected** to install them. @@ -79,6 +81,7 @@ Select **Sort by** to rearrange the apps alphabetically by app or publisher name ## View installed apps Go to **Downloads & updates** to see a list of installed apps on your device. If no apps are available to view, you'll see a message that no company apps were installed. +![Screenshot of the Downloads & updates page for the Company Portal app for Windows.](./media/windows-companyportal-02.png) The following information is available for each app: @@ -91,8 +94,6 @@ The following information is available for each app: ## Installing Microsoft Office Depending on the size of your workplace or school, there could be multiple versions of Office available to install in Company Portal. You should only install one version of Office. If you try to install an additional one, the first one will be uninstalled. If you're unsure which version is best for your role, contact your IT support person for guidance. -![The Company Portal app for Windows showing 2 versions of Office side by side.](./media/multiple-office-installs-cp-win10.png) - ## Share apps Share and recommend apps to your work or school contacts. The following steps describe how to share a link directly from Company Portal. diff --git a/memdocs/intune/user-help/intune-app-logs-aosp.md b/memdocs/intune/user-help/intune-app-logs-aosp.md index 7234c23155c..c248fd61db9 100644 --- a/memdocs/intune/user-help/intune-app-logs-aosp.md +++ b/memdocs/intune/user-help/intune-app-logs-aosp.md @@ -7,7 +7,7 @@ keywords: author: lenewsad ms.author: lanewsad manager: dougeby -ms.date: 03/04/2024 +ms.date: 10/08/2024 ms.topic: end-user-help ms.service: microsoft-intune ms.subservice: end-user diff --git a/memdocs/intune/user-help/intune-company-portal-password-message-reference.md b/memdocs/intune/user-help/intune-company-portal-password-message-reference.md index 694248cfb94..10dfefb308c 100644 --- a/memdocs/intune/user-help/intune-company-portal-password-message-reference.md +++ b/memdocs/intune/user-help/intune-company-portal-password-message-reference.md @@ -7,7 +7,7 @@ keywords: author: lenewsad ms.author: lanewsad manager: dougeby -ms.date: 03/18/2024 +ms.date: 10/08/2024 ms.topic: end-user-help ms.localizationpriority: high ms.service: microsoft-intune diff --git a/memdocs/intune/user-help/intune-company-portal-preferences-macos.md b/memdocs/intune/user-help/intune-company-portal-preferences-macos.md index c18ef27f83c..f07cb8726bc 100644 --- a/memdocs/intune/user-help/intune-company-portal-preferences-macos.md +++ b/memdocs/intune/user-help/intune-company-portal-preferences-macos.md @@ -7,7 +7,7 @@ keywords: author: lenewsad ms.author: lanewsad manager: dougeby -ms.date: 05/06/2024 +ms.date: 10/08/2024 ms.topic: end-user-help ms.service: microsoft-intune ms.subservice: end-user @@ -36,13 +36,14 @@ Select your preferences for single sign-on and in-app data collection in Company 2. Go to the menu bar and select **Company Portal** > **Preferences**. ## Single sign-on + Single sign-on (SSO) configures your work or school account so that you only have to authenticate once to access all cloud-based work apps and services. Preferences include: * **Register device**: Register your device to enable SSO and gain access to protected resources. This setting is only available on devices enabled for platform SSO. -* **Deregister**: Remove device registration and disable SSO. To access protected resources again on this device, you must reregister. This setting is only available on devices enabled for platform SSO. +* **Deregister**: Remove device registration and disable SSO. To access protected resources again on this device, you must reregister. This setting is only available on devices enabled for platform SSO. -* **Remove account from this device**: Remove your work or school account and any SSO authentication tokens from the device. +* **Remove account from this device**: Remove your work or school account and any SSO authentication tokens from the device. To opt out of SSO on your Mac, select the checkbox next to **Don't ask me to sign in with single sign-on for this device**. @@ -50,7 +51,7 @@ To opt out of SSO on your Mac, select the checkbox next to **Don't ask me to sig This setting enables Microsoft to collect data about your Intune Company Portal usage. When the checkbox is selected, your in-app performance and usage data are automatically anonymized and shared with Microsoft to help improve the reliability and performance of our products. Your organization doesn't have control over the collection of this data and cannot change your preference. -To turn off data collection in Company Portal, clear the checkbox next to **Allow Microsoft to collect usage data**. +To turn off data collection in Company Portal, deselect the checkbox next to **Allow Microsoft to collect usage data**. ## Advanced logging diff --git a/memdocs/intune/user-help/media/check-device-access-windows-cpapp/company-portal-windows-check-access.png b/memdocs/intune/user-help/media/check-device-access-windows-cpapp/company-portal-windows-check-access.png new file mode 100644 index 00000000000..159df0544ad Binary files /dev/null and b/memdocs/intune/user-help/media/check-device-access-windows-cpapp/company-portal-windows-check-access.png differ diff --git a/memdocs/intune/user-help/media/check-device-access-windows-cpapp/company-portal-windows-devices.png b/memdocs/intune/user-help/media/check-device-access-windows-cpapp/company-portal-windows-devices.png new file mode 100644 index 00000000000..63658dc7adf Binary files /dev/null and b/memdocs/intune/user-help/media/check-device-access-windows-cpapp/company-portal-windows-devices.png differ diff --git a/memdocs/intune/user-help/media/check-device-access-windows-cpapp/company-portal-windows-rename.png b/memdocs/intune/user-help/media/check-device-access-windows-cpapp/company-portal-windows-rename.png new file mode 100644 index 00000000000..ca39da2fd86 Binary files /dev/null and b/memdocs/intune/user-help/media/check-device-access-windows-cpapp/company-portal-windows-rename.png differ diff --git a/memdocs/intune/user-help/media/help-support-windows-cpapp/company-portal-windows-support.png b/memdocs/intune/user-help/media/help-support-windows-cpapp/company-portal-windows-support.png new file mode 100644 index 00000000000..132f67b1636 Binary files /dev/null and b/memdocs/intune/user-help/media/help-support-windows-cpapp/company-portal-windows-support.png differ diff --git a/memdocs/intune/user-help/media/reset-device-company-portal-windows/company-portal-windows-reset-confirmation.png b/memdocs/intune/user-help/media/reset-device-company-portal-windows/company-portal-windows-reset-confirmation.png new file mode 100644 index 00000000000..61106e339c4 Binary files /dev/null and b/memdocs/intune/user-help/media/reset-device-company-portal-windows/company-portal-windows-reset-confirmation.png differ diff --git a/memdocs/intune/user-help/media/reset-device-company-portal-windows/company-portal-windows-reset.png b/memdocs/intune/user-help/media/reset-device-company-portal-windows/company-portal-windows-reset.png new file mode 100644 index 00000000000..87e1000508a Binary files /dev/null and b/memdocs/intune/user-help/media/reset-device-company-portal-windows/company-portal-windows-reset.png differ diff --git a/memdocs/intune/user-help/media/sso-dialog-faqs/sso-consent-screen-mdm.png b/memdocs/intune/user-help/media/sso-dialog-faqs/sso-consent-screen-mdm.png new file mode 100644 index 00000000000..eccdedefcb3 Binary files /dev/null and b/memdocs/intune/user-help/media/sso-dialog-faqs/sso-consent-screen-mdm.png differ diff --git a/memdocs/intune/user-help/media/sso-dialog-faqs/sso-consent-screen-no-mdm.png b/memdocs/intune/user-help/media/sso-dialog-faqs/sso-consent-screen-no-mdm.png new file mode 100644 index 00000000000..33dc5dbb392 Binary files /dev/null and b/memdocs/intune/user-help/media/sso-dialog-faqs/sso-consent-screen-no-mdm.png differ diff --git a/memdocs/intune/user-help/media/sync-your-device-manually-windows/company-portal-windows-settings.png b/memdocs/intune/user-help/media/sync-your-device-manually-windows/company-portal-windows-settings.png new file mode 100644 index 00000000000..766de1ce94d Binary files /dev/null and b/memdocs/intune/user-help/media/sync-your-device-manually-windows/company-portal-windows-settings.png differ diff --git a/memdocs/intune/user-help/media/sync-your-device-manually-windows/company-portal-windows-sync.png b/memdocs/intune/user-help/media/sync-your-device-manually-windows/company-portal-windows-sync.png new file mode 100644 index 00000000000..4848a513e3c Binary files /dev/null and b/memdocs/intune/user-help/media/sync-your-device-manually-windows/company-portal-windows-sync.png differ diff --git a/memdocs/intune/user-help/media/turn-off-microsoft-usage-data-collection-windows/company-portal-windows-usage-data.png b/memdocs/intune/user-help/media/turn-off-microsoft-usage-data-collection-windows/company-portal-windows-usage-data.png new file mode 100644 index 00000000000..07361c7e523 Binary files /dev/null and b/memdocs/intune/user-help/media/turn-off-microsoft-usage-data-collection-windows/company-portal-windows-usage-data.png differ diff --git a/memdocs/intune/user-help/media/windows-companyportal-01.png b/memdocs/intune/user-help/media/windows-companyportal-01.png new file mode 100644 index 00000000000..ea1b7161e54 Binary files /dev/null and b/memdocs/intune/user-help/media/windows-companyportal-01.png differ diff --git a/memdocs/intune/user-help/media/windows-companyportal-02.png b/memdocs/intune/user-help/media/windows-companyportal-02.png new file mode 100644 index 00000000000..03df0cce181 Binary files /dev/null and b/memdocs/intune/user-help/media/windows-companyportal-02.png differ diff --git a/memdocs/intune/user-help/media/windows-companyportal-03.png b/memdocs/intune/user-help/media/windows-companyportal-03.png new file mode 100644 index 00000000000..6c1439dbb76 Binary files /dev/null and b/memdocs/intune/user-help/media/windows-companyportal-03.png differ diff --git a/memdocs/intune/user-help/media/windows-companyportal-04.png b/memdocs/intune/user-help/media/windows-companyportal-04.png new file mode 100644 index 00000000000..eaed9daa254 Binary files /dev/null and b/memdocs/intune/user-help/media/windows-companyportal-04.png differ diff --git a/memdocs/intune/user-help/remove-your-device-cpwebsite.md b/memdocs/intune/user-help/remove-your-device-cpwebsite.md index 8e34521e725..b588244bf2d 100644 --- a/memdocs/intune/user-help/remove-your-device-cpwebsite.md +++ b/memdocs/intune/user-help/remove-your-device-cpwebsite.md @@ -7,7 +7,7 @@ keywords: author: lenewsad ms.author: lanewsad manager: dougeby -ms.date: 11/29/2023 +ms.date: 10/08/2024 ms.topic: end-user-help ms.service: microsoft-intune ms.subservice: end-user diff --git a/memdocs/intune/user-help/rename-your-device-cpapp.md b/memdocs/intune/user-help/rename-your-device-cpapp.md index 3067e4826fe..0ab404bc516 100644 --- a/memdocs/intune/user-help/rename-your-device-cpapp.md +++ b/memdocs/intune/user-help/rename-your-device-cpapp.md @@ -7,7 +7,7 @@ keywords: author: lenewsad ms.author: lanewsad manager: dougeby -ms.date: 11/29/2023 +ms.date: 10/16/2024 ms.topic: end-user-help ms.service: microsoft-intune ms.subservice: end-user @@ -37,27 +37,16 @@ Rename a device to make it easier to recognize and manage in the Intune Company * iOS * Android -## Change name in device details +## Rename device -Select the name of a device in the Company Portal app to edit it directly. +After you rename a device, its name immediately changes in the app. 1. Open the Company Portal app and go to **Devices**. -2. Select the device you want to rename. -3. Next to the current device name, select the **Rename** pencil icon. +1. Select the device you want to rename. +1. Select the **Edit** pencil icon that's next to the current device name. Enter the new name, and then select **Rename**. - ![Example screenshot of the Company Portal app for Windows, highlighting the Rename pencil icon.](./media/1809_Rename_CPapp_Windows_icon.png) -4. Type in the new name and select **Rename**. The device name updates immediately in the app. - - ![Example screenshot of the Company Portal app for Windows, Device details page, Rename popup field.](./media/1808_RenameApp_Popup.png) - -## Rename device from Actions menu - -Rename a device via the **Actions** menu in the Company Portal app. - -1. Open the Company Portal app and go to **Devices**. -2. Select the device you want to rename. -2. Select **Actions** > **Rename**. -3. Type in a new name and select **Rename**. The device name updates immediately in the app. + > [!div class="mx-imgBorder"] + > ![Example screenshot of the Company Portal app for Windows highlighting the edit pencil icon and rename settings.](./media/check-device-access-windows-cpapp/company-portal-windows-rename.png) Still need help? Contact your IT support person. For contact information, sign into the Company Portal app or [Company Portal website](https://go.microsoft.com/fwlink/?linkid=2010980) with your work or school account. diff --git a/memdocs/intune/user-help/reset-device-company-portal-website.md b/memdocs/intune/user-help/reset-device-company-portal-website.md index 92a09e93995..933139db25b 100644 --- a/memdocs/intune/user-help/reset-device-company-portal-website.md +++ b/memdocs/intune/user-help/reset-device-company-portal-website.md @@ -7,7 +7,7 @@ keywords: author: lenewsad ms.author: lanewsad manager: dougeby -ms.date: 03/03/2023 +ms.date: 10/08/2024 ms.topic: end-user-help ms.service: microsoft-intune ms.subservice: end-user @@ -45,15 +45,19 @@ You can reset the following types of devices from the Company Portal website: * iOS/iPadOS devices that aren't supervised * Devices running Windows 10 or Windows 11 -The action may not be available on devices that your organization owns and lends out for use. If you're an IT support person and want to find out more about device reset and its limitations, see [Remove devices by using wipe, retire, or manually unenrolling the device](../remote-actions/devices-wipe.md). +The action may be unavailable on devices that your organization owns and lends out for use. If you're an IT support person and want to find out more about device reset and its limitations, see [Remove devices by using wipe, retire, or manually unenrolling the device](../remote-actions/devices-wipe.md). ## Reset device To reset a device to its original, out-of-box settings: 1. On any device, sign in to [the Company Portal website](https://go.microsoft.com/fwlink/?linkid=2010980) with your work or school account. -1. Select the menu > **Devices**. +1. Go to the menu and select **Devices**. 1. Select the device you want to reset. -1. Select **Reset**. If the reset option isn't visible at the top of your page, select the **More (…)** menu to see all overflow actions. Then select **Reset**. -1. A message warns you that you're about to erase all content on your device. Tap **Reset** to confirm. +1. Select **Reset**. + + >[!TIP] + > If the reset option isn't visible at the top of your page, select the **More (…)** menu to see all overflow actions. + +1. A message warns you that you're about to erase all data on your device, and reset the device to its factory default settings. Tap **Reset** to confirm. Need additional help? Contact your support person. For contact details, sign in to the [Company Portal website](https://go.microsoft.com/fwlink/?linkid=2010980) and go to **Helpdesk**. diff --git a/memdocs/intune/user-help/reset-device-company-portal-windows.md b/memdocs/intune/user-help/reset-device-company-portal-windows.md index ac75c24cc7b..6b733e0312c 100644 --- a/memdocs/intune/user-help/reset-device-company-portal-windows.md +++ b/memdocs/intune/user-help/reset-device-company-portal-windows.md @@ -2,12 +2,12 @@ # required metadata title: Reset device from Intune Company Portal for Windows | Microsoft Docs -description: Learn how to factory reset a used, lost, or stolen device in Company Portal for Windows. +description: Reset a used, lost, or stolen device in Company Portal for Windows. keywords: author: lenewsad ms.author: lanewsad manager: dougeby -ms.date: 10/04/2021 +ms.date: 10/16/2024 ms.topic: end-user-help ms.service: microsoft-intune ms.subservice: end-user @@ -20,7 +20,7 @@ searchScope: ROBOTS: #audience: -ms.reviewer: jieyang +ms.reviewer: madakeva ms.suite: ems #ms.tgt_pltfrm: ms.custom: intune-enduser; intune-azure @@ -31,40 +31,32 @@ ms.collection: # Reset device in Company Portal app for Windows -**Applies to** -- Windows 10 -- Windows 11 -- Windows 10 Mobile -- Windows Phone 8.1 - -Use the Company Portal app for Windows to reset a used, lost, or stolen device back to factory settings. All apps, settings, and personal data on the device will be deleted and the device will no longer appear in Company Portal. +Use the Company Portal app for Windows to reset a used, lost, or stolen device back to factory settings. After a reset, all apps, settings, and personal data on the device are deleted, and the device no longer appears in Company Portal. The reset option may not be available for every device that appears in Company Portal. Your organization can choose to hide the option. - ## Reset device To reset a device to its original, out-of-box settings: 1. Open the Company Portal app on any managed device and sign in with your work or school account. -2. Select **DEVICES**. -3. Select the device you want to reset. -4. Select **Actions** > **Reset**. -5. Select **Reset** to start wiping the device. +2. Select **Devices**, and then select the device you want to reset. +3. Select **Actions** > **Reset**. -## Reset limitations -Company Portal device resets aren't supported on all devices. The feasibility of a reset depends on the Windows version and how your organization configured their policies. This table lists the expected outcomes for various Windows devices and configurations. + > [!div class="mx-imgBorder"] + > ![Example screenshot of the Company Portal app for Windows highlighting the Reset option.](./media/reset-device-company-portal-windows/company-portal-windows-reset.png) +4. Select **Reset** to start wiping the device. -|Device configuration and management|Device type| -|---------------------------------------|---------------| -|Your organization manages your mobile device|**Windows 10/11 and Windows Phone 8.1**
                        Your device won't appear in Company Portal anymore, and Company Portal will try to reset the device back to the manufacturer's default settings. Your personal data, apps, and settings will be removed.

                        **Windows 10 Mobile**
                        The only way to unenroll your device is to reset it.| -|Your device can access company email only|**Windows Phone 8.1**
                        Your device won't appear in Company Portal anymore, and your work email account and unsaved emails will be deleted.

                        **Windows 7 or Windows Vista**
                        You cannot reset a device that's only used for email and running Windows 7 or earlier.

                        **Windows 8.1 and Windows 8**
                        Your device won't appear in Company Portal anymore, and your company email account and unsaved email will be deleted.| -|PCs and laptops|**Windows 8.1 and Windows 8**
                        You cannot reset a computer that's running Windows 8 or Windows 8.1, unless it's only being used for email.

                        **Windows 7 or Windows Vista**
                        You cannot reset a computer that's running Windows 7 or earlier.| + > [!div class="mx-imgBorder"] + > ![Example screenshot of the Company Portal app for Windows highlighting the confirmation message and final Reset button.](./media/reset-device-company-portal-windows/company-portal-windows-reset-confirmation.png) -## Next steps - -* You can also [reset a device from the Company Portal website](reset-device-company-portal-website.md). +## Reset limitations +Company Portal device resets aren't supported on all devices. The feasibility of a reset depends on the Windows version and how your organization configured their policies. This table lists the expected outcomes for various Windows devices and configurations. -* If you just want to remove your device from Company Portal, see [Remove your Windows device from management](unenroll-your-device-from-intune-windows.md). Removing the device effectively removes it from Intune and may cause you to lose access to the work-related content on your device. +|Device configuration and management|Device type| +|---------------------------------------|---------------| +|Your organization manages your mobile device|**Windows 10/11 and Windows Phone 8.1**
                        Your device no longer appears in Company Portal. Company Portal tries to reset the device back to the manufacturer's default settings. Your personal data, apps, and settings are removed.

                        **Windows 10 Mobile**
                        The only way to unenroll your device is to reset it.| +|Your device can access company email only|**Windows Phone 8.1**
                        Your device no longer appears in Company Portal. The email that belongs to your work account, and all unsaved emails, are deleted.

                        **Windows 7 or Windows Vista**
                        Devices running Windows 7 or earlier, and used exclusively for email, can't be reset.

                        **Windows 8.1 and Windows 8**
                        Your device no longer appears in Company Portal. The email that belongs to your work account, and all unsaved emails, are deleted.| +|PCs and laptops|**Windows 8.1 and Windows 8**
                        Devices running Windows 8 or Windows 8.1 can't be reset, unless they're used exclusively for email.

                        **Windows 7 or Windows Vista**
                        Devices running Windows 7 or earlier can't be reset.| -* Need additional help? Contact your IT support person. For contact information, check the [Company Portal website](https://go.microsoft.com/fwlink/?linkid=2010980). +Need more help? Contact your IT support person. For contact information, check the [Company Portal website](https://go.microsoft.com/fwlink/?linkid=2010980). diff --git a/memdocs/intune/user-help/set-up-mobile-threat-defense.md b/memdocs/intune/user-help/set-up-mobile-threat-defense.md index b045d2ddaf5..ef82f76b8f4 100644 --- a/memdocs/intune/user-help/set-up-mobile-threat-defense.md +++ b/memdocs/intune/user-help/set-up-mobile-threat-defense.md @@ -2,7 +2,7 @@ # required metadata title: Install mobile threat defense app on your mobile device | Microsoft Intune -description: Find out what mobile threat defense apps are and how to set one up to meet your organization's access requirements. +description: Find out what mobile threat defense apps are and how to set one up to meet work or school requirements. keywords: author: lenewsad ms.author: lanewsad @@ -36,10 +36,11 @@ ms.collection: Install a mobile threat defense (MTD) app on the personal device you use for work or school. An MTD app works by detecting and alerting you to threats on your device, like suspicious apps or networks, and operating system vulnerabilities. In this article, you'll learn how to set up and activate an MTD app so that you can satisfy your organization's security requirement and access work apps. ## Step 1: Install MTD app + >[!NOTE] -> An additional step, called *device registration*, happens prior to app installation on devices that aren't registered. Registration is required to confirm your identity and connect your school or work account to your device. For more information about device registration, see [Register your personal device on your organization's network](/azure/active-directory/user-help/user-help-register-device-on-network). +> An additional step, called *device registration*, happens prior to app installation on devices that aren't registered. Registration is required to confirm your identity and connect your work or school account to your device. For more information about device registration, see [Register your personal device on your organization's network](/azure/active-directory/user-help/user-help-register-device-on-network). -Install your organization's preferred mobile threat defense (MTD) app on your device. Your organization chooses the MTD app you need to use. If the app name or listing isn't provided to you during enrollment or app setup, contact your IT support person to determine which app you need to use. The following MTD apps are commonly used on Apple devices. Select an app to open its listing in the App Store. +Install a mobile threat defense (MTD) app on the device you use for work or school. Your organization chooses the MTD app you need to access internal resources. If the app name or listing isn't provided to you during enrollment or app setup, contact your IT support person to determine which app you need to use. The following MTD apps are commonly used on Apple devices. Select an app to open its listing in the App Store. * [ActiveShield](https://apps.apple.com/app/activeshield/id980234260) * [Microsoft Defender for Endpoint](https://apps.apple.com/app/microsoft-defender-atp/id1526737990) @@ -63,44 +64,69 @@ The following MTD apps are commonly used on Android devices. Select an app to op * [Zimperium MTD](https://play.google.com/store/apps/details?id=com.zimperium.zips) ## Step 2: Activate MTD app -Complete the following steps to activate the MTD app on your iOS or Android device. +The prompt to install a MTD app happens when you're setting up your device for work or school. The prompt could appear as an Intune Company Portal push notification or as a message in the Company Portal app or website. Tap the prompt to get the appropriate MTD app. + +After you install the MTD app, activate the MTD app on your iOS or Android device. ### Activation for iOS app 1. Open the MTD app. + 2. The MTD app asks for permission to open Microsoft Authenticator. Select **Open**. + 3. Sign in with your work account. + 4. Wait while the MTD app scans your device for security threats. If the scan doesn't happen automatically, you can start the scan yourself. -5. Return to the Company Portal app or website. - * Company Portal app: Select **CONFIRM DEVICE SETTINGS**. - * Company Portal website: Select **Check status**. - 6. Now that you have the app set up, you can sign in to work apps with your work account. If you're still blocked: - * Check the MTD app for threats and [resolve them](#resolving-a-threat). - * Return to the Company Portal app and check for other compliance issues that need your attention. For more information, see [Check compliance in Company Portal app for iOS](sync-your-device-manually-ios.md). + +5. Return to the Intune Company Portal app or website, and run a device check to register the changes you made on your device. + + * In the Company Portal app, select **CONFIRM DEVICE SETTINGS**. + + * On the Company Portal website, select **Check status**. + + After you've met this requirement, you can securely sign in and access work apps and files on your device. If Company Portal is still blocking you from access: + + * Check the MTD app for threats and [resolve them](#resolving-a-threat). + + * Return to the Company Portal app or website and check for other flagged device settings. Your workplace might have other requirements that require your attention. For more information, see [Check device compliance in Company Portal app for iOS](sync-your-device-manually-ios.md). ### Activation for Android app + 1. Open the MTD app. + 2. Review and grant permissions, as needed, to the MTD app. Permissions vary by MTD app. -3. Wait while the MTD app scans your device for security threats. If the scan doesn't happen automatically, you can start the scan yourself. -4. Return to the Company Portal app or website. - * Company Portal app: Select **CONFIRM DEVICE SETTINGS**. - * Company Portal website: Select **Check status**. -5. Now that you have the app set up, you can sign in to work apps with your work account. If you're still blocked: + +3. Wait while the MTD app scans your device for security threats. If the scan doesn't happen automatically, you can start the scan yourself. + +4. Return to the Intune Company Portal app or website, and run a device check to register the changes you made on your device. + + * In the Company Portal app, select **CONFIRM DEVICE SETTINGS**. + + * On the Company Portal website, select **Check status**. + +5. After you've met this requirement, you can securely sign in and access work apps and files on your device. If Company Portal is still blocking you from access: + * Check the MTD app for threats and [resolve them](#resolving-a-threat). + * Return to the Company Portal app and check for other compliance issues that need your attention. For more information, see [Check compliance in Company Portal app for Android](check-compliance-on-your-device-android.md). ## Resolving a threat -If a threat is detected and exceeds an acceptable threat level, your organization can either: +If a threat is detected and exceeds an acceptable threat level, your workplace could: * Block access: Block you from using apps while signed in to your work or school account. + * Wipe data: Delete your work or school data from one or more work apps. To resolve a threat and regain access to work apps, complete the following steps. 1. Open the MTD app on your device. -2. Open the threat details in the app. These details explain how the threat could affect your device if left unresolved, and how to resolve it. -3. Make the required changes on your device. For example, you may need to uninstall an app that's not safe. -4. Return to the MTD app and start a new scan. -5. Repeat these steps until all threats are resolved. It can take a few minutes for your changes to sync with the MTD app. Once those changes sync, you can access your work apps again. + +2. Open the threat details in the app. These details explain how the threat could affect your device if left unresolved, and how to resolve it. + +3. Make the required changes on your device. For example, you might need to uninstall an app that's not safe. + +4. Return to the MTD app and start a new scan. + +5. Repeat these steps until all threats are resolved. Wait a few minutes for your changes to sync between the MTD app and Company Portal. ## Information your organization can see diff --git a/memdocs/intune/user-help/sso-dialog-faqs.yml b/memdocs/intune/user-help/sso-dialog-faqs.yml new file mode 100644 index 00000000000..e8248e87c91 --- /dev/null +++ b/memdocs/intune/user-help/sso-dialog-faqs.yml @@ -0,0 +1,126 @@ +### YamlMime:FAQ +metadata: + title: FAQ - Adding your Microsoft Entra account to a device + description: Frequently asked questions about adding your Microsoft Entra account to a device and their answers. + author: DidunAyodeji + ms.author: dayodeji + ms.service: entra-id + ms.topic: faq + ms.date: 09/10/2024 + ms.reviewer: joflore + #customer intent: As an Entra account holder, I want to add my account to the device so that I am compliant with my organization's security requirements. +title: Adding your Microsoft Entra account to a device +summary: | + **The changes to the single sign-on enrollment page mentioned in this article are scheduled for October of 2024.** + + This article provides answers to some frequently asked questions (FAQ) about adding your Microsoft Entra account to a device. + +sections: + - name: Overview + questions: + - question: | + What is the single sign-on enrollment dialog page? + answer: | + The single sign-on (SSO) enrollment page is shown when you're trying to access protected resources through an app. The page is where you decide if you want to add your account to the device. When an app like Outlook tries to access a protected resource, you see the SSO enrollment page requesting you to add your account to the device. This functionality enables your administrator to make sure your device is compliant with your organization's security requirements. Adding your account to the device gives you the ability to seamlessly sign in to all your desktop apps. It also provides you with more security features. This dialog only appears when using your Microsoft Entra accounts. + + :::image type="content" source="media/sso-dialog-faqs/sso-consent-screen-no-mdm.png" alt-text="Screenshot of the SSO dialog enrollment page." lightbox="media/sso-dialog-faqs/sso-consent-screen-no-mdm.png"::: + + - question: | + What does selecting "Yes, all apps" do? + answer: | + You're automatically signed in to desktop apps that use your work or school account. You don't have to enter your credentials when you open these apps. + + - question: | + How do I sign out? + answer: | + On a Windows device, navigate to the **Settings** app > **Accounts** > **Access work or school** > Select your account > **Disconnect**. If you don't have access to the device you signed in to, go to [https://account.microsoft.com/devices](https://account.microsoft.com/devices) to manage your account and sign out. + + > [!NOTE] + > Signing out of any individual desktop app doesn't remove your account from the device. You must sign out of all apps via settings or [https://account.microsoft.com/devices](https://account.microsoft.com/devices) to remove your account from the device. + + - question: | + What does selecting "No, this app only" do? + answer: | + You're signed in to the individual app that you're currently trying to sign in to. Your account isn't added to the device and it isn't shown in the Windows Settings app under Accounts. You aren't signed in to other apps. + + - name: Mobile device management + questions: + - question: | + What is mobile device management? + answer: | + [Mobile device management (MDM)](/windows/client-management/mdm-overview) lets your administrator manage security and applications on your personal or corporate device without compromising your privacy. It's how organizations make sure only devices that are up to date and configured with required security policies are able to access apps and resources. If your company enables mobile device management, you see the following version of the dialog and you can enroll by checking the **Allow my organization to manage this device** checkbox. + + :::image type="content" source="media/sso-dialog-faqs/sso-consent-screen-mdm.png" alt-text="Screenshot of the SSO dialog enrollment page with MDM enrollment." lightbox="media/sso-dialog-faqs/sso-consent-screen-mdm.png"::: + + - question: | + What can an administrator see if I enroll in MDM? + answer: | + [Things your administrator can always see.](/mem/intune/user-help/what-info-can-your-company-see-when-you-enroll-your-device-in-intune#things-your-organization-can-always-see) + + - question: | + What can an administrator never see even if I enroll in MDM? + answer: | + [Things your administrator can never see.](/mem/intune/user-help/what-info-can-your-company-see-when-you-enroll-your-device-in-intune#things-your-organization-can-never-see) + + - question: | + What happens if I check the device management checkbox but don't sign in to all apps, I sign in to this app only? + answer: | + [Mobile device management](/windows/client-management/mdm-overview) isn't activated. If you select "No, this app only," mobile device management isn't activated even if the checkbox is checked. Mobile device management can only be turned on if you select "Yes, all apps." + + - question: | + What happens if I uncheck the device management checkbox but sign in to all apps? + answer: | + You're signed in to all desktop apps on the device, but the device isn't enrolled in [mobile device management](/windows/client-management/mdm-overview). Your organization might require MDM to access some applications or resources, without it you might not have access. + + - question: | + What can my administrator do if I enroll in mobile device management? + answer: | + They're able to: + - Install applications on devices + - Restrict access to specific operating systems + - Deploy and update software + - Configure device settings + - Enforce security policies + - Block personal devices + - Remove data from lost or stolen devices + - Secure and protect data on devices + + - name: General + questions: + - question: | + Can I change my selections later? + answer: | + The SSO enrollment dialog page appears only once per account so to change your choices, sign out of the account then sign back in. When you sign back in, you see the SSO enrollment dialog page again. You can then make different selections. + + - question: | + Why am I seeing the SSO enrollment dialog page? + answer: | + All Microsoft Entra users are prompted to add their account to the device when signing in to an app because it can provide you with more security. This page is where you decide if you want to add your account to the device or not. If your administrator requires mobile device management, you get to decide if you want to enroll in mobile device management on this page as well. + + - question: | + What are the benefits of signing in to all apps on my device? + answer: | + In addition to being compliant with your organization's policies, you get more security features. You're also automatically signed in to all your desktop apps. + + - question: | + Do my choices here apply to other devices I'm signed in to? + answer: | + No, your choices on the SSO enrollment page apply to this device only. + + - question: | + What is the difference between a service and an app? + answer: | + A desktop app is a software program that you access directly on the computer and it runs locally on the computer. A web app is a combination of pages that you access via a browser and it runs in the cloud. A web app has links to help you navigate through multiple pages. + + A service enables communication between different apps that work with the internet. Web services work by exposing APIs (Application Programming Interfaces) and allow for the exchange of information between different apps across different platforms (mobile, Windows, Microsoft Edge). + + - question: | + For administrator reference + answer: | + [Conditional Access](/entra/identity/conditional-access/overview) policies are used by administrators to protect resources. + + Applications configured to work with Windows [Web Account Manager](/entra/identity-platform/scenario-desktop-acquire-token-wam) authentication broker provide you with SSO and other [security features](/entra/identity/conditional-access/concept-token-protection). + + All Microsoft Entra customers are prompted to sign in using Web Account Manager if the app and operating system support it. + + [Learn more about mobile device management](/mem/intune/fundamentals/what-is-device-management). diff --git a/memdocs/intune/user-help/sync-your-device-manually-windows.md b/memdocs/intune/user-help/sync-your-device-manually-windows.md index c8b7ebf1144..10c27d8830e 100644 --- a/memdocs/intune/user-help/sync-your-device-manually-windows.md +++ b/memdocs/intune/user-help/sync-your-device-manually-windows.md @@ -7,7 +7,7 @@ keywords: author: lenewsad ms.author: lanewsad manager: dougeby -ms.date: 06/28/2024 +ms.date: 10/16/2024 ms.topic: end-user-help ms.service: microsoft-intune ms.subservice: end-user @@ -38,24 +38,26 @@ Sync the enrolled device you're using for work to get the latest updates, requir This article describes how to start a sync from the: -* Company Portal app -* Windows desktop taskbar or Start menu -* System settings app +* Company Portal app +* Windows desktop taskbar or Start menu +* System settings app ## Sync from Company Portal app for Windows Complete these steps to sync a device in the Company Portal app. You can sync devices running Windows 10 with the Creator's Update (1703) or later, and Windows 11. -1. Open the Company Portal app on your device. +1. Open the Company Portal app on your device and go to **Settings**. -2. Select **Settings** > **Sync**. + > [!div class="mx-imgBorder"] + > ![Example screenshot of the Company Portal app homepage, highlighting the Settings option.](./media/sync-your-device-manually-windows/company-portal-windows-settings.png) - ![Screenshot home page of Company Portal app, highlighting Settings area.](./media/RS1_homePage_settings_04.png) - - ![Screenshot settings page of Company Portal app, highlighting Sync button.](./media/RS1_settingspage_sync05.png) +1. Select **Sync**. + + > [!div class="mx-imgBorder"] + > ![Example screenshot of the Company Portal app, highlighting Sync button.](./media/sync-your-device-manually-windows/company-portal-windows-sync.png) ## Sync from device taskbar or Start menu -You can access the Company Portal syncing action from your device's desktop. This way is useful if you have the app pinned directly to your taskbar or Start menu, and want to quickly sync. +You can access Company Portal syncing action from the desktop. This way is useful if you have the app pinned directly to your taskbar or Start menu, and want to quickly sync. 1. Find the Company Portal app icon in your taskbar or Start menu. 2. Right-click the app's icon so its menu (also referred to as a jump list) appears. diff --git a/memdocs/intune/user-help/turn-off-microsoft-usage-data-collection-aosp.md b/memdocs/intune/user-help/turn-off-microsoft-usage-data-collection-aosp.md index 40a97e4acd0..7375528486c 100644 --- a/memdocs/intune/user-help/turn-off-microsoft-usage-data-collection-aosp.md +++ b/memdocs/intune/user-help/turn-off-microsoft-usage-data-collection-aosp.md @@ -7,7 +7,7 @@ keywords: author: lenewsad ms.author: lanewsad manager: dougeby -ms.date: 11/29/2023 +ms.date: 10/10/2024 ms.topic: end-user-help ms.service: microsoft-intune ms.subservice: end-user @@ -34,6 +34,8 @@ In-app performance and usage data is automatically anonymized and shared with Mi To turn off data collection: -1. Open the Intune app. -2. Select the menu button > **Settings**. -3. Turn **Usage data** off. +1. Open the Intune app. + +1. Select the menu button > **Settings**. + +1. Turn **Usage data** off. diff --git a/memdocs/intune/user-help/turn-off-microsoft-usage-data-collection-windows.md b/memdocs/intune/user-help/turn-off-microsoft-usage-data-collection-windows.md index ac51f974386..bd08617bce9 100644 --- a/memdocs/intune/user-help/turn-off-microsoft-usage-data-collection-windows.md +++ b/memdocs/intune/user-help/turn-off-microsoft-usage-data-collection-windows.md @@ -7,7 +7,7 @@ keywords: privacy author: lenewsad ms.author: lanewsad manager: dougeby -ms.date: 10/04/2021 +ms.date: 10/16/2024 ms.topic: end-user-help ms.service: microsoft-intune ms.subservice: end-user @@ -35,11 +35,17 @@ ms.collection: - Windows 10 - Windows 11 -This article describes how to prevent Microsoft from collecting data about your Intune Company Portal usage. To turn off data collection in Company Portal: +This article describes how to prevent Microsoft from collecting data about your Company Portal app usage. To turn off data collection in Company Portal: -1. Open the Company Portal app. -2. Select **Settings**. -3. Under **Usage data**, switch the toggle to **No**. +1. Open the Company Portal app and go to **Settings**. + + > [!div class="mx-imgBorder"] + > ![Example screenshot of the Company Portal app homepage, highlighting the Settings option.](./media/sync-your-device-manually-windows/company-portal-windows-settings.png) + +1. Under **Usage data**, switch the toggle to **No**. + + > [!div class="mx-imgBorder"] + > ![Example screenshot of the Company Portal app settings page, highlighting the usage data toggle that's set to "No".](./media/turn-off-microsoft-usage-data-collection-windows/company-portal-windows-usage-data.png) ## Allowing Microsoft data collection diff --git a/memdocs/intune/user-help/unenroll-your-device-from-intune-macos.md b/memdocs/intune/user-help/unenroll-your-device-from-intune-macos.md index 881f433ea69..37486c145b3 100644 --- a/memdocs/intune/user-help/unenroll-your-device-from-intune-macos.md +++ b/memdocs/intune/user-help/unenroll-your-device-from-intune-macos.md @@ -7,7 +7,7 @@ keywords: author: lenewsad ms.author: lanewsad manager: dougeby -ms.date: 08/25/2021 +ms.date: 10/08/2024 ms.topic: end-user-help ms.service: microsoft-intune ms.subservice: end-user @@ -37,39 +37,37 @@ After you remove a device: - The device is removed from Intune. - The device loses access to Company Portal features. For example, you can't install apps for the device from the Company Portal. -- You lose access to internal file shares and websites from your device. -- You lose access to internal apps on your device. -- You might be blocked from connecting to your org's network over Wi-Fi or virtual private network (VPN). +- You lose access to work or school file shares and websites previously accessed from the device. +- You lose access to work apps that are on the device. +- You might be blocked from connecting to your organization's network over Wi-Fi or virtual private network (VPN). - Work and school email profiles are removed from the device. -- Device restrictions previously enforced by Intune (for example, disabling the camera or requiring a certain password length) are no longer required. +- Device restrictions previously enforced by Company Portal (for example, disabling the camera or requiring a certain password length) are no longer enforced. This article describes how to remove a device from within the Company Portal app, and then how to uninstall the app. - ## Remove a device + Follow these steps to remove a device from Company Portal that you no longer need for work or school. For these steps to work, you must still have access to your work or school account. If you no longer have access to your account, see [Remove management profile](unenroll-your-device-from-intune-macos.md#remove-management-profile) (in this article) to unenroll your device. -1. Sign in to Company Portal for macOS. -2. Go to **Devices** and select the device you want to unenroll. -3. From the app toolbar, select the **Devices** menu > **Remove**. +1. Sign in to Company Portal for macOS. + +2. Go to **Devices** and select the device you want to unenroll. + +3. From the app toolbar, select the **Devices** menu > **Remove**. + 4. When asked to confirm the removal, select **Remove**. The device is immediately removed from Intune. After you complete these steps, you can uninstall Company Portal from your device. ## Remove management profile + To remove a device after you've left your workplace or school, you have to remove the *management profile* that was installed during enrollment. For steps specific to your version of macOS, see [Remove a configuration profile from your Mac](https://support.apple.com/guide/mac-help/configuration-profiles-standardize-settings-mh35561/mac) on the Apple Support website. After you remove the management profile, you can uninstall Company Portal from your device. ## Uninstall Company Portal app -To uninstall the Company Portal app from a macOS device: - -1. Open **Finder** > **Applications**. -2. Select and drag the Company Portal app to **Trash** (located in your dock). Or select the app and then choose **File** > **Move to Trash**. - - ![Example screenshot of macOS Finder, Applications folder, Company Portal app, highlighting "Move to Trash" option in the app menu.](./media/intune-company-portal-move-to-trash.png) -3. If prompted to, enter your device username and password to confirm the move. +To uninstall the Company Portal app from a macOS device, select and drag the Company Portal app to the trashcan located in your dock. For more information, see [Uninstall apps on your Mac](https://support.apple.com/en-us/102610) on the Apple Support website. ## Next steps If you change your mind and want your access back later, install the Company Portal app and go through device setup again. For detailed instructions, see [Enroll your Mac with Intune Company Portal](enroll-your-device-in-intune-macos-cp.md). -Still need help? Contact your support person. For contact information, check the [Company Portal website](https://go.microsoft.com/fwlink/?linkid=2010980). +Still need help? Contact your support person. For your organization's helpdesk information, sign in to the Company Portal app or [Company Portal website](https://go.microsoft.com/fwlink/?linkid=2010980). diff --git a/memdocs/intune/user-help/you-need-to-resolve-a-threat-found-by-checkpoint-android.md b/memdocs/intune/user-help/you-need-to-resolve-a-threat-found-by-checkpoint-android.md deleted file mode 100644 index 3280a4edc9d..00000000000 --- a/memdocs/intune/user-help/you-need-to-resolve-a-threat-found-by-checkpoint-android.md +++ /dev/null @@ -1,109 +0,0 @@ ---- -# required metadata - -title: Resolve threats in Harmony Mobile Protect for Android - Microsoft Intune | Microsoft Docs -description: Learn how to use Harmony Mobile Protect for Android to keep your device secure. -keywords: -author: lenewsad -ms.author: lanewsad -manager: dougeby -ms.date: 04/19/2022 -ms.topic: end-user-help -ms.service: microsoft-intune -ms.subservice: end-user -ms.assetid: 449c34ec-2d94-4c7f-8691-a5200efee3cb -searchScope: - - User help - -# optional metadata - -ROBOTS: -#audience: - -ms.reviewer: heenamac -#ms.suite: ems -#ms.tgt_pltfrm: -ms.custom: intune-enduser -ms.collection: -- tier2 ---- - -# Resolve threats found by Harmony Mobile Protect for Android - -Harmony Mobile Protect is a mobile threat defender app that's integrated with Intune to alert you to potential threats and compliance problems. As long as the threat or problem exists on your device, you might not be able to: - -* Connect to corporate e-mail -* Connect to corporate Wi-Fi -* Connect to SharePoint Online -* Sync corporate files with OneDrive -* Access internal apps - -This article describes how to use the app to view and resolve threats. - -## Set up Harmony Mobile Protect app -Complete the following steps to set up Harmony Mobile Protect on your device. - -1. Install the app from [Google Play](https://go.microsoft.com/fwlink/?linkid=2139455). Your organization might let you know that you need to get the app via notification, email, or by installing the app on your device. - * Company Portal/Intune app notification: Tap the push notification to open Google Play. - * Work or school email: Tap the link or scan the QR code provided in that email to open Google Play. - * App already installed: Open the app and continue to step 3 to sign in. -3. When installation is complete, open the app. -4. Tap your account (the same one you use to sign in at work or school) to sign in. -5. Tap **ACTIVATE** to make the app a device administrator. - -After your initial sign-in, the app will scan your device for threats. - -## Using Harmony Mobile Protect -Harmony Mobile Protect detects device threats, app threats, and network security events. This section describes how to use the app to view and resolve each type of threat. - -### Get threat notifications -By default, Harmony Mobile Protect uses push notifications and its in-app **Threat Center** to alert you to threats and events. As a best practice, do not turn off these notifications. - - ### View overall device status -The app's main screen shows the current status and threat count, if applicable. - -* No threat or events detected: The screen shows a green circle with a checkmark. - -* Threats detected: The screen shows a red circle with the number of threats detected. - -* Security event occurred: The screen shows a blue circle with the number of events that occurred. - -## View device threats -A device threat happens when the settings on your device don't meet your organization's requirements. When a threat is present, a red dot appears next to the **MY DEVICES** icon. To get more details about a threat: - -1. Tap **MY DEVICES** to open the list of settings that were scanned on your device. -2. Settings that appear in red do not meet your organization's requirements. Tap a red setting to find out more information about it. -3. Open the Settings app on your device to adjust the setting. -4. If Harmony Mobile Protect doesn't show the threat as resolved right away, return to the app and tap the circle on the main app page to initiate a new scan. - -### View app threats -An app is considered a threat when it poses a security risk to you or your organization's data. Examples of threats include: - -* Apps that contain malware -* Apps that are on your organization's block list -* Apps that are installed from unknown sources - -When a threat is present, a red dot appears next to the **MY APPS** icon. To get more details about a threat: - -1. Tap **MY APPS**. -2. The **SECURITY HISTORY** section shows the number of apps with threats. Tap the number. -3. The **Threat Center** opens. Tap the **i** info icon next to a threat to get more details about the threat, including the steps to resolve it. The quickest way to resolve a threat is to uninstall the affected app. - -To find out why your organization classifies an app as high, medium, or low risk, contact your IT support person. - -### View security events -A security event occurs when Harmony Mobile Protect prevents an attack before it happens. This type of event is informational and poses no immediate risk on your device. They could happen if your organization enforces network protection policies, such as requiring you to use a VPN. - -When an event occurs, you'll see a blue dot next to the **MY NETWORK** icon. To get more details about a security event: - -1. Tap **MY NETWORK**. -2. The **NETWORK PROTECTION** section shows the number of events that occurred. Tap the number. -3. The **Event Center** opens. Tap the **i** info icon next to any event to get more details about the prevented threat. - -## Next steps -If you use Company Portal or the Intune app, open the app and sync your device after you resolve a threat. Otherwise, you'll have to wait until Intune checks in with your device to regain access to corporate resources. - -Still need help? - -* For the most up-to-date information about Harmony Mobile Protect, see the Harmony Mobile Protect user and admin guides on the [Check Point support center website](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk120655). -* For additional help, contact your IT support person. Check out the [Company Portal website](https://go.microsoft.com/fwlink/?linkid=2010980) for contact information. diff --git a/memdocs/intune/user-help/you-need-to-resolve-a-threat-found-by-checkpoint-ios.md b/memdocs/intune/user-help/you-need-to-resolve-a-threat-found-by-checkpoint-ios.md deleted file mode 100644 index ea60121db00..00000000000 --- a/memdocs/intune/user-help/you-need-to-resolve-a-threat-found-by-checkpoint-ios.md +++ /dev/null @@ -1,52 +0,0 @@ ---- -# required metadata - -title: Resolving threats found by Check point Harmony Mobile Protect for iOS | Microsoft Docs -description: Learn how to fix a threat found by Check point Harmony Mobile Protect for iOS. -keywords: -author: lenewsad -ms.author: lanewsad -manager: dougeby -ms.date: 07/11/2024 -ms.topic: end-user-help -ms.service: microsoft-intune -ms.subservice: end-user -ms.assetid: 5b2a69e7-cc86-4f1b-81d9-35b8b23b937b -searchScope: - - User help - -# optional metadata - -ROBOTS: -#audience: - -ms.reviewer: heenamac -#ms.suite: ems -#ms.tgt_pltfrm: -ms.custom: intune-enduser -ms.collection: -- tier2 ---- - -# Resolve a threat found by Harmony Mobile Protect on iOS - -Harmony Mobile Protect is a mobile threat defense service that identifies and assesses potential threats on mobile devices used for work or school. The Harmony Mobile Protect app for iOS works with the Intune Company Portal app to keep work devices free of viruses and threats. While threats are present, you may be restricted from using your device for work, and unable to: - -* Connect to corporate e-mail -* Connect to corporate Wi-Fi -* Connect to SharePoint Online -* Sync corporate files with OneDrive -* Access company app - -This article describes how to recognize alerts about detected threats, and what to do to resolve them. - -## Troubleshoot virus or security threat -When Harmony Mobile Protect detects a virus or security threat on a work or school device, it acts according to your organization's mobile device management (MDM) policies. To maintain work access on the device, immediately investigate push notifications and Company Portal alerts about detected threats. Tap or open threat notifications and follow the onscreen instructions to resolve them in the Harmony Mobile Protect app. - - ![Example screenshot of the Company Portal device page, showing the Harmony Mobile Protect warning.](./media/CP-lookout-virus-banner-1808.png) - -## Troubleshoot an app threat - -If you continue to use a work or school device with an app threat, your device will lose access to work or school resources. To resolve the threat and regain access, go to the Harmony Mobile Protect app. Select the app from the list of threats, and then follow the onscreen instructions to uninstall the app. - -Still need help? Check in with your IT support person. You can find their contact information on the [Company Portal website](https://go.microsoft.com/fwlink/?linkid=2010980) or in the Intune Company Portal app. diff --git a/memdocs/intune/user-help/you-need-to-resolve-a-threat-found-by-lookout-for-work-android.md b/memdocs/intune/user-help/you-need-to-resolve-a-threat-found-by-lookout-for-work-android.md deleted file mode 100644 index b8ae5b212e2..00000000000 --- a/memdocs/intune/user-help/you-need-to-resolve-a-threat-found-by-lookout-for-work-android.md +++ /dev/null @@ -1,65 +0,0 @@ ---- -# required metadata - -title: Resolving threats found by Lookout for Work on Android | Microsoft Docs -description: Learn how to fix a threat found on an Android device by the Lookout for Work app. -keywords: -author: lenewsad - -ms.author: lanewsad -manager: dougeby -ms.date: 08/28/2018 -ms.topic: end-user-help -ms.service: microsoft-intune -ms.subservice: end-user -ms.assetid: 5656b3e6-e812-4264-a170-b17c9c03e4d4 - -searchScope: - - User help - -# optional metadata - -ROBOTS: -#audience: - -ms.reviewer: natgreen -#ms.suite: ems -#ms.tgt_pltfrm: -ms.custom: intune-enduser -ms.collection: -- tier2 ---- - -# Resolve a threat found by Lookout for Work on Android - -The Lookout for Work app is a Mobile Threat Defender service that identifies potential threats on your Android devices. These threats are reported to the Company Portal app, and appear there as unresolved, noncompliant issues. As long as these threats are present, you may be unable to: - -* Connect to corporate e-mail -* Connect to corporate Wi-Fi -* Connect to SharePoint Online -* Sync corporate files with OneDrive -* Access company apps - -This article describes how to recognize Lookout for Work threat alerts and what to do to resolve them. - -## Troubleshoot virus or security threat -Regain access to your company's resources when the Lookout for Work app detects a security or virus threat. - -1. If a virus or security threat is detected, you'll receive a message like the one shown in the screenshot below. Tap the **device management portal** link to open the [Company Portal website](https://portal.manage.microsoft.com/devices). - - ![Example screenshot of a Lookout for Work error message, with a link to Company Portal website and blue OK button.](./media/mtd-go-to-device-management-portal-android.png) - -2. Select your device. -3. Read the warning that appears below your device. It will instruct you to open Lookout for Work to fix the virus or security threat. - - ![Example screenshot of the Company Portal device page, showing the Lookout for Work warning.](./media/CP-lookout-virus-banner-1808.png) - -## Troubleshoot an app threat - -If you install an app that Lookout for Work identifies as a threat, you'll receive a message like the one shown in the screenshot below. - -![Example screenshot showing a Lookout Virus Alert message over the Lookout for Work app interface. Shows three buttons: "Close," "More Info," and "Uninstall."](./media/lookout-virus-alert-android.png) - -To regain the access you've lost to your company email and data, uninstall the questionable app. As long as the app is on your device, you'll be unable to access company resources. - -Still need help? Contact your company support. For contact information, check the [Company Portal website](https://go.microsoft.com/fwlink/?linkid=2010980). diff --git a/memdocs/intune/user-help/you-need-to-resolve-a-threat-found-by-lookout-for-work-ios.md b/memdocs/intune/user-help/you-need-to-resolve-a-threat-found-by-lookout-for-work-ios.md deleted file mode 100644 index 2904c65a155..00000000000 --- a/memdocs/intune/user-help/you-need-to-resolve-a-threat-found-by-lookout-for-work-ios.md +++ /dev/null @@ -1,63 +0,0 @@ ---- -# required metadata - -title: Resolving threats found by Lookout for Work on iOS | Microsoft Docs -description: Learn how to fix a threat found on your iOS device by the Lookout for Work app. -keywords: -author: lenewsad - -ms.author: lanewsad -manager: dougeby -ms.date: 10/05/2018 -ms.topic: end-user-help -ms.service: microsoft-intune -ms.subservice: end-user -ms.assetid: dd6aec3a-4063-4054-8d0f-d2f2034f0d3d - -searchScope: - - User help - -# optional metadata - -ROBOTS: -#audience: - -ms.reviewer: natgreen -#ms.suite: ems -#ms.tgt_pltfrm: -ms.custom: intune-enduser -ms.collection: -- tier2 ---- - -# Resolve a threat found by Lookout for Work on iOS - -The Lookout for Work app is a Mobile Threat Defender service that identifies potential threats on your iOS device. These threats are reported to the Company Portal app, and appear there as unresolved, noncompliant issues. As long as these threats are present, you may be unable to: - -* Connect to corporate e-mail -* Connect to corporate Wi-Fi -* Connect to SharePoint Online -* Sync corporate files with OneDrive -* Access company apps - -This article describes how to recognize Lookout for Work threat alerts and what to do to resolve them. - -## Troubleshoot virus or security threat -Regain access to your company's resources when the Lookout for Work app detects a security or app threat. - -1. If a virus or security threat is detected, you'll receive a message like the one shown in the screenshot below. Tap the **device management portal** link to open the [Company Portal website](https://portal.manage.microsoft.com/devices). - - ![Example screenshot of a Lookout for Work error message, with a link to Company Portal website and blue OK button.](./media/mtd-go-to-device-management-portal-android.png) - -2. Select your device. -3. Read the warning that appears below your device. It will instruct you to open Lookout for Work to fix the virus or security threat. - - ![Example screenshot of the Company Portal device page, showing the Lookout for Work warning.](./media/CP-lookout-virus-banner-1808.png) - -## Troubleshoot an app threat -If you install an app that Lookout for Work identifies as a threat, you'll receive a message like the one shown in the screenshot below. - -![Example screenshot showing a list of Active and Resolved app Threats detected by Lookout for Work.](./media/ios-lfw-threat-example.png) -Select the app name shown at the top of your screen. Then follow the instructions to remove and uninstall the app. As long as the app is on your device, you'll be unable to access company resources. - -Still need help? Check in with your company support. You can find their contact information on the [Company Portal website](https://go.microsoft.com/fwlink/?linkid=2010980). diff --git a/memdocs/intune/user-help/you-need-to-resolve-a-threat-found-by-skycure-android.md b/memdocs/intune/user-help/you-need-to-resolve-a-threat-found-by-skycure-android.md deleted file mode 100644 index 58a23b6743a..00000000000 --- a/memdocs/intune/user-help/you-need-to-resolve-a-threat-found-by-skycure-android.md +++ /dev/null @@ -1,62 +0,0 @@ ---- -# required metadata - -title: Resolving threats found by Symantec Endpoint Protection Mobile for Android | Microsoft Docs -description: Learn how to fix threats found on your Android device. -keywords: -author: lenewsad - -ms.author: lanewsad -manager: dougeby -ms.date: 07/01/2024 -ms.topic: end-user-help -ms.service: microsoft-intune -ms.subservice: end-user -ms.assetid: b5521762-a80c-4630-ae30-38b471da216b - -searchScope: - - User help - -# optional metadata - -ROBOTS: -#audience: - -ms.reviewer: heenamac -#ms.suite: ems -#ms.tgt_pltfrm: -ms.custom: intune-enduser -ms.collection: -- tier2 ---- - -# Resolve a threat found by Symantec Endpoint Protection Mobile on Android - -Symantec Endpoint Protection (SEP) Mobile is a Mobile Threat Defender service that identifies potential threats on your Android devices. These threats are reported to the Company Portal app, and appear as unresolved, noncompliant issues. If your device is identified as being noncompliant, you may be unable to: - -* Connect to corporate e-mail -* Connect to corporate Wi-Fi -* Connect to SharePoint Online -* Sync corporate files with OneDrive -* Access company apps - -This article describes how to recognize SEP Mobile threat alerts and what to do to resolve them. - -## Resolve virus or security threat - -1. When you attempt to access company email or websites, you'll receive a message like the one shown in the screenshot below. Tap the **device management portal** link to open the [Company Portal website](https://portal.manage.microsoft.com/devices). - - ![Example screenshot of a Lookout for Work error message, with a link to Company Portal website and blue OK button.](./media/mtd-go-to-device-management-portal-android.png) - -2. Select your device. -3. Read the warning that appears below your device. It will instruct you to open SEP Mobile to fix the virus or security threat. - - ![Example screenshot of the Company Portal device page, showing the SEP Mobile warning.](./media/CP-lookout-virus-banner-1808.png) - -## Resolve an app threat - -If you install an app that's seen as a threat to your device, you'll receive a notification within the SEP Mobile app. If the affected app remains on your device, you'll be unable to access company resources. - -To resolve, select the app from the list of threats in SEP Mobile. Then follow the on-screen instructions to remove and uninstall the app. - -Still need help? Contact your company support. For contact information, check the [Company Portal website](https://go.microsoft.com/fwlink/?linkid=2010980). diff --git a/memdocs/intune/user-help/you-need-to-resolve-a-threat-found-by-skycure-ios.md b/memdocs/intune/user-help/you-need-to-resolve-a-threat-found-by-skycure-ios.md deleted file mode 100644 index 9e9e0b33e06..00000000000 --- a/memdocs/intune/user-help/you-need-to-resolve-a-threat-found-by-skycure-ios.md +++ /dev/null @@ -1,62 +0,0 @@ ---- -# required metadata - -title: Resolving threats found by Symantec Endpoint Protection Mobile for iOS | Microsoft Docs -description: Learn how to fix threats security, virus, and app threats found on your iOS device. -keywords: -author: lenewsad - -ms.author: lanewsad -manager: dougeby -ms.date: 10/05/2018 -ms.topic: end-user-help -ms.service: microsoft-intune -ms.subservice: end-user -ms.assetid: b40595f0-a399-4aa1-aa6f-344c2a1cb883 - -searchScope: - - User help - -# optional metadata - -ROBOTS: -#audience: - -ms.reviewer: heenamac -#ms.suite: ems -#ms.tgt_pltfrm: -ms.custom: intune-enduser -ms.collection: -- tier2 ---- - -# Resolve a threat found by Symantec Endpoint Protection Mobile on iOS - -Symantec Endpoint Protection (SEP) Mobile is a Mobile Threat Defender service that identifies potential threats on your Android devices. These threats are reported to the Company Portal app, and appear as unresolved, noncompliant issues. If your device is identified as being noncompliant, you may be unable to: - -* Connect to corporate e-mail -* Connect to corporate Wi-Fi -* Connect to SharePoint Online -* Sync corporate files with OneDrive -* Access company apps - -This article describes how to regain access to your company's resources when SEP Mobile detects a security or app threat. - -## Troubleshoot a virus or security threat - -1. When you attempt to access company email or websites, you'll receive a message like the one shown in the screenshot below. Tap the **device management portal** link to open the [Company Portal website](https://portal.manage.microsoft.com/devices). - - ![Example screenshot of a Lookout for Work error message, with a link to Company Portal website and blue OK button.](./media/mtd-go-to-device-management-portal-android.png) - -2. Select your device. -3. Read the warning that appears below your device. It will instruct you to open SEP Mobile to fix the virus or security threat. - - ![Example screenshot of the Company Portal device page, showing the SEP Mobile warning.](./media/CP-lookout-virus-banner-1808.png) - -## Troubleshoot an app threat - -If you install an app that's seen as a threat to your device, you'll receive a notification within the SEP Mobile app. If the affected app remains on your device, you'll be unable to access company resources. - -To resolve, select the app from the list of threats in SEP Mobile. Then follow the on-screen instructions to remove and uninstall the app. - -Still need help? Check in with your company support. You can find their contact information on the [Company Portal website](https://go.microsoft.com/fwlink/?linkid=2010980). diff --git a/memdocs/intune/user-help/you-need-to-resolve-a-threat-found-by-zips-android.md b/memdocs/intune/user-help/you-need-to-resolve-a-threat-found-by-zips-android.md deleted file mode 100644 index c72ba16bdd8..00000000000 --- a/memdocs/intune/user-help/you-need-to-resolve-a-threat-found-by-zips-android.md +++ /dev/null @@ -1,60 +0,0 @@ ---- -# required metadata - -title: Resolving threats found by Zimperium zIPS on Android -description: Learn how to fix security and app threats found on your Android device. -keywords: -author: lenewsad -ms.author: lanewsad -manager: dougeby -ms.date: 07/01/2024 -ms.topic: end-user-help -ms.service: microsoft-intune -ms.subservice: end-user -ms.assetid: 9ffbb656-93cd-4e0b-96c0-c5038cd2cf31 -searchScope: - - User help - -# optional metadata - -ROBOTS: -#audience: - -ms.reviewer: heenamac -#ms.suite: ems -#ms.tgt_pltfrm: -ms.custom: intune-enduser -ms.collection: -- tier2 ---- - -# Resolve a threat found by Zimperium zIPS on Android - -Zimperium zIPS is a Mobile Threat Defender service that identifies potential threats on your Android devices. These threats are reported to the Company Portal app, and appear as unresolved, noncompliant issues. If your device is identified as being noncompliant, you may be unable to: - -* Connect to corporate e-mail -* Connect to corporate Wi-Fi -* Connect to SharePoint Online -* Sync corporate files with OneDrive -* Access company apps - -This article describes how to recognize Zimperium zIPS threat alerts and what to do to resolve them. - -## Troubleshoot virus or security threat -When a virus or security threat is detected, Zimperium zIPS will enforce restrictions according to your organization's access policies. Your company's access policies could prevent you from accessing your work's network, apps, and email from your device. - -Zimperium zIPS will prompt you to take action to regain the access you've lost. Select the threat and follow the instructions within the app to resolve it. - -Because the app is integrated with your company's MDM provider, you'll also see a warning about restricted access in the Company portal app. The warning instructs you to open Zimperium zIPS to fix the virus or security threat. - - ![Example screenshot of the Company Portal device page, showing the Zimperium zIPS warning.](./media/CP-lookout-virus-banner-1808.png) - -Select the warning banner that appears below the affected device. Zimperium zIPS will open and tell you how to eliminate the threat. - -## Resolve an app threat - -If you install an app that's seen as a threat to your device, you'll receive a notification within Zimperium zIPS. If the affected app remains on your device, you'll be unable to access company resources. - -To resolve, select the app from the list of threats in Zimperium zIPS. Then follow the on-screen instructions to remove and uninstall the app. - -Still need help? Contact your company support. For contact information, check the [Company Portal website](https://go.microsoft.com/fwlink/?linkid=2010980). diff --git a/memdocs/intune/user-help/you-need-to-resolve-a-threat-found-by-zips-ios.md b/memdocs/intune/user-help/you-need-to-resolve-a-threat-found-by-zips-ios.md deleted file mode 100644 index 2fde2d0028a..00000000000 --- a/memdocs/intune/user-help/you-need-to-resolve-a-threat-found-by-zips-ios.md +++ /dev/null @@ -1,58 +0,0 @@ ---- -# required metadata - -title: Resolving threats found by Zimperium zIPS on iOS | Microsoft Docs -description: Learn how to fix threats found on your iOS device. -keywords: -author: lenewsad -ms.author: lanewsad -manager: dougeby -ms.date: 07/01/2024 -ms.topic: end-user-help -ms.service: microsoft-intune -ms.subservice: end-user -ms.assetid: eaccd9c0-cd46-48e2-8675-4c022c74f672 -searchScope: - - User help - -# optional metadata - -ROBOTS: -#audience: - -ms.reviewer: heenamac -#ms.suite: ems -#ms.tgt_pltfrm: -ms.custom: intune-enduser -ms.collection: -- tier2 ---- - -# Resolve a threat found by Zimperium zIPS on iOS - -Zimperium zIPS is a Mobile Threat Defender service that identifies potential threats on your iOS devices. These threats are reported to the Company Portal app, and appear as unresolved, noncompliant issues. If your device is identified as being noncompliant, you may be unable to: - -* Connect to corporate e-mail -* Connect to corporate Wi-Fi -* Connect to SharePoint Online -* Sync corporate files with OneDrive -* Access company apps - -This article describes how to recognize Zimperium zIPS threat alerts and what to do to resolve them. - -## Troubleshoot virus or security threat -If a virus or security threat is detected, Zimperium zIPS will enforce restrictions according to your organization's access policies. Your company's access policies could prevent you from accessing your work's network, apps, and email from your device. - -Zimperium zIPS will prompt you to take action to regain the access you've lost. Select the threat and follow the instructions within the app to resolve it. - -Because the app is integrated with your company's MDM provider, you'll also see a warning about restricted access in the Company portal app. The warning instructs you to open Zimperium zIPS to fix the virus or security threat. - - ![Example screenshot of the Company Portal device page, showing the Zimperium zIPS warning.](./media/CP-lookout-virus-banner-1808.png) - -## Troubleshoot an app threat - -If you install an app that's seen as a threat to your device, you'll receive a notification within Zimperium zIPS. If the affected app remains on your device, you'll be unable to access company resources. - -To resolve, select the app from the list of threats in Zimperium zIPS. Then follow the on-screen instructions to remove and uninstall the app. - -Still need help? Check in with your company support. You can find their contact information on the [Company Portal website](https://go.microsoft.com/fwlink/?linkid=2010980). diff --git a/memdocs/intune/user-help/your-device-appears-encrypted-but-cp-says-otherwise-android.md b/memdocs/intune/user-help/your-device-appears-encrypted-but-cp-says-otherwise-android.md index ddd20292f67..05c065c9797 100644 --- a/memdocs/intune/user-help/your-device-appears-encrypted-but-cp-says-otherwise-android.md +++ b/memdocs/intune/user-help/your-device-appears-encrypted-but-cp-says-otherwise-android.md @@ -53,9 +53,9 @@ This section only applies to the Company Portal app. If your device offers you t Some Android devices on version 7.0 and later encrypt data in ways that are inconsistent with certain Android platform standards. These encryption methods put device information at risk. As a result, these devices aren't supported. -For a non-exhaustive list of supported Android devices, see the article [Supported operating systems and browsers in Intune](/intune/fundamentals/supported-devices-browsers#supported-samsung-knox-standard-devices). If your device isn't listed, refer to the device manufacturer or contact your support person. +For a non-exhaustive list of supported Android devices, see the article [Supported operating systems and browsers in Intune](/mem/intune/fundamentals/supported-devices-browsers#supported-samsung-knox-standard-devices). If your device isn't listed, refer to the device manufacturer or contact your support person. -> [!Note] +> [!NOTE] > Microsoft works with manufacturers to address any issues we find while testing or that users report to us. We update this article whenever new information is available. ## Update devices diff --git a/memdocs/zone-pivot-groups.yml b/memdocs/zone-pivot-groups.yml index ac3a44cb765..0fcb84c34d4 100644 --- a/memdocs/zone-pivot-groups.yml +++ b/memdocs/zone-pivot-groups.yml @@ -26,10 +26,10 @@ groups: title: Microsoft Edge baseline versions prompt: Choose a version pivots: - - id: edge-v112 - title: Edge v112 (May 2023) - id: edge-v117 title: Edge v117 (November 2023) + - id: edge-v112 + title: Edge v112 (May 2023) - id: edge-baseline-versions title: Edge baseline versions diff --git a/windows-365/business-continuity-disaster-recovery.md b/windows-365/business-continuity-disaster-recovery.md index 0dea3973f92..029605ee5dd 100644 --- a/windows-365/business-continuity-disaster-recovery.md +++ b/windows-365/business-continuity-disaster-recovery.md @@ -19,7 +19,7 @@ ms.assetid: #ROBOTS: #audience: -ms.reviewer: docoombs +ms.reviewer: docoombs, olivchen, rkiran ms.suite: ems search.appverid: MET150 #ms.tgt_pltfrm: @@ -29,6 +29,8 @@ ms.collection: - tier1 --- + + # Business continuity and disaster recovery overview Windows 365 provides highly resilient user cloud pcs, including: diff --git a/windows-365/business/TOC.yml b/windows-365/business/TOC.yml index 8579a5e14e5..93968802c2d 100644 --- a/windows-365/business/TOC.yml +++ b/windows-365/business/TOC.yml @@ -31,6 +31,8 @@ items: href: change-organization-default-settings.md - name: Remotely manage Cloud PCs href: remotely-manage-business-cloud-pcs.md + - name: Resize a Cloud PC + href: resize-cloud-pc.md - name: Reset a user's password href: reset-user-password.md - name: Restore a Cloud PC to an earlier state diff --git a/windows-365/business/apps-install-admin.md b/windows-365/business/apps-install-admin.md index 4fe2bb10b17..4a09e5dfe92 100644 --- a/windows-365/business/apps-install-admin.md +++ b/windows-365/business/apps-install-admin.md @@ -6,7 +6,7 @@ f1.keywords: ms.author: erikje author: ErikjeMS manager: dougeby -ms.date: 10/18/2023 +ms.date: 09/26/2024 audience: Admin ms.topic: how-to ms.service: windows-365 diff --git a/windows-365/business/assign-unassign-license.md b/windows-365/business/assign-unassign-license.md index 5c8cdce104f..94c918765f5 100644 --- a/windows-365/business/assign-unassign-license.md +++ b/windows-365/business/assign-unassign-license.md @@ -7,7 +7,7 @@ keywords: author: ErikjeMS ms.author: erikje manager: dougeby -ms.date: 04/10/2024 +ms.date: 09/24/2024 ms.topic: how-to ms.service: windows-365 ms.subservice: @@ -33,7 +33,7 @@ ms.collection: You can assign some licenses on [windows365.microsoft.com](https://windows365.microsoft.com). For full license management, use the [Microsoft 365 admin center](https://admin.microsoft.com). -1. Sign in to [windows365.microsoft.com](https://windows365.microsoft.com) with a Microsoft Entra Global Administrator account. +1. Sign in to [windows365.microsoft.com](https://windows365.microsoft.com) with an administrator account with the License Administrator role. 2. Select **Your organization’s Cloud PCs**. 3. Select the user whose licenses you want to manage. 4. Select **Licenses and apps**. diff --git a/windows-365/business/in-development.md b/windows-365/business/in-development.md index 3ed71e7e213..fb9d55a8a59 100644 --- a/windows-365/business/in-development.md +++ b/windows-365/business/in-development.md @@ -7,7 +7,7 @@ keywords: author: ErikjeMS ms.author: erikje manager: dougeby -ms.date: 03/13/2024 +ms.date: 09/25/2024 ms.topic: conceptual ms.service: windows-365 @@ -56,10 +56,6 @@ To help in your readiness and planning, this page lists Windows 365 Business upd By using the upcoming Resize action, you'll be able to upgrade Cloud PCs to more storage, RAM, and CPU. -### Resize support for Windows 365 Business - -You'll be able to use the resize remote action for Windows 365 Business Cloud PCs. - ## Monitor and troubleshoot diff --git a/windows-365/business/media/resize-cloud-pc/resize-cloud-pc.png b/windows-365/business/media/resize-cloud-pc/resize-cloud-pc.png new file mode 100644 index 00000000000..a12052dfb7a Binary files /dev/null and b/windows-365/business/media/resize-cloud-pc/resize-cloud-pc.png differ diff --git a/windows-365/business/media/resize-cloud-pc/resize-options.png b/windows-365/business/media/resize-cloud-pc/resize-options.png new file mode 100644 index 00000000000..aaabb3df385 Binary files /dev/null and b/windows-365/business/media/resize-cloud-pc/resize-options.png differ diff --git a/windows-365/business/reset-user-password.md b/windows-365/business/reset-user-password.md index bcfe4009b50..6f9c7adeab2 100644 --- a/windows-365/business/reset-user-password.md +++ b/windows-365/business/reset-user-password.md @@ -7,7 +7,7 @@ keywords: author: ErikjeMS ms.author: erikje manager: dougeby -ms.date: 08/28/2024 +ms.date: 09/24/2024 ms.topic: how-to ms.service: windows-365 ms.subservice: @@ -33,7 +33,7 @@ ms.collection: To reset a user’s password: -1. Sign in to [windows365.microsoft.com](https://windows365.microsoft.com) with a Microsoft Entra Global Administrator account. +1. Sign in to [windows365.microsoft.com](https://windows365.microsoft.com) with an administrator account with the Password Administrator role. 2. Select **Your organization’s Cloud PCs**. 3. Select the check box next to the user whose password you want to reset > **Select**. 4. Under **Reset password**, choose the options that you want for resetting the password. diff --git a/windows-365/business/resize-cloud-pc.md b/windows-365/business/resize-cloud-pc.md new file mode 100644 index 00000000000..01fe58cad8e --- /dev/null +++ b/windows-365/business/resize-cloud-pc.md @@ -0,0 +1,75 @@ +--- +# required metadata +title: Resize a Windows 365 Business Cloud PC +titleSuffix: +description: Learn how to resize a Windows 365 Business Cloud PC. +keywords: +author: ErikjeMS +ms.author: erikje +manager: dougeby +ms.date: 10/01/2024 +ms.topic: how-to +ms.service: windows-365 +ms.subservice: +ms.localizationpriority: high +ms.assetid: + +# optional metadata + +#ROBOTS: +#audience: + +ms.reviewer: lrayasam +ms.suite: ems +search.appverid: MET150 +#ms.tgt_pltfrm: +ms.custom: intune-azure; get-started +ms.collection: +- M365-identity-device-management +- tier2 +--- + +# Resize a Windows 365 Business Cloud PC + +[!INCLUDE [Resize a Cloud PC intro](../includes/resize-introduction.md)] + +## Requirements + +### Role requirements + +To resize a Cloud PC, the admin must have certain built-in Microsoft Entra roles. + +For a Cloud PC provisioned with a direct assigned license, at least one of the following roles: + +- Windows 365 Administrator + +Alternatively, you can assign a custom role that includes the permissions of this built-in role. + +[!INCLUDE [Resize a Cloud PC IP requirements](../includes/resize-ip-address-requirements.md)] + +[!INCLUDE [Resize a Cloud PC other requirements](../includes/resize-other-requirements.md)] + +## Resize a Windows 365 Cloud PC + +When resizing Windows 365 Cloud PCs, the Windows 365 service automatically takes care of: + +- Unassigning the original license. +- Assigning the new license on behalf of the admin. + +1. Sign in to the windows365.microsoft.com, select **Your organization's Cloud PCs** > choose a device > **Devices** > **Resize**. +![Screenshot of resize Cloud PC](./media/resize-cloud-pc/resize-cloud-pc.png) +2. Under **Resize**, there's a list of the sizes that you can upgrade or downsize to based on the licenses available in your inventory. You can upgrade a Cloud PC’s **Processor** and **RAM**. **Storage** can only be upgraded. Select one of the available options. +![Screenshot of resize options](./media/resize-cloud-pc/resize-options.png) +3. Select **Resize**. + +If there are available licenses, the resizing starts. + +If there are no licenses available, then you can purchase a new license at the Windows 365 Market place. The newly purchased license will be available for upgrade soon. + +## Resizing details + +[!INCLUDE [Resize a Cloud PC details](../includes/resize-details.md)] + +## Next steps + +[Remotely manage Windows 365 Business Cloud PCs](remotely-manage-business-cloud-pcs.md). diff --git a/windows-365/enterprise/TOC.yml b/windows-365/enterprise/TOC.yml index 007bc174359..aa21e6ee8c8 100644 --- a/windows-365/enterprise/TOC.yml +++ b/windows-365/enterprise/TOC.yml @@ -119,6 +119,8 @@ items: href: windows-365-boot-restrict-user-access-physical-device.md - name: Partner connectors for Windows 365 items: + - name: Partner integration scenarios + href: partner-integration-scenarios.md - name: Citrix requirements href: requirements-citrix.md - name: Set up Citrix HDX Plus for Windows 365 diff --git a/windows-365/enterprise/architecture.md b/windows-365/enterprise/architecture.md index 03d9b335a38..924fde7b5e0 100644 --- a/windows-365/enterprise/architecture.md +++ b/windows-365/enterprise/architecture.md @@ -19,7 +19,7 @@ ms.assetid: #ROBOTS: #audience: -ms.reviewer: thhickli +ms.reviewer: thhickli, mattsha, rikiran ms.suite: ems search.appverid: MET150 #ms.tgt_pltfrm: @@ -29,6 +29,8 @@ ms.collection: - tier2 --- + + # Windows 365 architecture Windows 365 provides a per-user per-month license model by hosting Cloud PCs on behalf of customers in Microsoft Azure. In this model, there’s no need to consider storage, compute infrastructure architecture, or costs. The Windows 365 architecture also lets you use your existing investments in Azure networking and security. Each Cloud PC is provisioned according to the configuration you define in the Windows 365 section of the Microsoft Intune admin center. diff --git a/windows-365/enterprise/assign-users-as-local-admin.md b/windows-365/enterprise/assign-users-as-local-admin.md index 4ff38b43105..094e4dc8273 100644 --- a/windows-365/enterprise/assign-users-as-local-admin.md +++ b/windows-365/enterprise/assign-users-as-local-admin.md @@ -35,7 +35,7 @@ ms.collection: The **User settings** page lets IT administrators manage the following settings for the user: - **Enable local admin**: If enabled, each user in the assigned groups is elevated to a local administrator of each of their own Cloud PCs. These permissions apply at the user level. -- **Enable users to reset their Cloud PCs**: If enabled, a **Reset** option is shown in the Windows 365 app and portal for users in the assigned groups. Resetting wipes and reprovisions the Cloud PC, deleting all user data and apps. +- **Enable users to reset their Cloud PCs**: If enabled, a **Reset** option is shown in the Windows App and portal for users in the assigned groups. Resetting wipes and reprovisions the Cloud PC, deleting all user data and apps. - **Allow user to initiate restore service**: If enabled, each user in the assigned groups can restore their own Cloud PCs to any available backup version. When managing settings, keep the following points in mind: diff --git a/windows-365/enterprise/azure-network-connections.md b/windows-365/enterprise/azure-network-connections.md index 29ded36f1fa..54e0de3dff1 100644 --- a/windows-365/enterprise/azure-network-connections.md +++ b/windows-365/enterprise/azure-network-connections.md @@ -7,7 +7,7 @@ keywords: author: ErikjeMS ms.author: erikje manager: dougeby -ms.date: 08/28/2024 +ms.date: 10/30/2024 ms.topic: overview ms.service: windows-365 ms.subservice: windows-365-enterprise @@ -47,8 +47,8 @@ There are two kinds of ANCs based on their join type. Both let you manage traffi When a Cloud PC is provisioned, the information in the ANC is used by the provisioning policy to provision the Cloud PC in the Azure subnet. The information required in an ANC includes: -- **Network details**: The Azure subscription, resource group, virtual network, and subnet that the Cloud PC will be associated with. When a provisioning policy runs, it creates a Cloud PC in the Microsoft hosted Azure subscription. To connect to a customer's on-premises network, a virtual network interface card (vNic) is injected into a customer-provided Azure virtual network (vNet). To create this vNic, Windows 365 needs sufficient access to an Azure subscription. -- **Active Directory domain**: The Active Directory domain to join, an Organizational Unit (OU) destination for the computer object, and Active Directory user credentials with sufficient permissions to perform the domain join. When a provisioning policy runs, the Cloud PC is joined to this Active Directory domain. The credentials will be stored securely in the Windows 365 service. +- **Network details**: The Azure subscription, resource group, virtual network, and subnet to associate with the Cloud PC. When a provisioning policy runs, it creates a Cloud PC in the Microsoft hosted Azure subscription. To connect to a customer's on-premises network, a virtual network interface card (vNic) is injected into a customer-provided Azure virtual network (vNet). To create this vNic, Windows 365 needs sufficient access to an Azure subscription. +- **Active Directory domain**: The Active Directory domain to join, an Organizational Unit (OU) destination for the computer object, and Active Directory user credentials with sufficient permissions to perform the domain join. When a provisioning policy runs, the Cloud PC is joined to this Active Directory domain. The credentials are stored securely in the Windows 365 service. During provisioning, the Cloud PC is connected to the Azure subnet and joined to a domain (either Windows Server Active Directory or Microsoft Entra ID). This process results in a Cloud PC that is: @@ -61,7 +61,7 @@ The ANC settings are applied to the Cloud PC only at the time of provisioning. ### Alternate ANCs -To help make provisioning Cloud PCs more reliable in the rare case of capacity constraints in a region, you have the option to assign alternate ANCs to a provisioning policy. You can define the priority order of the ANCs that the policy will use. If the first ANC is unavailable, the policy will automatically use the second ANC in the priority list. If the second one is unavailable, it will move on to the next, and so on. This lets administrators prepare multiple ANCs in different Azure regions, making provisioning more reliable. You don't have to use multiple ANCs. For more information about using alternate ANCs when creating your provisioning policies, see [Create provisioning policies](create-provisioning-policy.md). +To help make provisioning Cloud PCs more reliable in the rare case of capacity constraints in a region, you can assign alternate ANCs to a provisioning policy. You can define the priority order of the ANCs that the policy uses. If the first ANC is unavailable, the policy automatically uses the second ANC in the priority list. If the second one is unavailable, it moves on to the next, and so on. This process lets administrators prepare multiple ANCs in different Azure regions, making provisioning more reliable. You don't have to use multiple ANCs. For more information about using alternate ANCs when creating your provisioning policies, see [Create provisioning policies](create-provisioning-policy.md). ## First health check @@ -81,7 +81,7 @@ After provisioning, the information in an ANC is also used to monitor: - the connection health between your network-based resources - the Cloud PC hosted in the Microsoft hosted subscription -Windows 365 will report configuration issues that may cause provisioning failures or poor end-user experiences. This monitoring reduces your management overhead. For more information on these periodic checks, see [Azure network connection health checks](health-checks.md). +Windows 365 reports configuration issues that may cause provisioning failures or poor end-user experiences. This monitoring reduces your management overhead. For more information on these periodic checks, see [Azure network connection health checks](health-checks.md). ## Health check frequency @@ -102,13 +102,13 @@ The ANC wizard requires access to Azure and, optionally, on-premises domain reso - [Intune Administrator](/azure/active-directory/roles/permissions-reference#intune-administrator) or [Windows 365 Administrator](/azure/active-directory/roles/permissions-reference) role. - An Active Directory user account with sufficient permissions to join the AD domain into this Organizational Unit (Microsoft Entra hybrid join ANCs only). -To create or edit an ANC, you must at least have the Subscription Reader role in the Azure Subscription where the VNET associated with the ANC was located. +To create or edit an ANC, you must have at least the Subscription Reader role in the Azure Subscription where the VNET associated with the ANC was located. For a full list of requirements, see [Windows 365 requirements](requirements.md). ## Changing an Azure network connection -Changing the settings in an ANC won’t affect Cloud PCs previously provisioned with that ANC. Only Cloud PCs provisioned after the changes to the ANC will reflect such later changes. +Changing the settings in an ANC won’t affect Cloud PCs previously provisioned with that ANC. Only Cloud PCs provisioned after the changes to the ANC reflect such later changes. If you want to change the ANC related settings on a previously provisioned Cloud PC, you must reprovision the Cloud PC. Reprovisioning is a destructive action, so be sure it's an action you really want to take. For more information, see [reprovisioning](provisioning.md#reprovisioning). @@ -125,6 +125,10 @@ After completing either of these operations, you can delete the ANC. Each tenant has a limit of 10 Azure network connections. If your organization needs more than 10 Azure network connections, contact support. +## Inactive ANCs + +ANCs that are unused for a period of time become inactive. Inactive ANCs pause running health checks and can't be assigned to a provisioning policy until the ANC is reactivated and health checks complete successfully. + ## User sign-in When users attempt to sign in to their Cloud PC, user authentication occurs. diff --git a/windows-365/enterprise/cisco-webex-support.md b/windows-365/enterprise/cisco-webex-support.md index 072eddc5876..ea522437b13 100644 --- a/windows-365/enterprise/cisco-webex-support.md +++ b/windows-365/enterprise/cisco-webex-support.md @@ -45,7 +45,7 @@ To optimize Cisco Webex, you’ll need to: These instructions don't support connections through a web browser. -- **Windows 365 app for Windows** +- **Windows App** - **Windows Remote Desktop Client** - **Operating system**: Windows diff --git a/windows-365/enterprise/configure-single-sign-on.md b/windows-365/enterprise/configure-single-sign-on.md index 404f0980f71..c33e04e0370 100644 --- a/windows-365/enterprise/configure-single-sign-on.md +++ b/windows-365/enterprise/configure-single-sign-on.md @@ -7,7 +7,7 @@ keywords: author: ErikjeMS ms.author: erikje manager: dougeby -ms.date: 11/16/2023 +ms.date: 09/26/2024 ms.topic: how-to ms.service: windows-365 ms.subservice: windows-365-enterprise diff --git a/windows-365/enterprise/create-azure-network-connection.md b/windows-365/enterprise/create-azure-network-connection.md index b58773d20a4..fdc0e74ec34 100644 --- a/windows-365/enterprise/create-azure-network-connection.md +++ b/windows-365/enterprise/create-azure-network-connection.md @@ -7,7 +7,7 @@ keywords: author: ErikjeMS ms.author: erikje manager: dougeby -ms.date: 04/01/2024 +ms.date: 10/30/2024 ms.topic: how-to ms.service: windows-365 ms.subservice: windows-365-enterprise @@ -51,7 +51,7 @@ To create an ANC, you must meet these requirements: - If you want to create an ANC with a network or resource group that was never used in any pervious ANC creation, then you must have the Subscription owner or user administrator role. - For Disaster Recovery (DR) purposes, make sure that there are at least 50% of the IP addresses available in your subnet. If reprovisioning for DR is required, sufficient new IP addresses are required for each Cloud PC provisioned on the subnet. - For Windows 365 Government - GCC only and not GCC-H - make sure to complete the script options listed in [Set up tenants for Windows 365 Government](set-up-tenants-windows-365-gcc.md). - - If you aren't using Azure CloudShell, make sure that your PowerShell execution policy is configured to allow Unrestricted scripts. If you use Group Policy to set execution policy, make sure that the Group Policy Object (GPO) targeted at the Organizational Unit (OU) defined in the ANC is configured to allow Unrestricted scripts. For more information, see [Set-ExecutionPolicy](/powershell/module/microsoft.powershell.security/set-executionpolicy). +- If you aren't using Azure CloudShell, make sure that your PowerShell execution policy is configured to allow Unrestricted scripts. If you use Group Policy to set execution policy, make sure that the Group Policy Object (GPO) targeted at the Organizational Unit (OU) defined in the ANC is configured to allow Unrestricted scripts. For more information, see [Set-ExecutionPolicy](/powershell/module/microsoft.powershell.security/set-executionpolicy). When planning your ANC VNets with ExpressRoute as the on-premises connectivity model, refer to [Azure’s documentation on VM limits](/azure/expressroute/expressroute-about-virtual-network-gateways#performance-results). For the ExpressRoute Gateway SKU, make sure that you have the correct sized Gateway for the number of Cloud PCs planned within the VNet. Exceeding this limit could cause instability in your connectivity. @@ -68,7 +68,7 @@ When planning your ANC VNets with ExpressRoute as the on-premises connectivity m ![Screenshot of Name field](./media/create-azure-network-connection/connection-name.png) -4. Select a **Subscription** and **Resource group** for the new connection. Create a new resource group to contain your Cloud PC resources. Optionally, you can instead select an existing resource group in the list (which grant Windows 365 permissions to the existing resource group). If you don’t have a [healthy ANC](health-checks.md), you won't be able to proceed. +4. Select a **Subscription** and **Resource group** for the new connection. Create a new resource group to contain your Cloud PC resources. Optionally, you can instead select an existing resource group in the list (which grant Windows 365 permissions to the existing resource group). If you don’t have a [healthy ANC](health-checks.md), you can't proceed. 5. Select a **Virtual network** and **Subnet**. 6. Select **Next**. 7. For hybrid Microsoft Entra join ANCs, on the **AD domain** page, provide the following information: @@ -88,6 +88,8 @@ When planning your ANC VNets with ExpressRoute as the on-premises connectivity m 8. Select **Next**. 9. On the **Review + Create** page, select **Create**. +When an ANC is in use, it can't be deleted and certain configuration settings can't be edited. For more information, see [Edit Azure network connection](edit-azure-network-connection.md) and [Delete Azure network connection](delete-azure-network-connection.md). + ## Next steps diff --git a/windows-365/enterprise/create-dynamic-device-group-all-cloudpcs.md b/windows-365/enterprise/create-dynamic-device-group-all-cloudpcs.md index 7db2440cdd1..cf70f5f75a3 100644 --- a/windows-365/enterprise/create-dynamic-device-group-all-cloudpcs.md +++ b/windows-365/enterprise/create-dynamic-device-group-all-cloudpcs.md @@ -51,7 +51,7 @@ In these steps, you’ll use the Device Model device property to create the dyna 5. Select **Add dynamic query**. 6. On the **Dynamic membership rules** page, enter the following: 1. **Property** = "deviceModel" - 2. **Operator** = "Contains" + 2. **Operator** = "Starts With" 3. **Value** = "Cloud PC" 7. To validate that it works, select **Validate Rules (Preview)** > **+Add devices** > select some Cloud PCs and non-Cloud PC devices. 8. After the validation completes, select **Save** > **Create**. @@ -93,7 +93,7 @@ In these steps, you'll use the Device Model device property to create the dynami 5. Select **Add dynamic query**. 6. On the **Dynamic membership rules** page, enter the following: 1. **Property** = “deviceModel” - 2. **Operator** = “Contains” + 2. **Operator** = “Starts With” 3. **Value** = “Cloud PC” 7. Select **Add expression** and enter the following: 1. **Property** = “deviceModel” diff --git a/windows-365/enterprise/create-provisioning-policy.md b/windows-365/enterprise/create-provisioning-policy.md index e85990edfd2..0f43fa8055a 100644 --- a/windows-365/enterprise/create-provisioning-policy.md +++ b/windows-365/enterprise/create-provisioning-policy.md @@ -7,7 +7,7 @@ keywords: author: ErikjeMS ms.author: erikje manager: dougeby -ms.date: 10/17/2023 +ms.date: 09/16/2024 ms.topic: how-to ms.service: windows-365 ms.subservice: windows-365-enterprise @@ -94,7 +94,7 @@ To select an ANC, follow these steps: - **Custom image**: Choose **Select** > select an image from the list > **Select**. The page displays the list of images that you uploaded using the [Add device images](add-device-images.md) workflow. 4. Select **Next**. 5. On the **Configuration** page, under **Windows settings**, choose a **Language & Region**. The selected language pack is installed on Cloud PCs provisioned with this policy. -6. Optional. Select **Apply device name template** to create a Cloud PC naming template to use when naming all Cloud CPs that are provisioned with this policy. This naming template updates the NETBIOS name and doesn't affect the display name of the Cloud PC. When creating the template, follow these rules: +6. Optional. Select **Apply device name template** to create a Cloud PC naming template to use when naming all Cloud PCs that are provisioned with this policy. This naming template updates the NETBIOS name and doesn't affect the display name of the Cloud PC. When creating the template, follow these rules: - Names must be between 5 and 15 characters. - Names can contain letters, numbers, and hyphens. - Names can't include blank spaces or underscores. @@ -108,10 +108,13 @@ To select an ANC, follow these steps: - ABC-%USERNAME:5%-%RAND:5% 7. Optional. Under **Additional services**, choose a service to be installed on Cloud PCs provisioned with this policy: - **Windows Autopatch** is a cloud service that automates updates for Windows, Microsoft 365 Apps for enterprise, Microsoft Edge, and Microsoft Teams on both physical and virtual devices. For more information, see [What is What is Windows Autopatch?](/windows/deployment/windows-autopatch/overview/windows-autopatch-overview) and the [Windows Autopatch FAQ](https://go.microsoft.com/fwlink/?linkid=2200228). - - **Microsoft Managed Desktop** is a cloud service that helps with device deployment, service management and operations, and security. For more information, see [What is Microsoft Managed Desktop?](/managed-desktop/intro/). + - If you already have Windows Autopatch configured to manage your cloud PCs, this option replaces the existing policy. This replacement might disrupt any dynamic distribution that is already configured in Autopatch. + - When this option is selected, the system assigns devices to a new ring as the last ring of the Autopatch group. + - To manually enable dynamic distribution for your Cloud PCs, modify your Autopatch Groups dynamic distribution list to include the Entra ID group to which your Cloud PCs are being added. + - **None**. Manage and update Cloud PCs manually. 8. Select **Next**. 9. On the **Assignments** page, choose **Select groups** > choose the groups you want this policy assigned to > **Select**. Nested groups aren't currently supported. -10. For Windows 365 Frontline, you must also select a Cloud PC size for each group in the policy. Choose **Select one** > select a size under **Available sizes** > **Select**. After you've selected a size for each group, select **Next**. +10. For Windows 365 Frontline, you must also select a Cloud PC size for each group in the policy. Choose **Select one** > select a size under **Available sizes** > **Select**. After you select a size for each group, select **Next**. 11. On the **Review + create** page, select **Create**. If you used Microsoft Entra hybrid join as the join type, it can take up to 60 minutes for the policy creation process to complete. The time depends on when the Microsoft Entra Connect sync last happened. After the provisioning policy is created and assigned, Windows 365 automatically starts to provision Cloud PCs and assigns them to users in the assigned groups. diff --git a/windows-365/enterprise/delete-azure-network-connection.md b/windows-365/enterprise/delete-azure-network-connection.md index c0c171bbbd8..6bb0972bec7 100644 --- a/windows-365/enterprise/delete-azure-network-connection.md +++ b/windows-365/enterprise/delete-azure-network-connection.md @@ -7,7 +7,7 @@ keywords: author: ErikjeMS ms.author: erikje manager: dougeby -ms.date: 07/25/2024 +ms.date: 10/30/2024 ms.topic: how-to ms.service: windows-365 ms.subservice: windows-365-enterprise @@ -31,18 +31,29 @@ ms.collection: # Delete Azure network connection -Only an unassigned Azure network connection (ANC) can be deleted. If an ANC is in use by a provisioning policy, then you must take one of the following steps: +Only an unused Azure network connection (ANC) can be deleted. -- Remove the ANC from all provisioning policies. -- Delete the ANC. - -To delete an Azure network connection: +To delete an unused ANC: 1. Sign in to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431) > **Devices** > **Windows 365** (under **Provisioning**) > **Azure network connection**. You must have [Intune Administrator](/azure/active-directory/roles/permissions-reference#intune-administrator) or [Windows 365 Administrator](/azure/active-directory/roles/permissions-reference) permissions. ![Screenshot of delete connection](./media/delete-azure-network-connection/delete-connection.png) 2. Select the ellipses (**…**) next to the connection you want to delete > **Delete**. 3. Select **Confirm** when asked to delete the connection. +## In use ANCs + +ANCs that are in use can't be deleted. In use ANCs include ANCs that are: + +- Referenced by a provisioning policy, including as an alternate ANC. +- Used by a Cloud PC. +- Configured as backup ANCs for [cross region disaster recovery](cross-region-disaster-recovery.md). + +If an ANC is in use, then you must take one of the following steps before you can delete it: + +- Remove the ANC from all provisioning policies. +- Move Cloud PCs to another ANC or deprovision the Cloud PCs. +- Remove the ANC from all cross region disaster recovery user settings. + ## Next steps diff --git a/windows-365/enterprise/deployment-options.md b/windows-365/enterprise/deployment-options.md index 73064f8bb24..3241b7ca458 100644 --- a/windows-365/enterprise/deployment-options.md +++ b/windows-365/enterprise/deployment-options.md @@ -7,7 +7,7 @@ keywords: author: ErikjeMS ms.author: erikje manager: dougeby -ms.date: 12/08/2023 +ms.date: 09/26/2024 ms.topic: how-to ms.service: windows-365 ms.subservice: windows-365-enterprise diff --git a/windows-365/enterprise/device-images.md b/windows-365/enterprise/device-images.md index 861915529c7..6c445d43053 100644 --- a/windows-365/enterprise/device-images.md +++ b/windows-365/enterprise/device-images.md @@ -7,7 +7,7 @@ keywords: author: ErikjeMS ms.author: erikje manager: dougeby -ms.date: 08/09/2024 +ms.date: 09/09/2024 ms.topic: overview ms.service: windows-365 ms.subservice: windows-365-enterprise @@ -88,6 +88,8 @@ Each updated image includes: - [Microsoft Teams updates](https://support.microsoft.com/office/what-s-new-in-microsoft-teams-d7092a6d-c896-424c-b362-a472d5f105de) - [WebRTC redirector service updates](/azure/virtual-desktop/teams-on-avd#install-the-teams-websocket-service) +Applications that come pre-installed are the latest version that is available at the start of the second Tuesday of that month. Any app updates posted on that day are included in the image update of the subsequent month. + Newly provisioned Cloud PCs are automatically created with the latest images. For existing Cloud PCs, you can receive the updates by reprovisioning. ## Custom images @@ -118,3 +120,5 @@ When you upload a custom device image, Windows 365: [Learn about device configuration](device-configuration.md). [Learn about using apps, like Microsoft Teams, with your Cloud PCs](app-overview.md). + +[Learn about restoring a Cloud PC to a previous state](restore-overview.md) diff --git a/windows-365/enterprise/edit-azure-network-connection.md b/windows-365/enterprise/edit-azure-network-connection.md index 6d82413976b..9df54919f76 100644 --- a/windows-365/enterprise/edit-azure-network-connection.md +++ b/windows-365/enterprise/edit-azure-network-connection.md @@ -7,7 +7,7 @@ keywords: author: ErikjeMS ms.author: erikje manager: dougeby -ms.date: 07/25/2024 +ms.date: 10/30/2024 ms.topic: how-to ms.service: windows-365 ms.subservice: windows-365-enterprise @@ -44,10 +44,16 @@ To edit an Azure network connection: 1. Sign in to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431) > **Devices** > **Windows 365** (under **Provisioning**) > **Azure network connection** > select the connection you want to edit > **Properties**. 2. For all ANCs, you can edit the **General** settings by selecting **Edit** next to each header. You can edit all settings except **Join type**. For Microsoft Entra hybrid join connections, you can also edit the **AD domain** settings. -After the edits have been saved, the ANC checks are run to verify the configuration. +After the edits are saved, the ANC checks are run to verify the configuration. You can't edit an ANC if it's running checks. You must wait for the checks to pass/fail before edit functionality becomes available. +Some configuration settings can't be edited for ANCs that are: + +- Referenced by a provisioning policy, including as an alternate ANC. +- Used by a Cloud PC. +- Configured as backup ANCs for [cross region disaster recovery](cross-region-disaster-recovery.md). + ## Next steps diff --git a/windows-365/enterprise/encryption.md b/windows-365/enterprise/encryption.md index 30f53cdc2e4..eabfe077a2e 100644 --- a/windows-365/enterprise/encryption.md +++ b/windows-365/enterprise/encryption.md @@ -7,7 +7,7 @@ keywords: author: ErikjeMS ms.author: erikje manager: dougeby -ms.date: 12/05/2023 +ms.date: 09/26/2024 ms.topic: overview ms.service: windows-365 ms.subservice: windows-365-enterprise @@ -19,7 +19,7 @@ ms.assetid: #ROBOTS: #audience: -ms.reviewer: anbiswas +ms.reviewer: ryclar, pratikshah, saudm, jonshi ms.suite: ems search.appverid: MET150 #ms.tgt_pltfrm: @@ -29,6 +29,8 @@ ms.collection: - tier2 --- + + # Data encryption in Windows 365 Windows 365 encrypts data at rest and in transit as explained in this article. @@ -64,7 +66,7 @@ Windows 365 uses the Transport Layer Security (TLS) protocol to protect data in - Algorithm flexibility - Ease of deployment and use -TLS 1.2 is used for all connections started from Windows 365 to the Azure Virtual Desktop infrastructure components. These components use the same TLS 1.2 ciphers as [Azure Front Door](/azure/frontdoor/concept-end-to-end-tls#supported-cipher-suites). Additional technical details on the cipher suites are available at [Microsoft 365 technical reference details about encryption](/purview/technical-reference-details-about-encryption#tls-cipher-suites-supported-by-microsoft-365). +TLS 1.2 is used for all connections started from Windows 365 to the Azure Virtual Desktop infrastructure components. These components use the same TLS 1.2 ciphers as [Azure Front Door](/azure/frontdoor/concept-end-to-end-tls#supported-cipher-suites). Additional technical details on the cipher suites are available at [Microsoft 365 technical reference details about encryption](/purview/technical-reference-details-about-encryption#tls-cipher-suites-supported-by-microsoft-365). For the reverse connect transport, TLS 1.3 is supported. For more details see [Understanding Azure Virtual Desktop connectivity](/azure/virtual-desktop/network-connectivity). ## Next steps diff --git a/windows-365/enterprise/end-of-support.md b/windows-365/enterprise/end-of-support.md index f98c9578e09..a6cf36f7c5f 100644 --- a/windows-365/enterprise/end-of-support.md +++ b/windows-365/enterprise/end-of-support.md @@ -7,7 +7,7 @@ keywords: author: ErikjeMS ms.author: erikje manager: dougeby -ms.date: 07/25/2024 +ms.date: 10/14/2024 ms.topic: how-to ms.service: windows-365 ms.subservice: windows-365-enterprise @@ -55,6 +55,16 @@ These status values for custom images also appear under the **OS support status* Starting on the end of support date, gallery images that use the expired OS won’t be selectable for newly created provisioning policies. The images also won’t be available for use when editing existing provisioning policies. +## Removed images + +Gallery images might rarely be removed prior to the End of Support date. Such removed images go through the same **Warning** and **Unsupported** states as the OS. + +While in the Warning state, you can use existing provisioning policies to deploy devices using the image, but you can’t create new provisioning policies using the image. + +For images in the **Unsupported** state, no provisioning is possible. + +Planned removals are always preceded by proactive message center communications. + ## Next steps diff --git a/windows-365/enterprise/health-checks.md b/windows-365/enterprise/health-checks.md index 2f762ce4be8..18591c09fab 100644 --- a/windows-365/enterprise/health-checks.md +++ b/windows-365/enterprise/health-checks.md @@ -7,7 +7,7 @@ keywords: author: ErikjeMS ms.author: erikje manager: dougeby -ms.date: 08/28/2024 +ms.date: 10/30/2024 ms.topic: how-to ms.service: windows-365 ms.subservice: windows-365-enterprise @@ -44,12 +44,13 @@ Statuses include: - **Running checks**: The health checks are currently running. The ANC list view automatically refreshes every five minutes. Wait for the checks to complete before attempting to assign it to a provisioning policy. - **Checks successful**: All health checks passed. The ANC is ready for use. -- **Checks successful with warnings**: All critical health checks passed. However at least one non-critical check may have issues. An example of a check that may trigger this state is the Microsoft Entra hybrid join sync check. Microsoft Entra hybrid join sync can take up to 90 minutes, so we check much of the Microsoft Entra hybrid join sync service but can’t confirm the device sync succeeded until later. ANCs with this status can be used by provisioning policies. -- **Checks failed**: One or more required checks failed. An ANC can’t be used if it's in a failed state. You’ll have to resolve the underlying issue and Retry the health checks. +- **Checks successful with warnings**: All critical health checks passed. However at least one noncritical check may have issues. An example of a check that may trigger this state is the Microsoft Entra hybrid join sync check. Microsoft Entra hybrid join sync can take up to 90 minutes. Therefore, we check much of the Microsoft Entra hybrid join sync service but can’t confirm that the device sync succeeded until later. Provisioning policies can use ANCs with this status. +- **Checks failed**: One or more required checks failed. An ANC can’t be used if it's in a failed state. Resolve the underlying issue and Retry the health checks. +- **Inactive**: The ANC is inactive and health checks are paused. Reactivate the ANC to restart the health checks. After the health checks are passed, the ANC is ready for use. ## Status error details -Every failed ANC or success with warning error state includes the technical details behind the failure. Select the **View details** link for each failed check to view more information on the failure. After you’ve fixed the underlying issue, **Retry** the health check to rerun the tests. To retry the health check, you must: +Every failed ANC or success with warning error state includes the technical details behind the failure. Select the **View details** link for each failed check to view more information on the failure. After you fix the underlying issue, **Retry** the health check to rerun the tests. To retry the health check, you must: - Have the [Intune Administrator](/azure/active-directory/roles/permissions-reference#intune-administrator) or [Windows 365 Administrator](/azure/active-directory/roles/permissions-reference) role. diff --git a/windows-365/enterprise/hp-anyware-requirements.md b/windows-365/enterprise/hp-anyware-requirements.md index 26d50eba610..d18165c7f00 100644 --- a/windows-365/enterprise/hp-anyware-requirements.md +++ b/windows-365/enterprise/hp-anyware-requirements.md @@ -7,7 +7,7 @@ keywords: author: ErikjeMS ms.author: erikje manager: dougeby -ms.date: 04/10/2024 +ms.date: 10/09/2024 ms.topic: overview ms.service: windows-365 ms.subservice: windows-365-enterprise @@ -29,7 +29,7 @@ ms.collection: - tier2 --- -# Requirements for using HP Anyware for Windows 365 Enterprise (preview) +# Requirements for using HP Anyware for Windows 365 Enterprise To use HP Anyware for Windows 365, you must meet the following requirements: @@ -38,7 +38,7 @@ To use HP Anyware for Windows 365, you must meet the following requirements: - HP Anyware Standard license - Cloud PCs must have access to: - https://cas.teradici.com on TCP 443 for Broker connectivity. -- Consult [Anyware Session Planning Guide](https://www.teradici.com/web-help/pcoip/session_planning_guide/2023.12/network/network_requirements/) for more requirements. +- Consult the [Anyware Session Planning Guide](https://www.teradici.com/web-help/pcoip/session_planning_guide/2023.12/network/network_requirements/) for more requirements. ## Microsoft requirements @@ -46,8 +46,8 @@ To use HP Anyware for Windows 365, you must meet the following requirements: - Microsoft Entra domain in the same tenant as Microsoft Intune - Windows 365 Enterprise licenses in the same tenant as Microsoft Intune - Azure admin account: - - Microsoft Entra Global Admin for required authorizations in HP Anyware Service. - - Intune Admin for enabling the HP Anyware connector in Microsoft Intune. + - Intune Administrator for required authorizations in HP Anyware Service. + - Intune Administrator for enabling the HP Anyware connector in Microsoft Intune. - For more information about the Windows 365 requirements, see [Windows 365 requirements](requirements.md). ## Supported configurations diff --git a/windows-365/enterprise/hp-anyware-set-up.md b/windows-365/enterprise/hp-anyware-set-up.md index 5f41918fc64..5c498c11834 100644 --- a/windows-365/enterprise/hp-anyware-set-up.md +++ b/windows-365/enterprise/hp-anyware-set-up.md @@ -29,11 +29,11 @@ ms.collection: - tier2 --- -# Set up HP Anyware for Windows 365 Enterprise (preview) +# Set up HP Anyware for Windows 365 Enterprise HP Anyware for Windows 365 is a cloud-based service that lets you deliver Windows 365 Enterprise desktops on HP Anyware’s management and PCoIP protocol. HP Anyware's infrastructure and protocol excel in low bandwidth environments and intensive workloads. -HP Anyware for Windows 365 is in [public preview](../public-preview.md) in selected regions. To submit a request to join this preview, see [https://aka.ms/HPAnywarePublicPreviewSignUp](https://aka.ms/HPAnywarePublicPreviewSignUp). +HP Anyware for Windows 365 is available in selected regions. To sign up for a guided onboarding experience of HP Anyware for Windows 365 or sign up for updates, see [https://reinvent.hp.com/Anyware-for-windows365](https://reinvent.hp.com/Anyware-for-windows365). ## Set up overview @@ -41,7 +41,6 @@ To set up HP Anyware for Windows 365 Enterprise, follow these steps. The first t 1. [Fulfill requirements](hp-anyware-requirements.md). 2. [Turn on the Windows 365 HP Anyware connector in Intune](#turn-on-the-windows-365-hp-anyware-connector-in-intune). -3. [Sign up for the Preview – HP Anyware for Windows 365](https://aka.ms/HPAnywarePublicPreviewSignUp). 4. [Connect Microsoft Entra ID to HP Anyware](https://aka.ms/HPAnywareDocConnectEntraIDtoHP). 5. [Assign HP Anyware licenses to users and provision Cloud PCs](https://aka.ms/HPAnywareDocAssignHPLic). @@ -49,23 +48,15 @@ To set up HP Anyware for Windows 365 Enterprise, follow these steps. The first t To turn on the HP Anyware connector, follow these steps: -1. As a Global administrator, sign in to [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431), select **Tenant administration** > **Connectors and tokens**. +1. As a Intune Administrator, sign in to [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431), select **Tenant administration** > **Connectors and tokens**. ![Screenshot of navigating to Connectors and tokens](./media/set-up-citrix/connectors-tokens.png) 2. Select **Windows Windows partner connectors** > **Add**. -3. Under **Add connector**, select **HP Anyware (preview)** in the drop-down list. +3. Under **Add connector**, select **HP Anyware** in the drop-down list. 4. Next to **Allow people to use HP Anyware to connect to their Cloud PCs**, set the toggle to **On** > **Add**. -## Public preview limitations - -During the public preview, the following limitations exist: - -- The initial release supports selected regions. -- Windows 365 Frontline isn't supported. -- Nested groups aren't supported. - ## Next steps -To complete the integration, proceed to the HP Anyare Manager. For more information about HP Anyware set up, see [https://aka.ms/HPAnywareDocConnectEntraIDtoHP](https://aka.ms/HPAnywareDocConnectEntraIDtoHP). +To complete the integration, proceed to the HP Anyware Manager. For more information about HP Anyware set up, see [https://aka.ms/HPAnywareDocConnectEntraIDtoHP](https://aka.ms/HPAnywareDocConnectEntraIDtoHP). diff --git a/windows-365/enterprise/identity-authentication.md b/windows-365/enterprise/identity-authentication.md index e3b0756907f..bd36d73aa95 100644 --- a/windows-365/enterprise/identity-authentication.md +++ b/windows-365/enterprise/identity-authentication.md @@ -19,7 +19,7 @@ ms.assetid: #ROBOTS: #audience: -ms.reviewer: davidbel +ms.reviewer: davidbel, pratikshah ms.suite: ems search.appverid: MET150 #ms.tgt_pltfrm: @@ -29,6 +29,8 @@ ms.collection: - tier2 --- + + # Windows 365 identity and authentication A Cloud PC user's identity defines which access management services manage that user and Cloud PC. This identity defines: diff --git a/windows-365/enterprise/in-development.md b/windows-365/enterprise/in-development.md index 8a232de692f..4b4111565ca 100644 --- a/windows-365/enterprise/in-development.md +++ b/windows-365/enterprise/in-development.md @@ -7,7 +7,7 @@ keywords: author: ErikjeMS ms.author: erikje manager: dougeby -ms.date: 06/28/2024 +ms.date: 10/02/2024 ms.topic: conceptual ms.service: windows-365 @@ -56,14 +56,6 @@ To help in your readiness and planning, this page lists Windows 365 updates and ## Device management -### Support for symmetric NAT with RDP Shortpath - -In a future update, RDP Shortpath in Windows 365 will support establishing an indirect UDP connection using Traversal Using Relays around NAT (TURN) for symmetric NAT. TURN is a popular standard for device-to-device networking for low latency, high-throughput data transmission. For more information, see [Network Traversal Concepts](/azure/communication-services/concepts/network-traversal). For more information about RDP Shortpath, see [Use RDP Shortpath for public networks with Windows 365](rdp-shortpath-public-networks.md). - -### Chroma subsampling default change to 4:2:0 - -To reduce monitor support issues, the Windows 365 service will default the chroma subsampling at 4:2:0 (instead of the previous 4:4:4). - ### Cloud PC gallery images update to Microsoft Teams 2.1 In a future update, Windows 365 Cloud PC gallery images with Microsoft 365 applications will be updated to use Microsoft Teams 2.1. These images include: @@ -72,12 +64,22 @@ In a future update, Windows 365 Cloud PC gallery images with Microsoft 365 appli - Windows 10 Enterprise + Microsoft 365 Apps 22H2 - Windows 10 Enterprise + Microsoft 365 Apps 21H2 - -## Device security +### Azure network connections inactive state + +In a future update, Azure network connections that meet either of the following conditions for more than four weeks will be marked as inactive: + +- ANCs that aren't associated with provisioning policies. +- ANCs with provisioning policies that have no Cloud PCs associate with them. + +Inactive ANCs: -### Cloud PC support for FIDO devices and passkeys on macOS and iOS +- Can't be assigned to provisioning policies. +- Are skipped during health checks. -Windows 365 Cloud PCs will support FIDO devices and passkeys for Microsoft Entra ID sign in on macOS and iOS. +You'll be able to reactive such ANCs. + + + @@ -97,19 +99,15 @@ End users will be able to manually run connectivity checks on their Cloud PCs fr The Cloud PC action status report will show batches of devices in which actions have been triggered. Customers will be able to see the batch current progress. - -## Provisioning - -### New health check: UDP TURN (preview) +### Remoting connections report deprecation -A new UDP TURN check will be added to the Azure Network Connections health checks. For more information about health checks, see [Azure network connections health checks](health-checks.md). +The remoting connection report will be retired on December 31st, 2024. After this date, refer to the [Cloud PC connection quality report](report-cloud-pc-connection-quality.md). -## Security - -### New settings for Windows 365 security baselines + -New configuration settings will be introduced for the Windows 365 security baseline. + + diff --git a/windows-365/enterprise/install-windows-365-app-intune.md b/windows-365/enterprise/install-windows-365-app-intune.md index 2ecf7e6f0ff..593968ceeb9 100644 --- a/windows-365/enterprise/install-windows-365-app-intune.md +++ b/windows-365/enterprise/install-windows-365-app-intune.md @@ -7,7 +7,7 @@ keywords: author: ErikjeMS ms.author: erikje manager: dougeby -ms.date: 06/24/2024 +ms.date: 09/30/2024 ms.topic: how-to ms.service: windows-365 ms.subservice: windows-365-enterprise @@ -29,9 +29,9 @@ ms.collection: - tier2 --- -# Using Intune, install the Windows app on physical devices +# Using Intune, install Windows App on physical devices -Some of your users might have physical devices that don't have access to the Microsoft Store to install the Windows app. In these cases, you can install the Windows app to their devices by using Intune app assignment process. By assigning the app to device groups, you can automatically install the Windows 365 app on their devices. +Some of your users might have physical devices that don't have access to the Microsoft Store to install the Windows app. In these cases, you can install the Windows app to their devices by using Intune app assignment process. By assigning the app to device groups, you can automatically install Windows App on their devices. 1. Sign in to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431) > **Apps** > **All apps** > **Add**. ![Screenshot of add an app](./media/install-windows-365-app-intune/add-app.png) @@ -39,9 +39,9 @@ Some of your users might have physical devices that don't have access to the Mic 3. On the **Add App** page, select **Search the Microsoft Store app (new)**, search for **Windows app** and select it > choose **Select**. 4. On the **App information** page, you can leave all the settings as is or change them > **Next**. For more information about these settings, see [Add Microsoft Store apps to Microsoft Intune](/mem/intune/apps/store-apps-microsoft). 5. (Optional) On the **Scope tags** page, you can use scope tags to ensure that the right admins have the correct access and visibility to Intune objects. For more information about scope tags, see [Use role-based access control (RBAC) and scope tags for distributed IT](/mem/intune/fundamentals/scope-tags). Select **Next**. -6. On the **Assignments** page, add device and/or user groups containing the Cloud PCs on which you want the Windows 365 app to be automatically installed. If you target a user group, the users must first sign in to their Cloud PC before the app is installed. If you target a device group, the app is installed before the user signs in. - 1. Under **Required**, select **Add group** and add the groups containing the physical devices on which you want the Windows 365 app automatically installed. - 2. Under **Available for enrolled devices**, select **Add group** and add the user groups. The Windows 365 app is displayed in the Company Portal app and website for users to optionally install. +6. On the **Assignments** page, add device and/or user groups containing the Cloud PCs on which you want Windows App to be automatically installed. If you target a user group, the users must first sign in to their Cloud PC before the app is installed. If you target a device group, the app is installed before the user signs in. + 1. Under **Required**, select **Add group** and add the groups containing the physical devices on which you want Windows App automatically installed. + 2. Under **Available for enrolled devices**, select **Add group** and add the user groups. Windows App is displayed in the Company Portal app and website for users to optionally install. 3. After you've selected all the groups, select **Next** 7. On the **Review + create** page, select **Create**. diff --git a/windows-365/enterprise/introduction-windows-365-government.md b/windows-365/enterprise/introduction-windows-365-government.md index 11dca78acaa..e0ddc1624cb 100644 --- a/windows-365/enterprise/introduction-windows-365-government.md +++ b/windows-365/enterprise/introduction-windows-365-government.md @@ -61,14 +61,13 @@ The following features aren't yet supported for Windows 365 GCC or GCC High. - Audit logs support in Azure Log Analytics - [New Microsoft Teams client](/microsoftteams/new-teams-desktop-admin) - Windows 365 Boot (available for GCC, not available for GCC High) -- Windows App - Microsoft Purview forensic evidence - Windows 365 Switch - Windows 365 Frontline (available for GCC, not available for GCC High) -- Cloud PC connection quality report - Cross region disaster recovery - [Support for Omnissa Horizon clients and the Blast protocol](set-up-omnissa-horizon.md) -- [Microsoft Purview Customer Key](purview-customer-key.md) +- [Microsoft Purview Customer Key](purview-customer-key.md) +- [HP Anyware for Windows 365](hp-anyware-set-up.md) ## Next steps diff --git a/windows-365/enterprise/known-issues-enterprise.md b/windows-365/enterprise/known-issues-enterprise.md index 1df8bdba788..8edc0ee451f 100644 --- a/windows-365/enterprise/known-issues-enterprise.md +++ b/windows-365/enterprise/known-issues-enterprise.md @@ -245,7 +245,7 @@ This applies to the following gallery images: For newly provisioned Cloud PCs, verify WebRTC is available. If it’s not, you can use either of the following options: -- To add the WebRTC Redirector Service app to the list of apps to install by default onto Cloud PCs, follow the steps: [Add Microsoft 365 Apps to Windows 10/11 devices with Microsoft Intune](/intune/apps/apps-add-office365). +- To add the WebRTC Redirector Service app to the list of apps to install by default onto Cloud PCs, follow the steps: [Add Microsoft 365 Apps to Windows 10/11 devices with Microsoft Intune](/mem/intune/apps/apps-add-office365). - To add the WebRTC Redirector Service app to an individual Cloud PC, follow the steps: [install the Remote Desktop WebRTC Redirector Service](/azure/virtual-desktop/teams-on-avd#install-the-remote-desktop-webrtc-redirector-service). To get the most up-to-date installer, use this link: [https://aka.ms/msrdcwebrtcsvc/msi]( https://aka.ms/msrdcwebrtcsvc/msi). diff --git a/windows-365/enterprise/media/partner-integration-scenarios/partner-integration-connection-process.png b/windows-365/enterprise/media/partner-integration-scenarios/partner-integration-connection-process.png new file mode 100644 index 00000000000..dac101df5f4 Binary files /dev/null and b/windows-365/enterprise/media/partner-integration-scenarios/partner-integration-connection-process.png differ diff --git a/windows-365/enterprise/media/report-cloud-pc-connection-quality/view-report-connection-quality.png b/windows-365/enterprise/media/report-cloud-pc-connection-quality/view-report-connection-quality.png index dbcc193cd50..3037537ce78 100644 Binary files a/windows-365/enterprise/media/report-cloud-pc-connection-quality/view-report-connection-quality.png and b/windows-365/enterprise/media/report-cloud-pc-connection-quality/view-report-connection-quality.png differ diff --git a/windows-365/enterprise/media/report-cloud-pcs-not-available/view-report-cloud-pcs-not-available.png b/windows-365/enterprise/media/report-cloud-pcs-not-available/view-report-cloud-pcs-not-available.png index 25b64eaf966..c641dc7b0e1 100644 Binary files a/windows-365/enterprise/media/report-cloud-pcs-not-available/view-report-cloud-pcs-not-available.png and b/windows-365/enterprise/media/report-cloud-pcs-not-available/view-report-cloud-pcs-not-available.png differ diff --git a/windows-365/enterprise/media/restrict-office-365-cloud-pcs/create-conditional-policy.png b/windows-365/enterprise/media/restrict-office-365-cloud-pcs/create-conditional-policy.png index 20b2e2445cb..efec5d69195 100644 Binary files a/windows-365/enterprise/media/restrict-office-365-cloud-pcs/create-conditional-policy.png and b/windows-365/enterprise/media/restrict-office-365-cloud-pcs/create-conditional-policy.png differ diff --git a/windows-365/enterprise/media/restrict-office-365-cloud-pcs/include-apps.png b/windows-365/enterprise/media/restrict-office-365-cloud-pcs/include-apps.png index 8291926c478..24ecaac81b6 100644 Binary files a/windows-365/enterprise/media/restrict-office-365-cloud-pcs/include-apps.png and b/windows-365/enterprise/media/restrict-office-365-cloud-pcs/include-apps.png differ diff --git a/windows-365/enterprise/media/restrict-office-365-cloud-pcs/select-group.png b/windows-365/enterprise/media/restrict-office-365-cloud-pcs/select-group.png index 2b222bce2fa..90ac3526a6a 100644 Binary files a/windows-365/enterprise/media/restrict-office-365-cloud-pcs/select-group.png and b/windows-365/enterprise/media/restrict-office-365-cloud-pcs/select-group.png differ diff --git a/windows-365/enterprise/partner-integration-scenarios.md b/windows-365/enterprise/partner-integration-scenarios.md new file mode 100644 index 00000000000..a37893f4727 --- /dev/null +++ b/windows-365/enterprise/partner-integration-scenarios.md @@ -0,0 +1,64 @@ +--- +# required metadata +title: Partner integration scenarios for Windows 365. +titleSuffix: +description: Learn about partner integration scenarios for Windows 365. +keywords: +author: ErikjeMS +ms.author: erikje +manager: dougeby +ms.date: 10/23/2024 +ms.topic: overview +ms.service: windows-365 +ms.subservice: windows-365-enterprise +ms.localizationpriority: high +ms.assetid: + +# optional metadata + +#ROBOTS: +#audience: + +ms.reviewer: aradinger +ms.suite: ems +search.appverid: MET150 +#ms.tgt_pltfrm: +ms.custom: intune-azure; get-started +ms.collection: +- M365-identity-device-management +- tier2 +--- + +# Windows 365 partner integration supported scenarios + +The following partner integration scenarios support partner protocols on top of Windows 365, without compromising the simplicity and predictability that Windows 365 delivers. + +| Partner | Supported clients | Gateway service | Connection protocol | Supported service plans | +| --- | --- | --- | --- | --- | +| Citrix | Citrix Workspace web client
                        Citrix Workspace desktop clients for supported platforms | Citrix Cloud Gateway Service | Citrix HDX | Enterprise, Frontline +| HP | HP Anyware web client
                        HP Anyware desktop clients for supported platforms | HP Anyware Cloud Gateway Service | HP Anyware | Enterprise | +| Omnissa | Omnissa Workspace ONE web client
                        Omnissa ONE desktop clients for supported platforms | Omnissa Cloud Gateway Service | Omnissa Blast | Enterprise | + +While scenarios not listed here might still work in customers’ production environment, they aren't supported by Microsoft. + +> [!NOTE] +> +> On-premises gateway services aren't supported. + +## User connection process with partner integration + +![Diagram of Windows 365 partner supported connection process.](media/partner-integration-scenarios/partner-integration-connection-process.png) + +1. A user authenticates using Microsoft Entra ID, on-premises Active Directory, or a third party identity provider. +2. Windows 365 establishes a connection to the partner cloud gateway using partner protocols. +3. A Cloud PC is assigned to the user and is accessible from the web/workspace portals. +4. Windows 365 establishes a connection to the Cloud PC using partner protocols. + + +## Next steps + +[Set up Citrix HDX Plus for Windows 365 Enterprise](set-up-citrix.md). + +[Set up HP Anywhere for Windows 365 Enterprise](set-up-citrix.md). + +[Set up Omnissa Horizon for Windows 365 Enterprise](set-up-citrix.md). diff --git a/windows-365/enterprise/privacy-personal-data.md b/windows-365/enterprise/privacy-personal-data.md index 081c7926334..2e3185bfc3f 100644 --- a/windows-365/enterprise/privacy-personal-data.md +++ b/windows-365/enterprise/privacy-personal-data.md @@ -7,7 +7,7 @@ keywords: author: ErikjeMS ms.author: erikje manager: dougeby -ms.date: 09/13/2023 +ms.date: 10/02/2024 ms.topic: conceptual ms.service: windows-365 ms.subservice: windows-365-enterprise @@ -19,7 +19,7 @@ ms.assetid: #ROBOTS: #audience: -ms.reviewer: anbiswas +ms.reviewer: tnevins1, pratikshah ms.suite: ems search.appverid: MET150 #ms.tgt_pltfrm: @@ -30,6 +30,8 @@ ms.collection: - essentials-privacy --- + + # Privacy, customer data, and customer content in Windows 365 Windows 365 is a cloud-based service that lets you provision and manage Cloud PC for your users. You manage the Cloud PCs with the rest of your devices by using Microsoft Intune (Windows 365 Enterprise) or a self-serviced experience (Windows 365 Business). This documentation provides details on data platform and privacy compliance for Windows 365. Unless otherwise specified, the term Windows 365 in this document refers to both Windows 365 Enterprise and the Windows 365 Business. Where the details below differ, each product is called out individually. @@ -47,7 +49,7 @@ To protect and maintain enrolled devices, Windows 365 processes and copies data ## Windows 365 data storage -Depending on a tenant's region and preference, Windows 365 stores its customer content in Azure regions in North America, Europe, or Asia Pacific. Cloud PC virtual disk, customer content, data and storage associated with the Cloud PC lives in the Azure region that the Cloud PC is [provisioned](provisioning.md) in. For Windows 365 Enterprise, the region is defined in the [Azure network connection's](azure-network-connections.md) (ANC) **Virtual network** setting. Windows 365 Business stores customer data in the Azure region of the Cloud PC itself. +Depending on a tenant's region and preference, Windows 365 stores its customer content in Azure regions in North America, Europe, or Asia Pacific. Cloud PC virtual disk, customer content, data and storage associated with the Cloud PC lives in the Azure region that the Cloud PC is [provisioned](provisioning.md) in. For Windows 365 Enterprise, the region is defined in the Microsoft hosted network or [Azure network connection](azure-network-connections.md) (ANC) settings within the Cloud PC's associated provisioning policy. Windows 365 Business stores customer data in the Azure region of the Cloud PC itself. To manage the Cloud PC, certain data relating to the Cloud PC (like the machine’s name, diagnostic data, and service-generated data) is stored in Azure data centers in North America, Europe, or Asia Pacific, as defined by the tenant's location. This storage is mapped based on Microsoft Online tenant's country/region to the nearest Azure region. diff --git a/windows-365/enterprise/provisioning-errors.md b/windows-365/enterprise/provisioning-errors.md index 5a94a5b80e8..cdd3421b403 100644 --- a/windows-365/enterprise/provisioning-errors.md +++ b/windows-365/enterprise/provisioning-errors.md @@ -7,7 +7,7 @@ keywords: author: ErikjeMS ms.author: erikje manager: dougeby -ms.date: 07/16/2024 +ms.date: 09/13/2024 ms.topic: how-to ms.service: windows-365 ms.subservice: windows-365-enterprise @@ -169,6 +169,25 @@ Windows 365 provisioned the Cloud PC but didn’t disable the built-in Windows r **Suggested test**: Retry provisioning. +## Blocking High Risk Ports: One or more high risk ports couldn’t be disabled + +Windows 365 provisioned the Cloud PC but was unable to block all high-risk ports based on Microsoft security standards. Windows 365 disables high risk ports used for the management of resources or unsecure/unencrypted data transmission and shouldn't be exposed to the internet by default. + +If you are seeing this error, some factors to consider are: + +- Sometimes an enterprise will implement an Intune group policy that enables one of these ports by default. +- Make sure that there are no Intune policies that may override Windows 365's default of disabling these high-risk ports. + +**Suggested test**: Try any of these solutions: + +- Retry provisioning. +- If the device is Intune-enrolled, you can apply Intune policy to disable the ports. +- The user can also disable the ports manually by adding a local firewall rule onto their device. For a list of high risk ports that are recommended for blocking, please see [Security admin rules in Azure Virtual Network Manager](/azure/virtual-network-manager/concept-security-admins#protect-high-risk-ports). + +## Other provisioning failures + +If you encounter other provisioning errors not covered above, make sure all the required endpoints are allowed on the VNet used for your ANC and any gateway device. + ## Next steps [Troubleshooting](troubleshooting.md). diff --git a/windows-365/enterprise/report-cloud-pc-actions.md b/windows-365/enterprise/report-cloud-pc-actions.md index d968c398635..8f2dcd3cb12 100644 --- a/windows-365/enterprise/report-cloud-pc-actions.md +++ b/windows-365/enterprise/report-cloud-pc-actions.md @@ -7,7 +7,7 @@ keywords: author: ErikjeMS ms.author: erikje manager: dougeby -ms.date: 12/6/2023 +ms.date: 10/30/2024 ms.topic: overview ms.service: windows-365 ms.subservice: windows-365-enterprise @@ -31,7 +31,12 @@ ms.collection: # Cloud PC actions report (preview) -This report shows you what actions admins have taken on which Cloud PCs, and the status of those actions. +This report shows you the status and completion progress of actions admins have taken on Cloud PCs, for both: + +- Single actions on the **Devices** tab. +- Multiple devices using **Bulk device actions** on the **Bulk batches** tab. + + The report shows action statuses for the last 90 days. The Cloud PC actions report is in [public preview](..\public-preview.md). @@ -39,11 +44,11 @@ The Cloud PC actions report is in [public preview](..\public-preview.md). To get to the **Cloud PC actions** report, sign in to [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431), select **Devices** > **Monitor** > **Cloud PC actions (preview)**. -## Report data +## Devices tab :::image type="content" source="./media/report-cloud-pc-actions/report.png" alt-text="Screenshot of the Cloud PC actions report." lightbox="./media/report-cloud-pc-actions/report.png"::: -The report shows the following columns: +The tab shows the following columns: - **Device name** - **Primary user UPN** @@ -64,6 +69,17 @@ The report shows the following columns: - **Review required**: An admin must take action to complete the action. For example, assigning a target license to a device in **Resize Pending License** state for the **Resize** action. - **Date initiated** +## Bulk batches tab + +When an admin takes an action on multiple Cloud PCs at once using **Bulk device actions**, the actions are combined into a batch. + +The tab shows the following columns: + +- **Batch name** - An automatically generated name for a batch of devices undergoing a remote action. +- **Action** - Same as **Devices** tab. +- **Completion** - The progress of the action on the batch of devices. +- **Date initiated** + ## Next steps diff --git a/windows-365/enterprise/report-cloud-pc-connection-quality.md b/windows-365/enterprise/report-cloud-pc-connection-quality.md index 86e6fbc3d8a..f5006b63761 100644 --- a/windows-365/enterprise/report-cloud-pc-connection-quality.md +++ b/windows-365/enterprise/report-cloud-pc-connection-quality.md @@ -7,7 +7,7 @@ keywords: author: ErikjeMS ms.author: erikje manager: dougeby -ms.date: 03/27/2024 +ms.date: 10/18/2024 ms.topic: overview ms.service: windows-365 ms.subservice: windows-365-enterprise @@ -35,7 +35,7 @@ The **Connection quality report** helps Windows 365 administrators identify devi ## Use the Cloud PC connection quality report -To get to the **Cloud PC connection quality** report, sign in to [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431), select **Devices** > **Overview** > **Cloud PC performance** > **View report** (under **Connection quality**). +To get to the **Cloud PC connection quality** report, sign in to [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431), select **Reports** > **Cloud PC overview** > **Connection quality**. ![Screenshot of getting to the Cloud PC connection quality report](./media/report-cloud-pc-connection-quality/view-report-connection-quality.png) diff --git a/windows-365/enterprise/report-cloud-pc-recommendations.md b/windows-365/enterprise/report-cloud-pc-recommendations.md index b790a3ed7da..d58276759b9 100644 --- a/windows-365/enterprise/report-cloud-pc-recommendations.md +++ b/windows-365/enterprise/report-cloud-pc-recommendations.md @@ -42,11 +42,9 @@ An evolving model analyzes this data to determine whether Cloud PCs are: - Under-used. - Sized appropriately. -The Cloud PC recommendations report is in [public preview](..\public-preview.md). - ## Use the Cloud PC recommendations report -To get to the **Cloud PC recommendations** report, sign in to [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431), select **Reports** > **Cloud PC Overview** > **Cloud PC recommendations (preview)**. +To get to the **Cloud PC recommendations** report, sign in to [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431), select **Reports** > **Cloud PC Overview** > **Cloud PC recommendations**. ![Screenshot of Cloud PC recommendation report.](media/report-cloud-pc-recommendations/report-cloud-pc-recommendations.png) diff --git a/windows-365/enterprise/report-cloud-pcs-not-available.md b/windows-365/enterprise/report-cloud-pcs-not-available.md index 751476e1a15..021a70a8027 100644 --- a/windows-365/enterprise/report-cloud-pcs-not-available.md +++ b/windows-365/enterprise/report-cloud-pcs-not-available.md @@ -7,7 +7,7 @@ keywords: author: ErikjeMS ms.author: erikje manager: dougeby -ms.date: 08/28/2024 +ms.date: 10/18/2024 ms.topic: overview ms.service: windows-365 ms.subservice: windows-365-enterprise @@ -37,7 +37,7 @@ This report displays recent conditions up to 5 to 15 minutes ago. Therefore, Clo ## Use the Cloud PCs that aren't available report -To get to the **Cloud PCs that aren't available** report, sign in to [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431), select **Devices** > **Overview** > **Cloud PC performance** > **Cloud PCs that aren't available**. +To get to the **Cloud PCs that aren't available** report, sign in to [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431), select **Reports** > **Cloud PC overview** > **Cloud PCs that aren't available**. ![Screenshot of getting to the Cloud PCs that aren't available report](./media/report-cloud-pcs-not-available/view-report-cloud-pcs-not-available.png) diff --git a/windows-365/enterprise/report-remoting-connection.md b/windows-365/enterprise/report-remoting-connection.md index 0c6800d6289..aec5263dc3c 100644 --- a/windows-365/enterprise/report-remoting-connection.md +++ b/windows-365/enterprise/report-remoting-connection.md @@ -31,6 +31,9 @@ ms.collection: # Remoting connection report +> [!IMPORTANT] +> The remoting connection report will be retired on December 31st, 2024. After this date, refer to the [Cloud PC connection quality report](report-cloud-pc-connection-quality.md). + The Remoting connection report in [Endpoint analytics](/mem/analytics/overview) helps you monitor key performance metrics for connecting to the Cloud PCs. There are two metrics in this report: - **Round trip time (ms)** diff --git a/windows-365/enterprise/requirements.md b/windows-365/enterprise/requirements.md index 7563cd8e369..aedc7dd898a 100644 --- a/windows-365/enterprise/requirements.md +++ b/windows-365/enterprise/requirements.md @@ -63,7 +63,7 @@ A subscription in Azure Government is required for Windows 365 Government custom ## Microsoft Entra ID and Intune requirements - A valid and working Intune and Microsoft Entra tenant. -- Intune device type enrollment restrictions set to Allow Windows (MDM) platform for corporate enrollment. +- Intune default device type enrollment restrictions must be set to Allow Windows (MDM) platform for corporate enrollment. For more information, see [Device Enrollment Restrictions Limitations](/mem/intune/enrollment/enrollment-restrictions-set#limitations). - Infrastructure configuration: If you plan on provisioning Microsoft Entra hybrid joined Cloud PCs, you must configure your infrastructure to automatically Microsoft Entra hybrid join any devices that domain join to the on-premises Active Directory. This [configuration lets them be recognized and managed in the cloud](/azure/active-directory/devices/overview). - Microsoft Entra Domain Services isn't supported because it doesn't support Microsoft Entra hybrid join. diff --git a/windows-365/enterprise/resilience.md b/windows-365/enterprise/resilience.md index ef7b894a036..256891b7655 100644 --- a/windows-365/enterprise/resilience.md +++ b/windows-365/enterprise/resilience.md @@ -19,7 +19,7 @@ ms.assetid: #ROBOTS: #audience: -ms.reviewer: thhickli +ms.reviewer: thhickli, rkiran ms.suite: ems search.appverid: MET150 #ms.tgt_pltfrm: @@ -29,6 +29,8 @@ ms.collection: - tier2 --- + + # Windows 365 service resilience Windows 365 is designed to provide a resilient and reliable service for organizations and end users, connecting to, and using their Cloud PCs. diff --git a/windows-365/enterprise/resize-cloud-pc.md b/windows-365/enterprise/resize-cloud-pc.md index 63cb93cc6b4..abe679ca475 100644 --- a/windows-365/enterprise/resize-cloud-pc.md +++ b/windows-365/enterprise/resize-cloud-pc.md @@ -7,7 +7,7 @@ keywords: author: ErikjeMS ms.author: erikje manager: dougeby -ms.date: 07/09/2024 +ms.date: 10/03/2024 ms.topic: overview ms.service: windows-365 ms.subservice: windows-365-enterprise @@ -31,30 +31,7 @@ ms.collection: # Resize a Cloud PC -The **Resize** remote action, which preserves user and disk data, lets you: - -- Upgrade the RAM, CPU, and storage size of a Cloud PC. -- Downgrade the RAM and CPU of Cloud PC. Resizing doesn't let you downsize disk space. - -These operations don't require reprovisioning of the Cloud PC. - -You might consider resizing a Cloud PC when a user needs: - -- Higher RAM and VCPU cores to run CPU intensive applications. -- More disk space for file storing. -- Less RAM and vCPU cores to run their current workload applications. - -Resizing supports: - -- Direct and group-based licenses. -- Paid, preview, and trial licenses. -- Bulk and single device operations. - -Resizing doesn't support: - -- GPU Cloud PCs. GPU Cloud PCs might show up in the resize flow, but trying to resize a GPU Cloud PC will result in an error. - -Resizing automatically disconnects the user from their session and any unsaved work might be lost. Therefore, it's best to coordinate any resizing with the user before you begin. Contact your end users and have them save their work and sign out before you begin resizing. +[!INCLUDE [Resize a Cloud PC intro](../includes/resize-introduction.md)] Downsizing may impact support for nested virtualization. For more information, see [Set up virtualization-based workloads support](nested-virtualization.md). @@ -65,7 +42,7 @@ Downsizing may impact support for nested virtualization. For more information, s To resize a Cloud PC, the admin must have certain built-in Microsoft Entra roles. - For a Cloud PC provisioned with a direct assigned license, at least one of the following roles - - Intune Service Administrator + - Intune Service Administrator - Intune Reader + Cloud PC Admin roles - Intune Reader + Windows 365 Administrator - For a Cloud PC provisioned with a group-based license, at least one of the following roles @@ -75,24 +52,9 @@ To resize a Cloud PC, the admin must have certain built-in Microsoft Entra roles Alternatively, you can assign a custom role that includes the permissions of these built-in roles. -## IP address requirements +[!INCLUDE [Resize a Cloud PC IP requirements](../includes/resize-ip-address-requirements.md)] -When resizing a Microsoft Entra hybrid join bring-your-own-network Cloud PC, a second IP address must be available in the subnet for the Cloud PC to be resized. - -During the resizing operation, a second IP address is used when moving to the new size. This precaution makes sure that the Cloud PC can be rolled back to the original should an issue occur. - -To account for this precaution, you can: - -- Make sure that adequate IP addresses are available in the vNET for all Cloud PCs to be resized, or -- Stagger your resize operations to make sure that the address scope is maintained. - -If inadequate addresses are available, resize failures can occur. - -### Other requirements - -In order to use **Resize** there must be available licenses in inventory for the resized Cloud PC configuration. - -To **Resize** a Cloud PC, it must have a status of **Provisioned** in the Windows 365 provisioning node. +[!INCLUDE [Resize a Cloud PC other requirements](../includes/resize-other-requirements.md)] ## Resize a single Cloud PC provisioned with a direct assigned license @@ -102,7 +64,7 @@ When resizing Cloud PCs provisioned through direct assigned licenses the Windows - Assigning the new license on behalf of the admin. 1. Sign in to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431), select **Devices** > **All Devices** > choose a device > **Resize**. -![Screenshot of resize a Cloud PC](./media/resize-cloud-pc/resize.png) +![Screenshot of resize a Cloud PC.](./media/resize-cloud-pc/resize.png) 2. Under **Resize**, there's a list of the sizes that you can upgrade or downsize to based on the licenses available in your inventory. You can upgrade/downgrade a Cloud PC’s RAM and vCPU. You can only upgrade the OS disk storage. If you're downgrading a user’s Cloud PC, options with lower storage are grayed out. Select one of the available options. 3. Select **Resize**. @@ -113,13 +75,13 @@ If there are available licenses, the resizing starts. 1. Create a new target Microsoft Entra group. Add the users from the source Microsoft Entra group that you want to resize. Alternately, you can use existing Microsoft Entra groups if you're mapping the groups to individual Windows 365 license types. 2. Assign the existing provisioning policy targeting the original source Microsoft Entra group to the new target Microsoft Entra group. You only need to do this step if you don't have a discrete Microsoft Entra group for your provisioning policy assignment. If you have discrete Microsoft Entra groups to manage your provisioning policy assignments, you can omit this step. 3. Sign in to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431), select **Devices** > **All Devices** > choose the device that you want added to the Microsoft Entra target group > **Resize**. -![Screenshot of resize a Cloud PC](./media/resize-cloud-pc/resize.png) +![Screenshot of resize a Cloud PC.](./media/resize-cloud-pc/resize.png) 4. A list is displayed with all the possible SKUs that you can upgrade or downsize to based on the licenses that you have available in your inventory. You can upgrade/downgrade a Cloud PC’s RAM and vCPU. You can only upgrade the OS disk storage. If you're downsizing a user’s Cloud PC, options with lower storage are grayed out. Select one of the available options. 5. Select **Resize**. 6. The user’s Cloud PC is placed in the **Resize pending license** state as can be seen in the Windows 365 provisioning blade. 7. Select **Users** > search for the user name assigned to the Cloud PC and select it > **Groups**. 8. To retrieve the old license, remove the users from the original source Microsoft Entra group. If you don’t perform this step, a new Cloud PC will be provisioned with the original source license after you assign the target license. - - When using Microsoft Entra ID hybrid in your environment, after removing the user from the original group, you must wait until Microsoft Entra Connect synchronizes your on-premises Active Directory with with your Microsoft Entra ID. This can take up to 30 minutes. Then you can add the user to the new group. + - When using Microsoft Entra ID hybrid in your environment, after removing the user from the original group, you must wait until Microsoft Entra Connect synchronizes your on-premises Active Directory with your Microsoft Entra ID. This can take up to 30 minutes. Then you can add the user to the new group. 9. Assign the target license to the new target Microsoft Entra group. The resizing process now begins. ## Bulk resizing Cloud PCs @@ -159,7 +121,7 @@ Up to 5,000 Cloud PCs can be resized at a time. 7. Under **Select groups to include**, choose the groups containing the users who own the devices that you want to resize > **Next**. 8. On the **Review + create** page, select **Create**. The user’s Cloud PC is placed in the **Resize pending license** state as can be seen in the Windows 365 provisioning blade. 9. To retrieve the old license, remove the users from the original source Microsoft Entra group. If you don’t perform this step, a new Cloud PC will be provisioned with the original source license after you assign the target license. - - When using Microsoft Entra ID hybrid in your environment, after removing the user from the original group, you must wait until Microsoft Entra Connect synchronizes your on-premises Active Directory with with your Microsoft Entra ID. This can take up to 30 minutes. Then you can add the user to the new group. + - When using Microsoft Entra ID hybrid in your environment, after removing the user from the original group, you must wait until Microsoft Entra Connect synchronizes your on-premises Active Directory with your Microsoft Entra ID. This can take up to 30 minutes. Then you can add the user to the new group. 10. Assign the target license to the new target Microsoft Entra group. The resizing process now begins. ## Resizing details @@ -172,15 +134,9 @@ If the source license isn't removed first, and the new license is assigned to th If the source license isn't removed, and the target license isn't assigned within 48 hours, the device returns to the **Provisioned** state. -When resizing starts, the user is automatically disconnected from their Cloud PC and any unsaved work might be lost. - -Resizing can take from 15 to 20 minutes before the user can access their Cloud PC again. You can monitor the status in the Windows 365 provisioning blade. Users can see their Cloud PC status at https://windows365.microsoft.com. - If you have a combination of paid and trial licenses, the resize feature uses your paid licenses first. After these licenses run out, the resize operation uses your trial licenses. -If there are no licenses in your inventory, the resizing fails. To request more licenses, contact your procurement admin. After you purchase the license and added to the inventory in the Microsoft 365 admin center, you can retry the resize operation. Licenses can be purchased from various channels: EA, CSP, MCA, and Web Direct. - -Devices with a state of **Resize not supported** aren't resized. The status message and details can help you identify the issue. You can still proceed with a bulk resize even if you have devices in the list that are marked as **Resize not supported**. +[!INCLUDE [Resize a Cloud PC details](../includes/resize-details.md)] ## Resize with Step-up Licenses diff --git a/windows-365/enterprise/restrict-office-365-cloud-pcs.md b/windows-365/enterprise/restrict-office-365-cloud-pcs.md index bc128eb9aea..bd087454bfd 100644 --- a/windows-365/enterprise/restrict-office-365-cloud-pcs.md +++ b/windows-365/enterprise/restrict-office-365-cloud-pcs.md @@ -7,7 +7,7 @@ keywords: author: ErikjeMS ms.author: erikje manager: dougeby -ms.date: 09/27/2023 +ms.date: 09/30/2024 ms.topic: how-to ms.service: windows-365 ms.subservice: windows-365-enterprise @@ -36,18 +36,27 @@ Administrators can deny access to Office 365 services on any device other than a This article describes how to limit access to Office 365 services. You can use the same strategy with any cloud service that uses Microsoft Entra ID as the authentication source. 1. Create a Microsoft Entra security group to manage which users are controlled by the new policy. Add to this group all the Cloud PC users who will be subjected to the new policy. Only users in this group will be restricted to using Cloud PCs when accessing Office 365 services. If you want to change a user’s access, you can just remove them from this group. + 2. Sign in to [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431), select **Endpoint security** > **Conditional access** > **Create new policy**. + ![Create conditional access policy screen shot](./media/restrict-office-365-cloud-pcs/create-conditional-policy.png) + 3. Type a **Name** for your new Conditional Access policy. For example, “Restrict Office 365 access to CPCs”. + 4. Select **0 users and groups selected** > **Include** > **Select users and groups** > **Users and groups** > select the Microsoft Entra security group that you created > **Select**. + ![Select group screen shot](./media/restrict-office-365-cloud-pcs/select-group.png) -5. Select **No cloud apps, actions, or authentication contexts selected** > **Include** > **Select apps** > **None** (under **Select**) > search for and select **Office 365** > **Select**. + +5. Select **No target resources selected** > **Include** > **Select apps** > **None** (under **Select**) > search for and select **Office 365** > **Select**. + ![Select apps to include](./media/restrict-office-365-cloud-pcs/include-apps.png) + 6. Select **Exclude** > **None** (under **Select excluded cloud apps**) > search for and select **Azure Virtual Desktop** and **Windows 365** apps > **Select**. - ![Select apps to exclude](./media/restrict-office-365-cloud-pcs/exclude-apps.png) -7. Select **0 conditions selected** > **Not configured** (under **Filter for devices**). - ![Filter devices screen shot](./media/restrict-office-365-cloud-pcs/filter-devices.png) + +7. Select **0 conditions selected** (under **Conditions**) > **Not configured** (under **Filter for devices**). + 8. In the **Filter for devices** pane: + 1. Set **Configure** to **Yes**. 2. Select **Exclude filtered devices from policy**. 3. Select the dropdown option under **Property** > **Model**. @@ -55,12 +64,14 @@ This article describes how to limit access to Office 365 services. You can use t 5. In the text box under **Value**, type the value as **Cloud PC**. If the Cloud PC naming conventions change, change the filter value to match the device names. 6. Select **Done** to set the filter. - ![Configure filtering devices](./media/restrict-office-365-cloud-pcs/filter-devices-configure.png) + ![Configure filtering devices](./media/restrict-office-365-cloud-pcs/filter-devices-configure.png) You can set more options in this policy as needed, but such additions are outside the scope of this article. + 9. Select **0 controls selected** (under **Grant**) > **Block Access** >**Select**. - ![Block access screen shot](./media/restrict-office-365-cloud-pcs/block-access.png) + 10. Select **On** (under **Enable policy**). This policy will restrict users from accessing Office 365 services on non-Cloud PC devices. You may want to select **Report-only** to monitor the policy and build confidence prior to enforcing it. + 11. Select **Create** to complete the creation of policy. >[!NOTE] diff --git a/windows-365/enterprise/security.md b/windows-365/enterprise/security.md index 5e6fc627a48..f2f46f5b6f3 100644 --- a/windows-365/enterprise/security.md +++ b/windows-365/enterprise/security.md @@ -19,7 +19,7 @@ ms.assetid: #ROBOTS: #audience: -ms.reviewer: chrimo +ms.reviewer: lakasa, pratikshah, saudm, jonshi ms.suite: ems search.appverid: #ms.tgt_pltfrm: @@ -30,6 +30,8 @@ ms.collection: - essentials-security --- + + # Windows 365 security Windows 365 provides an end-to-end connection flow for users to do their work effectively and securely. Windows 365 is built with [Zero Trust](/security/zero-trust/zero-trust-overview) in mind, providing the foundation for you to implement controls to better secure your environment across the 6 pillars of Zero Trust. You can implement Zero Trust controls for the following categories: @@ -106,7 +108,7 @@ To manage RDP features available to the user during their Cloud PC connection, s Windows 365 Cloud PCs can be accessed from various operating system platforms and clients available in those platforms. -- **Windows OS platforms**: Windows 365 can be accessed using Remote Desktop client for Windows and the Windows 365 App. Both these apps receive updates using the Windows Update service. For more information, see [Windows Update security](/windows/deployment/update/windows-update-security). +- **Windows OS platforms**: Windows 365 can be accessed using Remote Desktop client for Windows and the Windows App. Both these apps receive updates using the Windows Update service. For more information, see [Windows Update security](/windows/deployment/update/windows-update-security). - **Apple devices (macOS and iOS)**: Remote desktop client apps and their updates are distributed by Apple's app store. For more information about MacOS and iOS security measures, see [Apple Platform Security](https://support.apple.com/en-sg/guide/security/welcome/web). - **Android platforms**: Android platform apps downloaded from Google play stores conform to the Google play store terms and conditions. For more information, see [Google Play Terms of Service](https://play.google.com/about/play-terms/index.html). diff --git a/windows-365/enterprise/set-up-tenants-windows-365-gcc.md b/windows-365/enterprise/set-up-tenants-windows-365-gcc.md index ec7c952fd86..f90cb495457 100644 --- a/windows-365/enterprise/set-up-tenants-windows-365-gcc.md +++ b/windows-365/enterprise/set-up-tenants-windows-365-gcc.md @@ -80,11 +80,11 @@ If you want to use Microsoft Entra join or Microsoft Entra hybrid join, consider For the Windows 365 GCC Setup Tool to complete tenant mapping, the Windows 365 Microsoft Entra application must be given permission to access your Azure Government AD tenant through a service principal. The service principal object defines what the app can do in the tenant, who can access the app, and what resources the app can access. Before running the Windows 365 GCC Setup Tool the first time, you must do the following: 1. If not already completed, install the Azure CLI on the computer where you will be creating the service principal. For more information, see [How to install the Azure CLI](/cli/azure/install-azure-cli). -2. Sign into your Azure Government AD tenant by using the Azure CLI steps defined in [Sign in with Azure CLI](/cli/azure/authenticate-azure-cli). Global Administrator permissions are required to create the service principal for the Windows 365 App. +2. Sign into your Azure Government AD tenant by using the Azure CLI steps defined in [Sign in with Azure CLI](/cli/azure/authenticate-azure-cli). Global Administrator permissions are required to create the service principal for Windows App. 3. For more information about working with service principals in Azure, see [Work with Azure service principal using the Azure CLI](/cli/azure/azure-cli-sp-tutorial-1). Grant the Windows 365 Microsoft Entra app permissions to your tenant by running the following PowerShell command: ```az ad sp create --id 0af06dc6-e4b5-4f28-818e-e78e62d137a5```. -4. After the command completes successfully, you should be able to view details about the service principal by running the following PowerShell command: ```az ad sp show --id 0af06dc6-e4b5-4f28-818e-e78e62d137a5```. You should see the Windows 365 application listed in the **All Applications** view in the Enterprise application blade in Azure portal. +4. After the command completes successfully, you should be able to view details about the service principal by running the following PowerShell command: ```az ad sp show --id 0af06dc6-e4b5-4f28-818e-e78e62d137a5```. You should see Windows App listed in the **All Applications** view in the Enterprise application blade in Azure portal. -The Windows 365 App service principal can only access Azure resources necessary to configure custom image and Azure Network Connection (ANC) support in Windows 365. After it's created, the service principal can only be deleted when custom images, ANC objects and corresponding Cloud PCs using them have been deprovisioned. Otherwise, Cloud PC provisioning tasks may fail, and existing Cloud PCs may become inaccessible. +The Windows App service principal can only access Azure resources necessary to configure custom image and Azure Network Connection (ANC) support in Windows 365. After it's created, the service principal can only be deleted when custom images, ANC objects and corresponding Cloud PCs using them have been deprovisioned. Otherwise, Cloud PC provisioning tasks may fail, and existing Cloud PCs may become inaccessible. ## Get started with the Windows 365 GCC Setup Tool diff --git a/windows-365/enterprise/share-restore-points-storage.md b/windows-365/enterprise/share-restore-points-storage.md index 0ab1e097594..d1b3f0df0e1 100644 --- a/windows-365/enterprise/share-restore-points-storage.md +++ b/windows-365/enterprise/share-restore-points-storage.md @@ -7,7 +7,7 @@ keywords: author: ErikjeMS ms.author: erikje manager: dougeby -ms.date: 08/28/2024 +ms.date: 10/18/2024 ms.topic: conceptual ms.service: windows-365 ms.subservice: windows-365-enterprise @@ -42,8 +42,8 @@ You might want to share (move or copy) a Cloud PC and its contents to: ## Share a single restore point -1. Sign in to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431) > **Devices** > **All devices** > select a device > select the ellipses (**...**) > **Share**. -1. In the **Select restore point** area, select a **Subscription** and **Storage account**. +1. Sign in to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431) > **Devices** > **Windows 365** > **All Cloud PCs** > select a device > **Restore points** > select the ellipses (**...**) > **Share**. +1. In the **Share restore point** area, select a **Subscription** and **Storage account**. 1. Select **Share**. A folder is created in the storage account. The folder name is identical to the Cloud PC name. The folder contains a VHD copy of the Cloud PC device disk. diff --git a/windows-365/enterprise/teams-on-cloud-pc.md b/windows-365/enterprise/teams-on-cloud-pc.md index e63c81c2f1a..0b1876f149c 100644 --- a/windows-365/enterprise/teams-on-cloud-pc.md +++ b/windows-365/enterprise/teams-on-cloud-pc.md @@ -56,7 +56,7 @@ Some of the key benefits of the optimizations are: Media optimization for Microsoft Teams is only available for the Windows and macOS endpoints. Media optimizations require: -- [Windows 365 app for Windows](/azure/virtual-desktop/teams-on-avd) via the Microsoft Store (ideally the latest version). +- [Windows App for Windows](/azure/virtual-desktop/teams-on-avd) via the Microsoft Store (ideally the latest version). - Remote Desktop client for Windows, version 1.2.1026.0 or later (ideally the latest version). - Remote Desktop client for macOS, version 10.7.7 or later ([beta client](https://aka.ms/rdmacbeta)). If you upgrade from versions earlier than 10.7.7, you'll also need to go to Microsoft **Remote Desktop Preferences** > **General** and turn on Teams optimizations. If you're using the client for the first time and already have version 10.7.7 or later installed, you won't need to turn that on. In that case, Teams optimizations are turned on by default. diff --git a/windows-365/enterprise/troubleshoot-azure-network-connection.md b/windows-365/enterprise/troubleshoot-azure-network-connection.md index 8f491982c94..ac09deec0ba 100644 --- a/windows-365/enterprise/troubleshoot-azure-network-connection.md +++ b/windows-365/enterprise/troubleshoot-azure-network-connection.md @@ -119,6 +119,8 @@ If this test fails, make sure that: - There are no firewall rules (physical, virtual, or in Windows) that might block required traffic. - You consider testing the endpoints from a VM on the same subnet declared for Cloud PCs. +If you aren't using Azure CloudShell, make sure that your PowerShell execution policy is configured to allow Unrestricted scripts. If you use Group Policy to set execution policy, make sure that the Group Policy Object (GPO) targeted at the Organizational Unit (OU) defined in the ANC is configured to allow Unrestricted scripts. For more information, see [Set-ExecutionPolicy](/powershell/module/microsoft.powershell.security/set-executionpolicy). + ## Environment and configuration are ready This check is used for many infrastructure related issues that might be related to infrastructure that customers are responsible for. It can include errors such as internal service time outs or errors caused by customers deleting/changing Azure resources while checks are being run. diff --git a/windows-365/enterprise/troubleshoot-windows-365-boot.md b/windows-365/enterprise/troubleshoot-windows-365-boot.md index 3dfa6d9661e..48e7ac9b159 100644 --- a/windows-365/enterprise/troubleshoot-windows-365-boot.md +++ b/windows-365/enterprise/troubleshoot-windows-365-boot.md @@ -7,7 +7,7 @@ keywords: author: ErikjeMS ms.author: erikje manager: dougeby -ms.date: 09/26/2023 +ms.date: 09/26/2024 ms.topic: troubleshooting ms.service: windows-365 ms.subservice: windows-365-enterprise @@ -39,9 +39,15 @@ If the user can't access the Cloud PC from the Windows 365 Boot physical device, 1. Check to see if you can sign in to the Cloud PC from either: - The browser at windows365.microsoft.com. - - The Windows 365 app on another (non-Windows 365 Boot) device. -2. If you can log into the Cloud PC from either method, then there's an issue with the Windows 365 Boot physical device. In this case, confirm that the physical device is correctly configured and has the requisite software versions. For more information, see [Windows 365 Boot physical device requirements](windows-365-boot-physical-device-requirements.md). -3. Admins can try to manually click on **Device sync** to get the policies delivered faster on the device. Users can try to restart the device. + - The Windows App on another (non-Windows 365 Boot) device. +2. If a user has more than one Cloud PC, make sure they have selected a default Cloud PC to use each time they sign in. To set this default: + - Navigate to https://windows365.microsoft.com. + - In the card for the Cloud PC you want to set as default, select the ellipses (...) > Settings. + - In the **Integrated experiences** tab, under **Boot to this Cloud PC**, select **Connect while signed into device**. + - Select **Save**. +3. If you can sign into the Cloud PC from the app or web, and a default Cloud PC has been set, then there's an issue with the Windows 365 Boot physical device. In this case, confirm that the physical device is correctly configured and has the requisite software versions. For more information, see [Windows 365 Boot physical device requirements](windows-365-boot-physical-device-requirements.md). +4. Admins can try to manually click on **Device sync** to get the policies delivered faster on the device. Users can try to restart the device. + ## Physical device registry key configuration @@ -64,7 +70,7 @@ Get-AppxPackage –AllUsers -name *MicrosoftCorporationII* This command shows all the Microsoft-maintained apps (like QuickAssist, Microsoft Family, and so on) on the physical device. In order for Windows 365 Boot to work correctly, confirm the following versions: -- Windows 365 app version 1.1.162.0 or later. +- Windows App version 1.1.162.0 or later. - Azure Virtual Desktop (HostApp) app version 1.2.4159. or later. Windows 365 Boot also requires the latest version of Windows 11. diff --git a/windows-365/enterprise/whats-new.md b/windows-365/enterprise/whats-new.md index 1511fc45426..3016d91a521 100644 --- a/windows-365/enterprise/whats-new.md +++ b/windows-365/enterprise/whats-new.md @@ -7,7 +7,7 @@ keywords: author: ErikjeMS ms.author: erikje manager: dougeby -ms.date: 08/29/2024 +ms.date: 10/23/2024 ms.topic: conceptual ms.service: windows-365 ms.subservice: windows-365-enterprise @@ -52,9 +52,125 @@ For more information about public preview items, see [Public preview in Windows ### Scripts ### End user experience ### Windows 365 Government -### Windows 365 app +### Windows 365 app --> + +## Week of October 28, 2024 (Service release 2410) + + +### Device management + +#### Bulk Troubleshoot action now generally available + +The Troubleshoot action in bulk has moved out of preview and into general availability. + +For more information, see [Remotely manage Windows 365 devices](remotely-manage-cloud-pc.md). + + +### Monitor and troubleshoot + +### Update to Cloud PC action status report + +The Cloud PC action status report now shows batches of devices on which actions were triggered. You can see the batch current progress. For more information, see [Cloud PC actions report ](report-cloud-pc-actions.md). + +### Azure network connections inactive state + +Azure network connections that meet either of the following conditions for more than four weeks are now marked as inactive: + +- ANCs that aren't associated with provisioning policies. +- ANCs with provisioning policies that have no Cloud PCs associate with them. + + +## Week of October 21, 2024 + + +### Partners + +#### Use Citrix HDX Plus with Windows 365 Frontline + +You can now use Citrix HDX Plus with Windows 365 Frontline Cloud PCs. + + +## Week of October 14, 2024 + + +### Device security + +#### New Windows 365 IP subnet for RDP connectivity + +Core TCP-based RDP traffic for Cloud PC connections uses the *.wvd.microsoft.com wildcard fully qualified domain name (FQDN). The FQDN remains unchanged, but the underlying IP addresses associated with it will shortly be changed to a single subnet. This will simplify optimization of this traffic and reduce the need for future change management. + + +### Device management + +#### Call redirection + +Windows 365 now supports multimedia redirection call redirection. For more information, see [Use multimedia redirection](/azure/virtual-desktop/multimedia-redirection). + + +### Partners + +#### HP Anyware for Windows 365 is now generally available + +HP Anyware for Windows 365 has moved out of preview and into general availability. + +For more information, see [Set up HP Anyware for Windows 365 Enterprise](hp-anyware-set-up.md) + + + +## Week of September 30, 2024 (Service release 2409) + + +### Monitor and troubleshoot + +#### Unavailable Cloud PCs report added to Reporting overview page + +The **Cloud PCs that aren't available** report has been added to the **Reports** > **Cloud PC overview** page. + + +### Device provisioning + +#### Windows 11 24H2 cloud PCs gallery images + +The latest Windows Enterprise 24H2 images are available for provisioning new devices. You can update your provisioning policies to use either of the following images: + +- Windows 11 Enterprise 24H2 +- Windows 11 Enterprise + Microsoft 365 Apps 24H2 + + + +## Week of September 23, 2024 + + +### Device management + +#### Windows 11 Cloud PCs now support EN-NZ + +Windows 365 Cloud PCs now support EN-NZ for Windows 11. + + +## Week of September 16, 2024 + + +### Device management + +#### Support for symmetric NAT with RDP Shortpath + +RDP Shortpath in Windows 365 now supports establishing an indirect UDP connection using Traversal Using Relays around NAT (TURN) for symmetric NAT. TURN is a popular standard for device-to-device networking for low latency, high-throughput data transmission with Azure Communication Services. For more information about TURN and Azure Communication Services, see [Network Traversal Concepts](/azure/communication-services/concepts/network-traversal). For more information about RDP Shortpath, see [Use RDP Shortpath for public networks with Windows 365](rdp-shortpath-public-networks.md). + +### Windows 365 support for HEVC video coding +Windows 365 will support Hardware High Efficiency Video Coding (HEVC) h.265 4:2:0 on Compatible GPU-enabled Cloud PCs. For more information, see [Enable GPU acceleration for Azure Virtual Desktop](/azure/virtual-desktop/enable-gpu-acceleration?tabs=intune). + + +### Windows App + +#### Windows App is now generally available + +Windows App has moved out of preview and into general availability. + +For more information, see [What is Windows App?](/windows-app/overview) + ## Week of August 26, 2024 (Service release 2408) @@ -137,9 +253,9 @@ New GPU offerings for Window 365 Enterprise Cloud PCs have moved out of preview ### Windows 365 Frontline -#### Windows 365 Frontline sign in time and shift change buffer improvements are now generally available +#### The Windows 365 Frontline concurrency buffer is now generally available -Sign in time and shift change buffer improvements have moved out of preview and into general availability. +The Windows 365 concurrency buffer has moved out of preview and into general availability. ## Week of July 23, 2024 @@ -926,7 +1042,7 @@ Users now have two options when they select the **Open in browser** drop-down bu #### Windows 365 app update notifications for users -Windows 365 app users will get a notification when an udpate is available. If users choose to update, the app closes and they'll get a Windows notification when the update is complete. +Windows 365 app users will get a notification when an update is available. If users choose to update, the app closes and they'll get a Windows notification when the update is complete. ### Monitor and troubleshoot diff --git a/windows-365/enterprise/windows-365-boot-known-issues.md b/windows-365/enterprise/windows-365-boot-known-issues.md index 68093cd4030..f5fd4858f6f 100644 --- a/windows-365/enterprise/windows-365-boot-known-issues.md +++ b/windows-365/enterprise/windows-365-boot-known-issues.md @@ -7,7 +7,7 @@ keywords: author: ErikjeMS ms.author: erikje manager: dougeby -ms.date: 09/26/2023 +ms.date: 09/26/2024 ms.topic: troubleshooting ms.service: windows-365 ms.subservice: windows-365-enterprise diff --git a/windows-365/enterprise/zoom-support.md b/windows-365/enterprise/zoom-support.md index 9c6ebba9233..250f83a716f 100644 --- a/windows-365/enterprise/zoom-support.md +++ b/windows-365/enterprise/zoom-support.md @@ -40,9 +40,8 @@ To optimize Zoom, you’ll need to install the Zoom VDI Client on the Cloud PC a ## Requirements -- **Windows 365 app for Windows**\* - **Windows Remote Desktop Client**\* -- **Windows 365 app** +- **Windows App** - **Operating system**: Windows \* These don't support connections through a web browser. diff --git a/windows-365/includes/resize-details.md b/windows-365/includes/resize-details.md new file mode 100644 index 00000000000..55922f99024 --- /dev/null +++ b/windows-365/includes/resize-details.md @@ -0,0 +1,18 @@ +--- +title: include file +description: include file +author: ErikjeMS +ms.service: windows-365 +ms.topic: include +ms.date: 09/25/2024 +ms.author: erikje +ms.custom: include file +--- + +When resizing starts, the user is automatically disconnected from their Cloud PC and any unsaved work might be lost. + +Resizing can take from 15 to 20 minutes before the user can access their Cloud PC again. You can monitor the status in the Windows 365 provisioning blade. Users can see their Cloud PC status at https://windows365.microsoft.com. + +If there are no licenses in your inventory, the resizing fails. To request more licenses, contact your procurement admin. After you purchase the license and added to the inventory in the Microsoft 365 admin center, you can retry the resize operation. Licenses can be purchased from various channels: EA, CSP, MCA, and Web Direct. + +Devices with a state of **Resize not supported** aren't resized. The status message and details can help you identify the issue. You can still proceed with a bulk resize even if you have devices in the list that are marked as **Resize not supported**. diff --git a/windows-365/includes/resize-introduction.md b/windows-365/includes/resize-introduction.md new file mode 100644 index 00000000000..b2e6f32975b --- /dev/null +++ b/windows-365/includes/resize-introduction.md @@ -0,0 +1,35 @@ +--- +title: include file +description: include file +author: ErikjeMS +ms.service: windows-365 +ms.topic: include +ms.date: 09/25/2024 +ms.author: erikje +ms.custom: include file +--- + +The **Resize** remote action, which preserves user and disk data, lets you: + +- Upgrade the RAM, CPU, and storage size of a Cloud PC. +- Downgrade the RAM and CPU of Cloud PC. Resizing doesn't let you downsize disk space. + +These operations don't require reprovisioning of the Cloud PC. + +You might consider resizing a Cloud PC when a user needs: + +- Higher RAM and VCPU cores to run CPU intensive applications. +- More disk space for file storing. +- Less RAM and vCPU cores to run their current workload applications. + +Resizing supports: + +- Direct and group-based licenses. +- Paid, preview, and trial licenses. +- Bulk and single device operations. + +Resizing doesn't support: + +- GPU Cloud PCs. GPU Cloud PCs might show up in the resize flow, but trying to resize a GPU Cloud PC will result in an error. + +Resizing automatically disconnects the user from their session and any unsaved work might be lost. Therefore, it's best to coordinate any resizing with the user before you begin. Contact your end users and have them save their work and sign out before you begin resizing. diff --git a/windows-365/includes/resize-ip-address-requirements.md b/windows-365/includes/resize-ip-address-requirements.md new file mode 100644 index 00000000000..ece90d30b21 --- /dev/null +++ b/windows-365/includes/resize-ip-address-requirements.md @@ -0,0 +1,23 @@ +--- +title: include file +description: include file +author: ErikjeMS +ms.service: windows-365 +ms.topic: include +ms.date: 09/25/2024 +ms.author: erikje +ms.custom: include file +--- + +## IP address requirements + +When you resize a Microsoft Entra hybrid join bring-your-own-network Cloud PC, a second IP address must be available in the subnet for the Cloud PC to be resized. + +During the resizing operation, a second IP address is used when moving to the new size. This precaution makes sure that the Cloud PC can be rolled back to the original should an issue occur. + +To account for this precaution, you can: + +- Make sure that adequate IP addresses are available in the vNET for all Cloud PCs to be resized, or +- Stagger your resize operations to make sure that the address scope is maintained. + +If inadequate addresses are available, resize failures can occur. \ No newline at end of file diff --git a/windows-365/includes/resize-other-requirements.md b/windows-365/includes/resize-other-requirements.md new file mode 100644 index 00000000000..e0a48720526 --- /dev/null +++ b/windows-365/includes/resize-other-requirements.md @@ -0,0 +1,16 @@ +--- +title: include file +description: include file +author: ErikjeMS +ms.service: windows-365 +ms.topic: include +ms.date: 09/25/2024 +ms.author: erikje +ms.custom: include file +--- + +### Other requirements + +In order to use **Resize** there must be available licenses in inventory for the resized Cloud PC configuration. + +To **Resize** a Cloud PC, it must have a status of **Provisioned** in the Windows 365 provisioning node. \ No newline at end of file diff --git a/windows-365/overview.md b/windows-365/overview.md index 58f3a798e68..2f6fe3036ad 100644 --- a/windows-365/overview.md +++ b/windows-365/overview.md @@ -7,7 +7,7 @@ keywords: author: ErikjeMS ms.author: erikje manager: dougeby -ms.date: 11/27/2023 +ms.date: 09/26/2024 ms.topic: overview ms.service: windows-365 ms.subservice: