Overview

• In this video guide, we will review how line-of-business (LOB) and Win32 applications get installed through Microsoft Intune. We will be covering what logs are used and where application installation information is stored in the registry.

Topics in Video

• Please see youtube: https://www.youtube.com/watch?v=RxjTYNd8gEk 

Helpful Resources

• Add a Windows line-of-business app to Microsoft Intune – https://docs.microsoft.com/en-us/mem/intune/apps/lob-apps-windows
• Intune Standalone – Win32 app management – https://docs.microsoft.com/en-us/mem/intune/apps/apps-win32-app-management 

 

Overview

• In this video guide, we will be covering how to setup Co-management in Microsoft SCCM. Co-management will allow you to use the full Configuration Manager client as well as the Microsoft Intune MDM.

Topics in Video

• Overview of Co-management in SCCM and Microsoft Intune – https://youtu.be/rTapalSHv6U?t=21
• The first scenario overview, using Azure AD Join Only (Cloud Domain Join) –  https://youtu.be/rTapalSHv6U?t=62
• The second scenario overview, using On-Prem domain join and auto-register in Azure Hybrid AD and MDM – https://youtu.be/rTapalSHv6U?t=86
• Validate Azure AD and Intune enrollment is enabled in the online portal – https://youtu.be/rTapalSHv6U?t=113
• Covering CMG prerequisites for the option to Install the SCCM Agent from an Azure AD only scenario – https://youtu.be/rTapalSHv6U?t=252
• Add the co-management subscription into the SCCM console – https://youtu.be/rTapalSHv6U?t=358
• Uploading the CCMSetup.msi to auto-deploy through Intune to install the SCCM agent through CMG – https://youtu.be/rTapalSHv6U?t=496
• Enroll a device into Azure AD from OOBE to have it auto-enroll into MDM/Intune – https://youtu.be/rTapalSHv6U?t=676
• Validate the device enrolled in MDM and the SCCM Client auto started and review the CCMSetup download from CMG over the internet – https://youtu.be/rTapalSHv6U?t=758
• Review ClientIDStartupManager to review how the Azure AD Authentication is used to be approved within the SCCM environment – https://youtu.be/rTapalSHv6U?t=871
• Validate in the Configuration Manager Control Panel applet the co-management is showing enabled – https://youtu.be/rTapalSHv6U?t=947
• Review the scenario for registering on-prem domain joined devices to register into Hybrid Azure AD and auto-MDM enroll in Intune – https://youtu.be/rTapalSHv6U?t=1043
• Install Azure AD Connect and Configure the OU for the user/device sync we need for the lab – https://youtu.be/rTapalSHv6U?t=1093
• Validate a valid public UPN suffix is configured in Active Directory Domain and Trust and configure the on-prem users that will be used to auto-enroll devices with the public UPN in AD Users and Computers – https://youtu.be/rTapalSHv6U?t=1171
• Set GPO to have devices auto-enroll into MDM/Intune when the device registered into Azure AD- https://youtu.be/rTapalSHv6U?t=1568
• Run dsregcmd /status to see if the device is registered with Azure AD – https://youtu.be/rTapalSHv6U?t=1687
• Configure devices to auto Azure Hybrid AD Join in Azure AD Connect – https://youtu.be/rTapalSHv6U?t=1731
• Validate on-prem domain joined SCCM client switched to be co-managed after auto-enrolling into Intune – https://youtu.be/rTapalSHv6U?t=1928
• Validate both devices are showing in Intune and the SCCM console with co-management capabilities – https://youtu.be/rTapalSHv6U?t=1997
• Deploy device reset to both co-managed devices – https://youtu.be/rTapalSHv6U?t=2099

Helpful Resources:

• Tutorial: Configure hybrid Azure Active Directory join for managed domains – https://docs.microsoft.com/en-us/azure/active-directory/devices/hybrid-azuread-join-managed-domains
• Enable Windows 10 automatic MDM enrollment – https://docs.microsoft.com/en-us/intune/windows-enroll#enable-windows-10-automatic-enrollment
• Co-management for Windows 10 devices – https://docs.microsoft.com/en-us/sccm/core/clients/manage/co-management-overview
• Enroll a Windows 10 device automatically using Group Policy – https://docs.microsoft.com/en-us/windows/client-management/mdm/enroll-a-windows-10-device-automatically-using-group-policy
• Prerequisites for co-management – https://docs.microsoft.com/en-us/sccm/core/clients/manage/co-management-prepare#prerequisites
• Auto-Pilot for new Windows 10 Devices – https://docs.microsoft.com/en-us/sccm/core/clients/manage/co-management-prepare#new-windows-10-devices

 

Overview

• In this video guide, we will be covering how you can set up the cloud management gateway in Configuration Manager to manage clients on the internet. This guide covers essential aspects of CMG such as certificates, site system roles, Azure prerequisites and much more!

Topics in Video

• CMG Vs. IBCM – https://youtu.be/kTOPhVHyZtE?t=42
• Certificates needed for Cloud Management Gateway – https://youtu.be/kTOPhVHyZtE?t=186
• Create Web Server CMG Certificate Template – https://youtu.be/kTOPhVHyZtE?t=289
• Review Client Communication Settings- https://youtu.be/kTOPhVHyZtE?t=401
• Request Server/Web Server Certificate for CMG – https://youtu.be/kTOPhVHyZtE?t=446
• Export Internal Root CA Certificate to use in CMG – https://youtu.be/kTOPhVHyZtE?t=583
• Allow Client to Use Cloud DP and CMG – https://youtu.be/kTOPhVHyZtE?t=622
• Configure Azure Subscription – https://youtu.be/kTOPhVHyZtE?t=658
• Give App Registrations Permissions in Azure – https://youtu.be/kTOPhVHyZtE?t=821
• Create Cloud Management Gateway – https://youtu.be/kTOPhVHyZtE?t=884
• Install Cloud Management Gateway Connection Point Role – https://youtu.be/kTOPhVHyZtE?t=1600
• Set Management Point and Software Update Point to Allow CMG Traffic – https://youtu.be/kTOPhVHyZtE?t=1660
• Distribute Content to CMG – https://youtu.be/kTOPhVHyZtE?t=1755
• Enable RDP for the Azure CMG Server – https://youtu.be/kTOPhVHyZtE?t=1869
• Verify Client Receive CMG Server for IBCM Mangement Point – https://youtu.be/kTOPhVHyZtE?t=2154
• Verify Client Notifications Work on Internet Client – https://youtu.be/kTOPhVHyZtE?t=2372
• Verify App Deployment Works from Internet Client using CMG – https://youtu.be/kTOPhVHyZtE?t=2491
• Verify Software Updates Works from Internet Client using CMG – https://youtu.be/kTOPhVHyZtE?t=2523
• Verify Hardware Inventory from Client Notification Channel Works – https://youtu.be/kTOPhVHyZtE?t=2650

Notes From Justin

• Niall Brady’s (windows-noob.com) CMG BlogN
  • Niall’s guide should be out soon. It looks like I beat him to it :).

Helpful Resources:

• Plan for the cloud management gateway in Configuration Manager – https://docs.microsoft.com/en-us/sccm/core/clients/manage/cmg/plan-cloud-management-gateway
• IBCM Vs. CMG – https://docs.microsoft.com/en-us/sccm/core/clients/manage/manage-clients-internet
• Set up cloud management gateway for Configuration Manager- https://docs.microsoft.com/en-us/sccm/core/clients/manage/cmg/setup-cloud-management-gateway
• Support for Configuration Manager features from CMG – https://docs.microsoft.com/en-us/sccm/core/clients/manage/cmg/plan-cloud-management-gateway#support-for-configuration-manager-features
• Cloud Management Gateway Performance and scale – https://docs.microsoft.com/en-us/sccm/core/clients/manage/cmg/plan-cloud-management-gateway#performance-and-scale
• Ports and data flow – https://docs.microsoft.com/en-us/sccm/core/clients/manage/cmg/plan-cloud-management-gateway#ports-and-data-flow
• Required ports – https://docs.microsoft.com/en-us/sccm/core/clients/manage/cmg/plan-cloud-management-gateway#required-ports
• Publish the certificate revocation list – https://docs.microsoft.com/en-us/sccm/core/clients/manage/cmg/security-and-privacy-for-cloud-management-gateway#publish-the-certificate-revocation-list
• Plan for PKI certificate revocation – https://docs.microsoft.com/en-us/sccm/core/plan-design/security/plan-for-security#BKMK_PlanningForCRLs
• Certificates for the cloud management gateway – https://docs.microsoft.com/en-us/sccm/core/clients/manage/cmg/certificates-for-cloud-management-gateway
• CMG server authentication certificate – https://docs.microsoft.com/en-us/sccm/core/clients/manage/cmg/certificates-for-cloud-management-gateway#cmg-server-authentication-certificate
• CMG trusted root certificate to clients – https://docs.microsoft.com/en-us/sccm/core/clients/manage/cmg/certificates-for-cloud-management-gateway#cmg-trusted-root-certificate-to-clients
• Enable management point for HTTPS – https://docs.microsoft.com/en-us/sccm/core/clients/manage/cmg/certificates-for-cloud-management-gateway#enable-management-point-for-https
• Classic Servier Deployment | Create Management Certificate  – https://docs.microsoft.com/en-us/azure/cloud-services/cloud-services-certs-create
• Classic Servier Deployment | Upload your service certificate to the Azure portal – https://docs.microsoft.com/en-us/azure/azure-api-management-certs