1. Windows 10 & Intune:
A Modern Desktop Management Story
Joe Crandall

2. Quick introduction In IT industry for 12+ years
Cloud Solutions Specialist
Client Engineer
Endpoint management
Patch
Application
Operating Systems deployment
Scripting & Automation
Infrastructure Engineer
VMWare, Hyper-V, VDI
Firewall / Load balancing
DevOps

3. Microsoft Vision – Device Mgmt.
Holistic, identity-driven protection
Guard your data & identities
Productivity without compromise
Preserve the mobile and desktop experiences
Flexible, comprehensive solutions
Do more with less—protect users, devices, apps, and data with intuitive mobile management on a future-ready platform.
Identity as a service (SSO)
User is automatically signed into their applications using Azure AD Premium
Windows AutoPilot
Provision devices from the manufacturer (think DEP)
Intune MDM
Manage ALL devices from the cloud anywhere
I want to briefly touch on Microsoft goal for Device Management in Azure…
Microsoft EM+S

4. Currently: Light touch
AutoPilot Demo
Enroll device in autopilot
Manual process currently
Enroll in Azure Active Directory
Auto-Enroll in Intune MDM
Deploy policies
Deploy applications
Deploy other mgmt. agents
Currently: Light touch
Future: Zero touch
Power up the JourneyTEAM BTS VM and walk through the provisioning process to demonstrate what the configuration looks like to end users. Explain that I’ll go into greater detail on how this works once it starts

5. What can you do with AutoPilot?
Attach a device to your company (Apple DEP)
Auto-Enroll Intune MDM
Skip some OoBE settings
AutoPilot Documentation

6. AutoPilot Requirements
Devices must be registered to the organization
Windows 10 Pro, Enterprise or Education, Build 1703 or later
Devices must have access to the internet
Azure AD Premium P1 or P2
Microsoft Intune or other MDM services to manage devices
Get-WindowsAutoPilotInfo
Windows 10 Autopilot

7. AutoPilot
Vendors supporting Autopilot auto- provisioned into your tenant starting early 2018
Power up the JourneyTEAM BTS VM and walk through the provisioning process to demonstrate what the configuration looks like to end users. Explain that I’ll go into greater detail on how this works once it starts

8. MDM – Auto Enrollment Enable MDM in AAD Define User Scope
Select Group \ Exclusions
Custom Terms of use
Enroll Windows Devices

9. Already AzureAD Joined?
Send a deep link to the users to enroll in MDM:
Register Device using Deep link

10. What Intune is…
Intune MDM is a excellent platform built to manage Windows 10 devices over the internet.
Device inventory
Lightweight software distribution
MDM policies and device restrictions
Remote wipe,
Password\Pin requirements
configuration
193+ Built-In Device Restriction settings
Backgrounds / login screen, start menu
Policy CSP’s
Microsoft Intune documentation

11. Intune MDM – Policy CSP Windows Updates ADMX backed policies
Policy Configuration Service Providers are Microsoft supported configuration items for Intune MDM managed devices:
Internet Explorer
Trusted Sites in IE
Local Security Policies
UAC via Windows 10
Windows Updates
ADMX backed policies
Understanding ADMX-backed policies
Win32 & Bridge ADMX
Device that has been enrolled in Intune MDM will check in on the following schedule
Windows PCs enrolled as devices: Every 3 minutes for 30 minutes, and then every 8 hours.
Additional Sites to watch:
PolicyCSP Documentation

12. Intune MDM – Policy CSP Event Log for Sync Settings:
DeviceManagement-Enterprise-Diagnostics-Provider
Sync under Settings

13. Intune MDM – Test Settings
Warning: Policy testing take a little bit of time!
Status in Intune
Device EventLog:
DeviceManagement- Enterprise-Diagnostics- Provider
Can potentially pull local logs to azure for better diagnostics
Event Log for Sync Settings:
DeviceManagement-Enterprise-Diagnostics-Provider
Sync under Settings

14. What Intune is not…
A full replacement for a systems management product (LANDesk, Symantec, Microsoft)
A full replacement for Domain Group Policies
Operating System Deployment
Patch Management
3rd Party application patching
Advanced reporting
Existing ingrained business process

15. System Center: Configuration Management
Where we are with Intune:
Intune
System Center: Configuration Management

16. Roadmap for Intune
Microsoft’s roadmap for Intune MDM includes the following features:
Jamf Partnership
MacOS management
Autopilot Improvements
Co-Management
SCCM/AD Joined w/ AAD Joined & Intune MDM
Intune Management Extension
Win32 / .exe deployment
PowerShell Scripts
MDM Policy options to match GPO’s
Brad Anderson VP of EM+S Talks about Intune

18. THANK YOU