1. Configuration Manager and InTune Gemeinsam oder einsam?

2. Introduction

3. It’s all about me! Who am I? Andrew Craig Where am I from? And now? Living three years in Switzerland Working for Syliance IT Services GmbH as System Center Senior Consultant www.syliance.com andrewdcraig.wordpress.com Twitter: @mracraig @syliance

5. Agenda Was heisst einsam? Was heisst gemeinsam? Warum gemeinsam? Windows Azure Active Directory (WAAD) integration How quickly can I set up InTune? What can I do to my mobile devices? Apps, hints, tips, tricks

6. Was heisst einsam?

7. Cloud-Only Configuration 8.1

8. Cloud Management Capabilities Capability / PlatformWindows 8 Windows 7, Windows Vista, Windows XPWindows RTWindows Phone 8iOSAndroid Application management Endpoint Protection  Hardware Inventory Software Inventory 1 1 1 1 Remote control 3 3  Reporting Software updates  Compliance settings 2 2 2 2 2 2 1 = Managed applications only 2 = Compliance reporting but no remediation automation 3 = Via Remote Assistance

9. Windows Intune Cloud Architecture Windows Phone 8 Windows RT Direct Management & App Publishing iOS CorpNetInternet x86 / x64 Windows 8 Windows 7 Windows Vista Windows XP Windows 8 Windows 7 Windows Vista Windows XP EAS Policy & Inventory DirSync Android App Publishing Android

10. Was heisst gemeinsam?

11. Unified Configuration R2 8.1

12. Unified Management Capabilities Capability / PlatformWindows 8 Windows 7, Windows Vista, Windows XP Windows Embedded Windows To GoMac OSWindows RT Windows Phone 8iOSAndroid Application management Endpoint Protection  Hardware Inventory 1 Software Inventory 2 2 2 2 Remote control  5  Reporting Software updates  4  Compliance settings 3 3 3 3 OS deployment N/A  N/A Out of band management N/A  Power management  Software metering  1 = Basic information only through Exchange ActiveSync 2 = Managed applications only 3 = Compliance reporting but no remediation automation 4 = Device User has to accept the update 5 = Via Remote Assistance

13. Windows Intune Unified Architecture Android Android App Distribution Windows Phone 8 Windows RT Direct Management & App Distribution iOS x86 / x64 Windows 8 Windows 7 Windows Vista Windows XP

14. Warum gemeinsam?

15. A house with many windowsSingle pane of glass

16. Exchange Connector/ActiveSync EAS – Application layer InTune MDM – OS Layer ConfigMgr – Manage Exchange Policies

17. Unified Management Capabilities Capability / PlatformWindows 8 Windows 7, Windows Vista, Windows XP Windows Embedded Windows To GoMac OSWindows RT Windows Phone 8iOSAndroid Application management Endpoint Protection  Hardware Inventory 1 Software Inventory 2 2 2 2 Remote control  5  Reporting Software updates  4  Compliance settings 3 3 3 3 OS deployment N/A  N/A Out of band management N/A  Power management  Software metering  1 = Basic information only through Exchange ActiveSync 2 = Managed applications only 3 = Compliance reporting but no remediation automation 4 = Device User has to accept the update 5 = Via Remote Assistance

18. Oder doch einsam?

19. Selection Criteria Current Infrastructure On-premise ConfigMgr? Something else? Scale of Solution Approx. Max of 5000 Users? Approx. Max of 100,000 Users? Required Feature Set Capabilities Supported Platforms

20. Windows Azure Active Directory (WAAD) integration

21. Provisioning Users

22. Windows Intune Contoso customer premises Cloud-Only / No Integration AD Windows Azure Active Directory Provisioning platform Lync Online SharePoint Online Exchange Online IdP Directory Store Admin Portal/ PowerShell/GRAPH Authentication platform IdP 1.Cloud Only / No Integration 2.Directory Synchronization 3.Directory and Federated SSO Joe@contos o.msonline.c om Joe@contoso.com

23. Windows Intune Contoso customer premises Directory Synchronization AD Directory Sync (DirSync) Windows Azure Active Directory Provisioning platform Lync Online SharePoint Online Exchange Online IdP Directory Store Admin Portal/ PowerShell/GRAPH Authentication platform IdP 1.No Integration 2.Directory Synchronization 3.Directory and Single sign-on (SSO)

24. Windows Intune Contoso customer premises Directory and Federated SSO AD Directory Sync (DirSync) Windows Azure Active Directory Provisioning platform Lync Online SharePoint Online Exchange Online Active Directory Federation Server 2.0 Trust IdP Directory Store Admin Portal/ PowerShell/GRAPH Authentication platform IdP 1.No Integration 2.Directory Synchronization 3.Directory and Federated SSO

25. Integration Comparison 1. No Integration Appropriate for Smaller orgs without AD on-premise Pros No servers required on- premise Same Domain name for users possible Cons No SSO No 2FA 2 sets of credentials to manage with differing password policies IDs mastered in the cloud 2. Directory Only Appropriate for Medium/Large orgs with AD on-premise Pros Users and groups mastered on-premise Enables co-existence scenarios Cons No SSO No 2FA 2 sets of credentials to manage with differing password policies or manual / 3 rd Party password sync Single server deployment 3. Directory and SSO Appropriate for Larger enterprise orgs with AD on-premise Pros SSO with corporate cred IDs mastered on-premise Password policy controlled on-premise 2FA solutions possible Enables hybrid scenarios Location isolation Cons Additional Servers required for ADFS

26. Activating Windows Intune Users Built-in group associated with a customer’s Windows Intune account Membership required for: – Users to appear in administrator console – Users to access company portal Users added to user group – When created – When edited Users removed from group – When edited

27. Online Services Directory Synchronization Tool

28. Configuring DirSync through the Account Portal

29. How quickly can I set up InTune?

30. Sign up for Windows Intune account Synchronize your AD with Windows Azure AD Configure Windows Intune Connector Place the Windows Intune connector site system role Setup MDM Properties

31. Do the paperwork Sign up at www.windowsintune.comwww.windowsintune.com Logon at admin.manage.microsoft.com Public domain and CNAME DNS User Principal Names (UPNs) Active Directory Federated Services (ADFS)

33. Allow plenty of time for sync Run Office 365 Deployment Readiness Tool Synchronize your AD with Windows Azure AD

36. Demo Configuring InTune with ConfigMgr

38. Create the subscription One way process!

39. Configure the Role Specify the Configuration Manager collection of users who will be enrolling their mobile devices for management through Windows Intune These values all appear on the Company Portal that users see when the connect to the portal with their mobile devices Specify the site code to which you want mobile devices assigned. Typically this will be the primary site in your hierarchy. View the current status of the Windows Intune service around the world

40. Adding the Windows InTune Connector

41. Add the Company Portal Application

42. Deploy the Company Portal Application

43. Demo What can I do to my mobile devices?

44. Apps, hints, tips, tricks

45. Apps Microsoft Apps Windows Phone Store iTunes App Store Google Play In-House LOB Visual Studio and Windows Phone SDKs Xcode and iOS SDK Eclipse, Android Studio and Android SDK

46. Available Examples Dynamics CRM Lync Sharepoint Office* Others…

47. Requirements Developer Licenses Code Signing Certificates Development Platforms

48. Hints, Tips, Tricks Planning Domain considerations Client-side Troubleshooting. Where are the Logfiles? Some things happen overnight Naughty children

49. Summary ConfigMgr has a rich feature set for managing clients InTune enhances this by adding MDM Standalone InTune is enhanced by deploying ConfigMgr Everyone benefits Take time to plan your implementation properly Be aware that mobile devices don’tbehave like desktops and laptops

50. Danke!