Intune - idiots guide

[mdrabble]

After some Googling, looking at NDES and Azure Application Proxy app.

 

The really annoying thing is that I am only looking into this for Sims.net access.

[sparkeh]

After some Googling, looking at NDES and Azure Application Proxy app.

 

The really annoying thing is that I am only looking into this for Sims.net access.

 

Just implemented this myself. I didn’t find the documentation particular clear so if I can be if any help just ask [emoji846]

[mdrabble]

Just implemented this myself. I didn’t find the documentation particular clear so if I can be if any help just ask [emoji846]

 

Spent today installing a new VM and installed NDES and installed then proxy app on the same VM - that is as far as I got today.

@SPArkh thank for you offer and if I get stuck or not sure of anything I will take you up on you very kind offer.

[mdrabble]

Just implemented this myself. I didn’t find the documentation particular clear so if I can be if any help just ask [emoji846]

 

@sparkeh are your devices purely AzureAD joined? What type of VPN tunnel are you using?

 

Cheers.

[sparkeh]

@sparkeh are your devices purely AzureAD joined? What type of VPN tunnel are you using?

 

Cheers.

 

No windows devices are currently hybrid.

We use Netmotion for our VPN but allow connections to Intune to breakout (and to google endpoints for you android devices).

[MYK-IT]

I am in the process of configuring / testing our existing Windows 10 deployment and joining to Local AD (using MDT), to

 

1) making devices a Hybrid AAD Joined Device (using Azure AD Connect) and

2) auto-enrolling the device into Intune (to give me options of managing device totally via GPO, Intune or a mixture of both)

 

Stage 1 I have completed, using a combination of Azure AD Connect and adding a GPO to stop devices being Azure Registered, as well as Hybrid AAD Joined (You can prevent your domain joined device from being Azure AD registered by adding the following registry value to HKLM\SOFTWARE\Policies\Microsoft\Windows\WorkplaceJoin: "BlockAADWorkplaceJoin"=dword:00000001. https://docs.microsoft.com/en-us/azure/active-directory/devices/hybrid-azuread-join-plan#review-things-you-should-know)

 

The auto-enrollment is the section I am struggling with, as in to fully automate the process (as part of MDT?)

 

I have enabled the "Enable automatic MDM enrollment using default Azure AD credentials" group policy, and selected "User Credential" – did try "device credential" but didn't work. But I must admit that originally, I had both the user scopes for "Users may join devices to Azure AD" within Azure AD, and "MDM User Scope" within Endpoint Manager set to certain test users / groups only and it failed. Despite logging in as one of those users. I have since changed the MDM user scope to "all" and my test device(s) are now listed within Intune.

 

However, for this particular need, these devices will be on-site devices (e.g. desktops) shared and used by staff / students – so I although they are listed correctly as "Corporate" within Intune; both the 'enrolled by' and 'primary user' accounts are populated; even though I have also applied the "Shared PC Configuration Policy" (would I still have to remove the 'primary user' manually from each device too?)

 

Ideally, I would like to know if this auto-enrollment process can be fully automated? Instead of logging in, after the MDT build-process has completed, with an appropriate account that can enroll with Intune (otherwise I may have an issue where numerous staff/student accounts have enrolled devices etc.). I appreciate that the auto-enrollment process is partially already is (with the applied GPO) but I was more thinking that the 'tag' could be defined (unless I configure a dynamic security group within Azure AD to contain computer accounts built this way), and / or perhaps use a DEM (Device Enrollment Manager) account, or other specific Azure AD account purely for enrolling devices into Intune?

 

I appreciate that Microsoft / Intune is all designed around the perfect 1:1 user/device scenario, and in some respects our local, onsite computers don't necessary have to be within Intune (if using local GPO) etc, but would I would like the option of doing so.

 

Any hints / tips, would be appreciated.

 

Thanks,

Edited February 24, 2021 by MYK-IT

[mdrabble]

Talk about frustration!

 

Setup NDES, Proxy App and all reportedly works.

 

Export CA Cert and deploy via intune as trusted Cert.

 

Next, create config profile for SCEP Cert - deploy out to my test laptop and the cert fails to enroll

 

1st Error in event viewer talks about SCEPInstallCertificateWithSCEPHelper failed to initalise SCPE enrollment with NDES Server - URL...... followed by CA Thumbprint.

 

2nd Error in event viewer gives this info - SCEP: Certificate enroll failed (The Signature of the certificate could not be verified)

 

Checked on Laptop and Root CA installed - checked the thumbprint against and it is correct

 

 

Anyone any ideas?

[sparkeh]

If you haven’t seen this already, this NDES/SCEP script is a God send for troubleshooting issues: https://docs.microsoft.com/en-us/troubleshoot/mem/intune/verify-ndes-configuration

 

So first of all validate that your infrastructure is setup correctly. There’s certainly certificate issues somewhere along the line.

[mdrabble]

If you haven’t seen this already, this NDES/SCEP script is a God send for troubleshooting issues: https://docs.microsoft.com/en-us/troubleshoot/mem/intune/verify-ndes-configuration

 

So first of all validate that your infrastructure is setup correctly. There’s certainly certificate issues somewhere along the line.

 

Ran the validation tests and all come back as fine - showing success on all areas.

 

Will agree looks like a Certificate issue somewhere - will have to do some more digging and googleing....

[mdrabble]

Have scrapped what I’ve done for certificates and SCEP and started again but this time looking at hybrid joined devices.

 

Just gone through and done the config work just need to test it now.