Technical Blog | REBELADMIN

Learn about Active Directory and Various Azure Services

Archives for November 2018

Step-by-Step Guide: How to publish applications to Windows 10 workstations using Microsoft Intune?

Last Updated on November 17, 2018 by Dishan M. Francis

In my previous post I explained how we can enroll Windows 10 devices into Microsoft Intune. You can access it using https://www.rebeladmin.com/2018/11/step-step-guide-enroll-windows-10-devices-microsoft-intune-using-autopilot/ . In this post I am going to demonstrate how to publish applications to windows 10 devices via Microsoft Intune (To devices which is enrolled successfully).

Tip

Before you enroll devices make sure you already have enabled MDM & MAM auto enrollment for all users/selected users. Otherwise device will not auto-enroll with Intune. 

These settings are under Azure Active Directory | Mobility (MDM & MAM) 

 

1. Log in to Azure Portal as Global Administrator

2. Then go to Intune | Devices | All Devices & Verify the status of enrolled devices

3. As next step, I am going to create device group. it will help us to publish applications in to target easily. To do that, go back to Intune home page and click on Groups | New Group

[Read more…] about Step-by-Step Guide: How to publish applications to Windows 10 workstations using Microsoft Intune?

Step-by-Step Guide: Enroll Windows 10 Devices in to Microsoft Intune using Autopilot

Last Updated on November 11, 2018 by Dishan M. Francis

If you worked with SCCM or VDI solutions you may already know that creating & managing system images is a painful task. If you are using Microsoft Intune as your MDM solution, we can use Intune & Windows autopilot feature to enroll & prepare device for the production use without worrying about re-build or applying custom operating system images. Windows autopilot is a windows 10 feature which can use to pre-configure, reset, repurpose, recover devices. In this demo I am going to demonstrate how to prepare & enroll windows 10 device in to Microsoft Intune using Windows autopilot. 

Prerequisites

1. Windows 10 version 1703 or higher must be used. Supported editions are:

• Pro

• Pro Education

• Pro for Workstations

• Enterprise

• Education

2. One of the Azure Active Directory (automatic MDM enrollment and company branding features) and MDM subscription:

• Microsoft 365 Business subscriptions

• Microsoft 365 F1 subscriptions

• Microsoft 365 Enterprise E3 or E5 subscriptions, which include all Windows 10, Office 365, and EM+S features (Azure AD and Intune)

• Enterprise Mobility + Security E3 or E5 subscriptions, which include all needed Azure AD and Intune features

• Azure Active Directory Premium P1 or P2 and Intune subscriptions (or an alternative MDM service)   

In my demo environment, I have windows 10 enterprise virtual machine with latest windows updates. Let’s see how we can enroll it to Azure Intune with Autopilot. 

1. Log in to Azure Portal as Global Administrator

2. Go to Azure Active Directory | Devices | Device Settings

3. Check settings under Users may join devices to Azure AD, if you have selected users or group, make sure you going to use those accounts for the enrollment process. in my environment I allow All.

4. Then go to Azure Active Directory | Users. Then go to the user you going to use for the enrollment and verify relevant licenses are assigned. 

5. In order to import devices, we need find out serial numbers, Windows product IDs & hardware hashes. To do that log in to your windows 10 machine and install following script. Then we can create CSV with relevant info. 

Install-Script -Name Get-WindowsAutoPilotInfo

You also can download script from https://aka.ms/Autopilotshell and install manually. 

[Read more…] about Step-by-Step Guide: Enroll Windows 10 Devices in to Microsoft Intune using Autopilot

Conditional Access with Azure AD B2B

Last Updated on November 4, 2018 by Dishan M. Francis

In my previous post I explain how we can use Azure AD B2B to share services/resources between organization. Once these B2B users are register with Azure AD, we can apply “Conditional Access” polcies to control their access further. In this demo I am going to show how to do that. 

Prerequisites

Before we start please go ahead and read my previous article about Azure AD B2B, because in this post I am going assume that you already finish the sign-up process for Azure AD B2B users. 

 You can access the post using https://www.rebeladmin.com/2018/11/cross-organization-collaboration-azure-ad-b2b/ 

In my demo environment, I have sg-Finance security group. All the users from Finance department are part of it. I do have several applications assigned to them. Company Contoso recently made partnership with another company. Some privileged users from this new company required access to the applications used by sg-Finance users. Therefore, I went ahead and made them member of this group using Azure B2B. However, I need to put extra layer of security for these external user access requests to make sure my sensitive data been protected.  

1. To start the configuration, I am logging in to https://portal.azure.com as Global Administrator

2. Then Azure Active Directory | Groups | sg-Finance | Members. In here I can see B2B user dmfrancis

3. Now go back to Azure Active Directory home page and click on Conditional Access

4. Then click on New policy

[Read more…] about Conditional Access with Azure AD B2B

Cross-Organization Collaboration with Azure AD B2B

Last Updated on November 2, 2018 by Dishan M. Francis

In on-premises Active Directory environment, we use “trusts” to establish identity infrastructure connection between businesses. Based on trust type and access permissions, users from one organization can access resources/services in other infrastructure using their own domain credentials. Azure AD B2B does the same thing for cloud resources but in much more easier way. In this demo I am going to demonstrate how easily we can allow users from other organizations to access our cloud resources using Azure AD B2B. 

In my demo environment, I do have an Azure AD user group called sg-Finance . All the users from Finance department are members of this group. I have assign several SaaS applications to them. Company Contoso recently merge with another company. Few privileged users from new company like to access some financial data belongs to Contoso. The relevant data is currently available via SaaS applications which is used by sg-Finance group members. In this demo, I am going to invite external user to be part of sg-Finance group so they can access same applications. 

1. To start, log in to Azure Portal https://portal.azure.com as Global Administrator

2. Then go to Azure Active Directory | Groups

3. Then go to sg-Finance group and then Members.

4. In here, Megan is a member of this group. I log in to http://myapps.microsoft.com as Megan to verify SaaS application access. In this demo I am using Box as sample app. 

5. Now go back to group page and click on Add members

[Read more…] about Cross-Organization Collaboration with Azure AD B2B