Tag: Intune

Categories
Microsoft365 Windows 11

Summary Post: How Windows Device Check-in Works With Intune

I don’t blog about Intune nearly as much as I used to, now that I no longer work for Microsoft and have a greater focus on the Apple ecosystem (which, to be fair, Intune still plays a pretty significant role with iPad/iPhone management).

However, I like to keep across what is happening in this space and I saw a great tweet earlier this week that touched on one of the age old complaints about Intune – the perceived slowness of policy synchronisation (especially compared to other MDM such as Jamf). The tweet came from Rudy Ooms who describes himself as:

Content Creator at Patch My PC | Reverse engineering Intune and Windows internals. Sharing what actually happens under the hood.

Back in 2019 I shared a similar blog post from Oliver Kieselbach entitled New To Intune As An MDM? Read This Blog Post First! – SamuelMcNeill.com (which is still a good read), where Oliver dived into how policy syncs work. In this newer post from Rudy, he tackles similar ground but with a view 6yrs on (wow, time flies!) and as always, I encourage you to read the original post in full:

Intune Sync and Policy Delivery: Debunking the 8 Hour Myth

Rudy does have a video overview of this topic if you’re more into listening and watching than reading:

I’ll share a few highlights from the post that are pertinent in my view, starting with:

Microsoft has documented this first enrollment sync behavior: during the Intune/MDM enrollment, devices check in more frequently to PULL down configuration profiles, certificates, and policies.

  • Every 3 minutes for the first 15 minutes
  • Then every 15 minutes for the next 2 hours
  • And only after that, it shifts to the ~8-hour cycle

Those first two bullet points are generally pretty well understood and most IT Pros will have seen this frequent sync and update during the first OOBE workflow (Out Of Box Experience).

Rudy correctly focuses on “Change Based Check-ins” with Intune and has even created a great diagram to help explain that:

To expand on that, he talks about the role of the Windows Notification Service (WNS) which functions in a similar fashion to Apple’s own Push Notification Service (APN – Configure devices to work with APNs – Apple Support (NZ)). As explained by Rudy:

That push message travels over the Windows Notification Service (WNS) and tells the device to check in. These are the triggers that make Intune notify devices:

  1. Changing targeting (adding or removing a device or user group)
  2. Editing a payload (changing/adding a new Intune policy or updating app assignment)
  3. Entra group membership changes
  4. Store app version updates released by the vendor

In practice, the first policy change is usually pushed down within a few minutes. From there, Intune enforces a quiet period/throttle (roughly 30 minutes per device) before sending another push. So, while it’s not instant like a remote wipe (which must always be immediate), it’s still far faster than waiting for the full 8-hour maintenance cycle. Let me zoom in on the push message itself a bit more.

The blog includes some interesting testing data showing that the WNS is somewhat of a ‘black box’ in terms of how it operates and where buffers can come into play between a push of a policy change and execution on the device (again, read the full blog on Rudy’s site).

But What About Throttling, You Say?

Something that many frustrated IT Admins have suspected and/or complained about is the preception Microsoft throttles Intune changes to reduce load (either for the Azure cloud or the endpoint). Rudy’s post goes into this in some detail, explaining how the first changes are almost immediate and then subsequent rapid changes are bundled together and throttled:

  • Change #1 → WNS push almost immediate
  • Change #2 and #3 (<30 min later) → bundled, resolved when device responds to the same notification
  • Change #4 (>30 min later) → new WNS push delivered

Whilst this may make a lot of sense for Microsoft, for IT Admins that are perhaps making rapid changes to configurations it can be a source of intense frustration. Of course, in a perfect world IT Admins are cool, calm and collected at all times and make all of their policy configuration changes with a single update. However, that rarely matches the often frenetic pace which busy IT Admins are required to work at and knowing that changes are being bundled and throttled is often a suboptimal experience.

It does sound like there is some work being done by Microsoft to redesign this with something called “Fast Lane” that is broken down in the blog – check it out.

Final Thoughts

It can be very hard to change perceptions and the old adage of “perception vs reality” is very real when it comes to Intune sync speed. Dealing far more regularly with Jamf and macOS/iPadOS these days than Intune and Windows, I can say that in terms of speed of policy sync and responsiveness it really does feel like Jamf is a Ferarri and Intune can be a Bambina stuck in rush hour traffic.

However, Rudy’s blog goes a long way to showing that perception is often just that: perception. (Again, read the original post in its entirety – it’s definitely worth it)

Ultimately, it’s a great thing if Windows and Intune become increasingly more responsive as managing endpoints from the cloud is a good thing for everyone. With that, a final graphic from Rudy’s blog to visualise timings:

Categories
Apple Microsoft365

Video: Configuring Platform SSO Password Sync For Multi-User Mac Devices

I saw this post today from Scott Breen at Microsoft, a great guy that I used to work with off and on over the last six years I was at Microsoft.

In this video, he steps through the configuration of using Apple’s Platform SSO with password sync for an EntraID Join of a macOS device that will be shared by multiple users. This is of course a very common scenario in education where labs of iMacs are common, or shared devices in a library context is also prevalent.

This builds on my earlier blog post last month announcing the launch of Microsoft’s PSSO integration with EntraID and highlights the effort Microsoft is clearly making in terms of improving the macOS experience within Intune.

Given many educational organisations already own M365 A3 licenses and many corporates have M365 E3 (both of which contain Intune and EntraID licensing – see this post), it reduces the cost of ownership to securely and easily integrate Macs into an organisational fleet of devices.

Reminder: this functionality is still currently in preview (as of June 2024), but watch this space once it goes public.

Check out all the docs here.

Categories
Apple Security

Friday Reflections: ‘Dodgy’ Content & Digital Citizenship – Sparking Knowledge Sharing & Best Practice Discussions Amongst IT Teams

I was doing my morning skim of the headlines before work this morning when I came across this article from The Post in New Zealand:

This was good timing as earlier this week I had attended an Apple reseller event where the topic and use cases for Managed Apple IDs was discussed at length and so I posted on an internal Teams chat whether this was a good example of where Managed Apple IDs may have prevented the cascading of bad decisions that led to students being exposed to inappropriate content:

So What Actually Happened?

It’s worth reading the article in full, but in case it’s removed or behind a paywall, a quick summary of the facts presented include:

  • The teacher had been responsible for the purchase, set up, maintenance and upgrade of school devices, and uploading photos from school events.
  • He had configured at least one of these iPads using his personal Apple ID, presumably so apps could be pushed out to the device(s) from the App Store
    • (worth noting this is not a compliant way for schools to use Apple App Store apps in a school context)
  • At some point, the teacher left the school and he later shared his login details when he was contacted by a primary school aged student using the device, who said the teacher’s password was required to remove his account.
    • A key reminder, that can not be overstated enough, is that you should never ever share your password in any situation as unforeseen outcomes can flow from this
  • The student must have entered the iCloud password onto the iPad which caused personal photographs and images on the former teacher’s iCloud account, including images of him and another teacher at the school “fully dressed and cuddling or sitting/lying close together” and memes with sexual statements, to sync to the iPad and be discovered by the students.
  • The students then spoke to the school Principal about the images.
    • Great to see the students doing the right thing and exercising commendable Digital Citizenship by alerting an adult when they encountered content online that made them feel uncomfortable.

Evidently, there was a litany of bad decisions related to the management of the school iPads made here, each compounding the other – NB this was not a school that our company managed/supported.

Helpful Internal Discussions Amongst The Team

One of the things I like about Microsoft Teams group chats is the speed and input that various team members can contribute to, allowing what I would describe as ‘ad hoc coaching’ – experienced team members reflecting on the incident above and sharing their insights from their experience. This allows rapid knowledge sharing and learning by the entire team and I’m going to share a few of these thoughts below:

Yikes what a situation. That’s a perfect example of why a school should be using an MDM for management of iPads. I bet the only reason that Apple ID was on the iPads would have been app deployment. Also super worrying the teacher just handed over his personal Apple ID credentials rather than removing the device from his iCloud account.

Comment 1

What I like about the above is the immediate recognition of the absence of ‘best practice’ when it comes to managing iPads – the use of an MDM (Jamf, Intune etc), as well as an accurate diagnose of why a school may be using a personal Apple ID – trying their best to deploy apps to iPads, likely unaware of how an MDM could support this task in a more time efficient and infinitely more secure method.

Additionally, it was pointed out that sharing of the password was never the right approach here (or anywhere!) and you can remove devices associated with your Apple ID – instructions here.

Geez. All good points above.

  1. An MDM could have prevented the need for an Apple ID on the device
  2. At the very least, why not a School Specific Apple ID?
  3. Why did the student “need the Apple ID” to access the iPad? Potentially teacher PD required on that one
  4. Good on the student for taking the matter to the principal
Comment 2

Like the first commenter, the second commenter immediately identified best practice that an MDM removes this risk and also suggests a ‘less bad’ option of using personal Apple IDs of possibly creating a school specific Apple ID for the management of these devices – some lateral thinking.

The third point made was a good one – why, precisely, was the student needing access to something requiring the Apple ID on the iPad? Were they trying to buy new apps for the device from the App Store – something that the school would normally like to prevent students from being able to do. The training of educators on best practice of management of iPads in the classroom extends to helping them understand what students should and should not be able to do on these great devices for learning – generally it would not be required for a student to be accessing the Apple ID functionality on a well managed and secured iPad.

Lastly, recognising the student did the right thing by talking to the Principal. It’s imperative that ‘the adults in the room’ reinforce good Digital Citizenship behaviour when they see it. It was through no fault of their own that the students were exposed to this content but the fact they made good decisions and informed an adult should be recognised and applauded.

Considering they are deploying apps with a single Apple ID they probably will not be registered to ASM so managed Apple ID wouldn’t come into affect. I believe most of our customers these days use ASM which we are encouraging heavily.

Comment 3

A third comment recognised the likely absence of Apple School Manager that would have solved for this issue, and the commenter has reinforced our company practice of strongly recommending ASM+MDM for the management of iPads.

The internal chat group then continued on in a more technical discussion of the pros/cons of Managed Apple ID in relation to the certificates associated with the Apple Push Notification Services in Apple School Manager (Establishing a certificate-based connection to APNs | Apple Developer Documentation).

Whilst most of the commenters were unconvinced by my initial ‘bait and switch’ comment of whether this news story was a good example where Managed Apple IDs would have ‘saved the day’, there was a general agreement that Managed Apple IDs could and should be used in relation to APNs

On the APNs issue – Cyclone’s standard is to ensure all APNs certificates are created using a Managed Apple ID. Any we find that are using a consumer Apple ID we go through a process with Apple to get the certificate migrated from the consumer ID to a newly created Managed Apple ID

APNs Comment 1

Again, this was a senior Apple engineer reinforcing for everyone on the chat group the company expectations for best practice when it comes to APNs using Managed Apple IDs – great learning.

Final Thoughts

For a random Friday morning, this ended up being a helpful discussion internally where various members of the team contributed expertise, knowledge and opinions related to a variety of topics:

  • Digital Citizenship
  • Teacher Professional Development
  • MDM and Apple School Managed best practice
  • Respective merits of Personal vs Managed Apple ID
  • Apple Push Notification configuration best practice
  • Real world examples/anecdotes to help educate potential customers on why managed services for school devices is a good idea.

Sparking these types of learning opportunities through the framing of a topical and real-world situation where things went wrong in a school (NB: this was not a school we manage/support) is a great way to focus a team discussion on how we can do things better and deliver a superior outcome for both our schools and the students they serve.

Categories
Microsoft365

Experimenting with Azure Virtual Machines Part 1 – Azure Lab Services

Introduction

Since I’ve moved on from Microsoft, my interests and focus have expanded beyond just the realm of Microsoft365 offerings and I’m dabbling in other technologies that can add value to the education industry and beyond.

In this multi-part blog series, I’m going to explore different flavours of Azure Virtual Machines, so buckle up and enjoy:

The Case For Azure Lab Services

Azure Lab Services enable you to easily set up a class, run a training lab, host a hackathon, experiment, and test your proof-of-concept ideas in the cloud.

Azure Lab Services

Configuring a traditional computer lab for specific scenarios has historically been a time consuming process. This has been made easier with the advent of cloud MDM tools like Microsoft Intune which can offer a significant amount of customized experience based on the user signing into the device, however there are still many scenarios that exist where greater levels of customisation are needed (Note: it is possible to use Intune to manage your Azure Lab Services too).

Furthermore, the end users may be bringing their own device (BYOD) that is not compatible or powerful enough for the task at hand – cloud based virtual computer labs provides a very real solution to this situation. In fact, recently I was talking with a school that was in this exact situation – students were using iPad Pros but required a Windows device for a particular online test. The ability to provision virtual machines for short term usage for students for the test was one avenue the school explored.

Other scenarios that Microsoft has created specific ‘how to’ tutorials for Azure Lab Services include:

In a business context, the ability to run training for staff in a contained environment that can be easily re-deployed for different groups of staff is very appealing. Likewise, if you’re conducting UX/UI testing with control groups, having the ability to run repeatable testing in a pre-configured environment is helpful.

Creating An Azure Lab Service

Rather than reinvent the wheel, I’ve embedded a good 3minute video from Microsoft showing the basics for setting up an Azure Lab. Note that the video is 2yrs old and there are some subtle differences to the Azure Portal now, but fundamentally the process is the same.

If you’re more of a ‘step by step’ learner, then the overarching process is as follows:

  • Create a Lab Plan
    • The Lab Plan is basically a collection of configurations and settings that apply to any labs created inside it. This includes linking it to an active Azure subscription, resource group for management and also the Azure region where the lab VM’s will be deployed.
  • Add a user to the Lab Creator Role
    • This allows you to choose who in your organisation can create new labs under the current Lab Plan.
    • Note: given all labs will incur costs, you want to be clear about who is responsible for associated billing costs that come from the lab usage.
  • Create a Lab
    • This is where you configure and create the actual VMs. It differs from the Lab Plan (high level configurations and settings) as it focuses much more on the type of VM you’re wanting in your Lab (OS, RAM, CPU, policies etc)
    • Note: initially you create a generic username/password to log into the VM. You have a choice to lock the password or allow the end users to reset the password on first login.
    • Customise the VM: You have a choice of running a standard OS template (choices around Linux, Windows 11, Windows Server etc) or choosing to customise a template with your specific needs.
      • Essentially, you start the custom template VM, make changes (install required software, make settings changes etc), stop the VM, then publish the custom VM template to the Lab. Details are here.
  • Publish Lab
    • This process allows you to choose/define the maximum number of VM that will be available to your end users. It’s super easy and the time to access the VMs depends on the number you’re creating.
    • Note: due to Azure region capacities, I have found the ability to create VMs is limited at times – the Azure Lab Services wizard advises how many VMs you can create in the current region during the Publish Lab process.

It really is that simple of a process and with the Lab created, the dashboard does give you an indicative cost associated with the lab. For experimentation purposes, I created a Lab with 5 VM that had a maximum of 10hrs per VM (so 50hrs total) and the indicative cost was USD$10 if all hours were used:

Shortly, I’ll share some tips on how to manage billing by implementing some guardrails around usage and avoiding cost blowouts.

Connect To A Lab

Once a lab is created and published, the ability to connect to each of the individual VM can be managed in a few ways, either by assigning VM to a specific student (AzureAD group sync or CSV upload), sharing a self-registration link, or emailing an invite to users. Once received, they can start the VM and connect to it using the RDP client of their choice. Either the Lab owner or the student can start the VM and then the remote desktop connection file can be downloaded and used to launch the remote desktop client to connect:

The student would need to sign in at the Azure Labs Portal with their organisational AzureAD credentials and they need to know the initial VM username/password created above (and, if configured, may be prompted to reset the password on first sign in).

Alternatively, if comfortable, a host and port number can be shared with an end user directly from the Lab VM pool page e.g.

Here is the same VM connected to using the Microsoft RDP client on my MacBook:

The Azure Lab Services dashboard allows you to see at a glance which machines are on, and how many hours of their assigned quota have been used:

With the appropriate permissions, a Lab Creator can start, stop or reset any of the VM in the lab. An individual student can turn on/off any VM in a lab that has been assigned to them through the portal.

Managing Costs – Avoiding Budget Blowouts!

Microsoft does publish a pricing calculator table online here.

One of the biggest considerations and concerns from organisations new to Azure Virtual Machines is the issue of cost and more specifically, how to avoid unpleasant bills for un-budgeted consumption! There is detailed guidance that you can read here

The good news is that Azure Lab Services offers three main ways to manage costs.

Quota Hours

The simplest way to have as close to a ‘fixed’ maximum cost as possible is the requirement to define the number of hours quota to the VM at the time of the lab creation. In my example above, I created 5 VM for a maximum of 10hrs per VM, that would have a total approximate budget of USD$10.

There are two variables that affect this cost: if students use less than the maximum quota of hours and the VM is turned off then the cost will be lower. More importantly, if the Lab Creator (professor, assistant, trainer etc) go into the VM to assess student work, then there is a charge for the consumed resources during these activities above and beyond any student consumption (and also above the quota hours)

Quotas are a good way to allow students to work on the VM for homework outside of scheduled class hours.

Scheduling

Scheduling creates either a one off or recurring schedule that will automatically start the VM at the define time (ahead of class, for example, to save time wasted on waiting for VM to start manually)

Note: scheduled hours and quota hours can operate separately or together. From the Microsoft Docs:

The use of schedules for a lab is optional and you might specify user quota instead, or use a combination of both. User quota is the time that lab users can run their lab VM outside of scheduled time. For example, to complete assignments or homework. Any scheduled time doesn’t count against extra time that lab users have. A lab can use quota time, scheduled time, or a combination of both.

https://learn.microsoft.com/en-us/azure/lab-services/classroom-labs-concepts#schedule

You can set a schedule to implement a hard stop on usage of VMs (e.g. end of the school/business day) that helps with ensuring no VM is left on accidentally creating wasted expense.

Settings

Put simply, these are ways to automatically shut down the VM if there is no active usage or no user connects to the VM once it starts. The options are as follows:

Whilst turning off a VM based on idle time makes a lot of sense to avoid unnecessary costs, getting this setting right may depend on your scenarios – some forethought into an appropriate ‘timeout’ period would be beneficial to avoid frustration of a user getting logged out and having to restart their VM.

A key takeaway for me is that there are various mechanisms that can be put in place to provide assurance around costs and prevent unexpected bills for the use of Azure Lab Services

Final Thoughts

Azure Lab Services offers affordable, flexible virtual machines in a lab context for a variety of services. It’s quick and easy to deploy and, if desired, the VM can even be managed by your Intune MDM licensing.

Given many educational institutions use iPads or ChromeBooks, Azure Lab Services can provide an ‘on demand’ virtual Windows lab that can be easily connected to from any OS. This can go some way towards delivering a more equitable device experience by removing the limitations of the host device a student may use by supplementing it with a virtual desktop that has comparable specifications for all students in a class.

I certainly look forward to having more conversations with customers about scenarios were Azure Lab Services would be of benefit to them.

Categories
Microsoft365 Podcast

Video: Modern Managed Devices Webinar

It was nice to get back in the swing of things this week, delivering a webinar to an engaged audience on some of the principles of modern management of devices in education.

You can watch the video above if you’re keen for a recap of the session, and I’ll include a link to the PDF version of the deck I shared here if you want to download a copy:

Modern-Management-of-Devices-and-TELADownload

Why Manage Devices?

Thankfully, this question is being asked less by schools these days, as they pivot towards “how best to manage devices?” but laying a solid foundation for the why is still critical in my mind and I opened the discussion with this slide:

A managed device delivers better learning outcomes

I’m a steadfast believer in this quote and, for me at least, we should never lose sight of the fact that technology and devices are a tool to enable educational progress, and not an end unto themselves. It was heartening to get feedback through the chat in the webinar that the audience were focused on a similar line of “keeping the main thing, the main thing” – education!

One of the key messages I wanted to land were the benefits of moving to modern device management over more traditional approaches (or legacy) management of devices. Some of the benefits of this modern approach are obvious:

I was genuinely (and very pleasantly) surprised to learn on the call that the majority of attendees were well on their way to modern management. Through the use of interactive polls in Microsoft Teams, some of these trends became evident:

Given my previous work with Microsoft and focus on Intune managed Windows devices, I enjoyed doing some “myth busting” around the management experience of Windows. I kicked off this section discussing the following:

I then shared the timelapse of setting up a Windows device in under ten minutes, worked that I’d prepared in advance of presenting at Bett Asia in Bangkok last year. Ultimately, It’s important to help educate our customers to the advancements that have been made in making Windows more easily managed from the cloud. Newer operating systems like iPadOS and ChromeOS were essentially ‘born in the cloud’ with an MDM-first mindset, however Windows has come a long way to being more easily managed from the cloud too.

In response to a poll question around future device purchases, nearly 30% of attendees did indicate they would consider Windows devices if they could manage them as easily as an iPad or ChromeBook, with another 28% unsure.

Final Thoughts

My takeaway from this is that schools both want (and need) easier manage of all their devices, irrespective of the OS choice they are making. Keeping devices secure and ready for learning is paramount and taking a modern management approach to this is the most cost and time effective way to do this.

This was evident in the final video case study I shared at the end of the webinar, on the partnership between Saint Kentigern College, Dynabook and Cyclone with a fully managed BYOD program. You can watch this here:

How To: Custom PowerBI Reporting From Intune Data

There are two things that I’m a sucker for when it comes to technology: a great data visualisation (often achieved via PowerBI) and a seamless cloud deployment and management of device (usually by Intune).

This morning I read a tweet from Jannik Reinhard that managed to combine the two of them in a single blog post, so naturally I wanted to read more! As always, I try to credit the original source when I’m inspired to write my own blog based on their content, so check out his tweet here:

https://twitter.com/jannik_reinhard/status/1546045123389169664?s=20&t=UCw-rskYsf1vaZIPN9f5BA

And you can read his full post here: Build PowerBi Dashboard based on Intune Data Warehouse – Modern Device Management (jannikreinhard.com)

The genius behind this blog post is the beta feature called the Microsoft Intune Data Warehouse – if you’re wondering what this is, then the documentation states:

The Intune Data Warehouse samples data daily to provide a historical view of your continually changing environment of mobile devices. The view is composed of related entities in time.

Data Warehouse data model – Microsoft Intune | Microsoft Docs

The warehouse exposes data in the following high-level areas:

  • App protection enabled apps and usage
  • Enrolled devices, properties, and inventory
  • Apps and software inventory
  • Device configuration and compliance policies

These are all super helpful things to know and, whilst Intune provides it’s own reports, sometimes you want to drill a little deeper into the data or present it in a way that makes more sense for your own preferences for troubleshooting.

Getting Set Up For Custom Reporting With PowerBI

Jannik’s blog does a great job stepping you through the steps to get set up – honestly, this is only going to take you 2-3minutes. I could screenshot it, but he’s already done this here

The key is to select ‘Get Data’ in PowerBI App and then search for “Intune” in the search box and you should see the connector:

The other super helpful contribution from Jannik is the Intune Dashboard template he’s build and shared on GitHub – you can download it from here. It comes pre-populated with his data, but a simple click of “Refresh” in PowerBI and you’ll be seeing your own data reporting from your tenant.

Sample Data From My Intune Console

Within 5 minutes of reading the original blog I had my own data being visualised and here are the three main views:

Apps

Devices

Config Profiles

One thing that confused me at first was the three buttons at the bottom of the report for App / Device / ConfigProfiles – you can see these highlighted above. I initially thought you could click on these to select each report, but you actually still need to click the tab at the bottom of PowerBI for each report – see below:

Correcting the above – Jannik helpfully reached out on Twitter and reminded me that when using PowerBI Desktop you need to select ctrl+click to trigger buttons in a report. Once you publish the dashboard to www.powerbi.com then you no longer need to hold ctrl+click, but simply click on the button and it will change views. Thanks for the reminder Jannik!

Other than that, the reports work beautifully and the data can be refreshed daily to see the latest snapshot. With a little tweaking of the PowerBI report you can call out out whatever data is most important to you – have fun!