This blog has been migrated and modernized - you will automatically be forwarded to https://skotheimsvik.no where all existing content has been imported and new content will be published.
Imagine a compromised administrative account going wild in your Intune environment. Wouldn't it be great to protect your configuration with a second factor, like MFA? Join me while I experience the new Multiple Administrative Approvals (MAA) feature for Intune which is out in public preview!
Please note: This is not a sponsored post!
There is a new integration available between Microsoft Intune and the Microsoft Store for managing app installations from the cloud. This allows admins to easily browse, deploy and monitor applications. The new feature is powered by WinGet, the new windows package manager. I will explore this new feature in this blog post.
Intune has for a long time been great at getting policies and aps on to devices. The challenge has been to get new applications ready for provision in Intune. Whit this new feature, Independent Software Vendors (ISV) can publish and maintain their packages directly to this solution. This will ease the process and the burden of application management.
With direct access to the apps in Intune, they can easily be made available fast and easy for user's self-service through the Company Portal. This is perfect for locked down environments where users have no local admin rights on their computers
Mobile devices can be a challenging asset to manage and keep secure with their many variations in ownership, management and operating systems. This blog post will give you some ideas on how you can enforce a minimum version of the operating system on the mobile phones accessing the company's data in Microsoft 365.
The cell phone is for many users the edge of privacy where they can accept the company's administration. At the same time, it is important for the company to have control over its data and applications.
Group based licensing in Microsoft 365 is not a new feature, but still a feature a lot of organizations is missing out on. Assigning licenses to groups instead of directly to users provides advantages related to automation, overview and more. Information of this is easily available on net, but I have been missing an automated way of providing uniform groups for the purpose.
Assigning licenses to users by group membership in Azure Active directory is consistently documented at Microsoft Learn and at several other online locations. The advantages of this are therefore not specifically mentioned in this blog post.
A clear brand builds identity and affiliation. Microsoft 365 and Endpoint Manager has a rich set of tools for customizing your brand into the products. This will look nice and integrated, and it will help the end users detect security attacks. Let's take a deep dive into the possibilities associated with branding your tenant and endpoints!
A brand is a name, term, design, symbol or any other feature that distinguishes one company's good or service from those of other companies. Brands are used for recognition, creating values and identification. A brand is the sum of all expressions by which an entity (person, organization, company, business unit, city, nation, etc.) intends to be recognized.
With a workforce spread all over the modern hybrid workplace, it is more important than ever to spread the love of the company's brand. This blogpost will focus on how your brand can be incorporated to Microsoft 365 and all endpoints by Microsoft Endpoint Manager.
In my early days as consultant within Microsoft technologies, I had complete lab environments running as virtual machines on heavy workstation laptops. Through the years as I have migrated to a cloud first philosophy, my lab environments have followed along. Working mainly with Microsoft 365 and Microsoft Endpoint Manager, my lab environments are now cloud based.
I still remember making a decision moving from high performance laptops hosting all my virtualized lab environments. Looking back to my first switch to a lightweight Surface, I don't regret. The new light weighted devices powered by the cloud has been fantastic in my everyday work life. But - I still need environments to test and verify technologies and ideas before putting them to production. This blog post will cover some ways to build lab environments for the cloud based Microsoft solutions.
When spending hours, days, months and lifetime in front of a computer, a good monitor is essential for the workplace. Personally I prefer large monitors with huge resolution to get enough space to work efficiently with Microsoft 365, Endpoint Manager, scripting and automation. Traditionally I have used 3 to 4 monitors lined up. I will now share my experience after migrating to one single superwide screen. will it fulfill my needs and expectations out of the box, or do I need to do some hacks?
Please note: This is not a sponsored post!
This is a follow up on my last blog post covering automated teams voice assignment for users. This time I will cover how the mentioned routine has been expanded to do reporting in PowerBI to show evolution and distribution throughout the lifetime of the service.
After running my routine of automated voice assignment in Teams for a while, I felt the need to have an overview of the solution and how it evolved.
In order to manage voice and phone number assignments in Microsoft Teams, you need at least Teams Communications Administrator role. This role does however have more privileges than most organizations want to assign to their first line staff. This blog post will cover a way for first line to automate voice activation of users with the granularity necessary to cover several technologies such as Direct Routing and Operator Connect.
The main idea is to let first line operators use the tools they have access to when managing users without the demand of acquiring extra privileges.
Microsoft Search helps users find relevant content, the right answers or people. Search administrators use their knowledge of the organization and its users to make it easy for users to find the relevant content. This blog post will cover how you can prepare information about employees in order to place them on a floor plan for the office buildings.
This type of setup is part of my mindset of using as many features as possible from the Microsoft 365 licenses, often triggered through configuration and maintenance of information which provides value throughout the product line.
This kind of functionality will add value when searching for colleagues in the office landscape, or even when searching for the closest meeting room.
After wiping a Windows10 Autopilot device from Microsoft Endpoint Manager, we got welcomed to the correct tenant by name and logo. When signing in with a current licensed user, we got the message saying "That username looks like it belongs to another organization. try signing in again or start over with a different account". Time to troubleshoot!
The background for the wipe was to repurpose the device for a new user.
When users select the option to not send a response when accepting a meeting invite in Microsoft Outlook, their response is not visible for the invitee. This makes it troublesome to keep track of attendees for the meeting. This is why many organizations want to disable this option.
If someone replies to a meeting invite by using the "Do Not Send a Response" option, the action is marked in the users calendar, but it will not reflect in the meeting tracking visible for invitees.
Inspirert av lærdommen fra prosjektet med å få Min renovasjon inn i Homey har jeg kastet meg over Posten sin løsning for å se om jeg kan få lest inn postbudets rute som variabler i min Homey.
Companies that have gone through several generations of IT systems will have to make their cloud journey in small steps - system by system. Devices and document storage are quickly moved to Microsoft 365. Special Line of Business systems may take longer to cloudify. This can present challenges in making data from dinosaur systems available to users of the modern Microsoft 365 platform.
To be certain we have a secure system from chip to cloud, it is fundamental to boot device from a trusted BIOS - often referred as secure boot. HP Connect for Microsoft Endpoint Manager is a cloud application designed to ease the management of UEFI BIOS on supported HP systems. This blog post will cover updating the BIOS on HP devices using MEM.
 |
| We need to have control of the boot environment of our managed devices |
Fortinet Document Library has a documented routine for distributing the FortiClient application with Intune to Microsoft Windows. This routine is working Ok, but it is missing information on how to distribute the VPN profiles to the client. This will be the topic for this post.
 |
| FortiClient without VPN profile |
Jeg har lenge ønsket å få informasjon fra vårt renovasjonsselskap RIR inn i mitt smarthus slik at jeg kan få målrettet varsel om dette sammen med annen varsling som huset gir oss. I forbindelse med at Homey slapp funksjonen advanced flow 01.07.2022, kom det ett innlegg i facebook gruppen Athom Homey Norge fra Vegard Hamar som viste en metodikk for å få dette på plass. Det krevde litt spekulasjon for å kunne gjenskape dette. Legger her ut mine notater slik at kanskje flere kan ha glede av dette.
When you go from a traditional IT operation model to modern based on Azure AD and Endpoint Manager, you will have a migration period with resources in both camps. Typically, endpoints first go to the cloud while well-established services lag behind.
This does not have to tie the endpoints to the ground. You can move your computers to pure Azure AD join, and still have access to on-premises services in Active Directory as long as the identities are hybrid.
Some tend to use Hybrid Azure AD Join (HAADJ) since they have some legacy traditions of device and application management. HAADJ can thus be tempting, but in the long run it will give more headache than pleasure. The best approach is to move the endpoints to pure Azure AD Join devices and then put more effort into adapting to the new operational environment offered by Microsoft Endpoint Manager.
Printers and print servers are one example of services that tends to be strongly attached to the premises, even though there are great alternatives in the cloud with Microsoft Universal Print or 3rd parties like Printix. With the hybrid identity signed in to the Azure AD joined Windows device, you can also use the existing Active Directory joined print server. I have created a Powershell script which can be used with Microsoft Endpoint Manager to distribute printers on a print server to Azure AD joined computers. This can be a great approach to make the move to the cloud more resilient, even though you will lose much of the borderless functions from a pure cloud-based print solution.
The script is available on my GitHub.
I believe the workday can be a tad less cluttered if certain stuff have a fixed placement. In a managed environment there might be interesting to have a customized start menu layout for all users giving a default set of pinned apps in a fixed order. This blog post will walk you through the routine of setting this up on Windows 11 by use of Microsoft Endpoint Manager.
Note: A customized start menu layout overwrites the entire existing layout. A partial locked layout like offered on Windows 10 is not available on Windows 11. The layout can be changed by the user. |
| Configure a preferred start menu layout on an existing Windows 11 device |
If your company has a strong branding profile, you might be interested in assigning a custom desktop theme pack to your Windows 11 computers reflecting your brand. I have put together a simple routine for distributing a deskthemepack with Microsoft Endpoint Manager.
During an engagement at a customer there was a demand of having all computers in Endpoint Manager/Intune renamed to a naming standard including the two character ISO country code from the device owner followed by the serial number of the device. This was solved by using Graph API in a Powershell script running in an Azure Runbook.
The mission is to have all Windows devices in Microsoft Endpoint Manager follow a specified naming standard giving the device a unique name consisting of a country code and the device serial - ie: NO-132435465768. The solution must address existing and new devices.
The challenge with this design is related to compiling a device name consisting of the country code found at the user owning the device and the serial found on the device it self. I have found examples online for renaming endpoints, but these did not get hold of the country codes from the user to use as part of the new device name. Some of these examples include:
 |
| Menu used for selecting country code when getting the hardware hash code |
The script has a hash table with current countries. The script will recure the country list selecting all users belonging to each country and further on list each
device belonging to those users. Attributes from the user gives access to
information about the country, while attributes from the device gives
information about the serial number. The script takes into account the maximum length of 15 characters for computer names. This gives the fundaments for renaming the
computer to the given naming standard. A rename will be initiated if the existing computer name differs from the standard.
The script authenticates through an Azure App Registration which has the following Microsoft Graph API application permissions:
 |
| Encrypted variables stored in the runbook |
When running the script, all outputs can be found in the logs, and all renamed computers are logged as warnings:
 |
| Feedback from the script with renamed computers found as warnings |
 |
| Device waiting to be renamed |
 |
| Device rename confirmed in the portal |
This routine will effectively and automatically rename devices on a given schedule as long as the app secret is valid. The script can be altered to mix and match variables from user and device in order to create the corresponding device name for your naming convention. You can for example use information from the user like department, company, region, postalcode as a part of the computername.
No extra charge for the mistakes - solution shared as it is - use it at your own risk.
Thanks for reading - please share and comment.
It has been a while since Microsoft released their machine learning based noise suppression for Microsoft Teams. With this setting available all background noise like shuffling papers, slamming doors, barking dogs, and so on are effectively reduced. This technology has quickly fallen into our pattern of use - which in turn has led to expectations of finding this in the meeting rooms
The new hybrid workspace is the hottest trend right now. At any time, a hybrid workplace will consist of both remote workers and in-office workers. Synchronizing these groups of employees into a cohesive, collaborative unit can be quite a challenge in order to not leave one group feeling anonymized or voiceless.
Microsoft Teams rooms should bring organizations closer to the ideal of hybrid work giving remote side workers the same opportunities to actively participate in the meeting. We see constant developments to support this, like the recent Front Row Layout for meetings.
As a remote worker, I often find unintentional noise from meeting rooms to be the biggest disturbance in meetings. This can be all from paperwork, pens and fingers drumming on the table, cups and cutlery, small talk and meeting in meetings. I am therefore happy to finally see machine-based noise cancellation available on the Teams Rooms System.
When in a call, settings for noise suppression are now found on the meeting room controller:
 |
| Click on the image for a larger view |
Teams offers three levels of noise suppression to help keep meeting participants focused. These settings can be changed at any time. For the Teams desktop app and iOS, the settings carries over to the next meeting or call once they are changed. This is not yet the case for Teams Room System.
The noise suppression feature can be enabled or disabled on the Teams Room Device by use of the NoiseSuppressionDefault variable found in an XML Configuration file as described here.
 |
| Click on the image for a larger view |
The article describes several settings and how these can be implemented on devices in small and large scale. The documentation does not state how to set Low or High as the default setting. This has been discussed in this Twitter thread, where @MauroB94454117 states that the code implemented is ahead of documentation at this time. The documentation is missing the part on how to force noise suppression to Low or High settings. This is done with the following variables in the XML file which are tested and found Ok:
0 = Off
1 = Auto
2 = Low
3= High
The following XML file gave me the highest level of noise suppression as the default state:
These are small steps to a better hybrid workspace in the modern workplace!
Those of you which has read through the Microsoft services agreement might have noticed paragraph 6b where Microsoft recommends that you regularly backup your content and data that you store on the services using third-party apps and services. One example of such third party tool popular by managed service providers is the Veeam Backup for Microsoft 365. This blog post will explain how you can get automatic reporting on licenses and sizes used by this application.
Please note: This is not a sponsored post!
 |
| Example of monthly report of all companies and users protected by Veeam 365 Backup which can be the basis for invoicing where this is based on the number of users in the system pr. company. |
 |
| Example of historical development of backup up users pr. company by Veeam 365 backup. |
 |
| Example of gigabyte compared to number of users pr. company protected by Veeam 365 backup. |
 |
| Example of usage of the calculated column for GB pr User. Infinity comes from stored data for customers which have terminated their contract where data still exists. This has been removed from the graph with a visuals filter displaying only companies with more than 0 users. |
 |
| Example of report for repositories with forecast in the Veeam 365 backup service. |
.gif) |
| The animation is blured to protect the data exposed in the report |
