Let Intune stimulate mobile updates

Mobile devices can be a challenging asset to manage and keep secure with their many variations in ownership, management and operating systems. This blog post will give you some ideas on how you can enforce a minimum version of the operating system on the mobile phones accessing the company's data in Microsoft 365.

The cell phone is for many users the edge of privacy where they can accept the company's administration. At the same time, it is important for the company to have control over its data and applications. 

An important prerequisite must be set from the orgranization - Yes, users can have access to data, under defined conditions. One important security measure is to ensure updated software regardless of management mode. Let us dive into the condition of having updated operative systems on the mobile device accessing company data.

Branding your tenant and managed endpoints

A clear brand builds identity and affiliation. Microsoft 365 and Endpoint Manager has a rich set of tools for customizing your brand into the products. This will look nice and integrated, and it will help the end users detect security attacks. Let's take a deep dive into the possibilities associated with branding your tenant and endpoints!

A brand is a name, term, design, symbol or any other feature that distinguishes one company's good or service from those of other companies. Brands are used for recognition, creating values and identification. A brand is the sum of all expressions by which an entity (person, organization, company, business unit, city, nation, etc.) intends to be recognized.

With a workforce spread all over the modern hybrid workplace, it is more important than ever to spread the love of the company's brand. This blogpost will focus on how your brand can be incorporated to Microsoft 365 and all endpoints by Microsoft Endpoint Manager.

Building a MEMpowered LAB environment

In my early days as consultant within Microsoft technologies, I had complete lab environments running as virtual machines on heavy workstation laptops. Through the years as I have migrated to a cloud first philosophy, my lab environments have followed along. Working mainly with Microsoft 365 and Microsoft Endpoint Manager, my lab environments are now cloud based. 

I still remember making a decision moving from high performance laptops hosting all my virtualized lab environments. Looking back to my first switch to a lightweight Surface, I don't regret. The new light weighted devices powered by the cloud has been fantastic in my everyday work life. But - I still need environments to test and verify technologies and ideas before putting them to production. This blog post will cover some ways to build lab environments for the cloud based Microsoft solutions.

Autopilot - Device deadlock between two tenants

After wiping a Windows10 Autopilot device from Microsoft Endpoint Manager, we got welcomed to the correct tenant by name and logo. When signing in with a current licensed user, we got the message saying "That username looks like it belongs to another organization. try signing in again or start over with a different account". Time to troubleshoot!

The background for the wipe was to repurpose the device for a new user. 

Windows Autopilot is managed and maintained by Microsoft in a backend database that associates hashes with customer tenants. This time I got a schizophrenic device dealing with two tenants.

Disable "Do Not Send a Response" option in Outlook with MDM

When users select the option to not send a response when accepting a meeting invite in Microsoft Outlook, their response is not visible for the invitee. This makes it troublesome to keep track of attendees for the meeting. This is why many organizations want to disable this option. 

If someone replies to a meeting invite by using the "Do Not Send a Response" option, the action is marked in the users calendar, but it will not reflect in the meeting tracking visible for invitees.

The problem has been present for a long time, and there has been some information available on how this can be solved by use of Group Policies in legacy Active Directory environments. Here's how to remove the option to not send a response on meeting invites using Configuration Policies in Microsoft Endpoint Manager and a Settings Catalog profile type.

HP Connect for Intune, Part1: BIOS Update

To be certain we have a secure system from chip to cloud, it is fundamental to boot device from a trusted BIOS - often referred as secure boot. HP Connect for Microsoft Endpoint Manager is a cloud application designed to ease the management of UEFI BIOS on supported HP systems. This blog post will cover updating the BIOS on HP devices using MEM.

We need to have control of the boot environment of our managed devices

Please note: This is not a sponsored post!

Install printers from AD printserver on AAD joined computers

When you go from a traditional IT operation model to modern based on Azure AD and Endpoint Manager, you will have a migration period with resources in both camps. Typically, endpoints first go to the cloud while well-established services lag behind. 

This does not have to tie the endpoints to the ground. You can move your computers to pure Azure AD join, and still have access to on-premises services in Active Directory as long as the identities are hybrid. 

Some tend to use Hybrid Azure AD Join (HAADJ) since they have some legacy traditions of device and application management. HAADJ can thus be tempting, but in the long run it will give more headache than pleasure. The best approach is to move the endpoints to pure Azure AD Join devices and then put more effort into adapting to the new operational environment offered by Microsoft Endpoint Manager.

Printers and print servers are one example of services that tends to be strongly attached to the premises, even though there are great alternatives in the cloud with Microsoft Universal Print or 3rd parties like Printix. With the hybrid identity signed in to the Azure AD joined Windows device, you can also use the existing Active Directory joined print server. I have created a Powershell script which can be used with Microsoft Endpoint Manager to distribute printers on a print server to Azure AD joined computers. This can be a great approach to make the move to the cloud more resilient, even though you will lose much of the borderless functions from a pure cloud-based print solution.

The script is available on my GitHub. 

Windows 11 - Customize the Start menu layout

I believe the workday can be a tad less cluttered if certain stuff have a fixed placement. In a managed environment there might be interesting to have a customized start menu layout for all users giving a default set of pinned apps in a fixed order. This blog post will walk you through the routine of setting this up on Windows 11 by use of Microsoft Endpoint Manager.

Note: A customized start menu layout overwrites the entire existing layout. A partial locked layout like offered on Windows 10 is not available on Windows 11. The layout can be changed by the user.

Create a JSON settings file

Set up your preferred Start menu layout on an existing Windows 11 computer. Pin the apps you like on the start menu and arrange the order of these apps.

Configure a preferred start menu layout on an existing Windows 11 device

Start Windows Powershell and export the configuration to a JSON file.

Windows 11 - Custom theme with MEM

If your company has a strong branding profile, you might be interested in assigning a custom desktop theme pack to your Windows 11 computers reflecting your brand. I have put together a simple routine for distributing a deskthemepack with Microsoft Endpoint Manager.

Design your preferred theme

Use the Settings app on a Windows 11 computer to design your preferred desktop theme. After setting a preferred background, sounds, colors and mouse cursors, you can save this as a named theme.

You now have this as a theme on your computer which can be exported for sharing. Save this as a file on your computer.

Rename computers with countrycode in Intune

During an engagement at a customer there was a demand of having all computers in Endpoint Manager/Intune renamed to a naming standard including the two character ISO country code from the device owner followed by the serial number of the device. This was solved by using Graph API in a Powershell script running in an Azure Runbook.

The mission

The mission is to have all Windows devices in Microsoft Endpoint Manager follow a specified naming standard giving the device a unique name consisting of a country code and the device serial - ie: NO-132435465768. The solution must address existing and new devices.

The challenge with this design is related to compiling a device name consisting of the country code found at the user owning the device and the serial found on the device it self. I have found examples online for renaming endpoints, but these did not get hold of the country codes from the user to use as part of the new device name. Some of these examples include:

• Using OMAURI as explained by Carson Cloud
• Using part of UPN in proactive remediations as explained by Matt Setchell
• Using part of UPN in a script as explained by Maurice Daly

New devices - autopilot profiles

During the initial phase of this project, I did design a configuration for Autopilot allowing the devices to start out with the correct device name upon the initial onboarding. This was based on several group tags matched with corresponding AutoPilot profiles. A specialized menu was built in order to ease the hash collection and at the same time have the group tag specified.

Menu used for selecting country code when getting the hardware hash code

This did work as expected for new computers. The CSV hash file got a Grouptag specified pr. device based on the operators choice when collecting the hash. When uploaded to Intune, the Grouptag did match with an Azure dynamic device group which in turn was targeted towards the corresponding autopilot profile setting the correct name on the device.

Although this was a full-blown technical solution, it didn't live up to the expectations of easy implementation from the first line helpdesk. The setup was therefore reversed leaving one common autopilot profile for each and every windows device in the tenant.

Existing devices - renaming with script

Initially this was thought as a one shot run to rename existing devices. As the first phase of naming new machines during Autopilot was neglected, the challenge is somewhat extended to do renaming of devices on a regular basis. This has led to a Powershell script running in an Azure Runbook on a schedule once pr. day.

Pseudo code

The script has a hash table with current countries. The script will recure the country list selecting all users belonging to each country and further on list each device belonging to those users. Attributes from the user gives access to information about the country, while attributes from the device gives information about the serial number. The script takes into account the maximum length of 15 characters for computer names. This gives the fundaments for renaming the computer to the given naming standard. A rename will be initiated if the existing computer name differs from the standard.

Azure App Registration

The script authenticates through an Azure App Registration which has the following Microsoft Graph API application permissions:

• DeviceManagementManagedDevices.PrivilegedOperations.All
• DeviceManagementManagedDevices.ReadWrite.All
• Directory.Read.All
• User.Read

The app secret for the app registration is created with powershell in order to have extra life time:

    $startDate = Get-Date

    $endDate = $startDate.AddYears(9)

    $ObjectID = 'XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX'

    $aadAppsecret01 = New-AzureADApplicationPasswordCredential -ObjectId $ObjectID -StartDate $startDate -EndDate $endDate

    ($aadAppSecret01).Value

Azure Runbook

The TenantID, ClientID and ClientSecret from the app registration are stored as encrypted variables in the Azure Runbook.

Encrypted variables stored in the runbook

The runbook does have most of the modules loaded already, except for the Microsoft.Graph.Authentication module which has to be added from the Gallery.

The script can now be added, published and linked to a schedule in the runbook. The script is available on my Github, and it has some comments throughout the code describing the process.

<#

  .NOTES

  ===========================================================================

   Created on:      09.05.2022

   Created by:      Simon Skotheimsvik

   Filename:        MEM-ChangeOfComputerNames-Runbook.ps1

  ===========================================================================

 

  .DESCRIPTION

    This script uses the Graph API to bulk rename Windows devices. It can for

    example be used in a scenario where autopilot default naming has been used

    and a new standardised naming convention has been agreed upon. This Script

    will use the Country Code from the owning users Azure Account. It can be

    modified to use other user variables as well.

    The script is designed to run unattended in an Azure Runbook.

     

  .EXAMPLE

    MEM-ChangeOfComputerNames-Runbook.ps1

#>

$GLOBAL:DebugPreference="Continue"

$Countries = @{

    Norway = "NO"

    Vietnam = "VN"

    Brazil = "BR"

    Chile = "CL"

    Croatia = "HR"

    India = "IN"

    Italy = "IT"

    Poland = "PL"

    Romania = "RO"

    Singapore = "SG"

    Canada = "CA"

}

# CONNECT TO GRAPH WITH AZURE APP-REGISTRATION STORED AS ENCRYPTED VARIABLES

$TenantId = Get-AutomationVariable -Name 'Computer_Rename_TenantID'

$ClientId = Get-AutomationVariable -Name 'Computer_Rename_ClientID'

$ClientSecret = Get-AutomationVariable -Name 'Computer_Rename_ClientSecret'

# Create a hashtable for the body, the data needed for the token request

# The variables used are explained above

$Body = @{

    'tenant' = $TenantId

    'client_id' = $ClientId

    'scope' = 'https://graph.microsoft.com/.default'

    'client_secret' = $ClientSecret

    'grant_type' = 'client_credentials'

}

# Assemble a hashtable for splatting parameters, for readability

# The tenant id is used in the uri of the request as well as the body

$Params = @{

    'Uri' = "https://login.microsoftonline.com/$TenantId/oauth2/v2.0/token"

    'Method' = 'Post'

    'Body' = $Body

    'ContentType' = 'application/x-www-form-urlencoded'

}

$AuthResponse = Invoke-RestMethod @Params

$Headers = @{

    'Authorization' = "Bearer $($AuthResponse.access_token)"

}

# Connect-MgGraph with Token in order to be able to post a computer renaming

$connection = Invoke-RestMethod `

    -Uri https://login.microsoftonline.com/$TenantId/oauth2/v2.0/token `

    -Method POST `

    -Body $body

 

$token = $connection.access_token

Connect-MgGraph -AccessToken $token

write-output "Authentication finished"

############################################################

# ROUTINE FOR RENAMING USERS AUTOPILOT DEVICES

############################################################

foreach ($CountryCode in $Countries.keys) {

    write-output "Working on country $CountryCode"

    $Country = $CountryCode

    $CountryCode = $($Countries[$Country])

    $MaxSerialLength = (15 - $CountryCode.get_Length())-1 #Max 15 characters allowed in devicename. Calculate length of serial# part.

    $userList = $Null

    # Get all users with the current country code. Use paging in order to get more than 999 which is max pr query

    $UsersURL = 'https://graph.microsoft.com/v1.0/users?$filter=startswith(country,'''+ $Country +''')&$top=999'

    While ($UsersURL -ne $Null) {

        $data = (Invoke-WebRequest -Headers $Headers -Uri $UsersURL -UseBasicParsing) | ConvertFrom-Json

        $userList += $data.Value

        $UsersURL = $data.'@Odata.NextLink'    

    }

    # Get all managed devices for each user

    foreach ($User in $UserList) {

        $upn = $User.userPrincipalName

        write-output "- Focus on user $upn"

        $DeviceList = $Null

        $deviceURL = 'https://graph.microsoft.com/v1.0/users/'+ $User.userPrincipalName +'/managedDevices?$filter=startswith(operatingSystem,''Windows'')'

        $DeviceList = (Invoke-RestMethod -Uri $deviceURL -Headers $Headers).value

        $NoOfDevices = $DeviceList.Count

        write-output "- $NoOfDevices device(s) found"

        foreach ($Device in $DeviceList) {

            $CurrentDeviceName = $Device.deviceName

            write-output "--- Focus on device $CurrentDeviceName"

            $OS = $Device.operatingSystem

            $DeviceID = $Device.id

            $FullSerial = $Device.serialNumber

            # Max 15 characters allowed in devicename - Some devices have to long serialnumber

            if ($FullSerial.get_Length() -gt $MaxSerialLength) {

                $DeviceSerial = $FullSerial.substring($FullSerial.get_Length()-$MaxSerialLength)

                write-output "---- Serial too long - shortened!"

            }

            else {

                $DeviceSerial = $FullSerial

            }

            # Calculates new devicename in format NO-12345678

            $CalculatedDeviceName = $CountryCode.ToUpper() + '-' + $DeviceSerial

           

            # Virtual computers have the text "SerialNumber" as serialnumber...

            if (($CurrentDeviceName -ne $CalculatedDeviceName) -and ($DeviceSerial -ne "SerialNumber")) {

                write-warning "---- Device $CurrentDeviceName needs to be renamed to $CalculatedDeviceName"

                # Calculate graph api url's

                $Resource = "deviceManagement/managedDevices/$DeviceID/setDeviceName"

                $GraphApiVersion = "beta"

                $URI = "https://graph.microsoft.com/$GraphApiVersion/$($Resource)"

                $JSONPayload = @{

                "deviceName" = $CalculatedDeviceName

                }

                $convertedJSONPayLoad = $JSONPayload | ConvertTo-Json

               

                #Send change to Graph.

                Invoke-MgGraphRequest -Uri $URI -Method POST -Body $convertedJSONPayLoad -Verbose -ErrorAction Continue

            }

            else {

                write-output "---- $CurrentDeviceName will not be renamed"

            }

        }

    }

}

Verify the results

When running the script, all outputs can be found in the logs, and all renamed computers are logged as warnings:

Feedback from the script with renamed computers found as warnings

This is reflected on the device in the Microsoft Endpoint Manager:

Device waiting to be renamed

As with other renaming requests in Microsoft Endpoint Manager, it requires the device to reboot before all registers (AzureAD, Intune, AutoPilot, Device) are up to date.

Device rename confirmed in the portal

Summary

This routine will effectively and automatically rename devices on a given schedule as long as the app secret is valid. The script can be altered to mix and match variables from user and device in order to create the corresponding device name for your naming convention. You can for example use information from the user like department, company, region, postalcode as a part of the computername.

No extra charge for the mistakes - solution shared as it is - use it at your own risk.

Thanks for reading - please share and comment.