CHAPTER 16
Integrating Intune Hybrid into Your Configuration Manager Environment

The past several years have seen dramatic changes in the information technology (IT) landscape. To meet the shift toward mobile devices, enterprises are recognizing the “consumerization of IT” and incorporating consumer devices into their IT infrastructure. This movement is being led by tech-savvy users demanding the ability to use the latest devices to access corporate resources from any location. To facilitate this access, employees must allow some control over their devices, and they must agree for their devices to be enrolled in a management solution.

Intune is Microsoft’s mobile device management (MDM, sometimes called modern device management) and mobile application management (MAM) solution. You can integrate Intune with System Center Configuration Manager (ConfigMgr) to provide hybrid management of on-premise and mobile devices using a single console.

Using Intune provides the following features:

Secure management of personal and corporate-owned devices across popular mobile platforms

Self-enrollment of devices

Hardware and software inventory

Mobile device configuration (for example, Wi-Fi profiles, email profiles, certificates, and virtual private networks [VPNs])

MAM policies, including integration with Office mobile apps

Application deployment (required or available via the Intune company portal)

Conditional access, which prevents access to email and other services on devices that are not enrolled with Microsoft Intune

Intune standalone means that mobile device management is carried out using a cloud portal. A hybrid solution involves integrating Intune and ConfigMgr, which makes it possible to manage your mobile and on-premise devices using the ConfigMgr console. The best solution—and the one you should use—is the one that works best for your organization. Do note that, as of the time this book was published, Microsoft has stated that Intune standalone is their recommended deployment topology. Microsoft has also developed migration strategies for customers to migrate from Intune hybrid to Intune standalone. With that said, Microsoft has also committed to supporting customers using Intune hybrid.

Intune hybrid and standalone both have pros and cons; however, the rapid cadence of releases from Microsoft constantly changes the advantages of each solution, making it futile to even attempt to provide a comparison table in this book, as it would be obsolete before the book is even published. For more information on choosing between the models, see https://docs.microsoft.com/sccm/mdm/understand/choose-between-standalone-Intune-and-hybrid-mobile-device-management.

As ConfigMgr is the industry standard for computer management, it is great that you can now use it to manage all your devices through a single console. However, historically there was always one major disadvantage: Microsoft would regularly release new Intune features that could be immediately utilized by standalone users, while hybrid customers would have to wait for the changes to be integrated with ConfigMgr, as it was challenging to quickly add new features to this massive on-premise solution.

The wait was quite frustrating for customers, and they often chose to implement standalone Intune as a result. With the release of ConfigMgr Current Branch, Microsoft has committed to upgrading the entire ConfigMgr solution at a rapid rate, using the new servicing model. This makes it easier to add new features in a reasonable time frame.

Azure Active Directory (AD) Premium: Enables user identity management

Microsoft Intune: Provides mobile device and application management

Azure Information Protection: Enables data protection

Cloud App Security: Manages cloud app usage and shadow IT

Advanced Threat Analytics: Provides breach and threat identification

While this book is concerned with Microsoft Intune, it is important to know about EMS and how it fits into the total solution.

If you are unsure whether the product is an appropriate fit for your organization, you can sign up for a trial in one of two ways. Note that you can transition your trial to production in each case:

To sign up for a 30-day Intune trial, go to https://docs.microsoft.com/intune/free-trial-sign-up and click Try now.

Click Sign in if you wish to add the trial to an existing Office 365 subscription. Otherwise, enter your information to sign up.

To extend the trial an additional 30 days, contact Intune support. Local support telephone numbers are available in the TechNet documentation at https://technet.microsoft.com/jj839713.aspx.

Existing Microsoft cloud customers can sign up for a 90-day EMS trial through the FastTrack program, at http://fasttrack.microsoft.com/ems. This program allows customers to explore new resources at their own pace. It helps with planning for successful rollouts and onboarding of new users.

Office 365 Admin Center (https://portal.office.com): You can use the Office 365 admin center to carry out some preliminary configuration for the hybrid solution. Use it to add and verify a custom domain, as described in the “Preparing Your Environment for Intune” section, later in this chapter.

The admin center can also be used to access the Intune admin console. Navigate to Admin Centers -> Intune.

Intune Admin Portal (https://manage.microsoft.com): The Intune admin portal is currently used only for day-to-day management of computers. Mobile device management using Intune standalone has been migrated to the Azure portal. In a hybrid environment, most management activities are performed using the Configuration Manager console. This is discussed further in Chapter 17, “Managing Mobile Devices.”

Azure Portal (https://portal.azure.com): Intune management is carried out using the Azure portal. Navigate to More Services -> Monitoring and Management -> Intune to access the Intune tiles, as shown in Figure 16.1.

FIGURE 16.1 Managing Intune via the Azure portal.

Use the Intune admin console to check how much storage you are using. Navigate to Admin -> Storage Use. You can purchase additional storage as needed.

A trial Intune subscription entitles you to 2GB of Azure storage.

Cloud identity

Synchronized identity

Federated identity

Each model presents varying levels of complexity, and it is important to choose the model that works best for your business. The following sections discuss these models in more detail.

This model is normally used only in small organizations that do not have on-premise AD.

Various tools are available to synchronize the user accounts and password hashes. Azure AD Connect was the recommended tool at the time this book was published, and it is the only tool currently undergoing Microsoft development. Azure AD Connect is discussed in the “Synchronizing Active Directory” section, later in this chapter.

This model typically uses Active Directory Federation Services (ADFS) and is the most complex model to implement. Additional network and server infrastructure is required to achieve high availability.

Adding and verifying a custom domain

Creating Domain Name System (DNS) records

Adding a user principal name (UPN)

Synchronizing Active Directory

Creating an alternate login ID (optional)

This work will already have occurred if you are using Office 365 services. The following sections describe these tasks in detail.

Follow these steps to add a custom domain:

1. Log in to the Office 365 portal (https://portal.office.com) using the global administrator account.

2. Navigate to Settings -> Domains. Initially you see only your onmicrosoft.com domain. Configuring the custom domain in advance simplifies management of user identities. (UPNs are discussed in the section “Adding a User Principal Name,” later in this chapter.)

3. Select Add Domain and enter your custom domain name. This book uses the domain EMSlab.ie.

4. The next screen of the wizard, shown in Figure 16.2, presents instructions to verify your ownership of this domain. You must add a specific record to the DNS records of the domain, and Microsoft verifies that new record. This action does not affect any existing DNS records.

FIGURE 16.2 Verifying the domain.

Two verification methods are available:

Adding a TXT record (preferred)

Adding an MX record (alternative)

Adding a TXT record is the easiest option. Follow the hyperlink in the wizard for additional information on this process with the various domain name registrars.

The DNS record can take up to 24 hours to propagate fully after being added, although it is normally available within an hour. Once the record is propagated, click Verify. You will receive the error “Verification DNS record not found” if you have not waited a sufficient amount of time before verification. Once the domain is verified, its status changes in the portal.

You create a CNAME record for your domain that redirects EnterpriseEnrollment-s .yourdomain.com to manage.microsoft.com. When the MDM agent in Windows starts the enrollment process, it examines the email address provided and searches the DNS records for that domain for this CNAME value.

If the CNAME is found, the enrollment is redirected to Microsoft servers, and the process continues without any further user intervention.

If the CNAME value is not found, you are prompted to enter the server name (manage.microsoft.com) to continue.

Creating a CNAME record helps ensure seamless enrollment of Windows devices in a production environment. You also could create a CNAME record that redirects to Enterprise- Registration.windows.net to support Windows 8.1 and Windows 10 mobile devices that register with Azure AD.

The “Adding and Verifying a Custom Domain” section, earlier in this chapter, discusses adding to Intune a custom domain name that is verified by Microsoft. This section shows how to add that domain as a UPN suffix in Active Directory.

To add a UPN, log on to a domain controller (DC) and perform the following steps:

1. Open Active Directory Domains and Trusts. Right-click Active Directory Domains and Trusts and choose Properties.

2. Add an alternative UPN suffix (that is, a custom domain name), as shown in Figure 16.3.

FIGURE 16.3 Adding an alternative UPN suffix.

3. You can now change the UPN for your users so it matches the primary SMTP address. Using Active Directory User and Computers, open the properties of a user account and then select the Account tab.

4. Using the dropdown arrow, select the alternate UPN suffix and ensure that the logon name matches the primary SMTP address, as shown in Figure 16.4.

It would be inefficient to perform this procedure manually for a large number of users. Community-developed scripts are available, and several tools exist to make bulk changes.

FIGURE 16.4 Changing the user UPN.

This book uses the commonly implemented synchronized user identity model (password synchronization). Azure AD Connect is the recommended tool for integrating your on-premise AD with Azure AD; it replaces older directory synchronization tools such as DirSync and Azure AD Sync, both of which reached end-of-support in April 2017.

At the time this book was published, Azure AD Connect 1.1 was the current version of the tool. This version has new and improved features, including the following:

Automatic Upgrades: Previous upgrades of DirSync, Azure AD Sync, and Azure AD Connect were manual.

More Frequent Synchronizations: Previous synchronization intervals were three hours. Azure AD Connect 1.1 supports synchronization intervals of 30 minutes.

Multi-factor Authentication (MFA): Azure AD Connect 1.1 now natively supports MFA.

Table 16.1 shows the prerequisite requirements for Azure AD Connect.

TABLE 16.1 Azure AD Connect Software Prerequisites

Table 16.2 lists the minimum hardware requirements for the Azure AD Connect server.

TABLE 16.2 Azure AD Connect Minimum Hardware Requirements

Download AzureADConnect.msi from the Microsoft Download Center, at https://www.microsoft.com/download/details.aspx?id=47594.

Two installation methods exist for Azure AD Connect:

Express: Supports the most common implementation scenarios

Custom: For more advanced options (recommended by the authors, so that you can choose which organizational units [OUs] to synchronize to Azure)

This book assumes that you are using the most common topology, which is a single on-premise forest with one or more domains and a single Azure AD. This scenario is supported by the Azure AD Connect express installation.

Before installing Azure, AD Connect, examine the official Microsoft Azure documentation to discover the differences and the details of each option. In particular, you should understand the expected behavior when you make specific choices.

Follow these steps to install Azure AD Connect:

1. Log on to the server as a local administrator.

2. Launch the installer to start the Microsoft Azure Active Direct Connect installation wizard.

3. Check the box to agree to the license terms and privacy notice and click Continue.

4. Choose between an express or custom installation. Choose Customize if you want to make any changes to the default installation (such as selecting which user accounts to synchronize). This is the recommended option.

5. When you are presented with the choices for installing required components, choose whether to accept the default configuration. If you do, the wizard installs a local SQL Server 2012 Express instance. The wizard also creates the appropriate security groups and assigns the correct permissions. Remember that the authors recommend using an existing SQL Server instance for advanced management purposes. Click Install to continue. The required components are installed.

6. When prompted to do so, choose the single sign-on method you want for your users, as shown in Figure 16.5. If you are not federating with ADFS, choose Password Synchronization. Click Next to continue.

FIGURE 16.5 Selecting the user sign-in method.

7. Enter your Azure Active Directory credentials. (You must be global administrator on the tenant; this process creates an Azure AD account that is used for subsequent synchronizations.) If this account has multi-factor authentication enabled, you need to complete the MFA challenge. Click Next to commence the Microsoft Online verification process.

8. Provide details for your on-premise Active Directory. (You must be an enterprise administrator.) Choose your forest and select Active Directory as the directory type. Enter your on-premise AD account and click Add Directory. After the directory is configured, click Next to continue.

9. By default, all domains and OUs are synchronized. This is not recommended. You should deselect domains and OUs as required. Click Next to continue.

10. When you are asked how your users should be uniquely identified, accept the default settings, which are appropriate for most scenarios, or change them. Click Next to continue.

11. On the next page, which gives you the option to filter users and devices, filter by AD group if this installation is part of a pilot project. If you wish to synchronize all user accounts in the selected OUs, accept the default and click Next to continue.

12. When you are presented with some optional features, check the box for any features you want and click Next. You are informed that you have completed the wizard and are ready to configure Azure AD Connect.

13. Choose to start the synchronization process as soon as the configuration completes and click Install to finish.

14. Verify that the users have synchronized to Azure AD. Log in to the Azure or Office 365 portal to view the synchronized accounts. Note that the user format matches the UPN configured in AD.

Although Azure AD Connect supports synchronization intervals of 30 minutes, you may want to use PowerShell to manually force the synchronization. Follow these steps:

1. Launch PowerShell as administrator.

2. Navigate to the %ProgramFiles%Microsoft Azure AD Syncin folder.

3. Execute DirectorySyncClientCmd.exe with the delta parameter.

This problem is resolved by implementing alternate login ID functionality, which enables you to configure the sign-in experience to use an alternative user attribute in Active Directory Domain Services rather than using the usual UPN.

You can use the alternate login ID functionality in conjunction with each of the three user identity models. You must configure how your users are identified during Azure AD Connect installation. You cannot edit or repair this configuration afterward. More information on configuring an alternate login ID can be found at https://technet.microsoft.com/library/dn659436.aspx.

A number of tasks are required to integrate Intune and Configuration Manager:

Configure user discovery

Create a user collection

Add an Intune subscription

Add the service connection point

These tasks are discussed in the following sections. After ConfigMgr and Intune are integrated, you will be able to manage mobile devices. This is described in detail in Chapter 17.

1. In the console, navigate to Administration -> Discovery Methods -> Active Directory User Discovery.

2. Check the box Enable Active Directory User Discovery, as shown in Figure 16.6. Click the yellow starburst icon and select the OUs you require. Only users in these OUs will be discovered. If you selected specific OUs when configuring Azure AD Connect, remember to include them. Click Apply.

FIGURE 16.6 Enabling Active Directory User Discovery.

3. When you are prompted to run full discovery as soon as possible, click Yes and monitor the progress by using the ADUSRDIS.LOG file.

The discovery agent contacts a DC to locate the user resources. It discovers user accounts from the specified OUs in Active Directory Domain Services and creates discovery data records (DDRs) when sufficient resource information can be found. The users are then available in the ConfigMgr console.

SELECT UserPrincipalName,
    COUNT(*) AS NumOfOccurances FROM (SELECT
    RIGHT(User_Principal_Name0,
    LEN(User_Principal_Name0)-PATINDEX('%@%',
    User_Principal_Name0)) AS UserPrincipalName FROM CM_P01.dbo.v_R_User)
AS sub GROUP BY UserPrincipalName

The Intune subscription is responsible for the following:

Retrieving the certificate needed to connect to Intune

Enabling users to enroll devices

Configuring the supported mobile platforms

FIGURE 16.7 Server browser issues.

To add an Intune subscription to Configuration Manager, follow these steps:

1. In the ConfigMgr console, navigate to Administration -> Overview -> Hierarchy -> Cloud Services. Right-click Microsoft Intune Subscriptions, and choose Add Microsoft Intune Subscription, as shown in Figure 16.8.

FIGURE 16.8 Adding an Intune subscription.

2. In the first dialog of the Create Microsoft Intune Subscription Wizard that appears, read the steps to complete the wizard and the prerequisites for managing the following platforms, as shown in Figure 16.9:

Windows: Sideloading keys

Windows Phone 8: Code-signing certificate

Windows Phone 8.1: Sideloading keys

iOS: Apple Push Notification Service certificate

Click Next to continue.

FIGURE 16.9 The Create Microsoft Intune Subscription Wizard.

3. Select Sign In to sign in to Microsoft Intune (see Figure 16.10).

FIGURE 16.10 Signing in to Microsoft Intune.

4. Confirm that you want to set Configuration Manager to be the mobile device management authority, as shown in Figure 16.11.

FIGURE 16.11 Setting the mobile device management authority.

5. Enter your Intune credentials and click Sign In. This account must be a global administrator on the tenant. The account is authenticated and the Intune screen disappears.

6. Click Next to continue creating the subscription.

7. Complete the general configuration of the Intune Subscription, shown in Figure 16.12:

Select the ConfigMgr collection configured earlier in this chapter, in the “Creating a User Collection” section. (Members of this collection are entitled to enroll devices.)

Specify how you would like your company name to appear on the company portal on your managed mobile devices. You can also provide a URL to company privacy documentation.

Choose the color scheme for the company portal. You can choose standard colors or customize the color using the palette.

Verify the Configuration Manager site code.

Use the dropdown to select a device enrollment limit, from 1 to 15. This limit defines the maximum number of devices a user can enroll and is optional. Note that an Intune license entitles a user to enroll a maximum of 15 devices.

Click Next to continue.

FIGURE 16.12 Intune subscription general configuration.

8. Specify the company contact information for the company portal, as shown in Figure 16.13. Enter the following information, which will be displayed to the user:

IT department contact name

IT department phone number

IT department email address

Website name

Additional information

Click Next to continue.

9. Customize the company portal by adding the company logo (see Figure 16.14). Click Next to continue.

FIGURE 16.13 Specifying company contact information.

FIGURE 16.14 Specifying your company logo.

10. Add device enrollment managers, if required, and click Next to continue.

11. Check the box to enable multi-factor authentication, if required. (There are several methods of configuring MFA, but they are beyond the scope of this book. See https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication for more information.) Click Next to continue.

12. Review the configuration in the Summary dialog box and click Next to configure the Intune subscription.

13. Close the wizard.

The Intune Subscription is now added, and you can verify that a new site system is created (manage.microsoft.com). This is the cloud distribution point.

You can now configure management of the various platforms (see Figure 16.15), as discussed in Chapter 17.

FIGURE 16.15 Configuring platforms.

The Intune connector role is not present in ConfigMgr Current Branch, and the service connection point (SCP) is now responsible for this functionality. This site system role is discussed in Chapter 6, “Installing and Updating System Center Configuration Manager.”

The authors recommend adding the SCP during ConfigMgr installation. This is actually the default action. If you skipped this step during installation, you must add the role now. The role can only be added on a central administration site (CAS) or standalone primary site. Follow these steps:

1. In the ConfigMgr console, navigate to Administration -> Site Configuration -> Servers and Site System Roles.

2. Right-click the server you require and select Add Site System Roles. The Add Site System Roles Wizard is launched.

3. Specify the service connection point role and click Next to continue.

4. Choose the device connection mode. Online is the recommended setting.

5. Click Next to continue.

6. Confirm your settings on the summary screen and click Next to add the role.

NOTE: SERVICE CONNECTION POINT MODES

Figure 16.16 shows the service connection point modes. Online mode is a persistent connection and the recommended setting. This mode is required if you configure an Intune subscription. If you create the Intune subscription while the service connection point is in Offline mode, it is automatically changed to Online.

FIGURE 16.16 Service connection point modes.

1. In the Configuration Manager console, navigate to Administration -> Overview -> Cloud Services and select Microsoft Intune Subscription.

2. Right-click Microsoft Intune Subscription and select Delete.

3. Navigate to Administration -> Overview -> Site Configuration and select Servers and Site System Roles.

4. Highlight the server with the service connection point.

5. Right-click Service connection point in the Site System Roles pane and select Remove Role.

6. Confirm that you wish to remove the role.

Now, create a new subscription. Follow these steps:

1. Create a new service connection point.

2. Add a new Intune subscription.

3. Set Configuration Manager to be the MDM authority.

There are a number of tools available to troubleshoot Intune integration, discussed in the next sections.

Right-click any component and choose Messages -> All to see detailed information, including errors and warnings.

FIGURE 16.17 Configuration Manager Site Status.

FIGURE 16.18 Configuration Manager Component Status.

For Intune integration, concentrate on the following components:

SMS_Cloud_Services_Manager

SMS_CloudUserSync

SMS_DMP_Downloader

SMS_DMP_Uploader

Table 16.3 describes log files that are useful in troubleshooting Intune integration issues.

TABLE 16.3 Log Files for Intune Integration Troubleshooting

FIGURE 16.19 CloudUserSync.log file.

You can enable verbose logging for any of the components (but do not forget to turn it off again). Follow these steps:

1. Open the registry on the Configuration Manager server and navigate to HKEY_LOCAL_MACHINESOFTWAREMicrosoftSMSCOMPONENTS.

2. Select the component for which you need to enable verbose logging.

3. If there already is a DWORD key called Verbose Logging, change the value.

4. If the key is not there, create it and change the value.

Table 16.4 lists verbose logging values.

TABLE 16.4 Verbose Logging Values

FIGURE 16.20 Intune service current status.

Several online documents are available to assist you, including the following:

Troubleshoot Azure AD Connect Installation Issues: https://support.microsoft.com/kb/3121701

Troubleshoot Connectivity Issues with Azure AD Connect: https://azure.microsoft.com/documentation/articles/active-directory-aadconnect-troubleshoot-connectivity/

For urgent issues, you can contact Microsoft by telephone. You can find a full list of local numbers for Intune support in the TechNet library. Local language is supported in most locations, and English is supported in all locations. See https://technet.microsoft.com/library/jj839713.aspx for further information.

For a less urgent issue, you can create an online support request through the Office 365 admin center, at https://portal.office.com. Follow these steps:

1. Navigate to Support -> Service Requests.

2. In the Create a service request page, which presents a list of support options, click More to see more options.

3. Select Mobile Device Management. You are presented with two dropdown boxes to identify the issue.

4. Make a selection in the Feature box. You can choose Intune: Service Administration, for example.

5. Select a symptom. This is a dynamic portal, and different choices are available, depending on the feature you select. You can choose Subscriptions and licenses, for example.

6. In the Issue Summary box, summarize your issue in one sentence.

7. Enter further details in the Issue details box. Click Next to continue. Microsoft provides hyperlinks to some documentation that may assist you.

8. If you still need to create a service request, click Yes, continue.

9. Add further details about the service affected. You can attach log files or screenshots if you wish. Click Next to continue.

10. Confirm your contact details and click Submit request.

The current version of the tool performs the following checks:

Verifies that the SMSExec service is running

Verifies the service connection point certificate

Checks for potential conflicts between service connection point certificates

Verifies the DNS CNAME entry for the specified UPN

Verifies device type enablement in Configuration Manager

Looks for known errors in status messages

Verifies UPN synchronization in Azure AD

Verifies that the specified user is a member of the cloud user collection

FIGURE 16.21 Hybrid Diagnostics tool.

After providing an overview of Intune, this chapter introduced user identity, including a description of each method to assist with deciding which is right for your organization. The chapter discussed the preparation of AD and Azure AD prior to integration. Remember that Azure AD Connect is now the only recommended tool for directory synchronization.

The integration is relatively straightforward. This chapter showed how to add the service connection point and Intune subscription. Configuring the Intune subscription enables you to customize the Intune company portal on the clients.

Finally, this chapter looked at some useful troubleshooting techniques and showed the values in log files and the status in the Configuration Manager console.

Chapter 17 discusses managing mobile devices. It walks through the enrollment of each of the device types and then shows the management possibilities provided by the Intune-integrated hybrid solution.

Chapter 17 also focuses on Windows 10. Windows 10 mobile and desktop devices can be enrolled for MDM management using the Intune hybrid integration. Standalone Intune also provides computer management with the Intune client. However, if possible, the authors recommend managing Windows 10 desktops using the full ConfigMgr client, as it provides a more comprehensive management experience.