Learning Microsoft Endpoint Manager

Unified Endpoint Management with Intune and the Enterprise Mobility + Security Suite

Scott Duffey

• Publisher: Scott Duffey
• Year: 2021
• ISBN:
  9780645127911
• Edition: 1
• Topic: Computer Science
• Subtopic: System Administration
• Index: Computer Science

The first-ever book on Microsoft Endpoint Manager (MEM), written by Microsoft Program Manager Scott Duffey!

Microsoft Endpoint Manager (MEM) has rapidly become one of the leading products for mobiledevice and PC management. Organizations around the worldare using it to manage settings, security, and apps on corporate-owned devices and empower users to be productive on their own personal devices by protecting corporate app data. MEM also provides a wealth of capabilities for driving improvements to end-user experiences onPC's through Endpoint Analytics and Windows AutoPilot.

In this book you will learn:

• Microsoft Endpoint Manager - What it is and how to use it
• How to set up your own MEM learning environment
• Mobile Device Management (MDM) for iOS, macOS, Android, and Windows 10 devices
• Device enrollment concepts for Personal and Corporate devices including Windows Autopilot, Apple Automated Device Enrollment (ADE), andGoogle ZeroTouch
• Endpoint Security configuration in MEM including device Compliance and Azure AD Conditional Access across MicrosoftIntune, Configuration Manager, Azure AD, Microsoft Defender for Endpoint, and Office 365
• Deploying, protecting, and configuration mobile and desktop applications.
• Extending MEM with Microsoft Graph API and PowerShell

This book includes learning material, examples, tips, and guided exercises and is suitable for IT administrators of any level who want to ramp up their knowledge of Microsoft Endpoint Manager.

Chapter 1

Introduction

Did you just land an IT job only to learn your new employer is using Microsoft Endpoint Manager (MEM) for device management? Perhaps you stretched the truth on your resume and suggested you knew it already? Maybe you are an old-hat, know-your-stuff device management pro for another product but your boss just told you the company is migrating? Whatever the case, this book will be your zero-to-hero ramp-up guide.

In authoring this book, I promise you a few things – firstly, I promise an easy but content-rich read. MEM is complicated enough without acronyms and tech-speak. I will keep it simple and articulate, and I’ll take the time to explain industry terminology. Second, I learn by doing stuff (and breaking stuff) and so do most of the IT admins I know. To maximize learning, I will get you ‘doing stuff’ as much as possible. Exercises will not have fine-grained, explicit steps; instead, I will guide you through the flow and prevent you from getting stuck or breaking too much stuff. The book is structured to start out simple, adding building blocks as you go until you reach a point where you can fish for yourself. I recommend that you go beyond the basic steps provided and take regular detours to explore additional configurations, settings and features along the way. At the end of this book, you should be comfortable building-out full scenarios in lab or production environments and be ready to show your boss how awesome you are.

There is one promise I cannot make. MEM is a cloud service; it gets updated super-frequently (once a month, sometimes more). So frequently that some content will get stale. Features and entire products get renamed, new features get added or just annoyingly moved around the UX! You will be fine, though – I will teach you the broad stuff, the concepts and administration patterns and give you all the resources you need to stay up to date to handle the inevitable product changes so you can be your company’s go-to MEM ninja for years to come.

Intune vs Endpoint Manager? What do we call this thing?

The first thing you need to know if you are new to this space is that the product name “Microsoft Endpoint Manager” is relatively new, and the product boundary is a little confusing – it’s got history. The nuts and bolts of the MEM product have existed for a long time as two separate, but successful, products – Intune and Configuration Manager.

The cloud product – Microsoft Intune – was first launched as “Windows Intune” and, as the name suggests, initially only supported Windows device management starting with Windows 7. After expanding into other mobile platforms, it was re-branded to “Microsoft Intune”.

Configuration Manager is probably the best-known enterprise device management software out there. It has gone by many names through the years, too, such as System Management Server (SMS) and System Center Configuration Manager (SCCM). Nowadays most IT pros just call it ConfigMan.

In 2019 there was a big announcement at the Microsoft Ignite conference – the two popular products announced to the IT pro world that they were getting married and birthing a beautiful new baby called Microsoft Endpoint Manager (MEM).

This product name stuff will be important background knowledge as you work your way through this book and any of the online docs and blog posts. You will find various names used out there and you might need to try alternative search terms to get the results you are looking for. In this book, I will be referring to the combined product as “Microsoft Endpoint Manager” (or MEM, for short), but I’ll use “Intune” from time to time when talking about parts of the product that only exist in the cloud service and are not at all relevant to the on-prem Configuration Manager server scenarios and infrastructure.

Reading and doing

To get the most out of this book I recommend both “reading it” and “doing it”. Take detours to try out new features you see along the way. You will find exercise sections called “Do it” as you progress, with steps getting less structured as you become familiar with the consistent patterns in the MEM admin center. In the first chapter, you will start by setting up a MEM trial account so you can really start sinking your teeth into it. Before you get there, though, there are some things that you will need.

Things you will need

Here is your equipment checklist:

 Administrator workstation

 Test devices (one of each platform you want to learn about)

 Internet connectivity and network

 (Optional) an on-prem network lab

Administrator workstation

This could be anything – PC, Mac – I do not mind, as long as it has good internet connectivity. On the admin workstation, you will need your favorite web browser installed to reach the administration portal. I recommend the Chromium-based Microsoft Edge browser for a few reasons: firstly, I have documented the lab steps with it; second, it has some neat features like the ability to add and switch profiles, which is super handy when logging into different cloud services with different personas.

Test devices

Here are my recommendations for test devices – you don’t need to rush out and buy a whole stack of new devices (although this book might be a good excuse for you to do so!). When I first started learning MEM, I either asked my family if I could use their old ones or built virtual machines for Windows. If your boss is awesome, they will agree to let you buy this stuff for the good of the company.

• An iOS test device – if you or someone in your family has an old iPhone or iPad lying around you should be able to get by using that. If you need to buy a new one, know that you will be able to do all the exercises in this book using the cheapest you can get away with (I bought a new iPad Mini because my kids get annoyed when I remotely wipe theirs).

• A macOS test device – most folks I know buy one of these second-hand. If you do that just make sure it can run macOS X 10.13 or later, as that’s the minimum supported by MEM at the time of writing. There are a couple other options if you do not want to buy a Mac, including renting one (online) through a service (around $50 per month for a dedicated device) or hosting a virtual machine in the cloud (AWS currently offers this instance type, but it’s intended for developer use and just a bit on the expensive side right now).

• At least one Android test device – Microsoft recommends devices running Android 5.0 (Lollipop) or later but my recommendation for a smoother experience is to use no older than Android version 6.0 (Marshmallow). If you can swing it, I recommend getting your hands on more than one Android device so you don’t have to constantly re-configure and re-enroll the device into different modes.

• A Windows device or VM – you will be able to get away with most exercises in this book with a VM (either VM in the cloud or a hypervisor like Hyper-V). In fact, I strongly recommend using a VM because it’s faster to reset the environment after each exercise. There are just one or two exercises where a physical PC would be helpful; I’ll note that in the “Do it” steps.

Networking

For most exercises in this book, you don’t need to configure anything special for networking. A good internet connection (for your administration workstation and each of your test devices) is a great start. You won’t need any of your test devices to have SIM cards – simply connecting to your home or work Wi-Fi is good enough. My recommendation is to connect using a Wi-Fi access point that is connected directly to the...