Everyone that has worked with Microsoft Intune up until recently know that Device Grouping in Microsoft Intune basically has been useless as you had to manually move devices into groups after enrollment.

Luckily for me I have a very skilled colleague in Lumagate @NickolajA who has already written a nice blogpost about this, so I am not going to write this up my self.

You can find the post here:

https://www.scconfigmgr.com/2016/04/12/configure-device-group-mapping-in-microsoft-intune/

In the latest update release for Intune it is now possible to manage all settings for Windows Defender directly from the General Windows 10 Policy template. In this blogpost I will show how this new feature work. 

I have a Windows 10 Azure AD joined machine who is managed by Intune. Now we have to go into the Intune portal – Policy – Configuration Policies and create a new General Configuration (Windows 10 Desktop and Mobile and later) policy. Note that the policy settings on Windows Defender only applies to Desktops and not Windows 10 Mobile.

The settings for Defender is found far down on the policy selections under the category Endpoint Protection.

As you can see there is a lot of settings to consider and I will explain what each settings does. Each setting that you chose to configure is set on the client itself and the user will not be able to change the setting afterwards. This is how a policy should work of course.

Allow real-time monitoring:
This setting you will enable real-time scanning for malware, spyware, and other unwanted software.

Allow behavior monitoring
This setting will configure Defender to check for certain known patterns of suspicious activity on devices.

Enable Network Inspection System
This setting will enable the Network Inspection System in Defender. The Network Inspection System (NIS) helps to protect devices against network-based exploits by using the signatures of known vulnerabilities from the Microsoft Endpoint Protection Center to help detect and block malicious traffic.

Scan all downloads
This setting controls whether Defender scans all files downloaded from the Internet.

Allow script scanning
Lets Defender scan scripts that are used in Internet Explorer.

Monitor file and program activity
The setting configures Defender to monitor file and program activity on devices. Available options are: Monitor only incoming files, Monitor only outgoing files, Monitor all files. 

Days to track resolved malware
This setting configures Defender to continue to track resolved malware for the number of days you specify so that you can manually check previously affected devices. If you set the number of days to 0, malware remains in the Quarantine folder and is not automatically removed.If you set it to something else it will automatically remove it from Quarantine after the set number of days.

Allow client UI access
This setting controls whether the Windows Defender user interface is available for end users or not.When this setting is changed, it will take effect the next time the end user’s PC is restarted.

Schedule a daily quick scan
This setting lets you schedule a quick scan that occurs daily at the time you select.

Schedule a system scan
This setting lets you schedule a full or quick system scan that occurs regularly on the day and time you select

Limit CPU usage during a scan
Lets you limit the amount of CPU that scans are allowed to use (from 1 to 100)

Scan archive files
This settings allows Defender to scan archived files such as Zip or Cab files.

Scan email messages
This setting allows Defender to scan email messages as they arrive on the device.

Scan removable drives
This setting lets Defender scan removable drives like USB sticks.

Scan mapped network drives
This setting lets Defender scan files on mapped network drive.
If the files on the drive are read-only, Defender will be unable to remove any malware found in them.

Scan files opened from network shared folders
This setting lets Defender scan files on shared network drives (for instance, those accessed from a UNC path.)
If the files on the drive are read-only, Defender will be unable to remove any malware found in them.

Signature update interval
This setting specify the interval at which Defender will check for new signature files. I recommend you to specify this to update signatures at least twice a day.

Allow cloud protection
This setting allow or block the Microsoft Active Protection Service from receiving information about malware activity from devices you manage. This information is used to improve the service in the future.

Prompt users for samples submission
Controls whether files that might require further analysis by Microsoft to determine if they are malicious are automatically sent to Microsoft.

Files and folders to exclude when running a scan or using real-time protection
Add one or more files and folders like C:\Path or %ProgramFiles%\Path\filename.exe to the exclusions list. These files and folders will not be included in any real-time, or scheduled scans.

File extensions to exclude when running a scan or using real-time protection
Add one or more file extensions like jpg or txt to the exclusions list. Any files with these extensions will not be included in any real-time, or scheduled scans.

Processes to exclude when running a scan or using real-time protection
Add one or more processes of the type .exe, .com, or .scr to the exclusions list. These processes will not be included in any real-time, or scheduled scans.

That concludes the settings. I will now just close up this blogpost by showing how a few of this setting look on the computer after you have applied the policy.

First I will show how Defender looks in the Settings app after the policy is applied.

As you can see “Some settings are managed by your organization” and I have no option to changes these settings.

Now I will try to open the Defender UI which I have configured to not be available to the end user. The result is as expected.

And at last I will show you the File extensions to exclude when running a scan or using real-time protection policy. I have added an extension called “testfile” in my policy. And this is visible in the settings app aswell to the users.

Here you can see that the file extension “testfile” has been excluded and that I am not able to add or change any of these settings.

Take care and protect your Windows 10 PC’s with Intune.

Let’s assume you have bought a PC with Windows 10 Pro and are setting this PC for joining Azure AD as part of your Out Of the Box Experience prosess.

The first thing we do is to choose that this Windows 10 Pro PC is owned by our company.

The next step is to Join Azure AD. At the same time this device will be enrolled into Intune by setup done i Azure AD to manage all AAD Joined devices by Intune.

My setup requires Multi-Factor Authentication to join Azure AD.

After the machine is done with the setup and the user is logged I can see that my current edition of Windows is Windows 10 Pro. Now I did a little waiting (5-10 minutes) do allow all policies to be downloaded to the device.

Then I got this notification on the desktop of my computer. You’re about to be signed out. A new edition of Windows is available. Restart your device to complete the upgrade. I did not wait for the 2 hours and restarted my device.

During restart I can see that my device is Adding features which means that the upgrade is processing in the background.

After I log in again I get a new notification telling me that my upgrade has completed successfully. I click on the notification to see what has happened.

Now, as you can see, my device is running Enterprise Edition of Windows 10 and is activated. Just to finish this up I also took a look in the Intune Console to see if the policy has reported back ok.

Here I see that the Windows 10 Upgrade Edition policy is applied and that my computer now conforms with the policy.

Provisioning of new Windows 10 PCs straight out of the box has now become even more complete. I can easiliy upgrade to the correct edition of Windows, and I can also easiliy add the Company Portal App to the device (look at my blogpost about integrating Intune with the Windows Store for Business on how to do that).

And all this is achieved by just joining my device to Azure AD.

If you are wondering about what Windows 10 Enterprise can give you that is not in the Pro edition, take a look at this links:

https://www.microsoft.com/en-us/WindowsForBusiness/windows-for-enterprise

https://www.microsoft.com/en-us/WindowsForBusiness/Compare

Set up the integration:

The first we need to do is to go to the Windows Store for Business and integrate with Intune. This is done at the business store side. Go to https://businessstore.microsoft.com/  and log in with you admin work credentials. Go through the steps to enable the business store for your company. Then you go to Settings – Management tools and click on “Add a management tool” and search for Microsoft Intune.

After you have added Intune and made sure it’s status is activated you can go and search for your app.

I am adding the Company Portal app. Just make sure to select Offline on the license. This is because only offline licensed apps will be syncronized with Intune.

Now we can go into the Intune admin console and set up the integration. You open the admin console at https://manage.microsoft.com and go to Admin – Mobile Device Management – Windows and Store for Business.

Here you configure the sync with Business Store.

And just wait for the initial sync to finish. It should be pretty fast. Now the status on your page should look like this:

At this page you can later do a manual sync, the automatic sync will run twice a day.

Deployment of Store for Business Apps

Now we need to go to the Apps section of the console and go into Volume Purchased Apps. You should now see the apps you have selected for offline use in the Windows Store for Business.

To deploy the apps you will need to mark the app and click on manage deployment. You choose what user group (can not be deployed to device groups) you will deploy the app too. I am chosing All Users as I want all users to have the company portal app on their enrolled device. This app is both for mobile and pc version of Windows 10 so it should be pushed out to both Windows 10 PCs and Windows 10 Mobile devices.

As you now see you only have 3 deployment actions available. Either Not Applicable, Required install or Uninstall. If you chose Not Applicable nothing happens, the other 2 options are kind of obvious.

Thats it. Now you have deployed your first app directly from the business store. At the same page you will also see status of license usage and deployments.

What I truly find useful with this feature is that we now can make mandatory distrubutions of apps from the Windows Store and we can easily push out the Company Portal app to all enrolled windows devices.

So why is this interresting?

When you buy a new Windows 10 Computer like for example a Surface Pro 4 it comes with Windows 10 Pro. The normal way to handle this for a lot of companies is to redeploy a brand ned image with Windows 10 Enterprise Edition to this device and join it to their onpremise domain.

In the new cloud world you might to just want to enable your users to join their new device to Azure AD instead. If do a simple Out Of The Box enrollment into Azure AD with Auto-Enrollment into Intune your user is just up and running in no time. But, until now, they have been stuck on running Pro Edition even though your company has the Enterprise licens.

So now we have a simple solution to upgrade from the cloud all those devices.

How do do the Edition Upgrade?

In the Intune Console create a new configuration policy for Windows.

Here you choose the Edition Upgrade Policy (Windows 10 Desktop and later)

Type your description, name and edition. Type in your MAK Key for Windows 10 Enterprise Edition. Save and Deploy to your Windows 10 Devices.

It is as simple as this.

There is a issue on Azure AD Domain joined machines if you want to add AzureAD users to a local group. Lets say you want to enable a user to log on remote to a AzureAD joined machine or you want to add users to the local administrators group. The GUI doesn’t support this at all because you are not able to check for users in the cloud. 

The first thing we need to do is to make the user in question to actually first log on to a machine locally to get the SID onto the machine it self.This is required to make this work.

If you go into the UI you will see this:

There is no active local users on the machine as this machine was AAD Joined during OOBE

If you go to Groups and open the local administrators group you will see that the user that joined the machine to AAD is added as a local administrator.

If you try to add users from AAD to the local group you will quickly find that it is not possible at all. There is no way to browse AAD for users or to add users and as we dont have any local users at all you cannot add users to the Administrators group. But luckily there is a very easy way to fix this manually.

Open CMD as administrator and run the command:
net localgroup administrators  <DomainName>\<UserName> /add

If we now open the GUI again we can see that the users exists in the local Administrators group:

This can also be used to add users to other groups as Remote Desktop Users to enable remote connection to the PC.

To do this you will first need to add Azure AD Identity protection to your tenant. That is described in my previous blogpost on this topic here. 

When you go into the AAD ID Protection portal you click on settings and then you go to Multi-Factor Authentication -> Registration

Here you will see your registration status and are able to set a policy that requires users to register their credentials on login. The nice part about using this policy instead of the old setting in the old Azure AD Portal (manage.windowsazure.com) is that you can now define a group of users and not necessary all users at once.

As you can see I have 6 users in my test tenant not registered for MFA and I have enabled a policy to require the users to register for MFA at logon. I have for demo purposes added a single user and a group. The choice is yours. I have also allowed the users to skip the registration for 3 days before it is enforced at logon. And of course you will need to enable to policy and save.

In the old portal the only option is to enable this for all users and it also states that this is not currently supported for Office 365 sign ins.

I have tested this by logging in to portal.office.com and the user experience is as follows.

During Grace period of 3 days the user login will be like this:

If the users chooses to skip this setup they will be logged in as normal until the grace period is done. After the grace period the user will be forced to enter the information to be able to login.

Now the user must click on the “Set it up now” button to be able to log in. The user is than automaticly redirected to the page for entering their details.

And when the details are verfied the login proceeds as normal.

THIS DOES NOT CHANGE THE LOGIN TO MFA REQUIRED IN THE FUTURE

I have also tested this in Office (Word 2016) trying to add my account to Office and this also applies to Office as far as I can see in my test.

This picture is from trying to log in to word with my test user and I can not get in without registering my MFA information.

Look for more posts on this subject – but I will probably need to wait for EU support before I can dig into all the nice things in AAD Identity Protection.

Adding Azure AD Identity Protection to your Azure Portal

First you have to log in on https://portal.azure.com  with your azure admin account. And go into Azure Marketplace. If you browse to the Securiy and Identity you will not find it yet so we have to search for it.

You click on the + New “button” in the portal and type in Azure AD Identity Protection and do a search, the result should be like this:

Then you click on Azure AD Identity Protection from the result section

On this next slide coming up you just click on Create. This will add AAD Identity Protection you your portal. 

Now if you have several directories in your tenant you need to choose which directory you should enable this on. I have only one directory so I am not able to a any choice here besides pin to dashboard at the bottom of this slide.

Now the AAD Identity Protection is enabled on your directory and are showing you current status (default is Last 7 days but you can change the view to last 30 or 90 days if you want)

When you go click on settings it will open a new slide and give you the possible configurations available. The first option is on weather you should sent weekly notification emails to your admins or not. Pretty straight forward and you can exlude admins from the newsletter if you want.

The next option is around Multi-Factor authentication. This helps you control deployment of Multi-Factor in your organization. If you apply this policy you will require users in your organization to register for MFA. You can choose a number of days the users may skip setting up MFA information (ex. Authentication Phone Number) and you can choose for which users you include or exclude from this policy.

Now over to risk policy settings.

Security Policies

User Risk

A user risk level is an indication (High, Medium, or Low) of the likelihood that the user’s identity has been compromised. It is calculated based on the user risk events that are associated with an identity.

The policy allow you to define levels on where you want to enforce MFA on next login or blocking logins. Also here you can define a scope of users and you can review impact if you have current risks in your enviroment. 

Sign-In Risk

A sign-in risk security policy is a conditional access policy that evaluates the risk level to a specific sign-in and applies mitigations based on predefined conditions and rules.

You have the same kind of options here on scope and risk levels around when to do what.

More information around setup, user experiences and how to mitigate risk can be found here https://azure.microsoft.com/en-us/documentation/articles/active-directory-identityprotection/ I really recommend you to read this article before you configure polices and setup in your enviroment.

Managing risks

You will find detailed information regarding risks by going into the console and find the user at risk by clicking on the dasboard.

Then you can see what the risk is about and you can click on the 3 dots on the right to mark the alert as resolved, false positive or you can choose to ignore it.

It is recommended that you deploy risk policies so that compromized account can be automaticly mitigated by the policy. If the user is tagged as compromized the user will go into Compromised Account Recovery Flow with forced MFA and forced change of password.

This is just about my first look at Azure AD Identity Protection so again, I recommend you to read the documentation from Microsoft on this who can be found here: https://azure.microsoft.com/en-us/documentation/articles/active-directory-identityprotection

Adding Azure AD Identity Protection to your Azure Portal

First you have to log in on https://portal.azure.com  with your azure admin account. And go into Azure Marketplace. If you browse to the Securiy and Identity you will not find it yet so we have to search for it.

You click on the + New “button” in the portal and type in Azure AD Identity Protection and do a search, the result should be like this:

Then you click on Azure AD Identity Protection from the result section

On this next slide coming up you just click on Create. This will add AAD Identity Protection you your portal. 

Now if you have several directories in your tenant you need to choose which directory you should enable this on. I have only one directory so I am not able to a any choice here besides pin to dashboard at the bottom of this slide.

Now the AAD Identity Protection is enabled on your directory and are showing you current status (default is Last 7 days but you can change the view to last 30 or 90 days if you want)

When you go click on settings it will open a new slide and give you the possible configurations available. The first option is on weather you should sent weekly notification emails to your admins or not. Pretty straight forward and you can exlude admins from the newsletter if you want.

The next option is around Multi-Factor authentication. This helps you control deployment of Multi-Factor in your organization. If you apply this policy you will require users in your organization to register for MFA. You can choose a number of days the users may skip setting up MFA information (ex. Authentication Phone Number) and you can choose for which users you include or exclude from this policy.

Now over to risk policy settings.

Security Policies

User Risk

A user risk level is an indication (High, Medium, or Low) of the likelihood that the user’s identity has been compromised. It is calculated based on the user risk events that are associated with an identity.

The policy allow you to define levels on where you want to enforce MFA on next login or blocking logins. Also here you can define a scope of users and you can review impact if you have current risks in your enviroment. 

Sign-In Risk

A sign-in risk security policy is a conditional access policy that evaluates the risk level to a specific sign-in and applies mitigations based on predefined conditions and rules.

You have the same kind of options here on scope and risk levels around when to do what.

More information around setup, user experiences and how to mitigate risk can be found here https://azure.microsoft.com/en-us/documentation/articles/active-directory-identityprotection/ I really recommend you to read this article before you configure polices and setup in your enviroment.

Managing risks

You will find detailed information regarding risks by going into the console and find the user at risk by clicking on the dasboard.

Then you can see what the risk is about and you can click on the 3 dots on the right to mark the alert as resolved, false positive or you can choose to ignore it.

It is recommended that you deploy risk policies so that compromized account can be automaticly mitigated by the policy. If the user is tagged as compromized the user will go into Compromised Account Recovery Flow with forced MFA and forced change of password.

Update: The Preview is for now only supported on Directories where Country/Region is set to United States. 

But you can still active the portal and have some information available on your directories outside US. My tenant is not set to United States. 

This is just about my first look at Azure AD Identity Protection so again, I recommend you to read the documentation from Microsoft on this who can be found here: https://azure.microsoft.com/en-us/documentation/articles/active-directory-identityprotection