Feature behaviors

How the NAC integration works

1. Register the NAC partner solution with Azure Active Directory (AAD) and grant delegated permissions to the Intune NAC API.
2. Configure the NAC partner solution with the appropriate settings including the Intune discovery URL.
3. Configure the NAC partner solution for certificate authentication.
4. User connects to corporate Wi-Fi access point or makes a VPN connection request.
5. NAC partner solution forwards the device information to Intune and asks Intune about the device enrollment and compliance state.
6. If the device is not compliant or not enrolled, the NAC partner solution instructs the user to enroll or fix the device compliance.
7. The device attempts to re verify its compliance and/or the enrollment state.
8. Once the device is enrolled and compliant, NAC partner solution gets the state from Intune.
9. Connection is successfully established which allows the device access to corporate resources.

Microsoft Intune Integration with Cisco ISE

Step 1: Configuring Microsoft Intune as an MDM server for ISE

1. Get the public certificate from the Intune/Azure Active Directory tenant and import it into ISE to support SSL handshake.
   1. Log on to the Intune Admin Console or Azure Admin console, whichever site has your tenant.
   2. Use the browser to get the certificate details. For, example, with Internet Explorer:
      1. Click on the lock symbol in the browser toolbar, then click View Certificates.

Step 2: Export the ISE system certificate and prepare it for Intune/Azure

1. In the ISE console, go to Administration > System > Certificates > System Certificates, select the Default self-signed server certificate, and click Export.
2. Select Export Certificate Only (default) and select a place to save it.
3. Choose Add an application my organization is developing
4. Run the following PowerShell script on the exported certificate file:

   $cer = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2 $cer.Import(“mycer.cer”) $bin = $cer.GetRawCertData() $base64Value = [System.Convert]::ToBase64String($bin) $bin = $cer.GetCertHash() $base64Thumbprint = [System.Convert]::ToBase64String($bin)   $keyid = [System.Guid]::NewGuid().ToString()

   Once script runs, it stores the value in variables. Type the variable name on PowerShell prompt and retrieve the values (please see the below demo screen) $base64Value $base64Thumbprint $keyidDemo:

1. Keep the values for $base64Thumbprint, $base64Value and $keyid, which will be used in the next step.

   Step 3: Create an ISE App in Intune/Azure Tenant

   1. Choose 'Add an application my organization is developing' from Azure Active Directory | Enterprise Application - All Applications | Categories | Add an Application

1. SIGN-ON URL. The URL where users can sign in and use your app. You can change this later as needed.
2. APP ID URI. The URI used as a unique logical identifier for your app. The URI must be in a verified custom domain for an external user to grant your app access to their data in Windows Azure AD. For example, if your Microsoft tenant is contoso.onmicrosoft.com, the APP ID URI could be https://app.contoso.onmicrosoft.com

 Step 4: Get the manifest file from Azure, add the ISE certificate information, and Upload the updated manifest    into Azure

1. Download the manifest file from Azure (for ISE App created in Step 3)
   1. Click on manifest
   2. click download to download the manifest file.

Step 5: Getting Values of endpoints attributes from Azure Portal

1. Navigate to App registrations > Endpoints

• MICROSOFT AZURE AD GRAPH API ENDPOINT
• OAUTH 2.0 TOKEN ENDPOINT
• APPLICATION ID or CLIENT ID

Step 6: Add Graph API and Intune API to application with permissions and delegations

• Read Directory data

• Read and write Microsoft Intune Device Configuration and Policies
• Read Microsoft Intune Configuration
• Sign users in
• Access users’s data anytime

• Get device state and compliance information from Microsoft Intune

• Read directory data

• Read directory data
• Sign in and read user profile

7.  In ISE, configure the Intune server in ISE

• Auto Discovery URL - Enter the value of Microsoft Azure AD Graph API Endpoint from the Microsoft Azure management portal. This the endpoint at which an application can access directory data in your Microsoft Azure AD directory using the Graph API. The URL is of the form: https://<hostname>/<tenant id>, for example, https://graph.ppe.windows.net/47f09275-5bc0-4807-8aae-f35cb0341329. An expanded version of this URL is also in the property file, which is of the form:

• Client ID - The unique identifier for your application. Use this if your application accesses data in another application, such as the Microsoft Azure AD Graph API, Microsoft Intune API, and so on.

• Token Issuing URL - Enter the value of the Oauth2.0 Authorization Endpoint from the previous step. This is the endpoint at which your app can obtain an access token using OAuth2.0. After your app is authenticated, Microsoft Azure AD issues your app (ISE) an access token, which allows your app to call the Graph API/ Intune API.

• Token Audience* - The recipient resource that the token is intended for, which is a public, well-known APP ID URL to the Microsoft Intune API.

SQL Server 2017 now runs on Linux. It’s the same SQL Server database engine, with many similar features and services regardless of your operating system.

Prerequisites

• You must have a SLES v12 SP2 machine with at least 3.25 GB of memory.
• The file system must be XFS or EXT4. Other file systems, such as BTRFS, are unsupported.
• Internet Connectivity on SUSE Linux machine

Supported client tools

SQL Server Management Studio (SSMS) for Windows

17.0

SQL Server Data Tools for Visual Studio

17.0

Visual Studio Code with the mssql extension

Latest

Environment

Domain Controller
 DNS

DC1

Windows Server 2016

Local
 10.0.0.1

SUSE Linux

SQL-Linux

SUSE Linux Enterprise Server (SLES) v12 SP3

Local (eth1)
 10.0.0.2
 
 Internet (eth0)
 DHCP

Microsoft SQL Management 
 Studio

Win-Node01

Windows Server 2016

Local
 10.0.0.3

Install SQL Server

1. Login to SUSE Linux

    sudo zypper addrepo -fc https://packages.microsoft.com/config/sles/12/mssql-server-2017.repo

    sudo zypper --gpg-auto-import-keys refresh

6. Verify if all repositories are up to date are refreshed

    sudo zypper install -y mssql-server

sudo /opt/mssql/bin/mssql-conf setup

     systemctl status mssql-server

Connecting to SLES SQL Server remotely and create database using client tool

1. Login on to the Windows machine 'Win-Node01' running SQL Management Studio. Open SQL Engagement Studio and enter below detailsServer Name: SQL-Linux.corp.contoso.comAuthentication: SQL Server AuthenticationLogin: SaPassword: <sa password given at the time of installing SQL>
2. Verify if SQL is connected successfully running on SUSE LINUX machine

CREATE DATABASE SUSE

GO

USE SUSE

Create Table Employee (ID INT, Name NVARCHAR(50), CITY NVARCHAR(10))

INSERT INTO Employee VALUES (1, 'Bill', 'New Jersey');

INSERT INTO Employee VALUES (2, 'Jack', 'New York');

Go

Select * from Employee

Go

Resources

• Based on telemetry data from user computers, Upgrade Readiness identifies application and driver compatibility issues that may block Windows upgrades, allowing you to make data-driven decisions about your organization’s upgrade readiness.
• Information is refreshed daily so you can monitor upgrade progress. Any changes your team makes, such as assigning application importance and marking applications as ready to upgrade, are reflected 24 hours after you make them.

Prerequisites

• In order to add the connection, your Configuration Manager environment must first configure a service connection point in an online mode. When you add the connection to your environment, it will also install the Microsoft Monitoring Agent on the machine running this site system role.
• Register Configuration Manager as a “Web Application and/or Web API” management tool, and get the client ID from this registration.
• Create a client key for the registered management tool in Azure Active Directory.
• In the Azure Management Portal, provide the registered web app with permission to access OMS, as described in Provide Configuration Manager with permissions to OMS.

Environment

Integrate Upgrade Readiness with Configuration manager

Create the connection

1. In the Configuration Manager console, choose Administration > Cloud Services > Upgrade Readiness Connector > Create Connection to Upgrade Analytics to start the Add Upgrade Analytics Connection Wizard.

3. On the Upgrade Readiness screen, provide your connection settings by filling in your Azure subscription, Azure resource group, and Operations Management Suite workspace.

3. Verify your connection settings on the Summary screen, then select Next. Note You must connect Upgrade Readiness to the top-tier site in your hierarchy. If you connect Upgrade Readiness to a standalone primary site and then add a central administration site to your environment, you must delete and recreate the OMS connection within the new hierarchy.

Complete Upgrade Readiness tasks

1. Add the UpgradeReadiness service to the OMS workspace.
2. Generate a commercial ID.
3. Subscribe to Upgrade Readiness.

Configure and deploy Upgrade Readiness deployment script.

1. Download Upgrade Readiness Deployment Script from below location:

2. Extract the files and modify 'RunConfig.bat' file

3. Save the file at the location accessible while creating package in Configuration manager

Create Config manager package/Program to deploy Script to client machines

1. Create upgrade readiness package and program to deploy script

2. Set the command line as 'RunConfig.bat'

3. Set the requirements for preferred platforms. Setting it to Windows 7 and Windows 8.1 64-bit

4. Update distribution point
5. Create Test collection and move client machines to new collection
6. 
7. Deploy 'UgradeReadinessScript' to 'Windows Upgrade Readiness' collection
8. 

4. Refresh Policies on Client machines
5. Once client get the policies from Management point, script will get installed
6. 

9. On Windows machine 7

10. Check log file for script successfully completion on CM1 Server

Upgrade Readiness view on Azure