Block apps from running on fully managed Android devices

My customer is using Microsoft Intune to manage Android devices (Samsung A51) which have been enrolled as "fully managed" devices. We have a device configuration profile in place to manage the device restriction settings. The customer also wants to block consumer and system apps that are pre-installed by the OEM and gave us a list of apps.

First I looked at a restricted apps policy. This is used to allow or prevent specific apps on devices. It is supported on Android and Samsung Knox Standard devices but is only available for "device administrator" management.

https://docs.microsoft.com/en-us/mem/intune/configuration/device-restrictions-android#restricted-apps

Next I decided to look at uninstall packages for the apps. I created packages for some of the apps based on their URL in the Google Play Store. Then I assigned the packages as Uninstall to the Android device group. This worked well but unfortunately, not all the apps were available in the Play Store, so this was an incomplete solution.

I found the answer with Android Enterprise system apps.

https://docs.microsoft.com/en-us/mem/intune/apps/apps-ae-system

This allowed me to create the app packages using the Package Name, with no reference to the Play Store. Every Android app has a registered package name. You just have to be able to find it.

This search link will give you details on package names for all system apps pre-installed on many Samsung models. I found everything I needed and was able to create the uninstall packages.

• Navigate to the Endpoint Manager admin center to create the apps.
• Click Apps > All Apps > Add
• For the App Type, look at the bottom option and choose Android Enterprise system app.
  

• Click Select to commence the Add App wizard.

• This is where you enter the app details. Pay particular attention to the Package name. It must be entered correctly. The tooltip tells us to contact the device manufacturer to get the system apps package name of the format com.example.app. Click Next to continue.
• You only have two options on the Assignments page. To enable an app, assign the system app as Required. To disable an app, assign the system app as Uninstall. System apps cannot be assigned as available. Select the assignment groups and click Next.
• Review and create the app.

I was able to prevent the apps in the table below from running and satisfy the customer requirement.

App	Package Name
Netflix	com.netflix.mediaclient
Galaxy Store	com.sec.android.app.samsungapps
Verizon Call Filter	com.vzw.ecid
Verizon Cloud	com.vcast.mediamanager
Verizon Digital Secure (Safe)	com.securityandprivacy.android.verizon.vms
My Verizon	com.vzw.hss.myverizon
AR Zone	com.ARZone.arzone
Bixby Voice	com.samsung.android.bixby.agent
Bixby Voice Stub	com.samsung.android.bixby.agent.dummy
Bixby Home	com.samsung.android.app.spage
Bixby Service	com.samsung.android.bixby.service
Bixby Vision Framework	com.samsung.android.bixbyvision.framework
Game Launcher	com.yujimny.android.gamelauncher
Samsung Internet	com.sec.android.app.sbrowser

I hope this helps. Until next time....

Intune - improvements to Office 365 ProPlus deployment

Simplified Office 365 ProPlus deployment has been a very popular feature of Microsoft Intune for quite some time. In the last few weeks there have been two improvements that will be very useful.

1. Now we can edit Office 365 ProPlus app deployments if we want to make changes, remove an app or change the channel, for example. Previously we had to delete the deployment and add a new one which was a real pain.

Editing the Office 365 ProPlus deployment

2. We also have greater control as we can now choose the specific version of Office 365 ProPlus to install. We don't have to accept the latest version any more.

Choose App Suite Settings in the properties of the deployment. In the section "Version to install on end user devices" choose Specific.

You now must choose a version.

There are many to choose from and the choices will change as the list is continually updated. 

Why is this significant? In my opinion it's very important to be in control of the version of software that you deploy to your estate. You need time to test your line of business apps, add-ins and macros so perhaps you don't want to be deploying the latest version as soon as it is published.

To me these are two very useful features. Until next time......

Comanagement and migrating from ConfigMgr hybrid to standalone Intune

Comanagement has arrived. It was announced by Microsoft last week at Ignite so we can finally talk about it publicly. This is one of the most important features to be delivered by Microsoft in recent years and will eventually cause a shift in the way that enterprises manage their devices. It is inevitable.

So, what is comanagement?
Quite simply, it is the ability to manage Windows 10 devices with ConfigMgr and Intune AT THE SAME TIME.

Why is comanagement important?
The majority of organizations use Active Directory (with GPO) and ConfgMgr to manage their on premise devices. The Microsoft vision is to manage Windows 10 devices using modern management with Intune. It is expected that comanagement will create a bridge between the two to simplify and reduce the risk of transition to modern management. The expectation is that organizations will transition in a phased manner as they move workloads one at a time (e.g. device compliance).

Some additional jargon: 

Modern management: managing Windows 10 devices using Intune MDM and Configuration Service Providers (CSPs).

Intune Management Extensions: codename Sidecar, these will add to Intune's MDM capability. The first extensions expected will allow administrators to run PowerShell scripts on managed devices and also manage Win32 and .exe applications.

Microsoft 365 Powered devices: these are Windows 10 devices running Office 365 Proplus which are managed by Enterprise Mobility + Security. This is a complete integrated solution and is the future direction for Microsoft.

Windows 10 Autopilot: could replace traditional imaging methods. Users will be able to self-provision their devices simply by authenticating with Azure Active Directory. Intune policies will then be automatically deployed to the devices during provisioning.


Note that comanagement is only supported for organizations that use standalone Intune. Therefore, to avail of this feature, organizations that have a ConfigMgr hybrid must first migrate to standalone Intune. I was very curious to test how much was involved in this.

Migrating from ConfigMgr hybrid to standalone Intune

Step 1 - import ConfigMgr data to Intune.

The Data Importer Tool is an awesome tool that collects data about the objects in your ConfigMgr hierarchy (1610 or later). It then allows you to import your selected objects to Microsoft Intune.

• Configuration items
• Certificate profiles
• Email profiles
• VPN profiles
• Wi-Fi profiles
• Compliance policies
• Apps
• Deployments

Download the tool (Microsoft Intune Data Importer.exe, it's less than 5MB) and extract the files.

The first task is to give the Data Importer tool permission in Azure to access resources.

Execute "intunedataimporter.exe -GlobalConsent"

Enter your Global Admin credentials.

Accept the resources that the tool needs access to.

Now launch the tool (intunedataimporter.exe). Start the process.

Review the information that you should be aware of when using the tool.

Enter the ConfigMgr details.

The ConfigMgr objects data is collected.

There are some errors. It will not be possible to import some objects. You can choose to fix the issues or ignore these objects.

This is a summary of the objects to be imported.

Sign in to Intune.

The objects are imported into Intune.

Step 2 - prepare Intune for user migration

This includes-

• fixing issues discovered during the data collection and import
• verify the imported objects
• assigning Intune licenses to migrated users
• verifying Intune user groups
• configuring RBAC
• configuring Exchange Connectors (if required)

Step 3 - change MDM authority to Intune standalone

(Note: before you change the MDM authority for the tenant you should test the process for a subset of users. Follow this process to exclude users from the ConfigMgr collection for testing).

Navigate to Administration > Overview > Cloud Services > Microsoft Intune Subscription

Right click your subscription and select Delete.

Select to Change the MDM Authority to Microsoft Intune.

Accept the warning.

Sign in to Intune.

The subscription has been removed and the MDM Authority has been changed to Intune. Note that it can take up to eight hours for a device to connect to the service after you change to the new MDM authority.

I hope this information was helpful. Until next time.....

Microsoft Intune - enterprise enrollment CNAME best practice

I was asked this question recently and I didn't know the answer so I did some research.

What is the correct DNS CNAME record to configure for Enterprise Enrollment of mobile devices with Intune?

First, I should explain that this CNAME is only required if you are enrolling Windows devices. It is not required for iOS and Android.

There are three options:

1. Redirect enterpriseenrollment.yourdomain.com to manage.microsoft.com
2. Redirect enterpriseenrollment-s.yourdomain.com to manage.microsoft.com
3. Don't configure a CNAME at all

So this is the scoop on the three options:

1. This is a throwback to the early stages of this technology. It still works but is now deemed to be less secure and not recommended by Microsoft. You will still find this referenced on many online blog posts simply because they have not been updated.
2. This is now the recommended configuration. It uses a secure channel (hence the -s).
3. This will also work but means that the user has to enter "manage.microsoft.com" as the server name during the enrollment process. This would be #2 in terms of preference.

Edit Feb 1st 2017:

manage.microsoft.com is being deprecated on Feb 11th 2017 and will no longer work for enrolling Windows devices.

You should to create a CNAME in DNS that redirects EnterpriseEnrollment.yourdomain.com to EnterpriseEnrollment-s.manage.microsoft.com.

You can see this information in the official docs

I hope this clears up any confusion. Until next time.......

Microsoft are listening to feedback?? - my experience

My favourite part of the being in the MVP Program is being able to provide feedback directly to the product group. The cynical view is that they just don't listen so there is no point in providing feedback. However this is simply not the case. I have a little story I would like to share.

Last year I deployed an Intune Proof of Concept for one of my customers. We carried out intensive testing of the various elements, one of which was mobile application management. We created MAM policies to restrict the integration between managed and unmanaged apps. This worked very well and data could not be transferred between managed and unmanaged apps. Unfortunately, it worked a little too well. If I clicked on a telephone number in Outlook or the managed browser I was unable to launch the phone dialer app on the device (as it was unmanaged) and I couldn't make a phone call. This just didn't make sense to me.

I filed a DCR (bug) on Microsoft Connect (you will need a Microsoft Live to access this) to allow special access to specific unmanaged apps (eg. phone dialer).

https://connect.microsoft.com/ConfigurationManagervnext/Feedback/Details/1513816

"While using Intune Managed Applications it would be good if users could integrate with specific device components eg phone dialer. Users should be able to make a telephone call by selecting the number in the Managed App. They currently can't - I've tested it. The operation is not permitted".

The DCR was actioned and closed. I'm pleased to say that ALL MAM-aware Office apps and the Intune Managed Browsers (for both iOS and Android) have now been upgraded to incorporate this request. I've just successfully tested with Outlook and Managed Browser.

If a feature doesn't make sense to you or doesn't work the way you think it should then let Microsoft know. The products will only improve with user feedback.

For bugs use Microsoft Connect:

http://connect.microsoft.com/ 

For feature suggestions use UserVoice.

Improvements in app blacklisting with Intune

The August update of the Intune service has introduced major improvements in mobile app management. Previously you could create app blacklists but these policies would only block apps on Windows devices. They would not prevent the installation or use of apps on Android or iOS devices. For these devices you could only report non-compliance if a blacklisted app was installed.

So what are these improvements?

Android
We can now create custom policies to allow and block apps for Samsung KNOX enabled Android devices.

• Once an app is blocked, it cannot be activated or run on the device, even if it is already installed.
• Specifying which apps are allowed designates which apps can be installed from the Google Play store. When a list of allowed apps is defined, no other apps can be installed from the store.

iOS
On iOS 9.3 and later (supervised devices only) we can add a list of hidden and shown apps to the iOS general configuration policy.

• Apps that are specified as hidden can’t be viewed or launched by users.
• When you specify a list of apps to be shown, no other apps can be viewed or launched.

Let's have a look at the custom Android policy and then we'll see the behaviour on a device.

In the Microsoft Intune administration console, choose Policy > Configuration Policies > Add.

In the Create a New Policy dialog box, expand Android, choose Custom Configuration, and then choose Create Policy.

Provide a name and optional description for the policy and then, in the OMA-URI Settings section, choose Add.

We want to specify the allowed apps so that all other apps will be blocked.

Note: You can find the package ID of an app by browsing to the app on the Google Play store. The package ID is contained in the URL of the app's page.

For example, the package ID of the Microsoft Word app is com.microsoft.office.word as the URL is
https://play.google.com/store/apps/details?id=com.microsoft.office.word

The package ID of the Adobe Reader app is com.adobe.reader as the URL is
https://play.google.com/store/apps/details?id=com.adobe.reader

In the Add or Edit OMA-URI Setting dialog box, specify the following:

• Setting name - Enter AllowInstallPackages.
• Setting description - List of apps that users can install from Google Play.
• Data type - String.
• OMA-URI - ./Vendor/MSFT/PolicyManager/My/ApplicationManagement/AllowInstallPackages
• Value - List of the Package IDs you want to allow. Use ; : , as delimiter. (Example: packageID1,packageID2). In my case this is com.adobe.reader,com.microsoft.office.word

Click OK.

Save Policy.

In the Policy workspace, select the policy and click Manage Deployment.
In the Manage Deployment dialog box, select one or more groups to which you want to deploy the policy, then click Add > OK.

User experience

So what happens on the device. I'm using an Android device with Samsung Knox enabled (Samsung Galaxy S4 phone).
I've tried to install an app that isn't on the allowed list.

I can't install the app and get the notification that "Security policy prevents installation of this application".

Then I tried to install Adobe Reader which is on the allowed list.

No problem.

This is very straightforward to configure and works instantly.

It's worth mentioning the supported devices again.

• Samsung Knox enabled Android devices (must be Samsung Knox - I was unable to get this working on an Android without Samsung Knox) 
• Supervised iOS devices 9.3 and later (supervised mode can be enabled on iOS devices using the Apple Device Enrolment Program or the Apple Configurator Tool) 

I hope this was useful. Until next time.......

Great WMUG event yesterday

We had a great event yesterday at Microsoft's fancy new offices in Paddington. My Windows Management User Group colleagues and I delivered a day of sessions with a ConfigMgr and Cloud theme.

The agenda was as follows:

Here are some photographs from the event. Perhaps you'd like to join us next time.

@SCCMentor (Paul Winstanley) talking about High Availability and MP replicas.

Yours truly delivered a session on how to implement on-premise MDM.

@RobMVP discussed ConfigMgr servicing and didn't go off-topic once.......

@SamErskine talked about OMS but warned us in advance that he wouldn't try to impress us.

@MatthewWhite showed us cool management of Windows 10 in the cloud.

@phil2pint finished up the day with an excellent session on content delivery and management.

Check in on WMUG website for details of upcoming events.

Until next time......

"We speak Geek" webinar - Feb 10th

I'm pleased to have been asked by Secunia (Flexera Software) to deliver a webinar as part of the "We speak Geek" series.

Intune is the Microsoft Mobile Device Management platform. It is the only MDM solution that can integrate with System Center Configuration Manager. Administrators can manage their on premise and mobile devices using a single console. In this webinar I will be discussing my favourite features of the solution.

The webinar is on February 10th at 4pm and is titled "5 really cool features of Configuration Manager with Intune". I hope you will be able to attend.

You can register here

https://www.brighttalk.com/webcast/8113/186135?source=gerryhampson

Until then.....

Configuration Manager 1511 - what's new in MDM

System Center Configuration Manager landing page

Configuration Manager 1511 has introduced On-premises Mobile Device Management. We can now manage mobile devices using the on-premise Configuration Manager infrastructure only (with no management or data transfer to or from Intune). I'm working on that in my lab at the moment and will blog about it shortly.

1511 also introduced some new traditional MDM features to Configuration Manager (which were already available in standalone Intune).

Limit the number of devices a user can enrol

Navigate to the properties of the Intune subscription > General tab

Use the drop down arrow to choose the device cap (maximum 5).

Specify terms and conditions users of the Company Portal must accept before accept before they can enroll or use the app

Navigate to Assets and Compliance > Compliance Settings > Terms and Conditions

Now you can create your own custom Terms and Conditions for your organisation.

Device enrollment manager role

Now we can create Device Enrollment managers who can enrol more than the maximum 5 devices.

See the Device Enrollment Manager tab in the properties of the Intune subscription.

Until next time....

Externally publish an internal web app with Azure Application Proxy

EMS Landing page

The Azure Application Proxy allows you to externally publish your internal web apps seamlessly and in a very straightforward manner. You don't need to configure any complicated networking in advance. There are just a couple of steps involved in this process:

1. Prerequisites
2. Azure AD Application connector
3. Add and publish web app

1. Prerequisites

There are a few prerequisites so that you can implement the solution.

• You need to have an Azure Global Administrator account.
• You need Active Directory Premium licenses for the users that will consume the published app.
• The server on which the connector is to be installed requires Windows Server 2012 R2 or later.
• Turn off IE Enhanced Security on the server (installation of connector only).
• The ports in the screenshot below must be opened outbound from this server to msappproxy.net

A port tester can be used to verify the connectivity between the server and Azure.

Execute the tool from http://testport.cloudapp.net

Port test results.

2. Azure AD Application connector

Open your Azure directory and select Configure.

Scroll down to the Application Proxy section. Select "Download now".

Note the requirements and download the connector.

Install the connector as administrator on your local server.

Click Install.

The connector installs.

Log in to Azure when prompted.

The Azure Application Proxy has been installed.

Note the new services that have been installed.

• Microsoft AAD Application Proxy Connector
• Microsoft AAD Application Proxy Connector Updater

Now back in the Azure Portal select "Manage Connections".

Verify that the connector is active.

3. Add and publish web app

Now we must add the application to Azure and publish to users.

Navigate to the Azure applications.

Select to "Add an application".

In this case we should choose "Publish an application that will be accessible from the outside of your network".

Enter the app details. Enter a name and the internal URL of the app. Choose Azure AD as the pre-authentication method.

The app has now been added. Select "Assign accounts" to publish to users. Select the user group you require.

That's it. You have now externally published the app. It's so easy to do.

Now have a look at the properties of the app. You will see the external URL. This is based on the app name that you configured previously.

You can now access the app externally or through the MyApps Panel.

Configure Single Sign-on (optional)

You can now optionally configure SSO as follows:

• Configure the app to use Integrated Windows Authentication (IWA)
• Create a Service Principal Name  (SPN) for the app
• Enable the Application Proxy Connector to impersonate users in AD against your app (delegate control in properties of the server computer account)
• Configure the Azure app to use IWA
• Enter an internal application SPN in Azure (see below)

I hope this helps. Until next time....