Anoop C Nair is Microsoft MVP from 2015 onwards for consecutive 10 years! He is a Workplace Solution Architect with more than 22+ years of experience in Workplace technologies. He is Blogger, Speaker, and Local User Group Community leader. His main focus is on Device Management technologies like SCCM and Intune. He writes about technologies like Intune, SCCM, Windows, Cloud PC, Windows, Entra, Microsoft Security, Career etc...
My Experience of Microsoft MVP Community Connect 2017 India Most Valuable Professional. Last week, I attended Microsoft MVP Community Connect 2017 India in Coorg. Coorg is located on the southern side of India and is also known as “The Scotland of India.”
This is a global event in full swing. Previously, it was called “MVP Open Days.” Last year, it was conducted in Hyderabad. These events are an opportunity for MVP communities to gather together, learn new skills, and celebrate everything being an MVP has to offer.
It was a great experience for me to meet Microsoft leaders. Interacting with community leaders from Microsoft helped me understand the strategies. The best part of the event was getting the chance to interact with fellow MVPs.
Coorg is an excellent place to be around this time of the year. The climate was just superb; it was drizzling. We didn’t have proper mobile network connections, so it was disconnected from the world. But, we had a Wi-Fi connection available, so it was ok for an emergency. Moreover, the resort was very nice in the middle of the forest.
Table of Contents
Microsoft MVP Community Connect India 2017
In this video, you will learn all the details about the Microsoft MVP Community Connect India 2017 event. Attendees interacted with Microsoft leaders and fellow MVPs, gaining insights into cloud computing, Azure, and community building.
My Experience of Microsoft MVP Community Connect 2017 India Most Valuable Professional – Video 1
My Experience of Microsoft MVP Community Connect 2017 India Most Valuable Professional
Those interactions and networking will help me understand their point of view about the cloud, Azure, Openness, etc. I learned a lot from each of my fellow MVPs, like how they conduct community events, write blog posts, create video tutorials, etc.
My Experience of Microsoft MVP Community Connect 2017 India | Most Valuable Professional
Microsoft MVP Community Connect 2017 allowed me to learn new things.
1. Different Strokes – Virtual Communication Cues
2. Stories Are Us – Written Communication Cues
3. Improvise and Improve – Spoken (social) Communication Cues
We are on WhatsApp now. To get the latest step-by-step guides, news, and updates, Join our Channel. Click here. HTMD WhatsApp.
Author
Anoop C Nair is Microsoft MVP! He is a Device Management Admin with more than 20 years of experience (calculation done in 2021) in IT. He is a Blogger, Speaker, and Local User Group HTMD Community leader. His main focus is on Device Management technologies like SCCM 2012, Current Branch, and Intune. He writes about ConfigMgr, Windows 11, Windows 10, Azure AD, Microsoft Intune, Windows 365, AVD, etc.
Let’s discuss the Differences Between the Intune Enrollment Restriction and Device Restriction Profile. I was going through one of the TechNet documents and got confused between enrollment restriction policies and device restriction policies. I have posted about both of these policies.
In the post-Intune Create Device Restriction Policy Profiles Deploy Security Policies to Windows 10 Devices, you will learn everything you need to create device restriction policy profiles in Intune and deploy security policies to Windows 10 devices. We will guide you step-by-step through setting up these policies to ensure your devices are secure and comply with your organization’s requirements.
How to Restrict Personal Android Devices from Enrolling into Intune post helps you to provide detailed instructions on restricting personal Android devices from enrolling into Intune using Endpoint Manager (MEM). It covers the steps necessary to configure enrollment restrictions, ensuring that only corporate-owned devices can be enrolled and managed through Intune.
Device restrictions are entirely different from Enrollment restrictions. Both options have different use cases, which will be explained in this post. These two policies are used in modern device management solutions like Intune and Azure AD.
Intune Device restriction profiles (Enrollment Device Platform Restrictions) are policies similar to GPO from the traditional device management world. Most enterprise organizations use GPO to restrict corporate-owned devices.
These are security policies that need to be applied to devices. Intune Device restriction policies control various mobile device settings and features (iOS, Android, macOS, and Windows 10).
MDM – Allow or Block
Allow – min/max range
Personally owned devices – Allow or Block
Device Type Restriction in Intune
Enrollment device platform restrictions make more sense. Navigate to Devices – Enroll Devices – Enrollment Device Platform Restrictions.
Differences Between Intune Enrollment Restriction Device Restriction Profile – Fig.1
This type of policy could apply to different categories, including security, browser, hardware, and data-sharing settings. For example, you could create a device restriction profile policy that prevents Windows users from sharing the internet or using Cortana, etc.
Intune Device Restriction profiles can be deployed to specific users/devices in AAD groups, whereas Intune Enrolment restriction policies can’t be deployed to specific user/device groups in Azure AD. The following section of this post provides more details.
Intune Device Limit Restrictions
Enrollment is the first part of Mobile Device Management (MDM). Why do we need to enroll a mobile device into Intune? Enrollment is the first step for management. When a device is enrolled in Intune, they have issued an MDM certificate, which that device then uses to communicate with the Intune service.
In several scenarios, we need to block employees from enrolling their devices in the corporate management platform. You want to block devices not secured enough to enroll in Intune, such as personal devices.
Also, we could block devices with lower OS versions. How is this possible from Intune? Difference Between Intune Enrollment Restriction Device Restriction Profile | Configuration Manager ConfigMgr.
Navigate to Microsoft Intune—Enroll Devices—Enrollment device limit restrictions. You will see two Intune enrollment restriction policies.
Device Type restriction is where we can define which platforms, versions, and management types can enroll. So, all other devices are blocked from Intune enrollment.
The only problem with Intune enrollment restrictions I can think of is that device type restrictions in Intune are deployed to “All Users, ” we can’t deploy or assign Intune enrollment restriction policies to “specific user group.” At the moment, the device type restrictions policies are tenant-wide configurations.
Device Limit Restrictions in Intune
Navigate to Enroll Devices – Enrollment Device Limit Restrictions to configure the limitation.
Differences Between Intune Enrollment Restriction Device Restriction Profile – Fig.2
We are on WhatsApp now. To get the latest step-by-step guides, news, and updates, Join our Channel. Click here. HTMD WhatsApp.
Author
Anoop C Nair is Microsoft MVP! He is a Device Management Admin with more than 20 years of experience (calculation done in 2021) in IT. He is a Blogger, Speaker, and Local User Group HTMD Community leader. His main focus is on Device Management technologies like SCCM 2012, Current Branch, and Intune. He writes about ConfigMgr, Windows 11, Windows 10, Azure AD, Microsoft Intune, Windows 365, AVD, etc.
Let’s learn how to Setup Android Work Support Step by Step Guide Microsoft Intune. Google’s strategic approach is to support management only via the Android Work channel, and Microsoft Intune’s strategy is to help Android work. This post will show how to set up Android work support in Intune portal.
As you can see in the embedded video guide attached to this post, we will learn how to unbind or change the Gmail/Google account we used to set up Android work support in the Intune Azure portal. Once the existing Gmail account has been removed, we can use a different Gmail account to configure or set up Android Work support in the Intune Azure console.
How to Unbind Android Work Account from Intune Azure Portal
We must unbind the account from the Intune Azure console to change the Setup Android Work Google account. The Unbind button in Intune Azure removes support for Android Work enrollment and eliminates the relationship between the Android work account Gmail and Intune.
I have seen some delay in unbinding the Gmail account from the Intune blade in the Azure portal. As you can see in the video here, I removed the Gmail account from the Android work setting in the Intune blade in the Azure portal, but it took 2 minutes for these changes to reflect. However, the removal of Android Work was immediately reflected on the Intune Silverlight portal.
How to Setup Android Work Support Step by Step Guide Microsoft Intune – Fig.1
Setup Android Work Support in Intune Azure Portal
The configuration or setup of Android Work support in the Intune Azure portal is very similar to that in the Silverlight portal. You need to click the Configure button to open a pop-up where you can log in with a new Gmail or Android Work account. The Google configuration wizard will help you set up the connection between Intune and Google APIs like Google Play for Work, Android Work management, etc.
Microsoft Intune
Enrollment
Android for Work Enrollment
How to Setup Android Work Support Step by Step Guide Microsoft Intune – Table 1
How to Setup Android Work Support Step by Step Guide Microsoft Intune – Fig.2
Setting up Android Work Enrollment & Management via Intune
Android for Work enrollment settings are the same as those in the Intune Silverlight console. In the Intune Azure portal, we have three options for setting up Android work enrollment.
1.Manage all devices as Android – This is opposite to Google’s strategic approach regarding managing the Android devices 2. Manage supported devices as Android for Work—As per my testing, all Android 6.0 and above devices are supported for Android work enrollment and management via Intune. I have a blog post that explains A4W supportability, “Intune Entry Level Low-Cost Device Support for Android for Work Enrollment.” Hence, this is my best bet option for enrollment. 3. Manage supported devices for users only in these groups, such as Android Work. This could be used in the testing or pilot process if your organization doesn’t have a test Intune environment.
How to Setup Android Work Support Step by Step Guide Microsoft Intune – Fig.3
We are on WhatsApp now. To get the latest step-by-step guides, news, and updates, Join our Channel. Click here. HTMD WhatsApp.
Author
Anoop C Nair is Microsoft MVP! He is a Device Management Admin with more than 20 years of experience (calculation done in 2021) in IT. He is a Blogger, Speaker, and Local User Group HTMD Community leader. His main focus is on Device Management technologies like SCCM 2012, Current Branch, and Intune. He writes about ConfigMgr, Windows 11, Windows 10, Azure AD, Microsoft Intune, Windows 365, AVD, etc.
Discuss the SCCM ConfigMgr CB Download Upgrade Step by Step Guide Configuration Manager Intune. This Saturday, the Microsoft SCCM team released the latest technical preview.
This is not the production version of the SCCM ConfigMgr CB version. You should not install this version of SCCM in a production environment. Technical preview versions of SCCM CB will get released every month.
I recommend that SCCM admins install the TP version of SCCM CB in their lab environment so that they can keep up with the new features that are enabled in every TP release.
Step by Step How to SCCM ConfigMgr CB TP 1705 Download and Upgrade Video Guide
In the video titled “Step by Step How to SCCM ConfigMgr CB TP 1705 Download and Upgrade Video Guide,” you will find a detailed tutorial on downloading and upgrading to the (SCCM) Current Branch Technical Preview 1705. The guide walks you through the entire upgrade process, ensuring a smooth transition from previous versions.
SCCM ConfigMgr CB Download Upgrade Step by Step Guide Configuration Manager Intune – Video 1
SCCM CB TP 1705 comes with loads of new features, and I will discuss some of them in detail in upcoming blog posts. In this post, we will discuss how I completedthe download and installation of SCCM ConfigMgr CB TP 1705.
You can refer to the video hereor the embedded at the start of this post. In this post, the download and upgrade of the SCCM ConfigMgr CB TP versionhave been segregated into SIX parts. As you can see in the picture below, you may need to start the download (Available to Download).
SCCM ConfigMgr CB TP 1705 – Download of the content
SCCM ConfigMgr CB TP 1705 – Available to Install
SCCM ConfigMgr CB TP 1705 – Pre-Requisite checks
SCCM ConfigMgr CB TP 1705 – Installation Process
SCCM ConfigMgr CB TP 1705 – Post Installation Steps
SCCM ConfigMgr CB TP 1705 – Console Upgrades
SCCM ConfigMgr CB TP 1705 – Download of the Content
Download SCCM CB 1705 content from the Microsoft content server. You can check the content download status from the log file called DMPDownloader.log. Also, the content status can be analyzed via Ethernet connection via Task Manager – Performance.
In addition to these, you can check the cab file size from the folder “EasySetupPayload.” The SCCM CB installation video guide explains all of this.
The following are the high-level steps of SCCM ConfigMgr CB in the console download process. The screenshot below shows the SCCM pack install update. It is in the state of Ready to install.
Once the content download of SCCM ConfigMgr has been completed, we can start the installation process of SCCM CB TP 1705. Right-click on the update and tap on “Install update pack.” This action will initiate an upgrade wizard. You can select some important options as part of this upgrade wizard. Monitor this process via CMUpdate.log and the SCCM CB console.
SCCM ConfigMgr CB TP 1705 – Prerequisite Checks
Before the start of the installation, the upgrade process will carry out prerequisite checks, such as checking the disk space available on the server. It will also include loads of other checks to ensure the upgrade process goes through without any issues.
Once the necessary pre-checks have been completed, the actual upgrade process will start. CMUpdate.log is your friend in this SCCM ConfigMgr CB TP 1705 upgrade process. Upgrading the ConfigMgr Database is the most important and time-consuming step in this SCCM CB installation process. Installing files is another process that may take a long time to finish, as you see in the video embedded in this video post.
SCCM ConfigMgr CB TP 1705 – Post Installation Steps
The post-installation steps of SCCM CB 1705 are critical; this is where the SCCM Executive service will be installed. SQL-based replication services, SMS hierarchy manager, etc., were installed during this step. SiteComp.log is your best friend in this step to monitor the progress of that installation.SCCM ConfigMgr CB TP 1705 – Console Upgrades.
The SCCM CB TP 1705 console upgrade is the last step of the in-console upgrade process. This is explained in the SCCM video tutorial embedded in this post. The SCCM CB TP 1705 console version is “5.00.8525.100,” and the site Server version is “5.00.8525.100.“
We are on WhatsApp now. To get the latest step-by-step guides, news, and updates, Join our Channel. Click here. HTMD WhatsApp.
Author
Anoop C Nair is Microsoft MVP! He is a Device Management Admin with more than 20 years of experience (calculation done in 2021) in IT. He is a Blogger, Speaker, and Local User Group HTMD Community leader. His main focus is on Device Management technologies like SCCM 2012, Current Branch, and Intune. He writes about ConfigMgr, Windows 11, Windows 10, Azure AD, Microsoft Intune, Windows 365, AVD, etc.
Let’s discuss how to Create SCEP Certificate Profiles in Intune and Deploy them to Windows 10 Devices. In this post, we will create and deploy an SCEP Certificate to Windows 10 Devices (How to Deploy an SCEP Certificate to Windows Devices).
NDES setup for SCEP – The NDES connector should be installed on your data center, and the NDES connector should be able to talk to the CA serverand use the Azure AD App proxy connector if you are using the Azure app proxy.
I won’t cover the setup of NDEs and the Azure AD App proxy connector. Those two configurations are very complex and well explained in other blogs.
Intune SCEP Certificate Deployment for Windows 10 Devices – SCEP Certificates to Users Devices
Before creating a Windows 10 SCEP Certificate in Intune, you need to create and deploy a certificate chain. The certificate chain includes the Root CA certificate and the Intermediate /Issuing CA certificate. Intune offers three certificate profiles: TRUSTED Certificate, SCEP Certificate, and PKCS Certificate. We are not going to use the PKCS certificate for SCEP profile deployment.
Create SCEP Certificate Profiles in Intune Deploy SCEP Profiles to Windows 10 Devices – Video 1
Create SCEP Certificate Profiles in Intune Deploy SCEP Profiles to Windows 10 Devices
Deploying SCEP Certificates to Windows 10 Devices will help connect corporate resources like Wi-Fi and VPN profiles. Before making a Windows 10 SCEP Certificate in Intune, you must create and deploy a certificate chain. The certificate chain includes the Root CA and Intermediate /Issuing CA certificates.
Intune offers 3 certificate profiles: TRUSTED Certificate, SCEP Certificate, and PKCS Certificate. We will not use the PKCS certificate for SCEP profile deployment.
Create SCEP Certificate Profiles in Intune Deploy SCEP Profiles to Windows 10 Devices – Fig.1
Intune Create SCEP Certificate Profiles in Endpoint Manager Deploy SCEP profiles to Windows 10 Devices. Following are the high-level tasks for deploying the SCEP Certificate to Windows10 Devices via Intune:-
Create and Deploy iOS Root CA certificate using Intune Azure Portal Create and Deploy iOS Intermediate/Issuing CA Certificate using Intune Azure Portal Create and Deploy SCEP Certificate to iOS Devices using Intune Azure Portal.
Create and Deploy Windows 10 Root CA, Windows 10 Intermediate/Issuing CA Certificate Profiles
As the first step, we need to create a Root CA cert profile. To create a Root CA cert, navigate through Microsoft Intune—Device Configuration—Profiles—Create a profile. Select the platform as Windows 10 and the profile type as Trusted Certificate. You must then browse and upload your ROOT CA cert (the Name of the cert = ACN-Enterprise-Root-CA.CER)from your CA server.
We need to select a destination store in the Windows 10 Trusted certificate profile. For the root certificate profile, we must select Computer Certificate store—root. Once the settings are saved, you must deploy the root certificate profile to the required Windows 10 devices.
Platform
Profile type
Windows 8.1 and later
Trusted Certificate
Create SCEP Certificate Profiles in Intune Deploy SCEP Profiles to Windows 10 Devices – Table 1
Create SCEP Certificate Profiles in Intune Deploy SCEP Profiles to Windows 10 Devices – Fig.2
We must follow the same process for deploying the Intermediate/Issuing CA certificate profile via Intune. Make sure that you upload the issuing CA cert (Name of cert = ACN-Issuing-CA-PR1.CER) from your CA server.
Another point we need to take care of is the destination store. We need to select the destination store as Computer Certificate Store—Intermediate. Click OK—Create to finish creating the Issuing cert profile.
Deploy Windows 10 Root CA and Intermediate/IssuingCA Certificate Profiles to the same group of Windows 10 devices. We can deploy these profiles using either an AAD user or device group. However, I would prefer to use AAD dynamic device groups wherever possible.
Create and Deploy Windows 10 SCEP Profile via Intune – Intune Create SCEP Certificate Profiles
To create and deploy a SCEP profile on Windows 10 devices, navigate to Microsoft Intune—Device Configuration—Profiles—”Create a profile.” Select the platform as Windows 10 and the profile type as SCEP Certificate.
When you create a SCEP profile for a Windows 10 device, you need to make some specific settings. The load of these configurations can differ between the CA server setup and another on-prem component setup.
Create SCEP Certificate Profiles in Intune Deploy SCEP Profiles to Windows 10 Devices – Fig.3
The certificate validity period is 1 year, which is the industry standard. There are four options for the Key storage provider (KSP): Enrol to trusted platform Module(TPM) KSP if present Software KSP, Enrol to Trusted platform module(TPM), otherwise fail, Enrol to passport, otherwise fail, and Enrol to Software KSP.
In this scenario, I have selected Enrol to Trusted Platform Module(TPM) KSP if the Software KSP is present. We must choose the subject name format value depending on your organizational requirement. In this scenario, I selected a familiar name as an email. The subject alternative name is UPN. Key usage is a digital signature and key encipherment. The key Size value is 2048. If your CA supports the same, the hash algorithm value (SHA-2) should be the latest one.
Another critical point is linking the SCEP profile with the ROOT cert profile you created. If you have not created any ROOT cert and intermediate/issuing CA cert profiles in Intune, it won’t allow you to create an SCEP profile. Extended key usage is another setting, and it should automatically get populated. One example here is “Client Authentication—1.3.6.1.5.5.7.4.3.”
Create SCEP Certificate Profiles in Intune Deploy SCEP Profiles to Windows 10 Devices – Fig.4
Enrollment Settings is the last set of settings for Windows 10 SCEP profiles in Intune. I recommend keeping the certificate renewal threshold at the default value of 20%. SCEP server URLs (e.g., https://acnndes-sccz.msappproxy.net/certsrv/mscep/mscep.dll) are very important. These are the URLs to which Windows 10 devices will go and request SCEP certs.
This should be reachable from the Internet. As I mentioned above, you can use Azure AD app proxy URLs. In this scenario, I will use Azure AD app proxy settings.
SCEP profile cert will be deployed to users’ stores in the format “ACN-Issuing-CA-PR5“.
End-User Windows 10 Certificate Store Experience – Intune Create SCEP Certificate Profiles
SCEP profile will be deployed to Current User\Personal\Certificates = “ACN-Issuing-CA-PR5“
Root and Intermediate CA cert will be deployed to Local Computer\Intermediate Certification Authorities\Certificates = ACN-Enterprise-Root-CA.CER and ACN-Issuing-CA-PR1.CER
Create SCEP Certificate Profiles in Intune Deploy SCEP Profiles to Windows 10 Devices – Fig.5
We are on WhatsApp now. To get the latest step-by-step guides, news, and updates, Join our Channel. Click here. HTMD WhatsApp.
Author
Anoop C Nair is Microsoft MVP! He is a Device Management Admin with more than 20 years of experience (calculation done in 2021) in IT. He is a Blogger, Speaker, and Local User Group HTMD Community leader. His main focus is on Device Management technologies like SCCM 2012, Current Branch, and Intune. He writes about ConfigMgr, Windows 11, Windows 10, Azure AD, Microsoft Intune, Windows 365, AVD, etc.
Let’s discuss creating SCEP Certificate Profiles and Deploying them to iOS Devices using Intune. Before obtaining an SCEP certificate in Intune, we must consider some prerequisites.
It would be best if you also had on-prem infrastructure components available. NDES connector is supposed to be installed on your Data Center, and the NDES connector should be able to talk to the CA server and Azure AD App proxy connector if you are using the Azure app proxy.
In “Intune SCEP HTTP Errors Troubleshooting Made Easy With Joy – #5,” Joymalya Basu Roy provides a comprehensive guide on diagnosing and resolving HTTP errors encountered during SCEP (Simple Certificate Enrollment Protocol) certificate deployments using Microsoft Intune. The post focuses on various HTTP errors, particularly the HTTP 500 Internal Server Error, and offers detailed steps to effectively identify and troubleshoot these issues.
I won’t cover the setup of NDEs and Azure AD App proxyconnectors. Those two configurations are complex and well explained in loads of other blogs. This post will cover how to create and deploy a SCEP Profile for iOS Devices via Intune Blade in the Azure portal.
How to Create and Deploy SCEP Certificate with Intune for iOS Devices
Deployment of SCEP Certificates to iOS devices will help them connect to corporate Wi-Fi and VPN profiles, etc.… You must create and deploy the certificate chain before creating an iOS SCEP Certificate in Intune.
The certificate chain includes the Root CA and Intermediate/Issuing CA certificates. There are 3 certificate profiles available in Intune: the TRUSTED Certificate, the SCEP Certificate, and the PKCS certificate. We are not going to use the PKCS certificate for SCEP profile deployment.
Create SCEP Certificate Profiles Deploy SCEP Profiles to iOS Devices using Intune – Video 1
Introduction – Create SCEP Certificate Profiles Deploy SCEP Profiles to iOS Devices using Intune
Deploying a SCEP Certificate to iOS devices will help them connect to corporate Wi-Fi, VPN profiles, etc. Before creating an iOS SCEP Certificate in Intune, you need to develop and deploy a certificate chain. The certificate chain includes the Root CA and Intermediate/Issuing CA certificates.
There are 3 certificate profiles available in Intune: TRUSTED Certificate, SCEP Certificate, and PKCS certificate. We are not going to use the PKCS certificate for SCEP profile deployment. The following is the high-level task list for deploying SCEP Profile to iOS Devices (Deploy SCEP profiles to iOS Devices).
Create SCEP Certificate Profiles Deploy SCEP Profiles to iOS Devices using Intune
Create and Deploy iOS Root CA certificate using Intune Azure Portal
Or Create and Deploy an iOS Intermediate CA certificate using Intune Azure Portal
Create and Deploy SCEP Certificate to iOS Devices using Intune Azure Portal
Create SCEP Certificate Profiles Deploy SCEP Profiles to iOS Devices using Intune – Table 1
Create SCEP Certificate Profiles Deploy SCEP Profiles to iOS Devices using Intune – Fig.1
Create and Deploy iOS Root CA, iOS Intermediate/Issuing CA Certificate Profiles
As the first step, we need to create a Root CA cert profile. To create a Root CA cert, navigate through Microsoft Intune—Device Configuration—Profiles—Create a profile (Deploy SCEP profiles to iOS Devices). Select the platform iOS and profile type Trusted Certificate. You must browse and upload your ROOT CA cert (Name of the cert = ACN-Enterprise-Root-CA.CER) from your CA server.
Once settings are saved, you must deploy the root cert profile to the required iOS devices. The exact process must follow for Intermediate/Issuing CA certificate profile deployment via Intune. Intune Create SCEP Certificate Profiles Deploy SCEP profiles to iOS Devices using Intune.
Make sure that you are uploading the issuing CA cert (Name of cert = ACN-Issuing-CA-PR1.CER) from your CA server. The video above explains all these configurations; you can watch them here.
Create and Deploy iOS SCEP Certificate Profile for iOS Devices
To create a SCEP certificate profile, navigate to Microsoft Intune – Device Configuration – Profiles – Create a profile. While making an iOS SCEP Certificate, we must select the Profile type as “SCEP certificate” and the platform as iOS.
The next step is configuring the settings. These settings are critical, and we need to consult with your CA team when you create a SCEP Certificate. Loads of these configurations can differ between the CA server setup and another on-prem component setup (Deploy SCEP profiles to iOS Devices).
The certificate validity period is 1 year, which is the industry standard. The subject name format also depends on your organization’s preference. In this scenario, I selected a familiar name as email and a subject alternative name as UPN. The key usage is a digital signature and critical decipherment. The key Size is 2048.
Another critical point is linking the SCEP Certificate with the ROOT cert profile you created. If you have not earned any ROOT certification in Intune, you won’t be able to develop an SCEP Certificate. Extended key usage is another setting, and it should automatically get populated.
One example here is Client Authentication – 1.3.6.1.5.5.7.4.3. Intune Create SCEP Certificate Profiles Deploy SCEP profiles to iOS Devices using Intune.
Create SCEP Certificate Profiles Deploy SCEP Profiles to iOS Devices using Intune – Fig.2
Enrollment Settings is the last set of settings for iOS SCEP profiles in Intune. I recommend keeping the renewal threshold of certificates as the default value of 20%. SCEP server URLs are critical. These are the URLs to which iOS devices will request SCEP certifications.
So, this should be reachable from the Internet. As mentioned above, you can use Azure AD App proxy URLs here (e.g., https://acnndes-sccz.msappproxy.net/certsrv/mscep/mscep.dll ). In this scenario, I will use Azure AD App proxy settings. All these configuration details are explained in the video here.
SCEP certificate will be in the following format: “ACN-Issuing-CA-PR5“.
We are on WhatsApp now. To get the latest step-by-step guides, news, and updates, Join our Channel. Click here. HTMD WhatsApp.
Author
Anoop C Nair is Microsoft MVP! He is a Device Management Admin with more than 20 years of experience (calculation done in 2021) in IT. He is a Blogger, Speaker, and Local User Group HTMD Community leader. His primary focus is Device Management technologies like SCCM 2012, Current Branch, and Intune. He writes about ConfigMgr, Windows 11, Windows 10, Azure AD, Microsoft Intune, Windows 365, AVD, etc.
Let’s learn how to Create and Deploy Security Policies for Android Devices using Intune. Android for Work Device Restriction Policies Deployment is the Security Policy for Android Devices. Security policies are important to secure the corporate data and applications on those devices.
In this post, we will explain how to create and deploy security policies for Android devices using the Intune blade in the Azure portal. These security policies help protect your devices and data.
Additionally, we will cover Intune compliance policies, which are crucial for ensuring your Android devices meet your organization’s security standards. Follow along to learn the steps for setting up both types of policies to enhance the security of your Android devices.
Learn How to Create and Deploy Security Policies for Android Devices using Intune
You can create the Intune device restriction policy for Android for Work from Microsoft Intune – Device Configuration profiles – Create New Profile. I selected Android for Work as the platform, and the platform selection is very important.
Also, it would help if you had to select the profile type while creating an Intune Configuration Restriction policy. In my scenario, it’s the Device restriction policy, which is named the Android Restriction policy,as seen in the video.
Platform
Profile Type
Android for Work
Device Restrictions
Learn How to Create and Deploy Security Policies for Android Devices using Intune – Table 1
Learn How to Create and Deploy Security Policies for Android Devices using Intune – Fig.1
There are two categories for configuring device restriction settings for Android: Work profile settings and Device password. Again, I won’t suggest setting up a device password policy as part of the configuration policy when you have a compliance policy setting for the Device password.
Data sharing between work and personal profile settings specify whether work profiles can share data with apps in the personal profile. Microsoft Intune recommended that the value of this setting is to prevent any sharing across boundaries.
We can block the Work profile notifications while the device is locked. Default app permission is another Android for the Work security setting. I don’t recommend configuring the password settings as part of Intune configuration policies. Password settings should be part of compliance policies for Android for Work devices.
Learn How to Create and Deploy Security Policies for Android Devices using Intune – Fig.2
Deploy Security Policy for Android Devices
Deploying the Android for Work device restriction policy is straightforward. However, it’s essential to consider some of the points before deploying the security policy for Android devices. After setting up the policy, click on the assignment and select the AAD User/Device group.
Click on the Save button, ton and you are done. The best-recommended way is to assign policies to the Azure AD dynamic device group for Android devices. However, the AAD device groups are still in preview; we may be better off using user group deploy device restriction policies for Android devices.
One thing to remember is that you can’t apply Android device platform policies to Android for Work devices. You should instead use Android for Work device platform policies for A4W. The EXCLUDE option is another helpful option while deploying device restriction policies in Intune.
This is useful when excluding devices or users from these security policies.
Learn How to Create and Deploy Security Policies for Android Devices using Intune – Fig.3
User Experience of Security Policy for Android Devices
The user experience of Android for Work devices can vary depending on the manufacturer of the devices. As mentioned in the previous post, Samsung and Nexus are the best-experienced devices I have tested.
But I would admit the user experience of Android for Work is far better than that of an Android device! As Android devices have different variants, it’s better to ensure that all the security policies for the Android device experience are excellent for all manufacturers.
Learn How to Create and Deploy Security Policies for Android Devices using Intune – Video 1
We are on WhatsApp now. To get the latest step-by-step guides, news, and updates, Join our Channel. Click here. HTMD WhatsApp.
Author
Anoop C Nair is Microsoft MVP! He is a Device Management Admin with more than 20 years of experience (calculation done in 2021) in IT. He is a Blogger, Speaker, and Local User Group HTMD Community leader. His primary focus is Device Management technologies like SCCM 2012, Current Branch, and Intune. He writes about ConfigMgr, Windows 11, Windows 10, Azure AD, Microsoft Intune, Windows 365, AVD, etc.
Let’s discuss the Intune Create Device Restriction Policy Profiles Deploy Security Policies to Windows 10 Devices. Intune configuration restriction policies are critical in modern device management strategy. Intune device restriction policy is the security settings applied on your Windows 10 CYOD device.
As part of your organization’s security policies, you may need to lock down mobile or Windows devices with corporate data and app access. Yes, Intune configuration restriction policies help you lock down Windows devices as per your organization’s security requirements.
In this post, you will learn everything you need to createdevice restriction policy profiles in Intune and deploy security policies to Windows 10 devices. We will guide you step-by-step through setting up these policies to ensure your devices are secure and comply with your organization’s requirements.
Whether you’re new to Intune or looking to enhance your device management skills, this guide will provide clear and straightforward instructions to help you effectively manage and protect your Windows 10 devices.
Intune Configuration Restriction Policy Deployment with Windows 10
In this video, you’ll learn all about deploying Intune Configuration Restriction Policies on Windows 10. We’ll show you each process step, making it easy to follow. Whether setting up new policies or adjusting existing ones, this video will help you understand how to use Intune to keep your Windows 10 devices secure and well-managed.
Intune Create Device Restriction Policy Profiles Deploy Security Policies to Windows 10 Devices – Video 1
Create Intune Device Restriction Policy for Windows 10 Devices
You can create an Intune device restriction policy for Windows 10 from Microsoft Intune—Device Configuration—Profiles—Create New Profile. I selected Windows 10 as the platform, and platform Selection is essential.
Also, it would be best to select the profile type while creating an Intune Configuration Restriction policy. In my scenario, the Device restriction policy is named “Windows 10 CYOD Restrictions.”
Platform
Profile Type
Windows 10 and Later
Device Restrictions
Intune Create Device Restriction Policy Profiles Deploy Security Policies to Windows 10 Devices – Table 1
Intune Create Device Restriction Policy Profiles Deploy Security Policies to Windows 10 Devices – Fig.1
As shown below, the Windows platform Intune device restriction policy for out-of-box settings is segregated into 16 sections. This list is comprehensive, and we can lock down Windows 10 machines as required.
Is this Intune device restriction policy a replacement for group policies? No, it’s still not a replacement for AD group policies.
General
Password
Personalization
Locked screen experience
App Store
Edge Browser
Search
Cloud and Storage
Cellular and Connectivity
Control Panel and Settings
Defender
Defender Exclusions
Network Proxy
Windows Spotlight
Display
Start
Deploy Windows 10 Intune Device Restriction Policy
You can deploy the Windows 10 Intune Device Restriction Policy to either Windows 10 CYOD dynamic devices or Windows 10 user groups. Dynamic device groups are still in preview, and the group typos are not always stable. So, at least for the next two months, I will prefer to deploy policies to user groups rather than dynamic device groups.
Windows 10 End-user Experience of Intune Device Restriction Policy
As you can see in the video tutorial at the top of this post, I’ve enabled the time settings to disable the option as part of the initial Windows 10 device restriction policy. The end-user logged in to the Windows 10 machine can’t change the time on the system.
After that, I changed the Windows time setting policy again, and after applying the new policy, the user can change the time on the Windows 10 system.
Intune Create Device Restriction Policy Profiles Deploy Security Policies to Windows 10 Devices – Fig.2
We are on WhatsApp now. To get the latest step-by-step guides, news, and updates, Join our Channel. Click here. HTMD WhatsApp.
Author
Anoop C Nair is Microsoft MVP! He is a Device Management Admin with more than 20 years of experience (calculation done in 2021) in IT. He is a Blogger, Speaker, and Local User Group HTMD Community leader. His main focus is on Device Management technologies like SCCM 2012, Current Branch, and Intune. He writes about ConfigMgr, Windows 11, Windows 10, Azure AD, Microsoft Intune, Windows 365, AVD, etc.
Let’s discuss how to Enable Intune Company Portal Browser Access for Conditional Access Enabled Web apps. I have been testing and developing a solution for Android device management with Intune. I have shared my Android for Work learning experiences in my previous posts – Android.
In this post, we will see and learn how to enable Intune Company Portal Browser Access for Android devices. What is the need for enabling company portal browser access?.
To put it in simple words, if your organization is using Azure AD Conditional Access (CA) enabled internal web applications, then we need to enable the Company portal browser access option.
This post will provide a comprehensive guide on enabling Intune Company Portal browser access for conditional access-enabled web apps. We will walk you through the necessary steps to configure your settings, ensuring easy access control and security compliance.
How to Enable Intune Company Portal Browser Access
The above video recording gives you the same user experience when you have CA access-enabled web applications and you have not enabled company portal browser access. As you can see in the video, the managed browser for Android devices gives an error stating that the device is not enrolled.
Yes, the managed browser application can’t understand whether the device is already enrolled. When you perform an action like “Intune Company Portal Browser Access, ” the app will try to install the Microsoft work account certificate on an Android device. There is a known issue with the previous version of the Company Portal application on Android devices.
How to Enable Intune Company Portal Browser Access
Open the Company Portal app.
Go to the Settings page from the ellipsis (…) or hardware menu button.
Press the Enable Browser Access button.
How to Enable Intune Company Portal Browser Access for Conditional Access Enabled Web Apps – Table 1
Microsoft Work Account Certificate Installation Error
Allow the Company portal and Intune-managed apps to record future actions in greater detail, which may help your IT administrator better identify and solve issues.
How to Enable Intune Company Portal Browser Access for Conditional Access Enabled Web Apps – Fig.1
End-User Experience of ENROLL Device Error
The solution to the Microsoft mentioned above “work account certificate installation” error is to update the company portal application for Android devices. Are you getting an ENROL error on your device (as you can see in the following screen capture)?
Does this error appear when you try to access Conditional Access-enabled web applications through the managed browser? The web apps without CA are working fine? If so, you must perform the following action from your Android device: “Intune Company Portal Browser Access.”
How to Enable Intune Company Portal Browser Access for Conditional Access Enabled Web Apps – Fig.2
Microsoft Work Account Certificate Installation
Now, it’s time to update the company portal application on Android for work-enabled devices. Once the device is updated with the latest version of the company portal app, then open up the company portal app and go to settings – tap on the button “Enable Browser Settings.”
This action opens a popup for installing a Microsoft Work Account certificate. The user must select the cert and tap on the ALLOW button. The video tutorial at the top of this post explains this process.
How to Enable Intune Company Portal Browser Access for Conditional Access Enabled Web Apps – Fig.3
End USER Experience of CA-enabled Web Application Access
Once the managed browser has a certificate, the web applications opened in the Managed browser can use the Microsoft Work account cert. This will allow the managed browser to securely open conditional access-enabled internal web applications. In my experience, the user doesn’t require a tap on the INSTALL button; rather, the user must tap on the ALLOW button to complete this configuration.
How to Enable Intune Company Portal Browser Access for Conditional Access Enabled Web Apps – Fig.4
We are on WhatsApp now. To get the latest step-by-step guides, news, and updates, Join our Channel. Click here. HTMD WhatsApp.
Author
Anoop C Nair is Microsoft MVP! He is a Device Management Admin with over 20 years of IT experience (calculation done in 2021). He is a Blogger, Speaker, and leader of the Local User Group HTMD Community. His main focus is on Device Management technologies like SCCM 2012, Current Branch, and Intune. He writes about ConfigMgr, Windows 11, Windows 10, Azure AD, Microsoft Intune, Windows 365, AVD, etc.
Let’s discuss how to Deploy Microsoft Store for Business Apps using Intune. Microsoft Store for business apps is part of your organization’s private store apps.
Only one way to deploy Store apps using Intune is required deployment. Microsoft Store for business apps can be deployed as “Available,” “Required,” or “Uninstall” apps to Windows 10 or Windows 11 devices.
On September 15, 2023, Microsoft Store for Business and Education apps will be removed from the Intune admin center. Apps on the device will remain until intentionally removed.
How to Deploy Microsoft Store for Business Apps using Intune – Fig.1
The logic behind NOT having an “available” deployment option is very understandable. The user doesn’t need an available deployment via Intune because the user always has private store access to install the apps manually.
Let’s check how to deploy the WhatsApp application from the Microsoft store to Windows 10/11 devices, which Microsoft Intune manages.
Devices must be registered with Azure AD or joined to the same Azure AD tenant where you registered the MSfB for online app deployment.
Azure AD Global admin (or appropriate) access to create Applications to connect ConfigMgr site to Azure AD and MSfB
Decide Offline or Online Applicationsusing Intune
The MSfB supports two types of application licenses, and you should be very careful with the license type of application you want to add. You don’t need devices Hybrid Azure AD registered or joined for Offline apps.
Online: Windows 10 devices must be joined to Azure Active Directory (Azure AD) or hybrid Azure AD-joined.
Offline: Devices don’t need to connect to the store or have a connection to the internet.
Search Store Applications from MSfB for Intune App Deployment
Let’s log in to the Microsoft Store for Business and search for the apps you want to add to Configuration Manager. Try to add WhatsApp to the private store and deploy it to managed Intune Windows 10/11 devices.
NOTE! – Microsoft Store for Business will retire in the first quarter 2023.
How to Deploy Microsoft Store for Business Apps using Intune – Fig.2
Add Apps to Private Store
You have already found the required app (above section): WhatsApp. Now, let’s add it to the organization’s private store.
Click on any application – WhatsApp
Select License type: Offline
Click on Get the app
How to Deploy Microsoft Store for Business Apps using Intune – Fig.3
Once you click the Get the App button, the WhatsApp application will be purchased and added to your Microsoft private store.
You have successfully added the WhatsApp Beta app to the private store.
This app will be available in the admin console after the next MSfB sync with Intune.
Click Close to continue.
How to Deploy Microsoft Store for Business Apps using Intune – Fig.4
Initiate a Manual Sync between Intune Portal and Microsoft Store for Business
Let’s Initiate a Manual Sync between Intune Portal and Microsoft Store for Business. If I’m not mistaken, the schedule sync will happen every 24 hours.
Login to Endpoint.Microsoft.com
Navigate to Tenant Administration – Connectors and Tokens.
Enabling Microsoft Store for Business sync lets you access volume-purchased apps with Intune. Two options must always be enabled for this scenario.
First, you must sign up and associate your Microsoft Store for Business account with Intune. Open the business store
Choose the language in which apps from the Microsoft Store for Business will be displayed in the Intune console Language:
Enable
Disable
Sync the apps you’ve purchased from the store with Intune. To reflect the newly purchased application WhatsApp, click the SYNC button on the client and wait for the sync to complete.
How to Deploy Microsoft Store for Business Apps using Intune – Fig.5
Deploy Microsoft Store App to Windows 11/10 using Intune
Let’s check how to Deploy the Microsoft Store App to Windows 11/10 using Intune. Let’s head over to Apps and check for the WhatsApp Beta application.
Deploy Microsoft Store App to Windows 11/10 using Intune
Open Intune portal.
Navigate to All Apps and Search for WhatsApp.
How to Deploy Microsoft Store for Business Apps using Intune – Table 1
How to Deploy Microsoft Store for Business Apps using Intune – Fig.6
Click on the WhatsApp application to start the deployment process. This is the typical deployment process for the Intune application. The application is created automatically when you sync Intune and Microsoft Store for Business.
You can assign applications to at least one group. Click ‘Properties‘ and edit ‘Assignments‘ to start the assignment.
How to Deploy Microsoft Store for Business Apps using Intune – Fig.7
I have deployed this as an available application to an Azure AD group of USERS.
How to Deploy Microsoft Store for Business Apps using Intune – Fig.8
End-User Experience of App installation on Windows 10 device
How to Deploy Microsoft Store for Business Apps using Intune – Video 1
Enable and Configure Microsoft Store for Business
First, we must sign up and associate the Microsoft Store for Business (MSfB) account with Intune. Then, we must accept the agreement and consent for Windows Store for Business.
How to Deploy Microsoft Store for Business Apps using Intune – Fig.9
Intune and Microsoft Store for Business Connection
You must open the Intune portal (Azure) to enable and configure Microsoft Store for Business. Microsoft Intune – Mobile Apps- Windows Store for Business. Choose the language in which Windows Store for Business apps will be displayed in the Intune console.
Once you sign up for the Windows Store for Business, you need to connect Intune with the store. This is required to Deploy Windows Store Apps via Intune. Click on the Manage tab and select Store Settings.
Once you are in store settings, you can see three out-of-box connections configured to deploy Windows Store for business apps via MDM solutions. Airwatch, MobileIron Cloud, and Microsoft Intune were the three connections created. Click on the Intune activate button to set up the connection between the store and Intune.
How to Deploy Microsoft Store for Business Apps using Intune – Fig.10
Sync the Applications and Deploy Applications via Intune
Once the Intune connection is activated, we must shop the apps and add them to your organization’s private store. It could take 24 hours (it’s pretty fast nowadays. Within minutes, it will be available) to reflect the newly added apps appearing in the private store. You can sync Intune to get the newly added apps into Intune.
We need to save the settings after the app syncs successfully.
Updated NOTE! You can now log in to the Microsoft Endpoint Manager Admin center and head to Tenant Administration—Connectors and Tokens. Then, click the SYNC button to make the application available in Intune applications.
Login to Endpoint.Microsoft.com and Navigate to Tenant Administration – Connectors and Tokens.
How to Deploy Microsoft Store for Business Apps using Intune – Fig.11
After a successful connection, you can see the following settings in Microsoft Store for Business.
How to Deploy Microsoft Store for Business Apps using Intune – Fig.12
How to Deploy Microsoft Store for Business App from Intune
Learn How to Deploy Microsoft Store for Business Apps from Intune. It would help if you headed to Apps – Windows node in the MEM Admin center portal (Intune) to search for application availability there. After the successful sync between Intune and Microsoft Store for Business, the Firefox browser app will be available in the MEM Intune portal.
Select the Windows Store apps you want to deploy to AAD user groups. We only have two options when deploying the Windows Store app via Intune. And those are REQUIRED and UNINSTALL.
So, there is no option to deploy the Windows Store app as an available deployment via Intune because the users already have access to the Windows Private Store.
How to Deploy Microsoft Store for Business Apps using Intune – Fig.12
End-User Experience of App Installation on Windows 10 Device
The end-user experience for Windows 10 1703 users is flawless. The deployment of the Windows Store app via Intune happened in the background, and the user’s name came to know about the installation on their Windows 10 device.
How to Deploy Microsoft Store for Business Apps using Intune – Fig.13
We are on WhatsApp now. To get the latest step-by-step guides, news, and updates, Join our Channel. Click here. HTMD WhatsApp.
Author
Anoop C Nair is Microsoft MVP! He is a Device Management Admin with more than 20 years of experience (calculation done in 2021) in IT. He is a Blogger, Speaker, and Local User Group HTMD Community leader. His main focus is Device Management technologies like SCCM 2012, Current Branch, and Intune. He writes about ConfigMgr, Windows 11, Windows 10, Azure AD, Microsoft Intune, Windows 365, AVD, etc.
Let’s learn about the SCCM Intune Facebook Community Growing Strong Microsoft Intune Facebook. We’ve created SCCM and Intune pages/groups to share knowledge between SCCM and Intune professionals.
Within the SCCM Intune FB Community, we share information about personal experience, the latest updates, tricks, solutions, Hotfixes, and tips from community experts and Microsoft.
SCCM Intune’s Facebook community is always fun and very interactive. Moreover, this type of community gives a personal touch. Real people interact with each other with loads of authenticity.
SCCM Intune Facebook Community groups are the virtual community group for SCCM/ConfigMgr/Intune professionals. Intern, these are the groups where we announce the “SCCM Intune User Group Event” and get feedback from the community.
More than just sharing information, it became a most efficient place for discussions of SCCM and Intune-related topics. This page and its groups have been very helpful to me personally because I don’t want to look at my RSS feed now and then to get updates from the IT world.
SCCM Intune Facebook Community Growing Strong Microsoft Intune Facebook – Fig.1
SCCM Intune Facebook Technical Community Groups Pages
Facebook groups are very interactive, and their design is very well suited for the IT Pro community. I’m a big fan of closed groups, as your posts in a closed group are visible only to the members of that group.
SCCM Intune Facebook Community Growing Strong Microsoft Intune Facebook – Video 1
We are on WhatsApp now. To get the latest step-by-step guides, news, and updates, Join our Channel. Click here. HTMD WhatsApp.
Author
Anoop C Nair is Microsoft MVP! He is a Device Management Admin with more than 20 years of experience (calculation done in 2021) in IT. He is a Blogger, Speaker, and Local User Group HTMD Community leader. His main focus is on Device Management technologies like SCCM 2012, Current Branch, and Intune. He writes about ConfigMgr, Windows 11, Windows 10, Azure AD, Microsoft Intune, Windows 365, AVD, etc.
Let’s discuss the Microsoft Intune Android Work Apps User Experience Explained. The android operating system has several variants, and fragmentation is very high. What are the reasons for this? With the open standards, every smartphone manufacturer has the freedom and option to customize the operating system according to their preference.
So, all the Android mobile device manufacturers grabbed the opportunity to push their apps and tweak their versions of Android. So, what is the biggest problem with the Intune Android Work app’s user experience? I will see the details in this post. Also, I have explained the same in the below video.
There is no standard user experience, and different mobile manufacturers, like Samsung, Sony, and LetV, have their own way of arranging Android Work applications. Once you have enabled Android for Work support, you can enrol the Android devices into Intune for management, as I explained in the post “How to Enroll Android for Work Supported Devices into Intune.”
In this post, we explain the user experience of Microsoft Intune Android Work Apps in all its details. This comprehensive guide delves into the user experience of Microsoft Intune Android Work Apps.
In this post, we will examine the difference between a good and a bad Intune Android for Work user experience. I wanted to make it clear that Intune cannot do much to improve the user experience because this is a necessary OS capability.
Microsoft Intune Android Work Apps User Experience Explained – Fig.1
I have tested Intune Android for Work enrollment with devices like Nexus 6P, Sony, Samsung, etc. The Intune Android Work Apps user experience is good for all the tested devices. However, the problem is the placement of badged applications on the devices.
Each Android mobile manufacturer has its own way of placing badged Android Work applications.
I like how a manufacturer places all the badged apps into a folder.
This is very useful for the user to switch from work applications to personal ones. In my testing, if the manufacturer does not create a group for work applications after Intune Android for Work enrollment, it does not provide a good user experience.
Per my testing on several Android devices, I liked the Intune Android for the Work user experience of Samsung and Google Nexus the most.
Intune Android for Work End User Device Experience Video LetV Samsung Nexus Sony
Initially, the Intune Android for Work enrollment experience with the company portal was not flawless. However, the enrollment process has greatly improved with the latest version of the Intune company portal. Suppose you enroll the device with the latest company portal app. You don’t have to close the existing company portal app and open the company portal app for the work app (with a badge/briefcase symbol) to continue the enrollment process.
Microsoft Intune Android Work Apps User Experience Explained – Video 1
Intune Android for Work Nexus 6s Enrollment Experience
In this video, we’ll walk you through the comprehensive enrollment experience of Intune Android for Work on the Nexus 6s. From the initial setup to the final configuration, we’ll guide you step-by-step to ensure a smooth and efficient process.
Microsoft Intune Android Work Apps User Experience Explained – Video 2
I like the Samsung and Google Nexus user experience because all the Android work applications are placed or stored in a separate WORK folder. The work folder helps users better segregate their apps from work apps.
That user experience is excellent. Microsoft Endpoint Manager Intune Android Work Apps User Experience Explained? The Android work apps’ user experience of Sony and LetV Android devices is not so good if you compare the UX of Samsung and Nexus.
The bad user experience is that those devices won’t create a separate folder for WORK apps. The video tutorial in the first part of this project explains the more detailed experience. Intune Android Work Apps User Experience Explained in the above video.
We are on WhatsApp now. To get the latest step-by-step guides, news, and updates, Join our Channel. Click here. HTMD WhatsApp.
Author
Anoop C Nair is Microsoft MVP! He is a Device Management Admin with more than 20 years of experience (calculation done in 2021) in IT. He is a Blogger, Speaker, and Local User Group HTMD Community leader. His main focus is on Device Management technologies like SCCM 2012, Current Branch, and Intune. He writes about ConfigMgr, Windows 11, Windows 10, Azure AD, Microsoft Intune, Windows 365, AVD, etc.
