Let’s discuss the SCCM Online Service Connection Point Details – 2 Options. Microsoft released a new SCCM Current Branch version, SCCM CB 1610. If you are running SCCM CB 1511, 1602, or 1606, you can directly upgrade to SCCM CB 1610. This post and video provide more details about SCCM ConfigMgr CB Updates in Console and Upgrade.
SCCM Upgrade Process The ConfigMgr CB upgrade process via updates and servicing channel is very straightforward if you have an ONLINE service connection point mode.
If you are running an offline service connection point mode, you must perform manual ways to get the latest SCCM CB 1610 updates available in your SCCM CB console.
This post provides all the details about the SCCM Online Service Connection Point Details—2 Options. For SCCM CB infra with an online service connection point, the SCCM CB 1610 update will automatically appear in the console once Microsoft has released this for “slow ring“.
Now (18th Nov 2016), Microsoft released SCCM CB 1610 updates only for the “fast ring,” which can be enabled only by running a PowerShell script provided in the following link.
SCCM Online Service Connection Point Details – 2 Options – Fig.1
SCCM Servicing Flowchart
Let’s discuss the SCCM Servicing Flowchart. The screenshot helps you show the updates and servicing download process. The flow chart documentation is here.
Updates and Servicing Download Process
Service Connection Point
Hierarchy Manager
The hierarchy Manager checks the applicability of the package
Is the package applicable?
DMP Downloader downloads the payload and redist files
The hierarchy Manager checks the applicability of the package
SCCM Online Service Connection Point Details – 2 Options – Table 1
SCCM Online Service Connection Point Details – 2 Options – Fig.2
How Did I Upgrade ConfigMgr SCCM CB 1602 to 1606
This is a 1-minute video that tells you how to start the SCCM CB 1610 upgrade process once the updates are available in the CM CB console. I have already covered the end-to-end SCCM CB upgrade process in a videohere (even though that is about the CM 1606 upgrade, the process is similar).
SCCM Online Service Connection Point Details – 2 Options – Video 1
Start the Upgrade Process from the Console
I’m sharing the video tutorial about upgrading the SCCM ConfigMgr CB 1610 console. Before initiating the SCCM ConfigMgr CB console upgrade process, you must complete all the reset activities for site system roles (sitecomp.log gives you more ideas). Otherwise, there could be more chances of failures during the SCCM CB console upgrade.
SCCM Console Upgrade
Let’s discuss the SCCM Console Upgrade. The below section shows the SCCM Console Upgrade details.
We are on WhatsApp now. To get the latest step-by-step guides, news, and updates, Join our Channel. Click here. HTMD WhatsApp.
Author
Anoop C Nair is Microsoft MVP! He is a Device Management Admin with more than 20 years of experience (calculation done in 2021) in IT. He is a Blogger, Speaker, and Local User Group HTMD Community leader. His main focus is on Device Management technologies like SCCM 2012, Current Branch, and Intune. He writes about ConfigMgr, Windows 11, Windows 10, Azure AD, Microsoft Intune, Windows 365, AVD, etc.
Let’s discuss the Feature Comparison Between SCCM ConfigMgr CB Versions | Configuration Manager Current Branch. SCCM ConfigMgr’s current branch (CB) XXXX was released last Friday (18th Nov 2016).
SCCM CB YYYY has many features, and the upgrade process via updates and servicing channels is straightforward. You are done with the SCCM CB 1610 upgrade with just a couple of clicks.
You can directly upgrade your SCCM CB 1511 server to 1610. You do not need to go through all the other upgrades (1602 /1606) available in your SCCM CB console. The blog post with more details is availablehere.
This post will share a comparison video of SCCM CB 1606 and 1610 features. The features discussed in the video below are essential for upcoming changes to SCCM ConfigMgr CB.
The video tutorial below explains how I Upgraded ConfigMgr SCCM CB 1602 to 1606.
Feature Comparison Between SCCM ConfigMgr CB Versions | Configuration Manager Current Branch – Video 1
Feature Comparison Between SCCM ConfigMgr CB Versions
The configuration and compliance policy updates are critical if you use a hybrid SCCM CB version to manage mobile devices and domain-joined machines. I think the SCCM team invested loads of time in improving the features of their product.
Feature Comparison Between SCCM ConfigMgr CB Versions
SCCM ConfigMgr 1606 and 1610
Feature Comparison Between SCCM ConfigMgr CB Versions | Configuration Manager Current Branch – Table 1
Feature Comparison Between SCCM ConfigMgr CB Versions | Configuration Manager Current Branch – Fig.1
Feature Comparison Between SCCM ConfigMgr CB Versions
SCCM CB is moving away from old-fashioned boundary-setting, such as fast and slow boundaries. Rather, investing more in current and neighbor boundary groups. This will help to evolve the product further in upcoming versions.
A version of SCCM 1610 feature comparison includes Boundary groups
current and neighbor boundary groups, Improvements on Windows Store for business,
Content size filter in Software update ADR and monitoring of loads of components have been updated,
And new dashboards have been included.
List of Feature Comparison Between SCCM ConfigMgr CB Versions
New Features as part of SCCM CB 1610 updates and servicing. Boundary Changes – Improvements for boundary groups – current boundary group vs neighbor boundary groups.
Improvements Windows Store for Business – Modify the client secret key and delete a subscription to the store from the SCCM Console.
Cloud management gateway for managing Internet-based clients – Cloud management gateway provides a simple way to manage Configuration Manager clients on the Internet.
Immediate Policy sync for MDM channel Intune-enrolled devices.
Configuration policies – New policies included in SCCM CB 1610 – Android (23), iOS (4), Mac (4), Windows 10 desktop and mobile (37), Windows 10 Team (7), Windows 8.1 (11), and Windows Phone 8.1 (3).
The Windows 10 Edition Upgrade Policy can be applied for SCCM CB 1610. It is now available for Intune and SCCM clients.
Client Agent—Client Peer Cache helps you manage content deployment to clients in remote locations. Peer Cache is a built-in SCCM solution that allows clients to share content directly from their local cache. To share content, enable the Configuration Manager client in full OS. Yes.
Customizable Branding is also included in the SCCM CB 1610.
The enforcement grace period is an excellent feature of SCCM CB 1610.
Another nice feature included in SCCM CB 1610 Software Update ADR is Content Size.
Monitoring – Compliance policies Dashboard and Client Data Source Dashboard.
We are on WhatsApp now. To get the latest step-by-step guides, news, and updates, Join our Channel. Click here. HTMD WhatsApp.
Author
Anoop C Nair is Microsoft MVP! He is a Device Management Admin with more than 20 years of experience (calculation done in 2021) in IT. He is a Blogger, Speaker, and Local User Group HTMD Community leader. His main focus is on Device Management technologies like SCCM 2012, Current Branch, and Intune. He writes about ConfigMgr, Windows 11, Windows 10, Azure AD, Microsoft Intune, Windows 365, AVD, etc.
Let’s discuss the Intune Starter Kit, a Helping Hand for IT pros who want to learn Intune. Loads of people requested a starter kit for Intune, as I have one for the SCCM 2012 starter kit, and the SCCM 2012 starter kit page was handy for the community (I think that is why people are requesting the Intune Starter Kit).
This post will mainly concentrate on Intune standalone (not Intune Hybrid and Office 365 Intune MDM). In most cases, there is no need/very minimal need for on-prem infrastructure if you go with Intune standalone and all the other cloud components like Azure Active Directory, Office 365, etc. I’ll keep adding new things to this page. This is just starting 😉
I started working with Intune in the latter part of 2012, and Microsoft Intune has evolved a lot over the years. In 2013, I started a post called “Microsoft Intune Wiki” (most of the links are outdated, but it’s worth going through if you want to see how Intune was).
We already have a Facebook group for Intune Professionals. If you would like to join the Facebook community of Intune Professionals, click here
Intune Starter Kit a Helping Hand for the ITPros who wanted to Learn Intune
What is Microsoft Intune?– Intune Starter Kit a Helping Hand for the ITPros who wanted to Learn Intune
Intune is Microsoft’s enterprise mobility management (EMM) solution. The EMM provider helps manage mobile devices, network settings, and other mobile services and settings. Microsoft Intune combines Device, Application, Information Protection, Endpoint Protection (antivirus software), and Security/Configuration policy management solution (SaaS) facilitated by Microsoft in the Cloud.
Additionally, Intune has features where admins can create a “Conditional Access” policy to get access to company resources. Only Intune will provide access to company or corporate resources (corporate mail, SharePoint, etc.) if the devices meet those conditions.
Previously, I mentioned Microsoft Intune as a lighter version of SCCM or ConfigMgrin the cloud. However, I don’t want to make it so simple this time. Intune architecture is entirely cloud-based and agile. To get a more detailed idea about Intune (Yes, this video is old and outdated in some parts as Intune evolved along with Microsoft’s Enterprise Mobility and Security (EMS).
I’m going to explain this in a slightly different way. Let me know if this is confusing. We can manage devices with an Intune client agent and arguably without one. For example, Intune company portal application(s) in different app stores like Google Playand Apple Store are Intune client agents.
So, when you install the Intune company portal onto your Android or iOS devices, you are doing agent-based management. Also, the Microsoft Intune client MSI can be downloaded once you have a valid Intune subscription. You can download and install it on Windows machines that you want to manage.
I have an old post (published in Dec 2012) here to help you understand the basics of Intune MSI agent installation. Once you install the Intune MSI agent on Windows machines, Intune will “fully manage” those machines.
Intune Starter Kit a Helping Hand for the ITPros who wanted to Learn Intune – Fig.1
So, what is arguably agent-less Intune management? Within Windows 10, we have a “build—Native” MDM agent as part of the operating system. We can enrol Windows 10 devices in Intune using the “in build—Native” MDM agent. In this scenario, we must use the Intune company portal to install applications like a shopping cart.
So, the Intune company portal does not act as an Intune agent in native MDM enrolment scenarios. Native MDM-managed devices are arguably NOT fully managed devices (at this point). I’m sure this will change sooner or later. The Windows 10 in-built MDM agent can enrol your Windows 10 devices in any other MDM management software, such as VMware Airwatch, Mobileiron, etc.
Enrolled via the Intune company portal.
Enrolled via Installation of Intune MSI client.
Enrolled via Windows 10 1607 and above in build Azure AD join and MDM enrolment.
MAM without MDM enrolment.
Intune Starter Kit a Helping Hand for the ITPros who wanted to Learn Intune – Fig.2
How Do you Get an Intune Account and Start Working/Testing with Intune?
Download the Microsoft EMS step-by-step guide from here. This guide will help you get a free trial version of Office 365, Azure AD, and Intune subscription. If you already have an Azure AD (Azure AD premium) subscription, things are straightforward, as I posted in the blog here.
Suppose you don’t have an Azure AD subscription. It is better to start with anEnterprise Mobility Suite (EMS)trial account, an Azure Free Trial Account (an Azure trial account is already created as an EMS trial account), and an Office 365 free trial subscription. Creating a NEW outlook.com account and getting ready with credit card details to activate the Azure trial subscription is better for getting these trail accounts.
Getting a trial version of Azure AD, Office 365, and Intune is very straightforward if you have never done this same process with your credit card and mobile number. Azure AD and Office 365 are prerequisites for Intune if you want to test all its features.
Note: Intune can also be signed up separately from here. If you want to test only Intune now, this is the way to go.
How to Start using Microsoft Intune Console
Once you have completed the subscription steps, you can log in to the Microsoft Intune (http://manage.microsoft.com/) portal (Silverlight is necessary for the Intune console to work). Internet Explorer with the Silverlight plugin is the best internet browser for the Intune console.
However, the Intune console will work on any internet browser that can add Silverlight as a plugin. It might even work without the Silverlight plugin, and I would love to see this soon.
Intune Starter Kit a Helping Hand for the ITPros who wanted to Learn Intune – Fig.3
How Do you Select the MDM Authority from the Intune Console?
MDM authority and management options are significant to me. Please note that you won’t be able to change it once you set MDM (Mobile Device Management) authority to Intune in the following place at the Intune console.
To change Intune MDM authority, you must raise a ticket with CSS or a service request via the Intune/Office 365 portal. So be very careful when you click on any links on the following page at the Intune console.
What Types of Management Authority Do We have for Intune?
Microsoft Intune
Configuration Manager (SCCM)
Office 365 (lightweight Intune)
Intune Starter Kit a Helping Hand for the ITPros who wanted to Learn Intune – Table 1
Quick question: Do I need to re-enrol devices if the MDM authority is changed from o365 MDM to Intune MDM? It works without re-enrolment of devices; it is just a compliance check, and everything looks okay on the device. I heard it’s supported, as both use Intune for MDM.
Intune Starter Kit a Helping Hand for the ITPros who wanted to Learn Intune – Fig.4
How to Start Managing Windows/iOS /Android Devices with Intune?
Managing Windows devices is very straightforward. Yes, Windows 10 management is very straightforward; earlier, we needed side loading and key SEP certificates to manage/deploy apps for Windows and Windows Phone devices.
Most of these certificates and sideloading essential requirements have been removed for most scenarios. Managing Android devices is also very straightforward. It takes 10 minutes to sync your Windows Store for Business and Microsoft Intune. More details are provided in the post “Integrate Windows Store for Business” here.
If you want to install store apps without using a Microsoft account, read the blog post “How to Add Apps to Business Store and Install Intune Company Portal without Using MS Account” here.
However, iOS\MAC OS device management has certificate requirements, and we need to go to the Apple portal, upload your cert for the tenant, and get the certificate for your Intune tenant.
The process for SCCM CB is explained in the following video, but the process is similar for Intune. More details here Microsoft document specifically for Intune.
Intune Starter Kit a Helping Hand for the ITPros who wanted to Learn Intune – Video 1
How Do I Deploy MSI Applications to Windows PCs using Intune?
Like SCCM, Intune can also deploy different applications to other devices. The types of applications that Intune supports now are EXE, MSI (Windows Installer and Windows Installer through MDM), APK, IPA, XAP, and APPX—APPXBUNDLE for Windows app package and Windows Phone app package. We can make software or applications available to devices via three methods.
Intune Starter Kit a Helping Hand for the ITPros who wanted to Learn Intune – Fig.5
1. Software Installer – select the type of software you want to install
2. External Link – this can be used for deploying the applications in the Google Store via deep linking
3. Managed iOS apps from Apps Store – this can be used to deploy the apps in the Apple Store via the deep linking method
Creating policies in Intune is another crucial step in configuring and managing devices through Intune. The following is the list of policies you can create and deploy via Intune.
Configuration Policies
Compliance Policies
Dynamics CRM Online Conditional Access Policy
Exchange Online Conditional Access Policy
Exchange On-premises Conditional Access Policy
SharePoint Online Conditional Access Policy
Skype for Business Online Conditional Access Policy
MAM Application Policy
MAM Browser Policy
What is the difference between the Intune Configuration and Intune Compliance Policy? You can see similar settings in compliance and configuration policies in some cases. So, what is the exact difference? Compliance policy works with conditional access policies; however, configuration policies are independent of conditional access. Compliance policies can deploy ONLY to USERS, whereas Configuration policies can be deployed to Devices and Users.
The Following Video will Explain How to Create and Deploy Intune Compliance Policies from the Console.
Compliance policy won’t force the device to change its configuration; rather, it will wait until the device enters the compliance stage to provide access to company resources like mail/SharePoint (in case a Conditional access policy is set). The configuration policy forces the device or user to change the configuration setting mentioned in the policy (which is arguably not true in all scenarios).
Intune Starter Kit a Helping Hand for the ITPros who wanted to Learn Intune – Video 2
What are MAM (Mobile Application Management) Policies?
Mobile Application Management policies are application-specific policies you can set up via Intune. What is the difference between configuration, Compliance policies, and MAM policies? Configuration and Compliance policies are for the entire device. It applies to everything on the device. MAM policies will be used only for the application with which it’s associated.
Intune Starter Kit a Helping Hand for the ITPros who wanted to Learn Intune – Fig.6
What is MAM without MDM enrolment (MAM WE – MAM Less MDM)?
This is another policy type in Intune. What is the difference between MAM with MDM enrolment and MAM without MDM enrolment? These are Mobile Application Management policies without enrolling in Intune. They help secure corporate data using BYOD/personal devices to access corporate mail, SharePoint, etc.
Why is the Intune option visible in the Azure portal (https://portal.azure.com/)? This is good news for SCCM/Intune admins. We are getting new features in Intune. This time, it’s Intune MAM (Mobile Application Management) without MDM enrolment.
For complete mobile device management, we must use the original Intune portal (https://manage.microsoft.com). Forums and other communities regularly asked whether Intune could coexist with MDM products like Airwatch or Mobile Iron.
How Do You Manually Add Users to the Intune Console?
How do you add users to the Intune console and provide permissions to users in the Intune console? We don’t have to do this when Intune Silverlight console is migrated to the Azure portal??
Before you try to provide service administrator access (limited roles available in Intune Silverlight console Full Access, Read-Only access, or Helpdesk—Group Node access) to users in Intune, you should make sure the administrator or server administrator user is already available in the Intune administrator console. More info here.
We are on WhatsApp now. To get the latest step-by-step guides, news, and updates, Join our Channel. Click here. HTMD WhatsApp.
Author
Anoop C Nair is Microsoft MVP! He is a Device Management Admin with more than 20 years of experience (calculation done in 2021) in IT. He is a Blogger, Speaker, and Local User Group HTMD Community leader. His main focus is on Device Management technologies like SCCM 2012, Current Branch, and Intune. He writes about ConfigMgr, Windows 11, Windows 10, Azure AD, Microsoft Intune, Windows 365, AVD, etc.
Are You Having an Issue with Windows 10 WIP EDP SCCM CB Configuration Manager ConfigMgr?
Are you having issues with Windows Information Protection (WIP, previously known as “Enterprise Data Protection – EDP” policies configured through the SCCM ConfigMgr CB 1606 production version?
If so, I was one of you. I’m talking about the issue I faced while deploying the WIP policy via the Windows 10 MDM channel. I will try to explain the problem which I had with WIP CI (for the specific scenario which I tested):-
When you open WIP CI, try to check whether everything is okay or not and exit out of CI with/without making any changes. Some values in CI XML will automatically change, breaking the entire CI.
Windows Information Protection WIP– Are You Having Issue with Windows 10 WIP EDP SCCM CB Configuration Manager ConfigMgr
I’ve embedded a video below explaining this bug/issue. If you are new to WIP/EDP and want to know how to create, deploy, and test WIP with Windows 10, look at my previous post and video here.
The good news is that Microsoft’s new rollup update (KB3186654)most probably fixed this issue. I have done extensive testing with Windows Information Protection (WIP) policies/CIs after installing the new rollup on the SCCM CB 1606 server, and the results are very promising.
Name
Type
New Windows 10 WIP
General
Are You Having Issue with Windows 10 WIP EDP SCCM CB Configuration Manager ConfigMgr – Table 1
Are You Having Issue with Windows 10 WIP EDP SCCM CB Configuration Manager ConfigMgr – Fig.1
How to Create – Deploy WIP EDP Using SCCM CB 1606 and End-user experience of WIP
I tried creating new WIP CIs, editing the existing WIP CIs, etc. All the scenarios I tested worked well for me. I tested this with Windows 10 1607 build numbers 14393.00 and 14393.82 (via MDM channel). Are You Having an Issue with Windows 10 WIP EDP SCCM CB Configuration Manager ConfigMgr Endpoint Protection?
Are You Having Issue with Windows 10 WIP EDP SCCM CB Configuration Manager ConfigMgr – Video 1
Sample of the correct WIP CI with correct ConstantValue
Let’s discuss the Sample of the correct WIP CI with the correct ConstantValue. The below section helps you show the sample of the correct WIP CI with the correct ConstantValue.
We are on WhatsApp now. To get the latest step-by-step guides, news, and updates, Join our Channel. Click here. HTMD WhatsApp.
Author
Anoop C Nair is Microsoft MVP! He is a Device Management Admin with more than 20 years of experience (calculation done in 2021) in IT. He is a Blogger, Speaker, and Local User Group HTMD Community leader. His main focus is on Device Management technologies like SCCM 2012, Current Branch, and Intune. He writes about ConfigMgr, Windows 11, Windows 10, Azure AD, Microsoft Intune, Windows 365, AVD, etc.
Intune Company Portal App Login Issues with Windows 11 or Windows 10 Devices? Have you tried to Repair or Reset Company Portal App to fix the issue? The Intune company portal application is not allowed to log in when it is installed on Windows 10 or Windows 11.
The issue explained in the post below could be due to either Azure AD authentication issues or proxy issues. It won’t let you log in with your username and password.
The Company Portal app will get redirected to the login page repeatedly. Have you tried to log in to the Intune company portal from a Windows device, and can you reproduce this issue?
Fix Company Portal App Login Error Occurred AAD Auth Proxy Issues. This post also explains the Tenant Restriction Policy and company portal issues.
Whenever you have an issue with the Intune Company Portal app, it’s better to Reset, Repair, or Reinstall it before trying to do further troubleshooting. Otherwise, this could be another issue if you see the same problems with a more significant number of Windows 11 devices.
Intune Company Portal App Repair options are easy to use, unlike other Win32 or MSI applications. Since the Intune Company portal is a Microsoft Store Application, it has all the Reset, Repair, and Reinstall options.
To fix Intune Company Portal App Repair Reset Options, you need to follow the steps explained below.
Navigate to the Apps & Features option by right-clicking on the Start button from Windows 11.
Use the search function to find the Company Portal application.
Click on the three (3) vertical dots menu.
FIX Intune Company Portal App Login Issues with Windows 10/11 – Fig.1
To repair the Company Portal Application on a Windows 11 device, select Advanced options, as shown in the screenshot below.
FIX Intune Company Portal App Login Issues with Windows 10/11 – Fig.2
The first step I always recommend is to TERMINATE the company portal app by clicking on the TERMINATE button from Apps -> Apps & Features -> Company Portal Advanced Options.
Intune Company Portal App Repair
Let’s check the next option, the Intune Company Portal app repair option. If this app isn’t working correctly, you can try to repair it. The Company Portal app’s data will not be affected.
FIX Intune Company Portal App Login Issues with Windows 10/11 – Fig.3
Company Portal App Repair Reset and Uninstall
Let’s check the following options to see if the Terminate and Repair options for the Company portal don’t work well. Company Portal App Repair, Reset, and Uninstall are the other options available on Windows 11 devices.
Company Portal REPAIR helps to fix the issue if the app is still not working as expected. The RESET will remove all the app-related data from the Windows 11 PC and give the Company Portal a fresh start.
The UNINSTALL button is the last resource for fixing theCompany Portal Application on Windows 11PC. After uninstalling the app, you can reinstall it from the Microsoft Store.
FIX Intune Company Portal App Login Issues with Windows 10/11 – Fig.4
Well, this is a weird issue, so stay with me! Let’s learn how to Fix the Company Portal App Login Error that Occurred. This issue is only for the Intune Company portal application. There was no issue accessing the company portal Website. This issue is only applicable to Windows 10/11 devices.
Problem Statement – Fix Company Portal App Login Error
Windows 10 devices started getting error messages when users tried to launch the Company portal app. The error details are given below.
Login error occurred – An error occurred while attempting to log in to Company Portal Login Error.
You get two options:
Share Details
Close
FIX Intune Company Portal App Login Issues with Windows 10/11 – Fig.5
Send Company Portal App for Windows 10 Logs
You can try to click on Share details to get the Company portal app log for Windows 10 or 11 devices. The message shows “Sending the Logs to Microsoft.“
FIX Intune Company Portal App Login Issues with Windows 10/11 – Fig.6
Now you can share the details with Microsoft using the Onenote file. Requesting help with the company portal app for Windows 10 or Windows 11.
NOTE! – You can send the company portal app logs for Windows 10 using the following method as well:
Open the Company Portal app.
Select Help & support > Get help.
FIX Intune Company Portal App Login Issues with Windows 10/11 – Fig.7
Details of Company Portal App Log
Describe the problem you’re experiencing. The Company Portal has collected your logs (Diagnostics ID: 2WWEWN) and sent them to Microsoft to help troubleshoot. Your description will help us understand what happened and how to fix the problem. After you’ve described the situation, send this email to your company support for more help.
Troubleshooting – Fix Company Portal App Login Error
Now, let’s enter the real troubleshooting scenario of the Company Portal app for Windows 10 devices.
First, I couldn’t find much information from the Microsoft logs mentioned in the above section.
I started looking at event logs to get more details.
Navigate to Microsoft-Windows-AAD/Operational (Azure AD authentication-related errors).
The following event ID 1098 shows an error that started when I tried to launch the company portal app.
FIX Intune Company Portal App Login Issues with Windows 10/11 – Fig.8
Event Log Details
The following are the company portal login issues with Windows 11/10 devices. As you can see in the paragraphs below, these logs are taken from event logs.
Log Name: Microsoft-Windows-AAD/Operational
Source: Microsoft-Windows-AAD
Date: 15/07/2020 16:00:58
Event ID: 1098
Task Category: AadTokenBrokerPlugin Operation
Level: Error
Keywords: Operational,Error
User:
Computer:
Description:
Error: 0xCAA82EE2 The request has timed out.
Exception of type 'class HttpException' at xmlhttpwebrequest.cpp, line: 163, method: XMLHTTPWebRequest::ReceiveResponse.
Log: 0xcaa10083 Exception in WinRT wrapper.
Logged at authorizationclient.cpp, line: 233, method: ADALRT::AuthorizationClient::AcquireToken.
Request: authority: https://login.microsoftonline.com/common, client: 8ba1a5c7-f19a-5de9-a1f1-7178c8d51343, redirect URI: ms-appx-web://Microsoft.AAD.BrokerPlugin/S-1-15-2-2666988183-1750391847-2906264630-3525785777-2857982319-3063633125-1907478113
Log: 0xcaa1007b Acquire token failed.
Log Name: Microsoft-Windows-AAD/Operational
Source: Microsoft-Windows-AAD
Date: 15/07/2020 16:00:58
Event ID: 1098
Task Category: AadTokenBrokerPlugin Operation
Level: Error
Keywords: Operational,Error
User:
Computer:
Description:
Error: 0xCAA82EE2 The request has timed out.
Exception of type 'class HttpException' at xmlhttpwebrequest.cpp, line: 163, method: XMLHTTPWebRequest::ReceiveResponse.Log: 0xcaa1007b Acquire token failed.
Logged at aggregatedtokenrequest.cpp, line: 70, method: AggregatedTokenRequest::AcquireToken.
Request: authority: https://login.microsoftonline.com/common, client: 8ba1a5c7-f19a-5de9-a1f1-7178c8d51343, redirect URI: ms-appx-web://Microsoft.AAD.BrokerPlugin/S-1-15-2-2666988183-1750391847-2906264630-3525785777-2857982319-3063633125-1907478113, resource: 00000002-0000-0000-c000-000000000000, correlation ID (request): 9d18dbac-d522-4d6e-8d14-c3e7610ec34c
0xcaa9004b Exception during nonce request
Log Name: Microsoft-Windows-AAD/Operational
Source: Microsoft-Windows-AAD
Date: 16/07/2020 10:11:06
Event ID: 1098
Task Category: AadTokenBrokerPlugin Operation
Level: Error
Keywords: Operational,Error
User:
Computer:
Description:
Error: 0xCAA82EE2 The request has timed out.
Exception of type 'class HttpException' at xmlhttpwebrequest.cpp, line: 163, method: XMLHTTPWebRequest::ReceiveResponse.
Log: 0xcaa9004b Exception during nonce request.
Request: authority: https://login.microsoftonline.com/common, client: 8ba1a5c7-f19a-5de9-a1f1-7178c8d51343, redirect URI: ms-appx-web://Microsoft.AAD.BrokerPlugin/S-1-15-2-2666988183-1750391847-2906264630-3525785777-2857982319-3063633125-1907478113, resource: 00000002-0000-0000-c000-000000000000, correlation ID (request): 9d18dbac-d522-4d6e-8d14-c3e7610ec34c
Fix Company Portal App Login Error Occurred
A proxy server tenant restriction was implemented using the following: Use tenant restrictions to manage access to SaaS cloud applications. For more details, see https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/tenant-restrictions.
The company portal app for Windows 10 or Windows 11 requires authentication to Azure AD through https://login.microsoftonline.com. These URLs are available in the above event logs. Tenant restrictions require TLS inspection only on traffic to Azure AD, not to the Office 365 cloud services.
It seems the TLS inspection for the following URL caused the issue. At least one of the following URLs is required:
https://enterpriseregistration.windows.net
https://login.microsoftonline.com
https://device.login.microsoftonline.com
https://autologon.microsoftazuread-sso.com (If you use or plan to use seamless SSO)
FIX Intune Company Portal App Login Issues with Windows 10/11 – Fig.9
Intune Company Portal Login Issues
After 3 login attempts, the company portal application will show you the following error: “Login error occurred – an error occurred while attempting to login“. You may also get the following details in the error log.
Have you ever seen this? The following scenarios show this issue in different Intune/AAD tenants. The table below helps you show more details.
The Issue in Different Intune/AAD Tenants
Windows 10 AAD Joined
Windows 10 MDM enrolled (Work account)
Windows 10 OOBE
FIX Intune Company Portal App Login Issues with Windows 10/11 – Table 1
I don’t have any solution for this issue yet. If you can reproduce this issue then please do comment on this post. When I remove add Work or School account from Settings – Accounts – Access work or school, then I’m able to login to the Intune company portal.
However, it will (obviously) say, “You need to add your device before you can install apps.” If you select “Don’t add this device,” the Intune company portal will proceed to the next page, which will show you the “my devices” list, etc., with a note, “It looks like you need to add this device so that you can install apps.”
FIX Intune Company Portal App Login Issues with Windows 10/11 – Fig.10
Log File Details – Intune Company Portal:-
Intune Company Portal Login Issues with Windows 10 Anniversary Update.
Microsoft.Management.Services.SelfServicePortal.CommonViewModels.ServiceLoginPageViewModel.<AuthenticateWithExceptionHandlingAsync>d__36.MoveNext()
2016-09-03T06:03:13.4876367Z WARN Event None 400 f67a7f1d-54e3-41e0-a838-e39ec3385ba3 3-0-0 Displaying error dialog
Title: Login error occurred
Message:An error occurred while attempting to login.
Exception: Microsoft.Management.Services.SelfServicePortal.Common.Portable.Authentication.IntuneAuthenticationException: Failed to authenticate with AAD
at Microsoft.Management.Services.SelfServicePortal.Extensions.AzureAD.Common.Authentication.AuthenticationResultHelper.ThrowIfAuthenticationStatusIsNotSuccess(AuthenticationStatus authenticationStatus)
at Microsoft.Management.Services.SelfServicePortal.Extensions.AzureAD.Common.Authentication.AzureADAuthenticationService.<AuthenticateAsync>d__0.MoveNext()
Resolution – Proxy Issue
The client app (in this case, Company Portal) should support tenant restrictions. I overlooked this point while writing this post. Microsoft docs already document that client software must request tokens directly from Azure AD so that the proxy infrastructure can intercept traffic.
NOTE! – The company portal (website) works well with tenant restrictions.
The proxy servers removed the OMT feature for TLS inspection for AAD authentication communication, which fixed the Company Portal.
We are on WhatsApp now. To get the latest step-by-step guides, news, and updates, Join our Channel. Click here. HTMD WhatsApp.
Author
Anoop C Nair is Microsoft MVP! He is a Device Management Admin with more than 20 years of experience (calculation done in 2021) in IT. He is a Blogger, Speaker, and Local User Group HTMD Community leader. His primary focus is Device Management technologies like SCCM 2012, Current Branch, and Intune. He writes about ConfigMgr, Windows 11, Windows 10, Azure AD, Microsoft Intune, Windows 365, AVD, etc.
