Anoop is Microsoft MVP! He is a Solution Architect on enterprise client management with more than 17 years of experience (calculation done in the year 2018) in IT. He is Blogger, Speaker, and Local User Group Community leader. His main focus is on Device Management technologies like SCCM 2012, Current Branch, Intune. He writes about technologies like SCCM, SCOM, Windows 10, Azure AD, Microsoft Intune, RMS, Hyper-V etc...
Microsoft released a new version of the SCCM Current Branch version, SCCM CB 1610. If you are running SCCM CB 1511 or 1602 or 1606, you can directly upgrade to SCCM CB 1610. More details about SCCM ConfigMgr CB Updates in Console and Upgrade in this post and video.
SCCM Upgrade Process
The ConfigMgr CB upgrade process via updates and servicing channel is very straightforward if you have an ONLINE service connection point mode. If you are running an offline service connection point mode, then you need to perform some manual ways to get the latest version of SCCM CB 1610 updates available in your SCCM CB console.
SCCM Online Service Connection Point
For SCCM CB infra with an online service connection point, the SCCM CB 1610 update will automatically appear in the console once Microsoft has released this for “slow ring“. Now (18th Nov 2016), Microsoft released SCCM CB 1610 updates only for the “fast ring” which can be enabled only through running a PowerShell script provided in the following link here.
This is a 1-minute video that tells you how to start the SCCM CB 1610 upgrade process once the updates are available in the CM CB console. I have already covered the end-to-end SCCM CB upgrade process in a video here (even though that is about CM 1606 upgrade, the process is similar).
Start the Upgrade process from the Console
I’m sharing the video tutorial about How to Upgrade SCCM ConfigMgr CB 1610 console. You need to make sure all the reset activities of site system roles (sitecomp.log gives you more idea) have been completed before you initiate the SCCM ConfigMgr CB console upgrade process. Otherwise, there could be more chances of failures during the SCCM CB console upgrade.
SCCM Console Upgrade
Author
Anoop is Microsoft MVP! He is a Solution Architect in enterprise client management with more than 20 years of experience (calculation done in 2021) in IT. He is a blogger, Speaker, and Local User Group HTMD Community leader. His main focus is on Device Management technologies like SCCM 2012, Current Branch, and Intune. E writes about ConfigMgr, Windows 11, Windows 10, Azure AD, Microsoft Intune, Windows 365, AVD, etc…
Feature Comparison Between SCCM ConfigMgr CB Versions | Configuration Manager Current Branch? SCCM ConfigMgr’s current branch (CB) XXXX has released last Friday (18th Nov 2016). SCCM CB YYYY comes with loads of features, and the up-gradation process via updates and servicing channel is very easy. It’s just a couple of clicks, and you are done with the SCCM CB 1610 upgrade.
You can directly upgrade your SCCM CB 1511 server to 1610. There is no need to go through all the other upgrades (1602 /1606) available in your SCCM CB console. More details are available in the blog post here.
Video
The SCCM CB 1610 up-gradation process is straightforward, as I explained in the previous blog post videohere.
Feature Comparison Between SCCM ConfigMgr CB Versions | Configuration Manager Current Branch
Feature Comparison Between SCCM ConfigMgr CB Versions
In this post, I’m sharing a comparison video of features between SCCM CB 1606 and 1610. These features discussed in the below video are very important for upcoming changes to SCCM ConfigMgr CB.
If you are using a hybrid version of SCCM CB to manage mobile devices and domain-joined machines, then the configuration and compliance policy updates are very important. I think the SCCM team invested loads of time improving the features of their product.
SCCM CB is moving away from old-fashioned boundary-setting like fast and slow boundaries. Rather investing more in current and neighbor boundary groups. This will help to evolve the product further in upcoming versions. Feature Comparison Between SCCM ConfigMgr CB Versions | Configuration Manager Current Branch?
What is New in Version
A version of SCCM 1610 feature comparison includes Boundary groups –
current and neighbor boundary groups, Improvements on Windows Store for business,
Content size filter in Software update ADR and monitoring of loads of components have been updated,
and new dashboards have been included.
List of Feature Comparison Between SCCM ConfigMgr CB Versions
Summery of features which I covered/compared in the following video :-
New Features as part of SCCM CB 1610 updates and servicing
Boundary Changes – Improvements for boundary groups – current boundary group vs neighbor boundary groups
Improvements Windows Store for Business – Modify the client secret key and delete a subscription to the store from SCCM Console
Cloud management gateway for managing Internet-based clients – Cloud management gateway provides a simple way to manage Configuration Manager clients on the Internet.
Immediate Policy sync for MDM channel Intune-enrolled devices
Configuration policies – New policies included in SCCM CB 1610 – Android (23), iOS (4), Mac (4), Windows 10 desktop and mobile (37), Windows 10 Team (7), Windows 8.1 (11), and Windows Phone 8.1 (3).
Windows 10 Edition Upgrade Policy can be applied for SCCM CB 1610 – Now available for Intune and SCCM clients.
Client Agent – Client Peer Cache helps you manage content deployment to clients in remote locations. Peer Cache is a built-in SCCM solution for clients to share content with other clients directly from their local cache. Enable Configuration Manager client in full OS to share content to Yes.
Customizable Branding is also included in the SCCM CB 1610
The enforcement grace period is one of the nice features included in SCCM CB 1610
Another nice feature included in SCCM CB 1610 Software Update ADR is Content Size
Monitoring – Compliance policies Dashboard and Client Data Source Dashboard
Anoop is Microsoft MVP! He is a Solution Architect in enterprise client management with more than 20 years of experience (calculation done in 2021) in IT. He is a blogger, Speaker, and Local User Group HTMD Community leader. His main focus is on Device Management technologies like SCCM 2012, Current Branch, and Intune. E writes about ConfigMgr, Windows 11, Windows 10, Azure AD, Microsoft Intune, Windows 365, AVD, etc…
Loads of people requested a starter kit for Intune as I have one for the SCCM 2012 starter kit, and the SCCM 2012 starter kit page was very useful for the community (I think that is why people are requesting the Intune Starter Kit). In this post, we will mainly concentrate on Intune standalone (not Intune Hybrid and Office 365 Intune MDM).
In most cases, no need/very minimal need for on-prem infrastructure if you are going with Intune standalone and all the other cloud components like Azure Active Directory, Office 365, etc. I’ll keep adding new things to this page. This is just starting 😉
I started working with Intune in the later part of 2012, and Microsoft Intune has evolved during the years, and it has changed a lot. In 2013, I started a post called “Microsoft Intune Wiki” (most of the links in that post are outdated, but it’s worth going through if you want to see how Intune was ?).
We already have a Facebook group for Intune Professionals. If you would like to join the Facebook community of Intune Professionals, click here
Intune Starter Kit a Helping Hand for the ITPros who wanted to Learn Intune
What is Microsoft Intune?
Intune is an enterprise mobility management (EMM) solution from Microsoft. The EMM provider helps manage mobile devices, network settings, and other mobile services and settings. Microsoft Intune is nothing but a combination of Device, Application, Information Protection, Endpoint Protection (antivirus software), and Security/Configuration policy management solution (SaaS) facilitated by Microsoft in Cloud.
Additionally, Intune has features where admins can create a “Conditional Access” policy to get access to company resources. If the devices met those conditions, only Intune would provide access to company or corporate resources (corporate mail, Share point, etc…).
Previously, I mentioned Microsoft Intune as a lighter version of SCCM or ConfigMgrin the cloud. However, I don’t want to make it so simple this time. Intune architecture is entirely cloud-based and agile. To get a more detailed idea about Intune (Yes, this video is old and outdated in some parts as Intune evolved along with entire Microsoft’s Enterprise Mobility and Security (EMS))
Management Options using Intune?
I’m going to explain in a bit different way. Let me know if this is confusing. We can manage devices with an Intune client agent and arguably without an Intune client agent. For example, Intune company portal application(s) in different app stores like Google Play and Apple Store are Intune client agents.
So, when you install Intune company portal onto your Android or iOS devices, you are doing agent-based management. Also, there is Microsoft Intune client MSI available to download once you have a valid Intune subscription. You can download and install it on Windows machines that you want to manage.
I have an old post (published in Dec 2012) here to help you understand the basic stuff about Intune MSI agent installation. Once you install Intune MSI agent on Windows machines, those machines are “fully managed” by Intune.
Intune Starter Kit a Helping Hand for the ITPros who wanted to Learn Intune
So what is arguably agent less Intune management? Within Windows 10, we have an “in build – Native” MDM agent as part of the operating system. We can enroll Windows 10 devices to Intune using the “in build – Native” MDM agent. In this scenario, we have to use Intune company portal to install applications like a shopping cart.
So Intune company portal is not acting as Intune agent in native MDM enrolment scenarios. Native MDM-managed devices are arguably NOT fully managed devices (at this point in time). I’m sure this will change sooner or later. Windows 10 in-build MDM agent can be used to enroll your Windows 10 devices to any other MDM management software VMWare Airwatch, Mobileiron, etc…
Enrolled via Intune company portal
Enrolled via Installation of Intune MSI client
Enrolled via Windows 10 1607 and above in build Azure AD join and MDM enrolment
MAM without MDM enrolment
Intune Starter Kit a Helping Hand for the ITPros who wanted to Learn Intune
How to get an Intune account and start working/Testing with Intune?
Download the Microsoft EMS step-by-step guide from here. This guide will help you to get a trial version of Office 365, Azure AD, and Intune subscription for free. If you already have an Azure AD (Azure AD premium) subscription, things are very straightforward, as I posted in the blog here.
Suppose you don’t have an Azure AD subscription, then better to start with an Enterprise Mobility Suite (EMS) trial account, Azure Free Trial Account (Azure trial account is already created EMS trial account), and Office 365 free trial subscription. To get these trail accounts, it’s better to create a NEW outlook.com account and get ready with Credit Card details to activate the Azure trial subscription.
Getting a trial version of Azure AD, Office 365, and Intune is a very straightforward process if you have never done this same process with your credit card and mobile number. Azure AD and Office 365 are prerequisites for Intune if you want to test/trial all the features of Intune.
Note:- Intune can be signed up separately as well from here. If you feel you are interested in testing only Intune now, this is the way.
How to start using Microsoft Intune Console
Once you have completed the subscription things and you can log in to Microsoft Intune (http://manage.microsoft.com/) portal (Silverlight is a must for Intune console to work). Internet Explorer with Silverlight plugin is the best internet browser for Intune console.
However, Intune console will work on any internet browser which can add Silverlight as a plugin. In the future, maybe, Intune console will work without the Silverlight plugin, and I would love to see this very soon.
The following documentation is where you can start reading about all the Intune topics:- Microsoft documentation Intune quick start guide here.
Intune Starter Kit a Helping Hand for the ITPros who wanted to Learn Intune
How to select the MDM authority from Intune console?
For me, MDM authority and management options are very important. Please note once you set MDM (Mobile Device Management) authority to Intune in the following place at Intune console, then you won’t be able to change it.
To change Intune MDM authority, you have to raise a ticket with CSS or service request via Intune/office 365 portal. So be very careful when you click on any links on the following page at Intune console.
What are types of Management Authority do we have for Intune?
Microsoft Intune
Configuration Manager (SCCM)
Office 365 (lightweight Intune)
Quick question:- Do I need to re-enroll devices if MDM authority is changed from o365 MDM to Intune MDM? – It is working without re-enrolment of devices, just a compliance check, and everything looks ok on the device. I think I heard it’s supported as both use Intune for MDM.
Intune Starter Kit a Helping Hand for the ITPros who wanted to Learn Intune
How to start managing Windows/iOS /Android devices with Intune?
Managing Windows devices is very straightforward. Yes, Windows 10 management is very straightforward; earlier we need to have side loading and key SEP certificates to manage/deploy app Windows, windows phone devices.
Now, most of these certificates and sideloading key requirements have been removed for most scenarios. Managing Android devices is also very straightforward. It’s 10 minutes of work to sync your Windows Store for Business and Microsoft Intune. More details in the post “Integrate Windows Store for business” are here.
If you want to install store apps without using a Microsoft account, read the blog post “How to Add Apps to Business Store and Install Intune Company Portal without Using MS Account” here.
However, iOS\MAC OS device management has certificate requirements, and we need to go to the apple portal, upload your cert for the tenant, and get the certificate for your Intune tenant.
The process for SCCM CB is explained in the following video, but the process is similar for Intune. More details here Microsoft document specifically for Intune.
How to Deploy MSI applications to Windows PCs using Intune?
Similar to SCCM, Intune can also deploy different kinds of applications to different types of devices. The types of applications that Intune supports now are EXE, MSI (Windows Installer and Windows Installer through MDM), APK, IPA, XAP, APPX – APPXBUNDLE for Windows app package and Windows Phone app package. We can make software or application available to devices via 3 methods.
Intune Starter Kit a Helping Hand for the ITPros who wanted to Learn Intune
1. Software Installer – select the type of software you want to install 2. External Link – this can be used for deploying the applications in Google Store via deep linking 3. Managed iOS apps from Apps Store – this can be used to deploy the apps in the apple store via the deep linking method
The following post will help understand the process of deploying applications using Intune “How to Deploy Applications and MAM Policies to Mobile Devices Using Intune Part 1” – here. More details about deploying the application via Intune are given in the following links here and here.
How to create policies within Intune console?
Creating policies in Intune are one of the other thing important step as part of Intune configuration and device management through Intune. Following is the list of policies you can create and deploy via Intune.
Configuration Policies
Compliance Policies
Dynamics CRM Online Conditional Access Policy
Exchange Online Conditional Access Policy
Exchange On-premises Conditional Access Policy
SharePoint Online Conditional Access Policy
Skype for Business Online Conditional Access Policy
MAM Application Policy
MAM Browser Policy
What is the difference between Intune Configuration Policy and Intune Compliance Policy:- In some cases, you can see similar kinds of settings in compliance and configuration policies. So what is the exact difference? Compliance policy works with conditional access policies however configuration policies are independent of conditional access. Compliance policies can deploy ONLY to USERS, whereas Configuration policies can be deployed to both Devices and Users.
Compliance policy won’t force the device to change the configuration at device rather it will wait until the device gets into the compliance stage to provide access to company resources like mail/SharePoint (in case of Conditional access policy is set). Configuration policy forces the device or user to change the configuration setting mentioned in the policy (arguably not true in all the scenarios).
The following video will explain to you how to create and Deploy Intune Compliance Policies from the console.
What are MAM (Mobile Application Management) policies?
Mobile Application Management policies are application specific policies that you can set up via Intune. What is the difference between configuration, Compliance policies, and MAM policies? Configuration and Compliance policies are for the entire device. It’s applicable for everything on the device. MAM policies will get applied only to the application with which it’s associated.
The following post will guide you through the process of deploying MAM policies to iOS or Android devices “How to Deploy Applications and MAM Policies to Mobile Devices Using Intune” – here. Microsoft Intune documentation about MAM policy creation here.
Intune Starter Kit a Helping Hand for the ITPros who wanted to Learn Intune
What is MAM without MDM enrolment (MAM WE – MAM Less MDM)?
This one another policy type in Intune. What is the difference between MAM with MDM enrolment and MAM without MDM enrolment? This is Mobile Application Management policies without enrolling to Intune. These policies are really helpful in BYOD/personal devices to get access to corporate mail and SharePoint, etc., securing the corporate data.
Why Intune option is visible in the Azure portal (https://portal.azure.com/)? This is good news for SCCM/Intune admins. We are getting new features in Intune. This time it’s Intune MAM (Mobile Application Management) without MDM enrolment.
For full management of mobile devices, we need to use the original Intune portal (https://manage.microsoft.com). It was a regular question in forums and other communities that can Intune coexist with other MDM products like Airwatch or Mobile Iron. More details here.
How to Manually Add Users to Intune Console?
How to add users to Intune console, and how to provide permissions to users in Intune console? We don’t have to do this when Intune Silverlight console is migrated to the Azure portal?? Before you try to provide service administrator access (Only limited roles available in Intune Silverlight console Full Access, Read-Only access, or Helpdesk – Group Node access) to users in Intune, you should make sure the administrator or server administrator user is already available in Intune administrator console. More info here.
Author
Anoop is Microsoft MVP! He is a Solution Architect in enterprise client management with more than 20 years of experience (calculation done in 2021) in IT. He is a blogger, Speaker, and Local User Group HTMD Community leader. His main focus is on Device Management technologies like SCCM 2012, Current Branch, and Intune. E writes about ConfigMgr, Windows 11, Windows 10, Azure AD, Microsoft Intune, Windows 365, AVD, etc…
Are You Having Issue with Windows 10 WIP EDP SCCM CB Configuration Manager ConfigMgr Endpoint Protection?
Are you having issues with Windows Information Protection (WIP, previously known as “Enterprise Data Protection – EDP”) policies configured through SCCM ConfigMgr CB 1606 production version?
If so, I was one of you. Here I’m talking about the issue I faced during the deployment of the WIP policy via the Windows 10 MDM channel. I will try to explain the issue which I had with WIP CI (for the specific scenario which I tested):-
Windows Information Protection = WIP
When you open WIP CI and try to check whether everything is ok or not and exit out of CI with/without doing any changes, it will automatically change some values in CI XML, which will break the entire CI.
I’ve embedded a video below that will explain this bug/issue in more detail. If you are new to WIP/EDP and want to know how to create, deploy, and test WIP with Windows 10, look at my previous post and video here.
The good news is that the new rollup update (KB3186654) released by Microsoft most probably fixed this issue. I have done extensive testing with Windows Information Protection (WIP) policies/CIs after installing the new rollup on SCCM CB 1606 server, and the results are very promising.
Are You Having Issue with Windows 10 WIP EDP SCCM CB Configuration Manager ConfigMgr Endpoint Protection
I tried creating new WIP CIs, editing the existing WIP CIs, etc…All the scenarios which I tested worked well for me. I tested this with Windows 10 1607 build Build numbers 14393.00 and 14393.82 (via MDM channel). Are You Having Issue with Windows 10 WIP EDP SCCM CB Configuration Manager ConfigMgr Endpoint Protection?
EDP WIP CI Known Issue with SCCM CB 1606 before installing Rollup Update KB 3186654
https://youtube.com/watch?v=TA9aXAHZTms
Are You Having Issue with Windows 10 WIP EDP SCCM CB Configuration Manager ConfigMgr Endpoint Protection
How to Create – Deploy WIP EDP Using SCCM CB 1606 and End-user experience of WIP:-
Are You Having Issue with Windows 10 WIP EDP SCCM CB Configuration Manager ConfigMgr Endpoint Protection?
Are You Having Issue with Windows 10 WIP EDP SCCM CB Configuration Manager ConfigMgr Endpoint Protection
Sample of the correct WIP CI with correct ConstantValue
Anoop is Microsoft MVP! He is a Solution Architect in enterprise client management with more than 20 years of experience (calculation done in 2021) in IT. He is a blogger, Speaker, and Local User Group HTMD Community leader. His main focus is on Device Management technologies like SCCM 2012, Current Branch, and Intune. E writes about ConfigMgr, Windows 11, Windows 10, Azure AD, Microsoft Intune, Windows 365, AVD, etc…
