You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
description: When you purchase licenses for Premium add-ons for Microsoft Intune, you expand the capabilities for device management with Microsoft Endpoint Manager.
7
+
keywords:
8
+
author: smbhardwaj
9
+
ms.author: smbhardwaj
10
+
manager: dougeby
11
+
ms.date: 04/05/2022
12
+
ms.topic: conceptual
13
+
ms.service: microsoft-intune
14
+
ms.subservice: fundamentals
15
+
ms.localizationpriority: high
16
+
17
+
# optional metadata
18
+
19
+
#ROBOTS:
20
+
#audience:
21
+
22
+
ms.reviewer: aanavath
23
+
ms.suite: ems
24
+
search.appverid: MET150
25
+
#ms.tgt_pltfrm:
26
+
ms.custom: intune-azure
27
+
ms.collection:
28
+
- M365-identity-device-management
29
+
- highpri
30
+
---
31
+
32
+
# Use Premium add-ons capabilities with Intune
33
+
34
+
Microsoft Endpoint Manager now offers Premium add-ons. You can find premium add-ons in Intune under **Tenant administration** > **Premium add-ons**. The **Summary** blade shows all premium add-ons that have been released, a short description, and the status of the add-on. You can view the status of each add-on as either **Active** or **Available for trial or purchase**.
35
+
36
+
Licenses for the Premium add-ons can be added for an additional cost to the licensing options that include Microsoft Endpoint Manager or Intune.
37
+
38
+
Global and Billing administrators can use the **Premium add-ons** page from the [Microsoft 365 admin center](https://admin.microsoft.com) to start a free trial or purchase licenses for each Premium add-on.
39
+
40
+
> [!NOTE]
41
+
Premium add-ons are currently not supported in Sovereign clouds.
42
+
43
+
## What add-ons capabilities are available
44
+
45
+
The following Premium add-ons are available:
46
+
47
+
-[Remote help](..\remote-actions\remote-help.md)
48
+
49
+
## What happens when you try/buy the Premium add-ons capability
50
+
51
+
Global and Billing administrators can choose to start free trials or purchase licenses for Premium add-ons through the [Microsoft 365 admin center](https://admin.microsoft.com).
52
+
53
+
Starting a free trial gives you a 90-day period to use the Premium add-on capability without any charge. Trials can be up to 250 users per tenant. At the end of the trial period, there's a 30-day grace period. After this point, you'll be unable to use the Premium add-on capability in Endpoint Manager for users within your tenant unless you've purchased the appropriate licenses. There's a one-time limit to start a trial for each tenant.
54
+
55
+
Purchasing licenses lets you use the Premium add-on capability in your tenant for the duration in which the licenses are active on your tenant based on the option selected during the Billing process.
56
+
57
+
## How to try or buy the premium add-ons capability
58
+
59
+
Premium add-on capabilities are disabled in [Microsoft Endpoint Manager admin center](https://go.microsoft.com/fwlink/?linkid=2109431) unless you are in the free trial period or have purchased licenses. Global and Billing administrators can choose to start a free trial or purchase licenses for Premium add-ons through the [Microsoft 365 admin center](https://admin.microsoft.com).
60
+
61
+
Administrators who aren't Global or Billing administrators can still see the status of their tenant's Premium add-ons trial or active licenses in the centralized Premium add-on page in Endpoint Manager (but can't start a free trial or purchase licenses).
62
+
63
+
### How to start a trial through the Microsoft 365 admin center
64
+
65
+
1. Navigate to **Tenant administration** > **Premium add-ons** as a Global or Billing administrator.
66
+
2. Find the Premium add-on to start a trial. For add-ons that say **Available for trial or purchase** in their status, you don't have a free trial started or any licenses purchased for those add-ons.
67
+
3. Click **View details** and see the details. :::image type="content" source="./media/premium-add-ons/remote-help-details.png" alt-text="Remote help details.":::
68
+
4. Click the **To try or buy, go to Purchase services** link to navigate to the Microsoft 365 Admin Center. A new tab opens on the **Product details** page for the relevant Premium add-on. :::image type="content" source="./media/premium-add-ons/remote-help-product-details.png" alt-text="Remote help product details.":::
69
+
5. In the Microsoft 365 Admin Center, follow the prompts to **Start free trial** and confirm your order. :::image type="content" source="./media/premium-add-ons/confirm-order.png" alt-text="Confirm order.":::
70
+
6. Navigate to **Tenant administration** > **Premium add-ons** and see that the Premium add-on capability you added is now **Active**.
71
+
72
+
### How to purchase premium add-ons
73
+
74
+
Licenses for Premium add-ons can be purchased just as you would purchase Intune licenses through the following ways:
75
+
76
+
- web direct purchase in the Microsoft 365 Admin Center
77
+
- Microsoft Volume License Servicing Center (VLSC)
78
+
- existing relationships with Microsoft partners/resellers
79
+
80
+
After you buy licenses via any source, the licenses are available in your Tenant and the status of the Premium add-ons capability will update accordingly.
81
+
82
+
## How to assign licenses
83
+
84
+
For information on how to assign licenses in Microsoft Endpoint Manager admin center, see [Assign Microsoft Intune licenses](licenses-assign.md)
85
+
86
+
## Monitor license use
87
+
88
+
Each of the Premium add-ons might have their own requirements for how many licenses need to be purchased.
89
+
90
+
-[Remote help](..\remote-actions\remote-help.md)
91
+
92
+
## Next steps
93
+
94
+
Learn about [Remote help](..\remote-actions\remote-help.md).
Copy file name to clipboardExpand all lines: memdocs/intune/fundamentals/whats-new.md
+13-1Lines changed: 13 additions & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -7,7 +7,7 @@ keywords:
7
7
author: Erikre
8
8
ms.author: erikre
9
9
manager: dougeby
10
-
ms.date: 03/25/2022
10
+
ms.date: 04/05/2022
11
11
ms.topic: conceptual
12
12
ms.service: microsoft-intune
13
13
ms.subservice: fundamentals
@@ -60,6 +60,18 @@ You can use RSS to be notified when this page is updated. For more information,
60
60
### Scripts
61
61
-->
62
62
63
+
## Week of April 4, 2022
64
+
65
+
### Device management
66
+
67
+
#### Microsoft Endpoint Manager premium add-ons<!-- 12953253 -->
68
+
69
+
Microsoft Endpoint Manager is introducing a new centralized experience to help IT admins identify premium add-on capabilities. These capabilities can be added for an additional licensing cost available for Microsoft Endpoint Manager using Intune. The first premium add-on is Remote Help.
70
+
71
+
You can find premium add-ons in Intune under **Tenant administration** > **Premium add-ons**. The **Summary** blade shows all premium add-ons that have been released, a short description, and the status of the add-on. You can view the status of each add-on as either **Active** or **Available for trial or purchase**. The premium add-ons capability can be used by Global and Billing administrators to start trials or purchase licenses for premium add-ons.
72
+
73
+
For more information about Premium add-ons, see [Use Premium add-ons capabilities with Intune](../fundamentals/premium-add-ons.md).
Copy file name to clipboardExpand all lines: memdocs/intune/protect/app-based-conditional-access-intune.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -67,7 +67,7 @@ In this example, the admin has applied app protection policies to the Outlook ap
67
67
68
68
1. The user tries to authenticate to Azure AD from the Outlook app.
69
69
70
-
2. The user gets redirected to the app store to install a broker app when trying to authenticate for the first time. The broker app can be either the Microsoft Authenticator for iOS, or the Microsoft Company portal for Android devices.
70
+
2. The user gets redirected to the app store to install a broker app when trying to authenticate for the first time. The broker app can be the Microsoft Authenticator for iOS, or either the Microsoft Authenticator or Microsoft Company portal for Android devices.
71
71
72
72
If users try to use a native e-mail app, they'll be redirected to the app store to then install the Outlook app.
Copy file name to clipboardExpand all lines: memdocs/intune/protect/conditional-access-integrate-jamf.md
+19-7Lines changed: 19 additions & 7 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -49,6 +49,7 @@ You need the following to configure Conditional Access with Jamf Pro:
49
49
50
50
- Jamf Pro 10.1.0 or later
51
51
- Microsoft Intune and Microsoft AAD Premium P1 licenses (recommended Microsoft Enterprise Mobility + Security license bundle)
52
+
- Global admin role in Azure Active Directory.
52
53
- A user with Microsoft Intune Integration privileges in Jamf Pro
53
54
-[Company Portal app for macOS](https://aka.ms/macoscompanyportal)
54
55
- macOS devices with OS X 10.12 Yosemite or later
@@ -107,12 +108,19 @@ To connect Intune with Jamf Pro:
107
108
8. Next, we will add permissions to update device attributes. At the top left of the **API permissions** page, select **Add a permission** to add a new permission.
108
109
109
110
9. On the **Request API permissions** page, select **Intune**, and then select **Application permissions**. Select only the check box for **update_device_attributes** and save the new permission.
111
+
10. Under **Microsoft Graph**, select **Application permissions**, then select **Application.Read.All**.
110
112
111
-
10. Next, grant admin consent for this app by selecting **Grant admin consent for _\<your tenant>_** in the top left of the **API permissions** page. You may need to re-authenticate your account in the new window and grant the application access by following the prompts.
113
+
11. Select **Add permissions**.
112
114
113
-
11. Refresh the page by click on the **Refresh** button at the top of the page. Confirm that admin consent has been granted for the **update_device_attributes** permission.
115
+
12. Navigate to **APIs my organization uses**. Search for and select **Windows Azure Active Directory**. Select **Application permissions**, and then select **Application.Read.All**.
114
116
115
-
12. After the app is registered successfully, the API permissions should only contain one permission called **update_device_attributes** and should appear as follows:
117
+
13. Select **Add permissions**.
118
+
119
+
14. Next, grant admin consent for this app by selecting **Grant admin consent for _\<your tenant>_** in the top left of the **API permissions** page. You may need to re-authenticate your account in the new window and grant the application access by following the prompts.
120
+
121
+
15. Refresh the page by selecting **Refresh** at the top of the page. Confirm that admin consent has been granted for the **update_device_attributes** permission.
122
+
123
+
16. After the app is registered successfully, the API permissions should only contain one permission called **update_device_attributes** and should appear as follows:
@@ -135,10 +143,14 @@ The app registration process in Azure AD is complete.
135
143
136
144
1. Activate the connection in the Jamf Pro console:
137
145
138
-
1. Open the Jamf Pro console and navigate to **Global Management** > **Conditional Access**. Click the **Edit** button on the **macOS Intune Integration** tab.
139
-
2. Select the check box for **Enable Intune Integration for macOS**.
140
-
3. Provide the required information about your Azure tenant, including **Location**, **Domain name**, the **Application ID**, and the value for the *client secret* that you saved when you created the app in Azure AD.
141
-
4. Select **Save**. Jamf Pro tests your settings and verifies your success.
146
+
1. Open the Jamf Pro console and navigate to **Global Management** > **Conditional Access**. Select **Edit** on the **macOS Intune Integration** tab.
147
+
2. Select the check box for **Enable Intune Integration for macOS**. When this setting is enabled, Jamf Pro sends inventory updates to Microsoft Intune. Clear the selection if you want to disable the connection but save your configuration.
148
+
3. Select **Manual** under **Connection type**.
149
+
4. From the **Sovereign Cloud** pop-up menu, select the location of your Sovereign Cloud from Microsoft.
150
+
5. Select **Open administrator consent URL** and follow the onscreen instructions to allow the Jamf Native macOS Connector app to be added to your Azure AD tenant.
151
+
6. Add the **Azure AD Tenant Name** from Microsoft Azure.
152
+
7. Add the **Application ID** and **Client Secret** (previously called Application Key) for the Jamf Pro application from Microsoft Azure.
153
+
8. Select **Save**. Jamf Pro tests your settings and verifies your success.
142
154
143
155
Return to the **Partner device management** page in Intune to complete the configuration.
Copy file name to clipboardExpand all lines: memdocs/intune/protect/mde-security-integration.md
+7-3Lines changed: 7 additions & 3 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -7,7 +7,7 @@ keywords:
7
7
author: brenduns
8
8
ms.author: brenduns
9
9
manager: dougeby
10
-
ms.date: 01/12/2022
10
+
ms.date: 04/05/2022
11
11
ms.topic: how-to
12
12
ms.service: microsoft-intune
13
13
ms.subservice: protect
@@ -46,7 +46,7 @@ This scenario extends the Microsoft Endpoint Manager Endpoint Security surface t
46
46
47
47
## Monitor status
48
48
49
-
Status and reports for MDE policies are available from the policy node under Endpoint security in the Microsoft Endpoint Manager admin center.
49
+
Status and reports for policies targeted at devices in this channel are available from the policy node under Endpoint security in the Microsoft Endpoint Manager admin center.
50
50
51
51
Drill in to the policy type, Antivirus or Firewall, and then select the policy to view its status. Policies for MDE have a *Policy type* of either *Microsoft Defender Antivirus (Preview)* or *Microsoft Defender Firewall (Preview)*.
52
52
@@ -58,6 +58,10 @@ When you select a policy, you'll see information about the device check-in statu
58
58
59
59
## Known limitations and considerations
60
60
61
+
### Assignment Filters and Security Management for Microsoft Defender for Endpoint
62
+
63
+
Assignment filters are not supported for devices communicating through the Microsoft Defender for Endpoint channel. While assignment filters can be added to a policy that could be targeted at these devices, the device will ignore assignment filters. For assignment filter support, the device must be enrolled in to Microsoft Endpoint Manager.
64
+
61
65
### Co-existence with Microsoft Endpoint Configuration Manager
62
66
63
67
When using Configuration Manager, the best path for management of security policy is using the [Configuration Manager tenant attach](../../configmgr/tenant-attach/endpoint-security-get-started.md). In some environments it may be desired to use Security Management for Microsoft Defender for Endpoint. When using Security Management for Microsoft Defender for Endpoint with Configuration Manager, endpoint security policy should be isolated to a single control plane. Controlling policy through both channels will create the opportunity for conflicts and undesired results.
@@ -76,7 +80,7 @@ The following security settings are pending deprecation. The Security Management
### Managing Security Configurations on domain controllers
83
+
### Managing security configurations on domain controllers
80
84
81
85
Currently, devices are not supported to complete a Hybrid Join to Azure Active Directory. Since an Azure Active Directory trust is required, domain controllers aren't currently supported. We are looking at ways to add support in the future.
0 commit comments