You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
@@ -268,7 +268,7 @@ For Managed Google Play apps deployed to Android Enterprise personally-owned wor
268
268
269
269
## Working with Managed Google Play closed testing tracks
270
270
271
-
You can distribute a non-production version of a Managed Google Play app to devices enrolled in an Android Enterprise scenario (**Android Enterprise personally-owned work profile (BYOD)**, **Android Enterprise fully managed (COBO)**, **Android Enterprise dedicated devices (COSU)**, and **Android Enterprise corporate-owned work profile (COPE)**) in order to perform testing. In Intune, you can see whether an app has a pre-production build test track published to it, as well as be able to assign that track to Azure Active Directory user groups or device groups. The workflow for assigning a production version to a group that currently exists is the same as assigning a non-production channel. After deployment, the install status of each track will correspond with the track's version number in Managed Google Play. For more information, see [Google Play's closed test tracks for app pre-release testing](https://support.google.com/googleplay/android-developer/answer/3131213).
271
+
You can distribute a non-production version of a Managed Google Play app to devices enrolled in an Android Enterprise scenario (**Android Enterprise personally-owned work profile (BYOD)**, **Android Enterprise fully managed (COBO)**, **Android Enterprise dedicated devices enrolled with Azure AD shared mode (aka COSU)**, and **Android Enterprise corporate-owned work profile (COPE)**) in order to perform testing. In Intune, you can see whether an app has a pre-production build test track published to it, as well as be able to assign that track to Azure Active Directory user groups or device groups. The workflow for assigning a production version to a group that currently exists is the same as assigning a non-production channel. After deployment, the install status of each track will correspond with the track's version number in Managed Google Play. For more information, see [Google Play's closed test tracks for app pre-release testing](https://support.google.com/googleplay/android-developer/answer/3131213).
272
272
273
273
> [!NOTE]
274
274
> Required app deployments for non-production app tracks are currently unavilable for devices enrolled in Android Enterprise personally-owned work profile (BYOD).
@@ -285,6 +285,10 @@ When necessary, you can delete Managed Google Play apps from Microsoft Intune. T
285
285
286
286
You can enable an Android Enterprise system app for [Android Enterprise dedicated devices](../enrollment/android-kiosk-enroll.md) or [fully managed devices](../enrollment/android-fully-managed-enroll.md). For more information about adding an Android Enterprise system app, see [Add Android Enterprise system apps to Microsoft Intune](apps-ae-system.md).
287
287
288
+
## MAM policies with AE dedicated devices enrolled with Azure AD shared mode
289
+
290
+
Intune-managed Android Enterprise dedicated devices enrolled with Azure AD shared mode can receive MAM policies and can be targeted separately from other Android enterprise devices. ntune-managed Android Enterprise dedicated devices that are not in Shared Device Mode will continue to be blocked from getting MAM. For more information about Intune-managed Android Enterprise dedicated devices enrolled with Azure AD shared mode, see [Android Enterprise dedicated devices](../fundamentals/deployment-guide-enrollment-android.md#android-enterprise-dedicated-devices).
@@ -300,7 +300,7 @@ For more information about notifications, see [Receive a custom notification](..
300
300
301
301
## Configure feedback settings for Company Portal and Microsoft Intune apps
302
302
303
-
There are a number of M365 enterprise policies which affect whether feedback must be enabled or disabled for currently logged users. These policies are available via the [Microsoft 365 Apps admin center](https://config.office.com/). In relation to Microsoft Intune, these policies affect feedback and surveys for the Intune Company Portal app and Microsoft Intune app.
303
+
There are a number of M365 enterprise policies which affect whether feedback must be enabled or disabled for currently logged users. These policies are available via the [Microsoft 365 Apps admin center](https://config.office.com/). In relation to Microsoft Intune, these policies affect feedback and surveys for the Intune Company Portal app, the Web Company Portal, and Microsoft Intune app.
304
304
305
305
M365 feedback policies include the following policies:
Copy file name to clipboardExpand all lines: memdocs/intune/enrollment/android-aosp-corporate-owned-user-associated-enroll.md
+5-3Lines changed: 5 additions & 3 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -8,7 +8,7 @@ keywords:
8
8
author: Lenewsad
9
9
ms.author: lanewsad
10
10
manager: dougeby
11
-
ms.date: 02/10/2022
11
+
ms.date: 06/27/2022
12
12
ms.topic: how-to
13
13
ms.service: microsoft-intune
14
14
ms.subservice: enrollment
@@ -81,7 +81,9 @@ Create an enrollment profile to enable enrollment on devices.
81
81
4. Select **Next**. Review the details of your profile and then select **Create** to save the profile.
82
82
83
83
### Access enrollment token
84
-
After you create a profile, Intune generates a token that's needed for enrollment. To access the token:
84
+
After you create a profile, Intune generates a token that's needed for enrollment. The token appears as a QR code. During device setup, when prompted to, scan the QR code to enroll the device in Intune.
85
+
86
+
To access the token:
85
87
86
88
1. Go to **Corporate-owned, user-associated devices**.
87
89
2. From the list, select your enrollment profile.
@@ -92,7 +94,7 @@ Another way to find the token is:
92
94
2. Locate your profile in the list, and then select the **More** (**...**) menu that's next to it.
93
95
3. Select **View enrollment token**.
94
96
95
-
The token appears as a QR code. During device setup, when prompted to, scan the QR code to enroll the device in Intune.
97
+
For devices that can't scan QR codes, you can export the enrollment profile JSON file and QR code image.
96
98
97
99
> [!IMPORTANT]
98
100
>- The QR code will contain any credentials provided in the profile in plain text to allow the device to successfully authenticate with the network. This is required as the user will not be able to join a network from the device.
Copy file name to clipboardExpand all lines: memdocs/intune/enrollment/macos-enroll.md
+3-7Lines changed: 3 additions & 7 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -8,7 +8,7 @@ keywords:
8
8
author: Lenewsad
9
9
ms.author: lanewsad
10
10
manager: dougeby
11
-
ms.date: 03/29/2022
11
+
ms.date: 06/27/2022
12
12
ms.topic: overview
13
13
ms.service: microsoft-intune
14
14
ms.subservice: enrollment
@@ -66,13 +66,9 @@ Intune supports the following enrollment methods for company-owned macOS devices
66
66
-[Device enrollment manager (DEM)](device-enrollment-manager-enroll.md): Use this method for large-scale deployments and when there are multiple people in your organization who can help with enrollment setup. Someone with device enrollment manager (DEM) permissions can enroll up to 1,000 devices with a single Azure Active Directory account. This method uses the Company Portal app or Microsoft Intune app to enroll devices. You can't use a DEM account to enroll devices via Automated Device Enrollment.
67
67
-[Direct enrollment](device-enrollment-direct-enroll-macos.md): Direct enrollment enrolls devices with no user affinity, so this method is best for devices that aren't associated with a single user. This method requires you to have physical access to the Macs you're enrolling.
68
68
69
-
## Bootstrap tokens (preview)
70
-
71
-
> [!IMPORTANT]
72
-
> This feature is in [public preview](../fundamentals/public-preview.md).
73
-
74
-
Intune supports the use of bootstrap tokens on enrolled Macs running macOS 10.15 or later. Bootstrap tokens grant volume ownership status to local user and guest accounts, so that non-admin users can approve important operations that an admin would otherwise need to do. Operations such as:
69
+
## Bootstrap tokens
75
70
71
+
Intune supports the use of bootstrap tokens on enrolled Macs running macOS 10.15 or later. Bootstrap tokens grant volume ownership status to local user and guest accounts so that non-admin users can approve important operations that an admin would otherwise need to do. Operations such as:
Copy file name to clipboardExpand all lines: memdocs/intune/fundamentals/azure-virtual-desktop-multi-session.md
+18-5Lines changed: 18 additions & 5 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -33,7 +33,7 @@ ms.collection:
33
33
34
34
Azure Virtual Desktop multi-session with Microsoft Intune is now generally available.
35
35
36
-
You can now use Microsoft Intune to manage Windows 10 or Windows 11 Enterprise multi-session remote desktops in the Microsoft Endpoint Manager admin center just as you can manage a shared Windows 10 or Windows 11 client device. When managing such virtual machines (VMs), you must use device-based configurations. Such configurations require user-less enrollments.
36
+
You can now use Microsoft Intune to manage Windows 10 or Windows 11 Enterprise multi-session remote desktops in the Microsoft Endpoint Manager admin center just as you can manage a shared Windows 10 or Windows 11 client device. When managing such virtual machines (VMs), you'll be able to use both device-based and user configuration.
37
37
38
38
Windows 10 or Windows 11 Enterprise multi-session is a new Remote Desktop Session Host exclusive to [Azure Virtual Desktop](/azure/virtual-desktop/) on Azure. It provides the following benefits:
39
39
@@ -45,8 +45,18 @@ You can manage **Windows 10** and **Windows 11 Enterprise multi-session** VMs cr
45
45
46
46
## Overview
47
47
48
-
Microsoft Intune only supports managing Windows 10 or Windows 11 Enterprise multi-session with device configurations. This means only [policies defined in the OS scope](/windows/client-management/mdm/policy-configuration-service-provider) and apps configured to install in the system context can be applied to Azure Virtual Desktop multi-session VMs. Additionally, all multi-session configurations must be targeted to devices or device groups. User scope policies aren't supported at this time.
48
+
Device configuration support in Microsoft Intune for Windows 10 or Windows 11 Enterprise multi-session is Generally Available (GA). This means [policies defined in the OS scope](/windows/client-management/mdm/policy-configuration-service-provider) and apps configured to install in the system context can be applied to Azure Virtual Desktop multi-session VMs. Additionally, multi-session configurations can be targeted to devices or device groups.
49
49
50
+
User configuration support in Microsoft Intune for Windows 11 multi-session VMs is in public preview. With this you'll be able to:
51
+
52
+
- Configure user scope policies using **Settings catalog** and assign to groups of users. You can use the search bar to search all configurations with scope set to "user".
53
+
54
+
- Configure user certificates and assign to users.
55
+
56
+
- Configure PowerShell scripts to install in the user context and assign to users.
57
+
58
+
> [!NOTE]
59
+
> User configuration support for Windows 10 multi-session builds will be available later this year.
50
60
51
61
## Prerequisites
52
62
@@ -70,7 +80,7 @@ See [What is Azure Virtual Desktop?](/azure/virtual-desktop/overview#requirement
70
80
71
81
Windows 10 or Windows 11 Enterprise multi-session VMs are treated as a separate OS edition and some Windows 10 or Windows 11 Enterprise configurations won’t be supported for this edition. Using Microsoft Intune doesn't depend on or interfere with Azure Virtual Desktop management of the same VM.
72
82
73
-
## Create the device configuration profile
83
+
## Create the configuration profile
74
84
75
85
To configure configuration policies for Windows 10 or Windows 11 Enterprise multi-session VMs, you'll need to use the [Settings catalog](../configuration/settings-catalog.md) in the Microsoft Endpoint Manager admin center.
76
86
@@ -95,7 +105,7 @@ Microsoft Intune won't deliver unsupported templates to multi-session devices, a
95
105
-**Key**: **OS edition**
96
106
-**Operator**: **==**
97
107
-**Value**: **Enterprise multi-session**
98
-
- Select **Apply**. The filtered list now shows all configuration profile categories that support Windows 10 or Windows 11 Enterprise multi-session. You can see the scope for the policy in parentheses (Device or User). Currently, only device settings are supported for multi-session.
108
+
- Select **Apply**. The filtered list now shows all configuration profile categories that support Windows 10 or Windows 11 Enterprise multi-session. The scope for a policy is shown in parantheses. For user scope it shows as (User) and all the rest are policies with device scope.
99
109
8. From the filtered list, pick the categories that you want.
100
110
- For each category you pick, select the settings that you want to apply to your new configuration profile.
101
111
- For each setting, select the value that you want for this configuration profile.
@@ -110,6 +120,7 @@ Windows 10 or Windows 11 Administrative Templates are supported for Windows 10 o
110
120
111
121
- ADMX-backed policies are supported. Some policies aren't yet available in the Settings catalog.
112
122
- ADMX-ingested policies are supported, including Office and Microsoft Edge settings available in Office administrative template files and Microsoft Edge administrative template files. For a complete list of ADMX-ingested policy categories, see [Win32 and Desktop Bridge app policy configuration](/windows/client-management/mdm/win32-and-centennial-app-policy-configuration#overview). Some ADMX ingested settings won't be applicable to Windows 10 or Windows 11 Enterprise multi-session.
123
+
- ADMX - ingested policies are not supported for user targetting at this time.
113
124
114
125
## Compliance and Conditional access
115
126
@@ -163,7 +174,9 @@ All Windows 10 or Windows 11 apps can be deployed to Windows 10 or Windows 11 En
163
174
164
175
## Script deployment
165
176
166
-
Scripts configured to run in the system context are supported on Windows 10 or Windows 11 Enterprise multi-session. This can be configured under Script settings by setting **Run this script using the logged on credentials** to **No**.
177
+
Scripts configured to run in the system context and assigned to devices are supported on Windows 10 or Windows 11 Enterprise multi-session. This can be configured under Script settings by setting **Run this script using the logged on credentials** to **No**.
178
+
179
+
Scripts configured to run in the user context and assigned to users are supported on Windows 11 Enterprise multi-session. This can be configured under Script settings by setting **Run this script using the logged on credentials** to **Yes**.
Copy file name to clipboardExpand all lines: memdocs/intune/protect/endpoint-security.md
+27-4Lines changed: 27 additions & 4 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -7,7 +7,7 @@ keywords:
7
7
author: brenduns
8
8
ms.author: brenduns
9
9
manager: dougeby
10
-
ms.date: 11/16/2021
10
+
ms.date: 06/21/2022
11
11
ms.topic: overview
12
12
ms.service: microsoft-intune
13
13
ms.subservice: protect
@@ -82,7 +82,7 @@ To learn more about using Security tasks, see [Use Intune to remediate vulnerabi
82
82
83
83
## Use policies to manage device security
84
84
85
-
As a security admin, use the security policies that are found under *Manage* in the Endpoint security node. With these policies, you can configure device security without the overhead of navigating the larger body and range of settings from device configuration profiles and security baselines.
85
+
As a security admin, use the security policies that are found under *Manage* in the Endpoint security node. With these policies, you can configure device security without having to navigate the larger body and range of settings in device configuration profiles or security baselines.
0 commit comments