You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: memdocs/intune/fundamentals/whats-new.md
+14Lines changed: 14 additions & 0 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -76,6 +76,20 @@ For related information, see [Endpoint management documentation]( ../../index.ym
76
76
77
77
Windows Company Portal now displays a grace period status to account for devices that don't meet compliance requirements but are still within their given grace period. Users are shown the date by which they need to become compliant and the instructions for how to become compliant. If users don't update their device by the given date, their device status changes to noncompliant. For more information about setting grace periods, see [Configure compliance policies with actions for noncompliance](../protect/actions-for-noncompliance.md#available-actions-for-noncompliance) and [Check access from Device details page](../user-help/check-device-access-windows-cpapp.md#check-access-from-device-details-page).
78
78
79
+
#### Linux device management available in Microsoft Intune<!-- 14616038 -->
80
+
81
+
Microsoft Intune now supports Linux device management for devices running Ubuntu Desktop 22.04 or 20.04 LTS. Intune admins don't need to do anything to enable Linux enrollment in the Microsoft Endpoint Manager admin center. Linux users can [enroll supported Linux devices](../user-help/enroll-device-linux.md) on their own and use the Microsoft Edge browser to access corporate resources online.
82
+
83
+
In the admin center, you can:
84
+
85
+
- Enforce Conditional Access policies in Microsoft Edge.
86
+
-[Create a Linux device compliance policy](../protect/device-compliance-get-started.md#device-compliance-policies) with rules about:
87
+
- Allowed distributions
88
+
- Custom compliance
89
+
- Device encryption
90
+
- Password policy
91
+
-[Apply custom compliance settings](../protect/compliance-use-custom-settings.md) using POSIX-complaint shell scripts for discovery, and JSON files to define the custom settings you want to use.
Copy file name to clipboardExpand all lines: memdocs/intune/protect/compliance-custom-json.md
+6-6Lines changed: 6 additions & 6 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -7,7 +7,7 @@ keywords:
7
7
author: brenduns
8
8
ms.author: brenduns
9
9
manager: dougeby
10
-
ms.date: 12/08/2021
10
+
ms.date: 10/19/2022
11
11
ms.topic: conceptual
12
12
ms.service: microsoft-intune
13
13
ms.subservice: protect
@@ -27,17 +27,17 @@ ms.custom: intune-azure
27
27
ms.collection: M365-identity-device-management
28
28
---
29
29
30
-
# Custom compliance JSON files
30
+
# Custom compliance JSON files for Microsoft Intune
31
31
32
-
To support [custom settings for compliance](../protect/compliance-use-custom-settings.md), you create a JSON file that identifies the settings and value pairs that you want to use for custom compliance. The JSON defines what a PowerShell discovery script will evaluate for compliance on the device.
32
+
To support [custom settings for compliance](../protect/compliance-use-custom-settings.md) for Microsoft Intune, you create a JSON file that identifies the settings and value pairs that you want to use for custom compliance. The JSON defines what a discovery script will evaluate for compliance on the device.
33
33
34
-
You’ll upload the JSON file when you create a compliance policy that includes custom compliance settings.
34
+
You’ll upload the JSON file when you create a compliance policy that includes custom compliance settings.
35
35
36
36
A correctly formatted JSON file must include the following information:
37
37
38
38
-**SettingName** - The name of the custom setting to use for base compliance.
39
-
-**Operator** - Represents a specific action that is used to build a compliance rule. For options, see the following list of supported operators.
40
-
-**DataType** - The type of data that you can use to build your compliance rule. For options, see the following list of supported DataTypes.
39
+
-**Operator** - Represents a specific action that is used to build a compliance rule. For options, see the following list of *supported operators*.
40
+
-**DataType** - The type of data that you can use to build your compliance rule. For options, see the following list of *supported DataTypes*.
41
41
-**Operand** - Represent the values that the operator works on.
42
42
-**MoreInfoURL** - A URL that’s shown to device users so they can learn more about the compliance requirement when their device is noncompliant for a setting. You can also use this to link to instructions to help users bring their device into compliance for this setting.
43
43
-**RemediationStrings** - Information that gets displayed in the Company Portal when a device is noncompliant to a setting. This information is intended to help users understand the remediation options to bring a device to a compliant state.
Copy file name to clipboardExpand all lines: memdocs/intune/protect/compliance-custom-script.md
+65-23Lines changed: 65 additions & 23 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,13 +1,13 @@
1
1
---
2
2
# required metadata
3
3
4
-
title: Create a PowerShell script to use for discover of custom compliance settings in Microsoft Intune
5
-
description: Create the PowerShell script that runs discovery on devices that receive device compliance policies for custom settings in Intune.
4
+
title: Create a discovery script for custom compliance policy in Microsoft Intune
5
+
description: Create scripts for Linux or Windows devices to discover the settings you define as custom compliance settings for Microsoft Intune.
6
6
keywords:
7
7
author: brenduns
8
8
ms.author: brenduns
9
9
manager: dougeby
10
-
ms.date: 11/16/2021
10
+
ms.date: 10/19/2022
11
11
ms.topic: conceptual
12
12
ms.service: microsoft-intune
13
13
ms.subservice: protect
@@ -27,21 +27,39 @@ ms.custom: intune-azure
27
27
ms.collection: M365-identity-device-management
28
28
---
29
29
30
-
# Custom PowerShell scripts for discovery
30
+
# Custom compliance discovery scripts for Microsoft Intune
31
31
32
-
Before you can use [custom settings for compliance](../protect/compliance-use-custom-settings.md) with Intune, you must define a PowerShell script for discovery of custom compliance settings on devices.
32
+
Before you can use [custom settings for compliance](../protect/compliance-use-custom-settings.md) with Microsoft Intune, you must define a script for discovery of custom compliance settings on devices. The script you use depends on the platform:
33
33
34
-
The discovery script:
34
+
- Linux devices, use a POSIX-compliant shell script
35
+
- Windows devices use a PowerShell script
35
36
36
-
- Is added to Intune before you create a compliance policy. After it's added, it will be available to select when you create a compliance policy with custom settings.
37
-
- Runs on a device that receives the compliance policy. The script evaluates the conditions of the JSON file you upload to the same policy.
38
-
- Identifies one or more settings, as defined in the JSON, and returns a list of discovered values for those settings. A single script can be assigned to each policy, and supports discovery of multiple settings.
39
-
- Must be compressed to output results in one line. For example: `$hash = @{ ModelName = "Dell"; BiosVersion = "1.24"; TPMChipPresent = $true}`
37
+
The script deploys to devices as part of your custom compliance policies. When compliance runs, the script discovers the settings that are defined by the JSON file that you also provide through custom compliance policy.
38
+
39
+
All discovery scripts:
40
+
41
+
- Are added to Intune before you create a compliance policy. After being added, scripts are available to select when you create a compliance policy with custom settings.
42
+
- Run on a device that receives the compliance policy. The script evaluates the conditions of the JSON file you upload when creating a custom compliance policy.
43
+
- Identify one or more settings, as defined in the JSON, and return a list of discovered values for those settings. A single script can be assigned to each policy, and supports discovery of multiple settings.
44
+
45
+
In addition, the PowerShell script for Windows:
46
+
47
+
- Must be compressed to output results in a single line. For example: `$hash = @{ ModelName = "Dell"; BiosVersion = "1.24"; TPMChipPresent = $true}`
40
48
- Must include the following line at the end of the script: `return $hash | ConvertTo-Json -Compress`
41
49
42
-
## Sample discovery script
50
+
## Limits
51
+
52
+
The scripts you write must be within the following limits in order to successfully return compliance data to Intune:
53
+
54
+
- Scripts can be no larger than 1 megabyte (MB) each.
55
+
- Output generated by each script can be no larger than 1 MB.
56
+
- Scripts must have a limited run time:
57
+
- On Linux, scripts must take five minutes or less to run.
58
+
- On Windows, scripts must take 10 minutes or less to run.
43
59
44
-
The following example is a sample PowerShell script.
60
+
## Sample discovery script for Windows
61
+
62
+
The following example is a sample PowerShell script that you would use for Windows devices:
Discovery scripts for Linux must be POSIX-compliant shell scripts, such as Bash. However, the scripts can call more complex interpreters from inside the script, like Python. To successfully use other interpreters, they must be correctly installed and configured on the devices in advance of receiving the discovery script.
83
+
84
+
**About POSIX-compliant syntax**: Because the custom compliance script interpreter for Linux supports only a POSIX-compliant shell, it’s important to use POSIX-syntax.
85
+
86
+
The following are examples of syntax that is compliant vs not compliant:
87
+
88
+
- Compliant:
89
+
90
+
```Shell
91
+
functionName() {
92
+
// scope of functionwith compliant syntax
93
+
}
94
+
```
95
+
96
+
For example, `["$a = foo]` - Use of a single equal sign for a string comparison is POSIX-complaint.
97
+
98
+
- Not compliant:
99
+
100
+
```Shell
101
+
functionfunctionName() {
102
+
// scope of functionwith non POSIX compliant syntax
103
+
}
104
+
```
105
+
106
+
For example, `["$a == foo]` - Use of a double equal sign for a string comparison isn't POSIX-complaint.
107
+
108
+
For more information, the following guide might be of use [POSIX Shell Tutorial (grymoire.com)](https://www.grymoire.com/Unix/Sh.html), a third-party website.
109
+
62
110
## Add a discovery script to Intune
63
111
64
-
1. Sign into Microsoft Endpoint Manager admin center and go to **Endpoint security** > **Device compliance** > **Scripts** > **Add** > **Windows 10 and later**.
112
+
Before deploying your script in production, test it in an isolated environment to ensure the syntax you use behaves as expected.
113
+
114
+
1. Sign into Microsoft Endpoint Manager admin center and go to **Endpoint security** > **Device compliance** > **Scripts** > **Add** > *(choose your platform)*.
65
115
2. On **Basics**, provide a *Name*.
66
116
3. On **Settings**, add your script to *Detection script*. Review your script carefully. Intune doesn’t validate the script for syntax or programmatic errors.
67
-
4. On **Settings**, configure the following behavior for the script:
117
+
4.***For Windows only*** - On **Settings**, configure the following behavior for the PowerShell script:
68
118
69
119
-**Run this script using the logged on credentials** – By default, the script runs in the System context on the device. Set this value to Yes to have it run in the context of the logged-on user. If the user isn’t logged in, the script defaults back to the System context.
70
120
-**Enforce script signature check** – For more information, see [about_Signing](/powershell/module/microsoft.powershell.core/about/about_signing?view=powershell-7.1&preserve-view=true) in the PowerShell documentation.
71
121
-**Run script in 64 bit PowerShell Host** – By default, the script runs using the 32-bit PowerShell host. Set this value to *Yes* to force the script to run using the 64-bit host instead.
72
122
73
-
5. Complete the script creation process. The script is now visible in the *Scripts* pane of the Microsoft Endpoint Manager admin center and will be available to select when configuring compliance policies.
74
-
75
-
## Limits
76
-
77
-
The scripts you write must be within these limits in order to successfully return compliance data to Intune:
78
-
79
-
- Scripts can be no larger than 1 megabyte (MB) each.
80
-
- Output generated by each script can be no larger than 1 MB.
81
-
- Scripts must take 10 minutes or less to run.
123
+
5. Complete the script creation process. The script is now visible in the *Scripts* pane of the Microsoft Endpoint Manager admin center and is available to select when configuring compliance policies.
Copy file name to clipboardExpand all lines: memdocs/intune/protect/compliance-policy-monitor.md
+19-8Lines changed: 19 additions & 8 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -7,7 +7,7 @@ keywords:
7
7
author: brenduns
8
8
ms.author: brenduns
9
9
manager: dougeby
10
-
ms.date: 08/24/2022
10
+
ms.date: 10/19/2022
11
11
ms.topic: how-to
12
12
ms.service: microsoft-intune
13
13
ms.subservice: protect
@@ -36,6 +36,16 @@ Compliance reports help you understand when devices fail to meet your [complianc
36
36
- The compliance status for an individual policy
37
37
- Drill down into individual devices to view specific settings and policies that affect the device
38
38
39
+
This article applies to:
40
+
41
+
- Android device administrator
42
+
- Android (AOSP) (*preview*)
43
+
- Android Enterprise
44
+
- iOS/iPadOS
45
+
- Linux - Ubuntu Desktop, version 20.04 LTS and 22.04 LTS
46
+
- macOS
47
+
- Windows 10 and later
48
+
39
49
## Open the compliance dashboard
40
50
41
51
Open the **Intune Device compliance dashboard**:
@@ -72,11 +82,11 @@ Descriptions of the different device compliance policy states:
72
82
73
83
-**Compliant**: The device successfully applied one or more device compliance policy settings.
74
84
75
-
-**In-grace period:** The device is targeted with one or more device compliance policy settings. But, the user hasn't applied the policies yet. This status means the device is not-compliant, but it's in the grace period defined by the admin.
85
+
-**In-grace period:***(This status isn’t supported by Linux)*The device is targeted with one or more device compliance policy settings. But, the user hasn't applied the policies yet. This status means the device is not-compliant, but it's in the grace period defined by the admin.
76
86
77
87
- Learn more about [Actions for noncompliant devices](actions-for-noncompliance.md).
78
88
79
-
-**Not evaluated**: An initial state for newly enrolled devices. Other possible reasons for this state include:
89
+
-**Not evaluated**: *(This status isn’t supported by Linux)*An initial state for newly enrolled devices. Other possible reasons for this state include:
80
90
81
91
- Devices that aren't assigned a compliance policy and don't have a trigger to check for compliance
82
92
- Devices that haven't checked in since the compliance policy was last updated
@@ -87,12 +97,13 @@ Descriptions of the different device compliance policy states:
87
97
88
98
-**Not-compliant:** The device failed to apply one or more device compliance policy settings. Or, the user hasn't complied with the policies.
89
99
90
-
-**Device not synced:** The device failed to report its device compliance policy status because one of the following reasons:
100
+
-**Device not synced:***(This status isn’t supported by Linux)*The device failed to report its device compliance policy status because one of the following reasons:
91
101
92
102
-**Unknown**: The device is offline or failed to communicate with Intune or Azure AD for other reasons.
93
-
94
103
-**Error**: The device failed to communicate with Intune and Azure AD, and received an error message with the reason.
95
104
105
+
-**Checking status**: *(Applies only to Linux)* Intune is currently evaluating the devices compliance your organization’s policies.
106
+
96
107
> [!IMPORTANT]
97
108
> Devices that are enrolled into Intune, but not targeted by any device compliance policies are included in this report under the **Compliant** bucket.
98
109
@@ -103,12 +114,12 @@ When a setting for a compliance policy returns a value of **Error**, the complia
103
114
##### Examples:
104
115
105
116
- A device is initially marked **Compliant**, but then a setting in one of the compliance policies targeted to the device reports **Error**. After three days, compliance evaluation completes successfully and the setting now reports **Not compliant**. The user can continue to use the device to access Conditional Access-protected resources within the first three days after the setting states changes to **Error**, but once the setting returns **Not compliant**, the device is marked **Not compliant** and this access is removed until the device becomes **Compliant** again.
106
-
117
+
107
118
- A device is initially marked **Compliant**, but then a setting in one of the compliance policies targeted to the device reports **Error**. After three days, compliance evaluation completes successfully, the setting returns **Compliant**, and the device's compliance status becomes **Compliant**. The user is able to continue to access Conditional Access protected resources without interruption.
108
119
109
-
- A device is initially marked **Compliant**, but then a setting in one of the compliance policies targeted to the device reports **Error**. The user is able to access Conditional Access protected resources for seven days, but after seven days, the compliance setting still returns **Error**. At this point, the device becomes Not compliant immediately and the user loses access to the protected resources until the device becomes **Compliant** – even if there's a grace period set for the applicable compliance policy.
120
+
- A device is initially marked **Compliant**, but then a setting in one of the compliance policies targeted to the device reports **Error**. The user is able to access Conditional Access protected resources for seven days, but after seven days, the compliance setting still returns **Error**. At this point, the device becomes Not compliant immediately and the user loses access to the protected resources until the device becomes **Compliant**, even if there's a grace period set for the applicable compliance policy.
110
121
111
-
-A device is initially marked **Not compliant**, but then a setting in one of the compliance policies targeted to the device reports Error. After three days, compliance evaluation completes successfully, the setting returns **Compliant**, and the device's compliance status becomes **Compliant**. The user is prevented from accessing Conditional Access protected resources for the first three days (while the setting returns **Error**). Once the setting returns **Compliant** and the device is marked **Compliant**, the user can begin to access protected resources on the device.
122
+
- A device is initially marked **Not compliant**, but then a setting in one of the compliance policies targeted to the device reports Error. After three days, compliance evaluation completes successfully, the setting returns **Compliant**, and the device's compliance status becomes **Compliant**. The user is prevented from accessing Conditional Access protected resources for the first three days (while the setting returns **Error**). Once the setting returns **Compliant** and the device is marked **Compliant**, the user can begin to access protected resources on the device.
0 commit comments