Skip to content

Commit 8d2cf57

Browse files
Cleaned up the "Install the Intune Connector" section
1 parent 918c405 commit 8d2cf57

1 file changed

Lines changed: 20 additions & 15 deletions

File tree

memdocs/autopilot/windows-autopilot-hybrid.md

Lines changed: 20 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ keywords:
88
author: ErikjeMS
99
ms.author: erikje
1010
manager: dougeby
11-
ms.date: 06/07/2021
11+
ms.date: 06/22/2021
1212
ms.topic: how-to
1313
ms.service: microsoft-intune
1414
ms.subservice: enrollment
@@ -113,15 +113,23 @@ The organizational unit that's granted the rights to create computers must match
113113

114114
## Install the Intune Connector
115115

116-
The Intune Connector for Active Directory must be installed on a computer that's running Windows Server 2016 or later. The computer must also have access to the internet and your Active Directory. To increase scale and availability, you can install multiple connectors in your environment. We recommend installing the Connector on a server that's not running any other Intune connectors. Each connector must be able to create computer objects in any domain that you want to support.
116+
### Before you begin
117117

118-
> [!NOTE]
119-
> If your organization has multiple domains and you install multiple Intune Connectors, you must use a service account that's able to create computer objects in all domains, even if you plan to implement hybrid Azure AD join only for a specific domain. If these are untrusted domains, you must uninstall the connectors from domains in which you don't want to use Windows Autopilot. Otherwise, with multiple connectors across multiple domains, all connectors must be able to create computer objects in all domains.
120-
> The connector service account must have the following permissions:
121-
> - [**Logon as Service**](/system-center/scsm/enable-service-log-on-sm?view=sc-sm-2019&preserve-view=true)
122-
> - Must be part of the **Domain user** group and a member of the local **Administrators** group on the Windows server that hosts the connector.
118+
- The Intune Connector for Active Directory must be installed on a computer that's running Windows Server 2016 or later.
119+
- The computer must have access to the internet and your Active Directory.
120+
- To increase scale and availability, you can install multiple connectors in your environment. We recommend installing the Connector on a server that's not running any other Intune connectors. Each connector must be able to create computer objects in any domain that you want to support.
121+
122+
If your organization has multiple domains and you install multiple Intune Connectors, you must use a service account that can create computer objects in all domains, even if you plan to implement hybrid Azure AD join only for a specific domain. If these are untrusted domains, you must uninstall the connectors from domains in which you don't want to use Windows Autopilot. Otherwise, with multiple connectors across multiple domains, all connectors must be able to create computer objects in all domains.
123+
124+
- The connector service account must have the following permissions:
125+
126+
- **[Logon as Service](/system-center/scsm/enable-service-log-on-sm?view=sc-sm-2019&preserve-view=true)**
127+
- Must be part of the **Domain user** group
128+
- Must be a member of the local **Administrators** group on the Windows server that hosts the connector
129+
130+
- The Intune Connector requires the [same endpoints as Intune](../intune/fundamentals/intune-endpoints.md).
123131

124-
The Intune Connector requires the [same endpoints as Intune](../intune/fundamentals/intune-endpoints.md).
132+
### Install steps
125133

126134
1. Turn off IE Enhanced Security Configuration. By default Windows Server has Internet Explorer Enhanced Security Configuration turned on. If you're unable to sign in to the Intune Connector for Active Directory, then turn off IE Enhanced Security Configuration for the Administrator. [How To Turn Off Internet Explorer Enhanced Security Configuration](/archive/blogs/chenley/how-to-turn-off-internet-explorer-enhanced-security-configuration).
127135
2. In the [Microsoft Endpoint Manager admin center](https://go.microsoft.com/fwlink/?linkid=2109431), select **Devices** > **Windows** > **Windows enrollment** > **Intune Connector for Active Directory** > **Add**.
@@ -134,13 +142,10 @@ The Intune Connector requires the [same endpoints as Intune](../intune/fundament
134142
8. Go to **Devices** > **Windows** > **Windows enrollment** > **Intune Connector for Active Directory**, and then confirm that the connection status is **Active**.
135143

136144
> [!NOTE]
137-
> The Global administrator role is a temporary requirement at the time of installation.
138-
139-
> [!NOTE]
140-
> After you sign in to the Connector, it might take a couple of minutes to appear in the [Microsoft Endpoint Manager admin center](https://go.microsoft.com/fwlink/?linkid=2109431). It appears only if it can successfully communicate with the Intune service.
141-
142-
> [!NOTE]
143-
> Inactive Intune connectors will still appear in the Intune Connectors blade and will automatically be cleaned up after 30 days.
145+
>
146+
> - The Global administrator role is a temporary requirement at the time of installation.
147+
> - After you sign in to the Connector, it can take several minutes to appear in the [Microsoft Endpoint Manager admin center](https://go.microsoft.com/fwlink/?linkid=2109431). It appears only if it can successfully communicate with the Intune service.
148+
> - Inactive Intune connectors still appear in the Intune Connectors blade and will automatically be cleaned up after 30 days.
144149
145150
### Configure web proxy settings
146151

0 commit comments

Comments
 (0)