System Center AMA topics

Cloud Management Gateway documentation

Aaron Czechowski — Thu, 19 Oct 2017 17:01:27 GMT

There were several questions about the SCCM cloud management gateway, so here are some resources for future reference:

Plan for CMG (requirements, features, cost estimates, FAQs):

https://docs.microsoft.com/en-us/sccm/core/clients/manage/plan-cloud-management-gateway

Install and assign Configuration Manager Windows 10 clients using Azure AD for authentication (using CMG with Azure AD and Intune)

https://docs.microsoft.com/en-us/sccm/core/clients/deploy/deploy-clients-cmg-azure

Intune/ConfigMgr resources from Ignite

Vladimir Petrosyan — Thu, 19 Oct 2017 17:01:15 GMT

Hi all - we thought that it would be useful for you to know about all the Intune/ConfigMgr sessions that we presented at Ignite. In these sessions, you will be able to learn more about co-management.

Windows 10 & Office 365 ProPlus deployment and management:

Intune/ConfigMgr:

That's a wrap!

EricStarker — Fri, 09 Feb 2018 20:41:46 GMT

Thank you for joining us and voicing your questions and feedback during this fun and action-packed hour.

We will put together a summary document of what was covered during and share it in this group. See you next time!

(EDIT: Here's the summary attached!)

Does Intune already can use for Co-Management

Yinghua Zeng — Thu, 19 Oct 2017 16:59:07 GMT

I installed ConfigMgr TP1709, configured Cloud Mangement (Azure AD user sync worked), Cloud gateway management, and Co-Management is assigned to a collection.
I have installed Windows 10 1709, domain joined, ConfigMgr client installed, Azure AD joined. (Not joined to work place).

In Intune portal I only see my machine is Hybrid Azure AD joined, I don't see it is managed by MDM/ConfigMgr. Did I miss something, or just Co-Management feature is not yet for everyone?

CoManagementHandler.log said

Failed to enroll into device management with error (0x80180015 - Mobile device management generally not supported).

Unknown Mdm Enrollment Url.

Is this portal written in Silverlight? ;-)

Karlis Kisis — Thu, 19 Oct 2017 16:55:26 GMT

Slow, cumbersome, "Read more".. just feedback.

co-management licensing?

sccmguy123 — Thu, 19 Oct 2017 16:54:55 GMT

How does Licensing work for Co-Management between ConfigMgr and Microsoft Intune?

Any plans for better control over Windows 10 Feature/Build updates?

Karlis Kisis — Thu, 19 Oct 2017 16:52:31 GMT

Are there any plans to give more granular control over moving to the next Win10 "Current Branch".. like a seperate release cycle, scheduling etc. Like upcoming Windows 10 Fall Creators Update rollout..

Only 15 minutes to go!

Dylan_Snodgrass — Thu, 19 Oct 2017 16:45:54 GMT

We're here and ready for more questions! Be sure to get them in before the end of the hour.

Does co-management require any additional infrastructure?

Steve Whitcher — Thu, 19 Oct 2017 16:43:01 GMT

We currently have a single site SCCM environment, all on prem. Will we need to add any additional servers, site servers, roles, etc to use co-management?

Any plans to support pushing Intune MDM Apps via SCCM DPs in large organizations?

Karlis Kisis — Thu, 19 Oct 2017 16:39:14 GMT

One of the concerns with "Cloud first" approach is network bandwidth on larger deployments.. example: 2000 users in the same building.. any plans to "proxy" these downloads via local DP or similar solution?

Command line to install Configuration Manager client

Yinghua Zeng — Thu, 19 Oct 2017 16:38:00 GMT

In this Article https://docs.microsoft.com/en-us/sccm/core/get-started/capabilities-in-technical-preview-1709, it said Command line to install Configuration Manager client:

ccmsetup.msi CCMSETUPCMD="/mp:<URL of cloud management gateway mutual auth endpoint>/ CCMHOSTNAME=<URL of cloud management gateway mutual auth endpoint> SMSSiteCode=<Sitecode> SMSMP=https://<FQDN of MP> AADTENANTID=<AAD tenant ID> AADTENANTNAME=<Tenant name> AADCLIENTAPPID=<Server AppID for AAD Integration> AADRESOURCEURI=https://<Resource ID>”

Shouldn't AADCLIENTAPPID=<Native Client AppID for AAD Intergration> ?

Any plans to publish more detailed documents regarding all the new features?

Octavian-Costin Clinci — Thu, 19 Oct 2017 16:34:17 GMT

Hey,

We've already seen some very good information in the first half of this AMA (similar questions have been asked by some customers).

Any plans to publish in-depth information like this in the future for some of us who would like to deep-dive in a "behind the scenes" way?

Thanks

Greater visibility of errors

Sam Schirmer — Thu, 19 Oct 2017 16:31:37 GMT

Are there any plans to give the community greater visibility to errors that we see in stand alone intune?

e.g instead of seeing that an error occurred. It would be nice to see what the error was, and what service is affected within the tenant rather than just a generic error code.

If we could have access to reporting tools and logs, then it would greatly help speed up the process when it came to troubleshooting issues that arise from time to time.

Where's the ROI on InTune? (A.K.A. Let's talk licensing)

Bryan Dam — Thu, 19 Oct 2017 16:37:58 GMT

So at Ignite there was a ton of presentations on the boatloads of time and money we were going to save by moving to InTune. We renewed our EA just a few months ago and InTune/EMS was a straight up $7 million dollar increase per year for the whole org. The savings from moving away from SCCM: $0. I can buy an incredible amount of infrastructure and hire Johan and Mikael for that kind of cash. So InTune is kind of a hard sell at the moment.

I'm in retail and the overwhelming majority of our boxes are kiosk-like devices. We don't even bother with domain joining them at all since they are so single-use and user agnostic. When we looked at InTune it is so user-focused that it simply couldn't do the things that AirWatch does (not my project so I can't really give specific details personally ... I just know that was the outcome).

So the answer I'm well aware is to run InTune where it makes sense and SCCM where it makes sense. I don't see how we save money by having multiple systems for different parts of the business. SCCM works beautifully at scale and simply subtracting 5k from a 25K install base saves ... nothing .... absolutely nothing in terms of infrastructure or time. That makes InTune simply a pure additional cost without any savings that I can even theorize much less prove.

Adopting co-management

Robert Bill — Thu, 19 Oct 2017 16:28:17 GMT

According to the current documentation, co-management is only supported if you have Intune standalone. Since this is for managing Windows 10 with both ConfigMan and Intune, it would appear that lots of people will currently have Intune hybrid configured. Will this be updated to work with hybrid or mixed authority mode for organizations during the transition to standalone?

Is Co-Management just for Intune and SCCM or can it be used with Intune and AD/GPO?

Sam Smith — Fri, 20 Oct 2017 21:00:01 GMT

Is Co-Management just for Intune and SCCM or can it be used with Intune and AD/GPO?

Hybrid client

Yury Kissin — Thu, 19 Oct 2017 16:26:42 GMT

I have many clients that are hybrid - sometimes the work inside the network and sometimes outside. Previously, with IBCM, I could set them up as a hybrid client, meaning that when the client was connected to the internal network it was connected directly to the SCCM server and when roaming it connected to the SCCM server in the DMZ.

Can I achieve that with CO-Management?

Which scenario to choose - hybrid vs Intune standalone

Deleted — Thu, 19 Oct 2017 16:24:44 GMT

We have Office 365 and EMS licenses and have SCCM deployment. User devices run Win7,8,10, and MacOS; mobile devices are iOS and Android.
Now we would like to start managing mobile devices and would like to have full stack of capabilities like endpoint encryption, protection, security policies, conditional and risk based access etc.
Should we go with Intune standalone and start on a clean slate: manage what we can with Intune, and leave Win7 in SCCM while we gradually upgrade them to Win10, or there is benefit from running SCCM+Intune hybrid?
Some of benefits of hybrid scenario based on my research:
1. better support for MacOS in SCCM (through plugins like Parallels) than it there is today in Intune (Intune has upcoming integration with JAMF, are there other integrations?)
2. endpoint protection for MacOs is included in SCCM
3. SCCM has centralized management of antivirus
4. reporting today is richer in SCCM

Any other considerations you comment on? Thanks.

SCCM/Intune

Sam Schirmer — Thu, 19 Oct 2017 16:23:59 GMT

If we moved to an integrated SCCM/Intune platform, would we be limited by features within the SCCM environment in regards to features we can implement? or has the intune features cycle and the SCCM integration aligned better so that the SCCM/Intune integrated environments isn't lagging behind the stand alone intune platform?

Would moving to the integrated platform provide us with better logging for troubleshooting diagnosis for example or give us better visibility as to when there are issues in the environment?

Utilising Group Policy on a device enrolled in Co-Management?

Sam Smith — Thu, 19 Oct 2017 16:23:51 GMT

We are a provider of Cloud Solutions are investigating extending this to management of the end points with Intune.

Intune works great from a compliance stand point but lacks the breadth of configuration options afforded with Group Policy.

Would a device enrolled in co-management be able to be controlled by Group Policy? Will there be any restrictions to this?

We are investigating solutions to users that have a highly mobile workforce. Intune has been great at deploying VPN settings to get them dialled back in to their existing infrastructure.

However with them no longer being Domain Joined devices we are missing the ease of configuration.

Can you envision a scenario where a VPN profile is deployed, connected a log on and allow for a standard processing of Group Policy?

Kind of like a cloud based traditional corporate infrastructure.