book

Mastering Microsoft Endpoint Manager

by Christiaan Brinkhoff, Per Larsen

October 2021

Intermediate to advanced

666 pages

12h 33m

English

Packt Publishing

Read now

Unlock full access

Foreword ContributorsAbout the authorsAbout the reviewers
Who this book is forWhat this book coversTo get the most out of this bookDownload the color imagesConventions usedGet in touchShare Your Thoughts
An introduction to Microsoft 365What do the services achieve?Microsoft Endpoint ManagerAzure Virtual DesktopAVD and Windows 365 Cloud PC – shared responsibility model 1AVD and Windows 365 Cloud PC – shared responsibility model 2Productivity ScoreOneDrive for Business (part of Microsoft 365 Apps)Microsoft Defender for Endpoint (formerly MDATP)SummaryQuestionsAnswersFurther reading
Paths to modern managementMicrosoft Endpoint Manager and Intune Endpoint Manager admin center portalMicrosoft 365 admin center portalCloud PC/Windows 365 Azure Active Directory (Azure AD) Cloud management gateway (CMG)Desktop AnalyticsMicrosoft Endpoint Manager – from on-premises to the cloudExploring Windows 10 Enterprise in detailUsing Windows via a Windows 365 cloud PCAzure KMS – cloud PC/Windows 365/AVDWUfB is the new way of manning Windows servicingBring your own deviceWhat is zero trust?Verifying identityVerifying devicesSummaryQuestionsAnswersFurther reading
What is Windows 365?Removing the complexity of traditional VDI deploymentsWhy virtualize Windows in the cloud?Comparing Windows 365 Enterprise and BusinessMicrosoft Endpoint ManagerHigh-level architecture components and responsibilitiesMicrosoft Endpoint Configuration Manager supportCo-management and Windows 365Sizes and performance of fixed-price licensesOn-premises connectionsProvisioning policiesWindows 365 – gallery imagesCustom imagesRoles and delegationThe Watchdog serviceOptimized Teams on Windows 365Microsoft EdgeSleeping tabsStartup boostScreen capture protectionSummaryQuestionsAnswersFurther reading
Technical requirements for deploying Windows 365Azure subscriptionAzure VNetAzure VNet – required related URLs and portsMicrosoft Endpoint Manager and AVD – service URLsRemote Desktop Protocol requirementsHybrid Azure AD joinedPurchasing and assigning cloud PC licenses via the Microsoft 365 admin center portalOn-premises network connectionsProvisioning a cloud PC User settings – self-serviceSelf-service capabilities – IT adminReprovisioning the cloud PCLocal administratorVM SKU upgrades (preview feature)Image management – creating a custom image (optional)Supported endpointsInformation Worker Portal (IWP)Azure AD – MyApps unified (workspace) portal Multi-factor authentication and conditional accessSecurity baselines for a cloud PCDistributing the Remote Desktop client via Microsoft Endpoint Manager – Intune to your physical endpoints Auto-subscribing users in the Remote Desktop clientAutopilot and cloud PCs – lightweight thin client (Kiosk)Monitoring and analyticsShadow users with Quick AssistWindows 11Microsoft Managed DesktopSummaryQuestionsAnswersFurther reading
Endpoint scenariosIdentity roles and privileges for Microsoft IntuneCompliance AdministratorCompliance Data AdministratorIntune AdministratorMessage Center ReaderSecurity AdministratorSecurity OperatorSecurity ReaderIdentity roles and privileges for a Windows 365 cloud PC Azure Subscription OwnerIntune AdministratorDomain Administrator Identity roles and privileges for Universal PrintPrinter AdministratorPrinter TechnicianLicensing requirements Supported OSesRequired web browser versionsWindows 11 requirements How do you get Windows 11? Administrator licensingAzure AD group-based licensing Setting the mobile device management authorityEnabling Windows automatic enrollmentUsing Azure Virtual Desktop with IntuneMicrosoft Intune enrollment restriction for WindowsMicrosoft Intune device restrictions for WindowsBlocking personal Windows devicesMicrosoft Intune device limit restrictions for WindowsCustomizing Intune company portal apps, the company portal website, and the Intune appAssociating your Microsoft Store for Business account with IntuneMEM – network URL firewall requirements Access for managed devicesWindows 365 endpoint URLsNetwork URL requirements for PowerShell scripts and Win32 appsWindows Push Notification Services – required URLsWindows 365 and Azure Virtual Desktop – required URLsUniversal Print – required URLsDelivery OptimizationSummaryQuestionsAnswersFurther reading

Deploying existing Windows devices into Microsoft Endpoint Manager Enrolling devices – Windows enrollmentWhen to use what solutionWindows Update for BusinessTypes of updates managed by Windows Update for BusinessEnforcing compliance deadlines for updatesHow to handle conflicting or legacy policiesHow to set up and configure Windows Update for BusinessSafeguard holdsExpediting a Windows patchThe Windows Insider Program for BusinessSummaryQuestionsAnswersFurther reading
Technical requirementsWindows Autopilot overviewUploading the hardware ID to Windows Autopilot Windows Autopilot for existing devicesWindows updates during the Out-of-Box Experience (OOBE) Auto-assigning Windows Autopilot profiles in IntuneSigning in to Graph ExplorerEnrollment Status Page (ESP)ESP implementation Windows CSPAutopilot reporting and diagnosticsCompany PortalConfiguring automatic BitLocker encryption for Autopilot devicesCloud configuration scenarioDeploying essentials that users might need to access work or school resourcesEdge kiosk self-deployment scenarioCreating a specific ESP for the Edge kioskCreating a Windows Autopilot profileSelf-Deploying (preview) Autopilot ResetWiping and resetting your devicesFresh startWindows Recovery Environment SummaryQuestionsAnswersFurther reading
Application delivery via Microsoft Endpoint ManagerDifferent application types you can deployLOB applicationsSupersedence modeCommunity tool – Win32App Migration ToolDeploying Microsoft 365 apps Update channels Office Customization Tool Microsoft 365 Apps admin centerMicrosoft 365 apps – customization Deploying Microsoft Teams OneDriveDeploying Microsoft EdgeWhat is MSIX?AppxManifest.xmlAppxBlockMap.xmlAppxSignature.p7xHow to create MSIX packagesPushing the MSIX package application to your endpointsSummary QuestionsAnswersFurther reading
Policy management What is a CSP policy?Windows Push Notification Services (WNS)Policy management within Microsoft Endpoint ManagerMigrating existing policies from AD – Group Policy management (preview)SummaryQuestionsAnswersFurther reading
Policy management Configuring a policy from the Endpoint Manager Security bladeConfiguring your Endpoint security profile Windows 10 unhealthy endpointsAttack surface reductionConfiguring a policy from the Settings catalogConfiguring administrative templatesURL reputationOneDrive Known Folder Move configurationOneDrive – block syncing specific file extensions Configure device configuration (template)Leveraging a custom policy as a last resortPushing PowerShell scripts – scripted actions to endpointsCompliance policiesWindows Organizational compliance reportSummaryQuestionsAnswersFurther reading
The Office cloud policy serviceCreating a policy configuration with the OCP serviceConfiguring policiesTips and tricks in the OCP serviceHow are Office cloud policies applied?Security Policy AdvisorSummaryQuestionsAnswersFurther reading
Windows profiles Modern profile managementEnterprise State RoamingMicrosoft Office's roaming settings Outlook's signature cloud settings OneDrive for Business Known Folder MoveWindows 10 Storage Sense OneDrive and Storage SenseMicrosoft EdgeESR + OneDrive + Edge + OfficeMigrating from legacy to modern profile managementSummaryQuestionsAnswersFurther reading
Microsoft Identity AAD AAD users AAD guest usersAAD group typesAAD membership types Hybrid AADConditional Access Users and groupsCloud apps ConditionsGrantPreventing users from carrying out AAD device registrationSelf-service password reset AAD password protectionPassword-less authenticationEnabling password-less authenticationWhat is and isn't supported in each password-less scenario BitLocker disk encryption BitLocker recovery keysMicrosoft Defender for EndpointIntegration with MEMSecurity baselinesCompliance policiesWindows 365 security baselinesRequirements for Defender for EndpointConnecting to Intune – MEM integrationAlerts and security assessmentsSecurity recommendationsSummaryQuestionsAnswersFurther reading
Monitoring and analyticsMonitoring your physical and virtual cloud endpoints Endpoint analytics – advanced monitoringStart up performance – logon duration Performance score breakdown Top 10 impacting start up processesOS restart historyResource performance Insights and recommendations – score trendsApplication reliabilityWindows 365-specific metrics Insights and recommendations Configuration Manager data collectionCustomizing your baselinesProactive remediationsAzure Monitor integration Productivity ScoreService healthSummaryQuestionsAnswersFurther reading
What is Universal Print?Universal Print – architecture explainedThe print connectorWhere does my printed data go?Printer defaultsUniversal Print – service requirementsNetwork requirementsLearning how to deploy Universal PrintDelegating printer access – custom rolesConnecting your existing printer to Universal PrintConfiguring Universal PrintEnabling Hhybrid AD configuration – via the Universal Print connectorRegistering your own custom printers with Universal PrintSharing your printers with your usersAssigning permissions to use a printer(s)Testing your Universal Print connected printerAssigning and deploying cloud printers with Microsoft Endpoint ManagerSummaryQuestionsAnswersFurther reading
Troubleshooting MEMService health and message center Troubleshoot blade in MEMTroubleshooting Windows 10 MEM enrollmentBitLocker failuresWindows 10 device diagnosticsClient requirementsTroubleshooting application deliveryWin32 LOBMicrosoft Store appsTroubleshooting AutopilotWindows 11 Autopilot diagnostics pageTroubleshooting locating a Windows deviceTroubleshooting Microsoft EdgeSummaryQuestionsAnswersFurther reading
Troubleshooting yourself and Microsoft SupportWindows 365 provisioning errorsCloud PC – device-based filteringSummaryQuestionsFurther reading
Join the new W365 Community! Microsoft Tech Community and MS LearnOther community blogs, Microsoft MVPs,and more…Summary
Other Books You May EnjoyPackt is searching for authors like youShare Your Thoughts

Overview

Mastering Microsoft Endpoint Manager provides comprehensive guidance on deploying and managing Windows 10, Windows 11, and Windows 365 systems using modern management tools. You will learn actionable strategies for configuring Microsoft Endpoint Manager to simplify user experience and enhance security on both physical and cloud PCs.

What this Book will help me do

Master the deployment of Windows 365 Cloud PC to streamline cloud-based system management.
Learn to configure advanced policies within Microsoft Endpoint Manager to automate and centralize settings.
Understand best practices for profile management and migration to ensure smooth transitions for users.
Gain strategies for implementing robust security protocols to protect system infrastructures.
Develop troubleshooting techniques and find resources for handling issues effectively.

Author(s)

Per Larsen is an experienced IT professional and author with a deep background in Microsoft technologies, specializing in endpoint management and state-of-the-art cloud services. Leveraging years of practical experience, Per offers readers a clear and structured approach to mastering Microsoft Endpoint Manager.

Who is it for?

This book is ideal for IT professionals, enterprise mobility administrators, and systems architects who manage Windows environments. It's suited for those seeking to enhance their skills in handling physical and cloud PCs using modern tools. The content is tailored for readers with a foundation in endpoint management and those aspiring to implement best practices in secure enterprise IT management.