Cloud attach - Endpoint Managers silver lining - part 8 Enabling Tenant Attach

[anyweb]

Introduction

This is part 8 in a series of guides about cloud attach in Microsoft Endpoint Manager, with the aim of getting you up and running with all things cloud attach. This part will focus on enabling tenant attach. This series is co-written by Niall & Paul, both of whom are Enterprise Mobility MVP’s with broad experience in the area of modern management. Paul is 5 times Enterprise Mobility MVP based in the UK and Niall is 11 times Enterprise Mobility MVP based in Sweden.

In part 1 we configured Azure AD connect to sync accounts from the on premise infrastructure to the cloud. In part 2, we prepared Azure resources for the Cloud Management Gateway, in part 3 we created the cloud management gateway and verified that everything was running smoothly. In part 4 we enabled co-management. With co-management, you retain your  existing processes for using Configuration Manager to manage PCs in your organization and you gain the additional advantage of being able to transfer workloads to the cloud via Endpoint Manager (Intune). In part 5 we enabled the compliance policies workload and reviewed how that affected a co-managed computer. In this part we will enable conditional access and see how that can be used to deny access to company resources. In part 6 we configured conditional access and used it to deny access to company resources unless the device was encrypted with BitLocker. In part 7 we showed you how to co-manage Azure AD devices. In this part we'll enable Tenant Attach and take a brief look at it's features.

Below you can find all parts in this series.

 

• Cloud attach - Endpoint Managers silver lining - part 1 Configuring Azure AD connect
• Cloud attach - Endpoint Managers silver lining - part 2 Prepare for a Cloud Management Gateway
• Cloud attach - Endpoint Managers silver lining - part 3 Creating a Cloud Management Gateway
• Cloud attach - Endpoint Managers silver lining - part 4 Enabling co-management
• Cloud attach - Endpoint Managers silver lining - part 5 Enabling compliance policies workload
• Cloud attach - Endpoint Managers silver lining - part 6 Enabling conditional access
• Cloud attach - Endpoint Managers silver lining - part 7 Co-managing Azure AD devices
• Cloud attach - Endpoint Managers silver lining - part 8 Enabling tenant attach <- you are here
• Cloud attach - Endpoint Managers silver lining - part 9 Renewing expiring certificates
• Cloud attach - Endpoint Managers silver lining - part 10 Using apps with tenant attach

Tenant attach first showed up in Technical Preview 2002.2, but was released in ConfigMgr 2002 which you can read about here. You can think of tenant attach as being a way to give your Endpoint Manager admins access to ConfigMgr actions/data via the MEM console (login to your tenant at https://aka.ms/memac) without needing to do it via the ConfigMgr console.

The prerequisites

The user account needs to be a synced user object in Azure AD (hybrid identity). This means that the user is synced to Azure Active Directory from Active Directory.

• For Configuration Manager version 2103, and later:
  • Has been discovered with either Azure Active Directory user discovery or Active Directory user discovery.
• For Configuration Manager version 2010, and earlier:
  • Has been discovered with both Azure Active Directory user discovery and Active Directory user discovery.

• The Initiate Configuration Manager action permission under Remote tasks in the Microsoft Endpoint Manager admin center.
  • For more information about adding or verifying permissions in the admin center, see Role-based access control (RBAC) with Microsoft Intune.

Note: In case it’s not clear above, you need to configure Azure AD Connect to sync your on-premise users to the cloud for the user actions to succeed. You also need to go through the Azure services in ConfigMgr and configure cloud management to sync Azure Active Directory User Discovery.

During this blog post we used a user that satisfies the above, namely niall@azurenoob.com to perform the tenant attach related actions in MEM.

Step 1. Create a collection

This is an optional step, but helps you to keep track of which devices are Tenant Attached. Create a collection called Tenant Attached, you will use that collection to populate your tenant attached devices. Once created, place one or more devices into the collection.

Step 2. Enable tenant attach

In the ConfigMgr console, select the Administration node and expand cloud services, select Co-management (2103 or earlier) or based on what we saw in the recent technical preview (Technical Preview 2106) select Cloud Attach (2107 or later). Select CoMgmgtSettingsProd, right click and bring up the properties.

In Co-management properties, click on the Configure upload tab.

 

Next, place a check in the Upload to Microsoft Endpoint Manager admin center checkbox, and select a collection, for example use the Tenant Attached collection we created in step 1,

Note: If you select All devices managed by Microsoft Endpoint Configuration Manager then all devices (including servers) will show up in the MEM console.

Next, deselect the Enable Endpoint Analytics for devices upload to Microsoft Endpoint Manager. And finally click Apply. When prompted to authenticate to Azure services, enter the credentials of your Global Admin account for the applicable tenant.

After correctly entering your credentials, the changes will be applied and you can review the success or failure of your actions via the CMGatewaySyncUploadWorker.log

 

Step 3. Verify upload of data

After a device is added to the target collection, you can look at the CMGatewaySyncUploadWorker.log to verify that it uploads data for the number of records you added. So if for example you add one computer to the Tenant Attached collection, then it'll state "Batching 1 records" as shown below. This will only happen when it detects a new device, in the next upload (15 minutes later) it'll return to Batching 0 records and so on unless of course new devices are detected in the collection.

This upload of data occurs every 15 minutes. In the below screenshots, all highlighted devices are tenant attached and are in the Tenant Attached collection.

 

Next, login to your tenant at https://aka.ms/memac this will display your devices. After the data is uploaded from ConfigMgr, check devices in Microsoft Endpoint Manager and depending on the type of device you'll see one or more devices matching that device name. 

In the first example, we have a device that is shown with two records, one is listed as co-managed and the other record as ConfigMgr. That record is tenant attached. The Managed by column will denote how the device is managed and tenant attached co-managed devices (hybrid azure ad joined) may have a second record where it states managed by ConfigMgr. We saw this repeatedly with this specific client, even after clean installing Windows 10 on it...the client version in this particular case was CM2103.

 

If it's an Azure AD joined device that is also co-managed (as we described in Part 7) then the managed by column will state Co-managed and yet this device will have only one record.

 

Lastly if the device is merely managed by ConfigMgr (not co-managed, not azure ad joined) then it will show up with one record.

 

Step 4. Looking into tenant attach features

Now that we can identify the different types of devices that are tenant attached, let's take a look at the power of tenant attach. If we look at the Azure AD joined, co-managed device which we deployed in part 7, we can see that the following additional capabilities are now available by enabling tenant attach and adding this computer to that collection so that the device becomes tenant attached.

The following are available (in preview):

• Resource explorer
• Client details
• Timeline
• Collections
• Applications
• CMPivot
• Scripts

in addition, you can now trigger the following actions

• Sync machine policy
• Sync user policy
• App evaluation cycle

In the MEM console, the tenant attach abilities are highlighted below in red.

Below you can see the Timeline feature and some of the data it can provide. To grab more data, click the Sync button and then refresh the screen.

And here's a quick look at CMPivot

Resource explorer is chock full of data

Conclusion

Using Tenant attach gives your admins more power to do ConfigMgr actions via the MEM console without needing to even install the ConfigMgr console.