Mobile Device Management with Configuration Manager 2012 R2 - Part 1. Integrating Microsoft Intune

[faucheur]

Hello,

 

we have configured all the necessary steps (ad synchronisation, the intune subscriptions to clients, domain verification, sccm connector,.. )

 

visited hundreds of sites to come to the same problem, device enrollement is impossible

 

first of all i would like to ask, is Windows server 2012 R2 mandatory for intune to work? we are currently running Windows server 2012 (no sp1)

 

if this is not true could you answer the following questions please :

 

1)We would like to manage only windows phone 8.1 devices, not deploy any applications, correct?

 

2)The company portal app is downloaded from the Microsoft store on the phone, so no need to be signed by a certificate?

 

3) The user must have the same user name and UPN in the AD Azure, as in the in the local AD to identify correctly

 

4) Is the DNS alias mandatory(as this is only a redirection)? As we can specify manually on the phone the server "manage.microsoft.com"?

 

5) I saw there was a way to view logs though the “field medic” app however after opening them and only seeing Event IDs(task manager), this didn’t help me a lot, am i doing something wrong?

 

i've also tested on android phones downloading the company portal from google play store, the device still isn't enrolled.

 

any ideas?

[anyweb]

visited hundreds of sites to come to the same problem, device enrollement is impossible

 

 

what happens when you try to enroll a device ? be specific please

 

did you follow all the steps in my guide step by step ?

[faucheur]

Hello,

thank you for the quick response,

 

yes all steps have been done except the following :

 

-while configuring the windows intune subscription in sccm

no company contact Info(only available for Server 2012 r2 i think)

no company Logo (only available for Server 2012 r2 i think)

 

-no baselines/ configuration Items configured for android

 

-enabling of windows phone 8 is not enabled at the moment (was actif beforehand, but has been disabled since)

As we do not want to distribute the company portal through sccm, (should be easier to install company portal app through windows app store).

From what i understand the checkbox only needs to be checked if you want to deploy the signed company portal app correct?

 

However android was enabled and i still coudn't enroll it

 

here is what happens when i try to enroll the windows phone 8.1

 

i start from the company portal app

 

(notice how we have managed to enroll a pc for my account)

 

which directs me to the workplace

 

i enter my credentials which asks me for the server as the dns was not configured (optional)

 

i log onto the intune portal successfully

 

 

and get the message enrollement failed contact your IT support

 

 

thank you for your time.

[g-fx]

Hey Guys,

 

Is it possible to dirsync only select members? like in the howto? It seems to have sucked up all security groups and users without setting a UPN as it looks like its set by default across the domain.

 

Thanks!

[faucheur]

Hey Guys,

 

Is it possible to dirsync only select members? like in the howto? It seems to have sucked up all security groups and users without setting a UPN as it looks like its set by default across the domain.

 

Thanks!

 

yes it is possible, we synced only a certain OU based on the AD group :

 

[anyweb]

-enabling of windows phone 8 is not enabled at the moment (was actif beforehand, but has been disabled since)

As we do not want to distribute the company portal through sccm, (should be easier to install company portal app through windows app store).

From what i understand the checkbox only needs to be checked if you want to deploy the signed company portal app correct?

 

 

if you want Intune Hybrid to support Windows Phone then "Enable Windows Phone 8 enrollment" must be selected, it will not work if it is not selected.

[Peter van der Woude]

To add-on to Niall's correct answer, this might give some more information: http://www.petervanderwoude.nl/post/windows-phone-8-1-and-the-microsoft-intune-company-portal-app/

[faucheur]

Hello again,

 

Sorry for the wait,

 

First of all thank you for the documentation it cleared up my vision how how intune hybrid works, i didn't know you were obliged to download the app from sccm if you wanted a hybrid connexion.

Before retrying to enable windows 8 phone, I’d like to confirm something, we recently had a phone call with a member of staff of windows Intune.

 

He told us that it is possible to sign the application with a certificate other than Symantec, we currently have a wildcard certificate, would it be the same method to sign the company portal app?

 

2nd why would android devices not enroll if their checkbox was activated in sccm.

 

This makes me think that the problem doesn't come uniquely from the disabled checkbox.

 

thank you

[Peter van der Woude]

For the Company Portal app a Symantec certificate is required. For more information see the FAQ here: https://technet.microsoft.com/en-us/library/61e9b6c3-8795-49b0-8ab2-a9a05ee3ea1f#BKMK_FAQ

[g-fx]

 

yes it is possible, we synced only a certain OU based on the AD group :

 

temp.jpg

 

Thanks faucheur, Im not familiar with Azure AD connect tool in that picture.. just following this guide via dirsync.. I presume this is for single-sign on? that's a step later for me