Intune - documentation and backup. Part 3

Storage Account

In part 3 of the "Intune - documentation and backup" series, I will first create a Resource group to hold all resources, and to track cost.
After that, I will go on to create the Storage account that will hold all files.

Resource Group

Create a Resource group.
Select your Subscription. Fill in with a Resource group name, and then select your Region.

I will create a Resource Group "RG-BBJ-IntuneMgmt" in West Europe.

Storage Account

I will create a Storage Account with the following configuration:

Configuration	Value
Basics
Storage account name	sabbjintunemgmt
Resource group	RG-BBJ-IntuneMgmt
Region	(Europe) West Europe
Primary service	Azure Blob Storage or Azure Data Lake Storage
Performance	Standard (general-purpose v2)
Redundancy	LRS
Advanced
Access tier	Cool
Networking
Public network access	Enable
Public network access scope	Enable from all networks
Routing preference	Microsoft network routing
Security
Require secure transfer for REST API operaions	Enabled
Enable storage account key access	Enabled
Minimum TLS version	Version 1.2
Permitted scope for copy operations	From any storage account
Encryption
Encryption type	Microsoft-managed keys (MMK)

In this Storage Account, I will create 3 Classic File Shares:

Share name	Value
backup	This will contain Backup data from Intune
documentation	This share will contain versions of the Intune Documentation created at runtime.
intunemanagement	This share contains the tool IntuneManagement and it must be copied to this share.

Now, download "Intune Management" from "https://github.com/Micke-K/IntuneManagement", and copy all files to the "intunemanagement" file share.

Now that the Storage Account is ready, next step is creating the Automation Account.

Comming soon - Cloud Rebuild

 

• Cloud rebuild is now introduced to Windows Insiders.
• Cloud rebuild is a new recovery option that restores a Windows 11 PC to a clean, known-good state by performing a full OS reinstall, even when Windows won’t boot. Unlike Reset this PC, Cloud rebuild downloads both the target Windows image and the device’s drivers from Windows Update, so the device comes back fully functional without USB media, without a custom image, and without depending on the health of the currently installed OS.

The new Cloud rebuild option in Windows Recovery Environment (WinRE), enabling a full Windows reinstall using files downloaded from Windows Update.
More about it here:

Cloud rebuild (Preview) | Microsoft Learn

Intune - documentation and backup. Part 2

 App Registration

First, we create an App registration in Entra ID.

Navigate to Entra ID > Manage > App registrations.
Click on "New registration" and fill in Name and Supported account types.

On the page for the App (IntuneManagement) go to “API permissions” blade.
Add a permission > Microsoft Graph > Application permissions.

Add the following API permissions as shown in the following example.
Then do “Grant admin consent for ….”.

Permissions

Agreement.ReadWrite.All

Application.Read.All

CloudPC.ReadWrite.All

DeviceManagementApps.ReadWrite.All

DeviceManagementConfiguration.ReadWrite.All

DeviceManagementManagedDevices.ReadWrite.All

DeviceManagementRBAC.ReadWrite.All

DeviceManagementScripts.ReadWrite.All

DeviceManagementServiceConfig.ReadWrite.All

Group.ReadWrite.All

Organization.ReadWrite.All

Policy.Read.All

Policy.ReadWrite.ConditionalAccess

User.ReadWrite.All

Next, we will create a Client secret.
On “Certificates & secrets” blade, choose “Client secrets" and then “+ New client secret”.

Take note of the “Value” when creating the secret, we will need this. After creation the Value is hidden.

Now, we have prepared the App registration.
In the next step, I will create a Resource group for the tool to manage cost and resources.
Also, I will create a Storage Account to hold tool files and backup/documentation.

Intune - documentation and backup. Part 1

Working for customers, I had a need to make documentation to my work in Intune.
Using Word and Snipping Tool did the job, but it was time consuming, and the document had to be updated every time some changes was made in Intune.

Then I discovered "Intune Management" by Micke-K
Micke-K/IntuneManagement: Copy, export, import, delete, document and compare policies and profiles in Intune and Azure with PowerShell script and WPF UI. Import ADMX files and registry settings with ADMX ingestion. View and edit PowerShell script.

With his tool I could easily create documentation, and even export settings to JSON files as backup.

When starting the app and logging in, some permissions are required and must be approved.

Then the GUI is ready. From here, you can export, import and do documentation.

This is a great tool.
But there is more.... you can automate it, and run it on a schedule.

I will like to schedule, run and store backup and documentation in Azure. Without any use of onprem.
But this setup can easily be modified to run on an onprem server and storage.

During this serie of blogs, I will walk you through the Azure setup, like App Registration, Resource Group, Storage Account, Automation Account and script.

How this can give some inspiration.

App inventory for Windows devices in Microsoft Intune

 

“Discovered Apps” is now being replaced by “All apps”, and this is great news.

Discovered apps did not show real-time inventory. It only gave a count of what was installed across enrolled devices. It refreshed slowly and it only collected a basic set of data.

With the April update...

Microsoft changed both the upload model and the underlying data platform. The new app inventory is built on the same modern data platform that device inventory introduced. That platform was designed for continuous, high-frequency data collection, which gives it more capacity and lower latency than what Discovered apps ran on. The result is that data arrives in the portal faster and the infrastructure can handle the volume of a constantly updating fleet without degrading.

The agent only uploads what changed since the last sync (not sending a full snapshot). This is why multiple updates per day per device is possible without generating proportionally more traffic.

Windows devices get inventory updates multiple times per day. The agent does not wait for the regular MDM check-in, App inventory uploads run on their own schedule through the inventory channel.

For each app, the agent now collects the following (if registered at install time):

• Install path
• Install date
• Uninstall command
• Estimated size on disk
• Architecture (x86, x64, ARM64)
• Per-user install scope
• Store-specific identifiers
• Supported languages

How it works...

You create a Properties Catalog profile in the Intune admin center and assign it to devices. Intune then hands it off to "MMP-C" (Microsoft Management Platform – Cloud). MMP-C wraps the profile as a "Declared Configuration document" (WinDC) and queues it for delivery on the next device sync.

The Declared Configuration model works on desired state. The device gets a document that says what state it should be in and works toward that state. This is the same channel that delivers hardware inventory policies and the same one that Endpoint Privilege Management uses.

When the document lands on the device, it installs the "Microsoft Device Inventory Agent" if it is not there yet. The agent lives at C:\Program Files\Microsoft Device Inventory Agent and runs as a Windows service called "InventoryService".

The agent uses WMI queries to collect application data and writes everything into a local SQLite databases at C:\Program Files\Microsoft Device Inventory Agent\InventoryService\ .

The first harvest runs after a random delay. That is by design. After that first harvest, everything is incremental. Once the data reaches the Intune backend, it shows up in the "All Apps" tab per device.

How to set up...

You need a "Properties Catalog device configuration policy" assigned to corporate-owned Windows 11 devices enrolled in Microsoft Entra ID. Devices must be either Microsoft Entra joined or Hybrid joined.

Go to Devices > Windows > Configuration, click + Create > New Policy, select Windows 10 and later as the platform, and pick Properties Catalog as the profile type. 

Click Next, and give it a name. Then click Next to get to Configuration properties.

Click on + Add properties

Here we have the extended properties available for applications. Add all the properties available (Nothing is enabled by default). Enable the app-related entities from the catalog.

Add scope tags and assignments like any other configuration policy.

Once the policy reaches a device and the agent finishes its first harvest, data starts showing up in the All Apps tab on the next check-in. There is no policy status report for Properties Catalog. You will not see a green success indicator like you would for a settings catalog policy. You have to look at the device directly in All Apps or Resource Explorer to confirm that data is coming in.

If you delete the Properties Catalog policy later, the last collected data stays visible in Device Inventory for up to 28 days before it clears.

The new App Discovery experience

When going to a device in Intune (new device view experience), click on Tools and reports

Select "All Apps"

The new inventory view

You find the official documentation here:
App inventory for Windows devices - Microsoft Intune | Microsoft Learn

Remove Default Microsoft Store Packages from Intune

 Finally there is a native way to remove default Microsoft Store packages directly from a policy in Intune.

You will find it in Settings Catalog
Administrative Templates > Windows Components > App Package Deployment

Corporate device identifiers

Microsoft has announced that Corporate device identifiers for Windows is now working: