Intune - documentation and backup. Part 2

 App Registration

First, we create an App registration in Entra ID.

Navigate to Entra ID > Manage > App registrations.
Click on "New registration" and fill in Name and Supported account types.

On the page for the App (IntuneManagement) go to “API permissions” blade.
Add a permission > Microsoft Graph > Application permissions.

Add the following API permissions as shown in the following example.
Then do “Grant admin consent for ….”.

Permissions

Agreement.ReadWrite.All

Application.Read.All

CloudPC.ReadWrite.All

DeviceManagementApps.ReadWrite.All

DeviceManagementConfiguration.ReadWrite.All

DeviceManagementManagedDevices.ReadWrite.All

DeviceManagementRBAC.ReadWrite.All

DeviceManagementScripts.ReadWrite.All

DeviceManagementServiceConfig.ReadWrite.All

Group.ReadWrite.All

Organization.ReadWrite.All

Policy.Read.All

Policy.ReadWrite.ConditionalAccess

User.ReadWrite.All

Next, we will create a Client secret.
On “Certificates & secrets” blade, choose “Client secrets" and then “+ New client secret”.

Take note of the “Value” when creating the secret, we will need this. After creation the Value is hidden.

Now, we have prepared the App registration.
In the next step, I will create a Resource group for the tool to manage cost and resources.
Also, I will create a Storage Account to hold tool files and backup/documentation.

Intune - documentation and backup. Part 1

Working for customers, I had a need to make documentation to my work in Intune.
Using Word and Snipping Tool did the job, but it was time consuming, and the document had to be updated every time some changes was made in Intune.

Then I discovered "Intune Management" by Micke-K
Micke-K/IntuneManagement: Copy, export, import, delete, document and compare policies and profiles in Intune and Azure with PowerShell script and WPF UI. Import ADMX files and registry settings with ADMX ingestion. View and edit PowerShell script.

With his tool I could easily create documentation, and even export settings to JSON files as backup.

When starting the app and logging in, some permissions are required and must be approved.

Then the GUI is ready. From here, you can export, import and do documentation.

This is a great tool.
But there is more.... you can automate it, and run it on a schedule.

I will like to schedule, run and store backup and documentation in Azure. Without any use of onprem.
But this setup can easily be modified to run on an onprem server and storage.

During this serie of blogs, I will walk you through the Azure setup, like App Registration, Resource Group, Storage Account, Automation Account and script.

How this can give some inspiration.

App inventory for Windows devices in Microsoft Intune

 

“Discovered Apps” is now being replaced by “All apps”, and this is great news.

Discovered apps did not show real-time inventory. It only gave a count of what was installed across enrolled devices. It refreshed slowly and it only collected a basic set of data.

With the April update...

Microsoft changed both the upload model and the underlying data platform. The new app inventory is built on the same modern data platform that device inventory introduced. That platform was designed for continuous, high-frequency data collection, which gives it more capacity and lower latency than what Discovered apps ran on. The result is that data arrives in the portal faster and the infrastructure can handle the volume of a constantly updating fleet without degrading.

The agent only uploads what changed since the last sync (not sending a full snapshot). This is why multiple updates per day per device is possible without generating proportionally more traffic.

Windows devices get inventory updates multiple times per day. The agent does not wait for the regular MDM check-in, App inventory uploads run on their own schedule through the inventory channel.

For each app, the agent now collects the following (if registered at install time):

• Install path
• Install date
• Uninstall command
• Estimated size on disk
• Architecture (x86, x64, ARM64)
• Per-user install scope
• Store-specific identifiers
• Supported languages

How it works...

You create a Properties Catalog profile in the Intune admin center and assign it to devices. Intune then hands it off to "MMP-C" (Microsoft Management Platform – Cloud). MMP-C wraps the profile as a "Declared Configuration document" (WinDC) and queues it for delivery on the next device sync.

The Declared Configuration model works on desired state. The device gets a document that says what state it should be in and works toward that state. This is the same channel that delivers hardware inventory policies and the same one that Endpoint Privilege Management uses.

When the document lands on the device, it installs the "Microsoft Device Inventory Agent" if it is not there yet. The agent lives at C:\Program Files\Microsoft Device Inventory Agent and runs as a Windows service called "InventoryService".

The agent uses WMI queries to collect application data and writes everything into a local SQLite databases at C:\Program Files\Microsoft Device Inventory Agent\InventoryService\ .

The first harvest runs after a random delay. That is by design. After that first harvest, everything is incremental. Once the data reaches the Intune backend, it shows up in the "All Apps" tab per device.

How to set up...

You need a "Properties Catalog device configuration policy" assigned to corporate-owned Windows 11 devices enrolled in Microsoft Entra ID. Devices must be either Microsoft Entra joined or Hybrid joined.

Go to Devices > Windows > Configuration, click + Create > New Policy, select Windows 10 and later as the platform, and pick Properties Catalog as the profile type. 

Click Next, and give it a name. Then click Next to get to Configuration properties.

Click on + Add properties

Here we have the extended properties available for applications. Add all the properties available (Nothing is enabled by default). Enable the app-related entities from the catalog.

Add scope tags and assignments like any other configuration policy.

Once the policy reaches a device and the agent finishes its first harvest, data starts showing up in the All Apps tab on the next check-in. There is no policy status report for Properties Catalog. You will not see a green success indicator like you would for a settings catalog policy. You have to look at the device directly in All Apps or Resource Explorer to confirm that data is coming in.

If you delete the Properties Catalog policy later, the last collected data stays visible in Device Inventory for up to 28 days before it clears.

The new App Discovery experience

When going to a device in Intune (new device view experience), click on Tools and reports

Select "All Apps"

The new inventory view

You find the official documentation here:
App inventory for Windows devices - Microsoft Intune | Microsoft Learn

Remove Default Microsoft Store Packages from Intune

 Finally there is a native way to remove default Microsoft Store packages directly from a policy in Intune.

You will find it in Settings Catalog
Administrative Templates > Windows Components > App Package Deployment

Corporate device identifiers

Microsoft has announced that Corporate device identifiers for Windows is now working:

Autopilot Device Preparation - Part 5 - Corporate Device indentifier

If you have followed my blogs on setting up Autopilot Device Preparation (ADP) but ends up with this error:

Well – then your company is blocking Windows Personal devices in Device platform restrictions.

When the user logs in, the device is considered a Personal device. To overcome this problem, Microsoft has announced the “Corporate identifier”.

The Corporate identifier consist of Manufacturer, model and serial number.
The Corporate identifier can be uploaded as a .csv file.

To import a Corporate identifier csv file, navigate to Devices > Enrollment and click on “Corporate device identifiers”.

Click “Add” to select your csv file. 

As identifier type, select “Manufacturer, model and serial number (Windows only)”

Now your device is considered a Company device, and ADP will run.

 

Remark !!
When Corporate identifier was introduced it didn’t work, so Microsoft pulled it back for some “work”.
So – if you want to test out ADP now, you have to allow private devices.
Microsoft is expecting that this feature will be available later this month.

Autopilot Device Preparation - Part 4 - Monitoring

With Autopilot Device Preparation (ADP) comes a new report, that works in (almost close to) real-time.
The new report can be found under Devices | Monitor. Windows Autopilot device preparation deployments.

Here you find summarized progress of deployments with deployment trends.
You can select a device and find details of  the device, Timeline of the OOBE, Profile name and version, Apps applied with status and scripts applied with status.

Click on your device to find the deployment details.

Device details:

Apps details:

Scripts details:

This new report is a huge improvement over Autopilot v1 reporting.