What's new in Microsoft Intune (2308)

Find the latest and greatest on Microsoft Intune in this new series from the MSEndpointMgr team.
We go through all of the new implemented features for Windows in the last months and at the same time, demo and talk through how they could be utilized in your environment.
2308
(01:05) Uninstall Win32 and Microsoft store apps using the Windows Company Portal
(06:45) Win32 app configurable installation time
(11:30) New BitLocker profile for Intune's endpoint security Disk encryption policy
(13:50) Use the Turn off the Store application setting to disable end user access to Store apps, and allow managed Intune Store apps
(16:15) Updates for compliance policies and reports
(19:40) Improved user experience for device timeline in Endpoint Analytics
(23:05) CloudDesktop log now collected with Windows diagnositcs data
(26:15) Elevation report by applications for Endpoint Privilege Management
(29:15) Defender Update controls to deploy updates for Defender is now generally available
(33:05) Group Policy analytics is generally available
(35:25)Remediations now available in the "by platform" blade
What's new in Microsoft Intune:
learn.microsoft.com/en-us/mem...
#MSIntune #ConfigMgr #Reports #Windows10 #Windows11 #Winget #Debug #RemoteHelp #WhatsNewInMicrosoftIntune

[@bobbydk123]

Great content as always 🎉

[@MSEndpointMgr]

Thanks!

[@Lewis01Brown]

Intune Win32 apps need an advanced option to be able to have an "Uninstall" package so we could use PSADT but without the installer files in the intunewin file

[@MSEndpointMgr]

Preach it. We need more options, but let's add the feature request and keep asking until we get it :)

[@AbdullahOllivierreIT]

I do not get it. PSADT is only great when user interaction is required

[@MSEndpointMgr]

@@AbdullahOllivierreIT it is also great for logging and standardizing your package estate

[@Nozuka621]

Would you recommend using the Bitlocker settings in "Endpoint Security" shown here over a "device configuration profile"? And why? Feels a bit confusing, that you can do it in both places... not sure which one to choose.

[@MSEndpointMgr]

Good question. We ask the same.
Endpoint Security is good to use if you have a seperate SecOps devision that you want to give access to policy. They can use the Entra role Security Admin to get access to these kind of policies.
Settings Catalog is kind of the universal place we Intune admins use, but it can be hard sometimes to build the right policy pack, whereas Endpoint Security is more of a template kind of thing, THIS is the settings that you want to consider.
Hope this helped you.

[@Nozuka621]

​@@MSEndpointMgr Good points, thanks! Feels like they should just make the same profiles show up in both places then... oh well :)

[@MrMarcLaflamme]

Regarding turning off the Store. Maybe I missed you mentioning this but what about the built in Windows apps that are updated automatically through the Store? Such as Calculator, Notepad, Phone Link, etc. I didn't specifically deploy these as they came installed but they are updated via Store. Will they need to be re-deployed via Intune as a required store app to be updated?

[@MSEndpointMgr]

They will continue to be updated. Everything you have that is installed via store will still be updated. By using this new policy you prohibit, manual store app shopping and also winget install locally.

[@MrMarcLaflamme]

@@MSEndpointMgr Okay that's good to know. Regarding your last point about winget locally, does that mean if I open a terminal prompt and run winget install x, this will not work?

[@Minerva___]

At 15:38 you mention that updates won’t be blocked, however, in the informational bubble in the Settings picker screen it states, “Access to the Store is required for installing app updates.” I wouldn’t put it past Microsoft forgetting to update this information, but have you successfully tested that updates are possible for UWP apps? I’m asking because we recently began vulnerability testing in which a large number of the UWP apps were missing updates. This was due to a GPO we configured to block access to the store. I’m trying to move away from a hybrid configuration in my environment and would like to configure this via Intune but need to make sure it works.
Is there a way to test (or force) apps to fetch updates with this Configuration Profile in place?
Also, it looks like this is only supported for Windows Enterprise or Windows Education. Unfortunately, we’re only running Windows Professional.

[@MSEndpointMgr]

@@Minerva___ yes only for those platforms.
The text in the setting is very clunky written. It is confirmed by MSFT that above stated is indeed the behavior. Apps will update

[@terrymoorenz]

Exciting changes with the Bitlocker configuration. Will you also be able to set the PIN on a global level ?

[@MSEndpointMgr]

Absolutely exciting! PIN on a global level, can you elaborate?
You can assign the policy and thereby target your devices.

[@terrymoorenz]

@@MSEndpointMgr One of our customers requires the same bit locker startup PIN across all Intune MDM Windows endpoints. Is there a way to push the 6 digit PIN without end user interaction ?

[@MSEndpointMgr]

@@terrymoorenz hmm so a startup pin which is the same for all devices and telling the user afterwards? Why bother to have PIN then? Shouldersurf one device and steal the code. It does not sound as a very good idea to be honest.

[@webcomment8895]

@@MSEndpointMgrThe reason to do that is to automate applying an initial PIN on all devices. Standard users cannot create Bitlocker PINs; they can only change existing PINS.
You would require users to change the PIN after they receive their device so they would not all have the same PIN.
A simple way to ensure users will change the PIN ASAP is to set the initial PIN to be much longer and more complex than the minimum requirements.
Set a 25 character default PIN and then tell users the minimum PIN length is 7 characters and they will all change the PIN to something else rather than keep using the PIN they were given.