Microsoft Endpoint Manager - Intune - Conditional Access

I haven’t been on my game this week. If we’re honest, I think a lot of us have been a little bit off. Covid-19 has been looming for months, yet somehow we failed to anticipate how the virus would impact our daily lives. In North America, we watched as the pandemic exploded first in Southeast Asia then quickly moved across Europe. Most of us expected we would see it here, but I think that in our hubris we never expected a major disruption to business and society. Our culture isn’t one to slow down. We tend to believe we are above the fray and can weather any storm.

It’s not a secret that I claim to be a technology disruptor. As IT pros working with Microsoft 365, we want to change the way that our organizations work. Our goal is to empower our end users. Change typically takes time and being a disruptor in technology is as much about being a salesman as it is about being a skilled technologist. We are used to pitching new solutions, talking about the benefits of new technology, and working to build allies in our organizations. Workplace disruption is typically a slow and methodical process. Even if we know the value these tools have it can take time to deploy them because of the impact they would have on end users, infrastructure requirements, and workplace culture that isn’t always ready for change.

Six months ago, we couldn’t have predicted the impact a global pandemic would have on the workplace. What was once unthinkable is now our reality. The disruptors have now joined the ranks of the disrupted. Pitching a modern workplace was always about creating a nirvana that would empower workers to work from any location, on any device with total security and unlimited freedom. It sounds great on paper, but a lot of organizations weren’t ready to adopt remote work models, so change was incremental. Many of the modern workplace tools were considered ‘nice-to-haves,’ but not essential for continuing day to day operations. Our roadmaps have been filled with bucket list items from the Microsoft 365 suite of tools, but for most of us those tools aren’t deployed yet. However, we can’t unmake decisions that were made six months ago. It would be easy to say, “If we had deployed Teams globally six months ago, we wouldn’t be in this situation,” or, “If we had only decided to set up a Cloud management gateway or co-manage our Windows 10 devices we could address this issue on PCs.” 
​

Welcome! This blog series will examine how traditional IT team dynamics fit in the Modern Workplace, and whether we are prepared to manage and deploy solutions effectively in a cloud-first world.

Sometimes it’s best to sit and listen.

In a recent meeting I sat back as the attendees “discussed” their vision for addressing a specific challenge. I was a late invitee, and it was clear to me that the brief overview of the agenda I was given didn’t match the meeting’s intent.

There was a business challenge that needed to be addressed, but the actual intent of the meeting was much broader. It turned into a round table discussion about many of the challenges that we face and how we can overcome them.

I’m not known for keeping quiet. Typically, I jump into a conversation early and make sure my opinions are known. In this meeting I chose to sit back and listen. The perspective I gained was invaluable. Once we had exchanged the typical pleasantries, one colleague led with a question. She had barely completed her question when another team member offered a solution. Unfortunately, the “solution” being offered was little more than a defense of the status quo.

The back and forth continued and I quickly realized that while everyone was in the same discussion, both sides were talking about something different. One team member was looking for a new, modern solution to a problem, while the other team member only saw challenges – the costs involved, man hours, lack of expertise, and a litany of other issues were brought up. No one bothered to ask if it was worth it – or even worse, if there was a workable solution available that we could easily leverage.
​
As technologists on the forefront of workplace modernization we are by nature disrupters. We want to empower our users to do more, but it can be difficult to share our vision and gain traction on deploying modern solutions. Our teams don’t always share a unified vision, and when we do, we frequently talk past each other. 

The Challenge

I was recently asked to create a simple process to change the primary language of Windows 10 during OS Deployment. Due to regional expectations we also had to be able to select a different keyboard layout based on user preferences. One of the challenges we face is that we have support personnel in different regions, but not in all offices. Our remote offices did not have a centralized imaging solution, which meant that we needed to provide a solution and streamline the process.

My goal was to provide a solution that would be easy to understand, simple to execute, and easy to maintain across different regions. My personal preference is a simple task sequence that minimizes the number of conditional steps needed to execute.

In this case I wanted to provide our technicians with a clean user interface. I wanted to avoid using DISM to inject languages during the task sequence, which in turn prevents me from having to manage additional content used in the task sequence. The task sequence should be lite-touch, prompting for basic information like site code, form factor, language settings, and additional applications.

Microsoft Endpoint Manager 1910 added support for language settings to the “Apply Windows Settings” step. This would be a great solution if you have a small number of configurations to support, but in an environment with a multitude of possibilities it could be difficult to manage. I will cover using these settings in a future blog post as I think they are an excellent addition to Configuration Manager, they just don’t meet my needs for this project.

Most of the other documentation that I found required integration of MDT with SCCM. The posts that did not use integrated MDT used some elements of MDT or other scripts to set these values. I considered that option but wanted to see if I could get by without the additional steps.
When I saw that language support had been added to the task sequence I decided to test whether or not I could set the language settings without the use of a script. This may have worked prior to version 1910, but I have not tested it. I suspect that this functionality is a direct result of the settings being added to the task sequence directly.

After looking at different possible solutions I determined that the best way to create a technician-facing UI was UI++ by Jason Sandys of ConfigMgrFTW. UI++ gives me the ability to create a simple UI that can be easily customized and ported to other locations. I can use one deployment package for all my locations and point to a different XML file based on the region.
​

This is my latest post on the challenges faced by IT pros in the Modern Workplace, where I examine how changes in technology and business impact Modern Endpoint Managers and other technical professionals. The first post in the series can be found here.

​“Hello … IT. Have you tried turning it off and on again?” Roy and Maurice from the IT Crowd earned a special place in pop culture as the nerdy but lovable IT duo who personified a stereotype in the early 2000s.

It wasn’t that long ago that the information technology field, particularly systems engineering and administration, were dominated by the Roys and Maurices of the world. We never would have expected that Cosmo would run a column titled, “FYI, there are some pretty cool IT jobs out there.” Jobs that were once stereotyped as being the realm of unkempt, socially awkward guys working in dark, cluttered offices are now in-demand and sought after.

In the article, “How the IT Guy Became the ‘It Guy’: The Evolving Portrayal of Tech Professionals in Movies and Television,” Christina Wang discusses the changing image of IT pros in pop culture. She tracks the changing image from Dennis Nedry in Jurassic Park, to Roy and Maurice, and finally to Felicity Smoak in Arrow. In a lot of ways, this evolution mirrors reality. In the mid-90s the typical systems admin was expected to be a jack-of-all-trades with deep technical skills. IT teams were leaner, so deeply technical admins were regularly called upon for end user support – which led to confrontation and the stereotype of the IT guy as impatient and aloof, talking down to end users.

Roy and Maurice marked the first major evolution in the changing face of the IT pro. Throughout the series of the IT Crowd, we saw them being called to the president’s office and interacting with end users. They were looked at as advisors – not just technical assets. Roy was still a bit impatient with end users, but he worked to understand their needs and requirements. Maurice tried hard to fit in, even if he really didn’t understand the pop culture topics of the day. This first evolution tracked closely with the advent of Windows Server. Systems administration became more accessible to more people. While sysadmins were still expected to have deep technical skills, they could specialize more in different areas. End users became more knowledgeable, but many still had to call support frequently as the technology was not as stable nor easily accessible.

This is the second post in a series on the principles behind the Modern Workplace. 
​
​The first can be found here: It's not you, It's me
​

“Change for the sake of change is frivolous. It must be avoided. I know what users want because I’ve been doing this for so long, I know what works!” For a guy who has loudly told the world that he has never read Harry Potter, my (former) coworker sure did an amazing Dolores Umbridge impersonation.

We are caught in a cultural tug-of-war in our technology departments. On one side we have legacy SysAdmins who believe that IT knows what’s best for our users. The other end is anchored by the Modern Workplace evangelists who preach a gospel of agility, data-driven decision making, and user empowerment. End users are caught in the middle, often to the detriment of our organizations.

Brad Anderson touched on this in his blog post announcing Modern Endpoint Manager. He cites a study by Enterprise Strategy Group that shows certain trends amongst end users. The study demonstrates the importance of moving towards modern endpoint solutions. 

It’s not you, it’s me.

I get it – you want this amazing modern workplace experience, but I’m not sure you know what you’re ACTUALLY asking for. I mean, look at our environment. It’s complex because it needs to be. The old IT manager wrote a login script, and I’ve spent a lot of time adding to it and maintaining it – and, well, to be honest … I’m not quite sure what all of it does. I just don’t want to break anything by taking it out. And our group policies? I mean, I know what the stuff I created does. I’m just not sure about everything else … and besides, do we really want to mess with our Default Domain policy? I don’t think we can tolerate that kind of risk – and have you met OUR end users? OUR users are the worst! Way worse than anywhere else I have been!
​
I could insert any number of clichés here. (The world is changing, the future is now, or any statement involving the word synergy.) We all know that business and technology are changing at an unrelenting pace. Our organizations are demanding that we provide solutions that allow them to be more mobile, more collaborative, and more flexible. We, as IT Pros, have turned around and asked our vendors for better solutions. They have, in turn, provided those solutions.