Protect Corporate Apps & Data on devices with Intune Mobile Application Management (MAM) – Using Intune in Azure Portal

Mobile Application Management or simply MAM is a great feature that comes with Enterprise Mobility + Security suite. It helps to protect corporate apps and data by enforcing configurable policies. MAM policies can be deployed to employee-owned unmanaged devices, devices that are enrolled in Intune and devices managed by a third-party mobile device management (MDM) solution.
This article describes how to configure MAM policies on Android devices that are enrolled in Intune.

For this guide I am using a device which is enrolled in Intune.

Upgrade to Internet Explorer 11 using System Center Configuration Manager - An Alternative Way

Recently one of our customer wanted to upgrade their Internet Explorer version to 11 in Windows 7 machines since Microsoft already stopped support for versions below Internet Explorer 11 long time back.

For the upgrade, most used methods are:

1. Task Sequence.
2. IEAK - Internet Explorer Administration Kit.

From above two, task sequence was the preferred method because, in that, it is possible to deploy prerequisites first and then deploy Internet Explorer 11 and also it can control restarts.

IEAK does not have many success rates.

But for me both of the above methods didn't work as it should. Task sequence gave errors.

So I used this method:

Error 0x00004005 While Running SCCM Capture Media in Windows 10

When you're creating a reference image for a specific laptop or desktop model using SCCM capture media, in the middle of the process (in sysprep stage) you might get 0x00004005.

Most common reason for this is, the store apps that comes with Windows 10.

You will able to find more details regarding this issue from log files in 2 locations.

1. SCCM Task Sequence log (SMSTS.log) - on Run prompt type %temp% to go directly to log location.
2. Sysprep Error Log (setuperr.log) - Go to C:\Windows\System32\Sysprep\Panther\.

Enable BitLocker Using SCCM OSD Task Sequence and MBAM

Few days ago I wanted to enable BitLocker as a part of OS deployment. With SCCM & MBAM this can be done in two ways.

1. Used Space Encryption or Pre-Provisioning BitLocker.
2. Full Disk Encryption (FDE) or the normal way.

Pre-Provisioning BitLocker is crazily fast. Because it encrypts the disk even before the OS is applied. Also it will only encrypt the used space. So when data gets written to disk it will automatically encrypt the newly added data. Used Space Encryption is good if the HDD has never stored confidential data in the past or the HDD is previously fully encrypted with BitLocker. I prefer this method.

FDE as the name suggests, encrypts the entire disk. Also it's a time consuming process even if configured as a part of OS deployment. It might take 2-3 hours or more depending on the size of the HDD and the size of the data on the HDD. But most people prefer this method.

I will share my experience & task sequences which worked for me to do above in both ways.

Sri Lanka IT Pro Forum - December 2016

Last year (actually last week 😉) I got a chance to do a session with my colleague Muditha Jayath Chathuranga on the topic "Protecting Corporate Data with Microsoft Intune Conditional Access" at Sri Lanka IT Pro Forum December meetup. This was a good experience for me as this was my first time.