Posts

Showing posts from June, 2024

Microsoft Remote Help native app with Full Control, Conditional Access, macOS - Bringing it altogether

Image
In April 2024, Microsoft announced full support for Intune Remote Help on the macOS platform. This new enhancement brought remote assistance to the same level as Windows OS. It also meant that now remote sessions could be trusted with strong authentication like multi-factor and even leverage conditional access policies. Even though Remote Help is not part of the default Intune license, it does come as part of the Intune suite or can be purchased as a separate add-on. Remote Help is available for macOS as both a native application, and as a Web App that runs within the user's web browser. As of writing this blog, Full Control feature is only supported with the client native app and that is what I'll be focusing on in this blog. But first, here is a quick glance on the capabilities of the Remote Help feature - - Remote Help can be enabled to provide assistance on unenrolled devices - Conditional access can be utilized for setting conditions for Remote Help. - Compliance Warnings...

Secure Home folders in macOS using Intune

Image
If you have onboarded your macOS devices onto Defender for Endpoint, then more often than not, you will see the vulnerability recommendation flagging for ' Secure Home folders in macOS ' affecting the secure score. The potential risk here being is that allowing all users to view the top level of all networked user's home folder may not be desirable since it may lead to the revelation of sensitive information. This is because by default macOS allows all valid users into the top level of every networked user's home folder, with the ability to view the folder content and this can be a security risk. The remediation steps involves running commands in Terminal for each user account with a local home folder to modify the permissions. In my honest opinion, if the macOS devices are meant for single user use, then this recommendation may not really apply. But in case of multiple users, it is a whole different story. Regardless of the device use, if you are looking to address thi...

Blocking Chrome extensions with custom messages on macOS using Intune

Image
  When it comes to managing third party browser extensions for macOS, there is no easy way. While Intune has the settings added for Google Chrome in settings catalog for Windows, the same is missing for macOS. Now that organizations are using a mixture of OS platforms between Windows and macOS, it is becoming increasingly important to have consistency in management of enterprise devices. Until such time, administrators will have to find ways to configure such settings in a supported manner. Luckily in case of macOS, one can configure .plist and\or .mobileconfig files to manage most of the settings if note all. In this blog, I will quickly demonstrate how to block Google Chrome extension and display a custom message to the end user. I am using Google Drive as an example. First we need to identify the extension ID and the easiest way is to access https://chromewebstore.google.com/ and search for the application. In this case we are searching for Google Drive. The search result w...

Move Android devices from device administrator to personally owned work profile management in Intune

Image
Back in April 2020,  Google announced deprecation of Android Device Administrator Management and since then no fixes or improvements have been added to DA. Now Microsoft recently announced that Intune will be ending support for device administrator management on devices with access to Google Mobile Services (GMS), beginning August 30, 2024. It is important to note that after Intune ends support for Android device administrator, devices with access to GMS will be impacted in the following ways:  1. Users won’t be able to enroll devices with Android device administrator. 2. Intune won’t make changes or updates to Android device administrator management, such as bug fixes, security fixes, or fixes to address changes in new Android versions. 3. Intune technical support will no longer support these devices. Moving from Android DA to Android AE. Luckily Microsoft have made it possible for organizations to move their Android enrollments from DA to AE without much hassle. It does invo...