Looking at Intune Suite

Intune Suite is a set of paid add-ons grouped together into one single monthly license. In this chapter, we will learn about the currently available features of Intune Suite, how to deploy them, how to use them, and, more importantly, how to automate them.

In this chapter, we will cover the following recipes:

• Deploying and using Remote help
• Learning about Microsoft Tunnel for Mobile Application Management
• Reviewing device anomalies
• Configuring Endpoint Privilege Management
• Future developments

Technical requirements

For this chapter, you will need a modern web browser and a PowerShell code editor such as Visual Studio Code or PowerShell ISE.

All the scripts referenced can be found here:

https://github.com/PacktPublishing/Microsoft-Intune-Cookbook/tree/main/Chapter-14

Chapter materials

At the time of writing, Intune Suite costs $10 per user per month (or the equivalent in local currency) and includes the following:

• Advanced endpoint analytics: This uses machine learning to improve the Endpoint Analytics offering and look for themes and trends across the estate by detecting anomalies for proactive monitoring. It also includes advanced scope tags and an improved device timeline.
• Endpoint Privilege Management: Also available as a stand-alone add-on, this is used to elevate specified applications without users needing administrative rights.
• Microsoft Tunnel for Mobile Application Management: Also included in Intune Plan 2, this is a VPN tunnel for mobile applications on iOS and Android.
• Remote help: This is a remote assistance tool for Windows, macOS, and Android and is also available as a stand-alone add-on.
• Specialized devices management: This allows for the management of devices such as HoloLens and Surface Hub and is also...

Deploying and using Remote help

Remote help is a remote assistance tool available for Windows, macOS, and Android. It allows for connections to unenrolled devices and can be fully managed with granular role-based access control (RBAC) and custom Intune roles.

Getting started

There are multiple parts required for using Remote Help. This recipe will cover configuring the policies and RBAC, but you also need to have the applications deployed to your devices.

For Windows devices, the installer can be found here and packaged following the instructions in Chapter 11, Packaging Your Windows Applications:

https://aka.ms/downloadremotehelp

For Android, the application can be found here and deployed using the Managed Google Play Store, as covered in Chapter 5, Android Device Management:

https://play.google.com/store/apps/details?id=com.microsoft.intune.remotehelp

The macOS version runs entirely in the web browser, so there is no requirement for application deployment.

...

Learning about Microsoft Tunnel for Mobile Application Management

Microsoft Tunnel for Mobile Application Management (MAM) is a way to require applications to connect to an on-prem VPN solution on an unmanaged device running Android or iOS.

Getting started

Microsoft Tunnel for MAM extends the existing Tunnel VPN functionality. Therefore a pre-requisite is for the Microsoft Tunnel connection to be active and connected to your on-premises environment.

More information about setting up Microsoft Tunnel can be found here:

https://learn.microsoft.com/en-us/mem/intune/protect/microsoft-tunnel-configure

For devices running Android, both the Company Portal and Microsoft Defender for Endpoint apps need to be deployed to them. There are no app requirements for iOS.

How to do it…

Microsoft Tunnel for MAM is configured within app protection policies. We covered the creation of these in Chapter 5, Android Device Management and Chapter 6, Apple iOS Device Management....

Reviewing device anomalies

Advanced Endpoint Analytics is another feature of Intune Suite, and it is split into three components:

• Device anomaly detection: This uses machine learning to look for trends across your estate and alert you of any potential issues. This is what we will be covering in this recipe.
• Custom device scopes: This allows you to add scope tags to the Endpoint Analytics Reports to give different permissions to different groups of administrators. For example, you could provide a business unit access to only review reports for their particular devices. You can find out more about this at https://learn.microsoft.com/en-us/mem/analytics/device-scopes.
• Enhanced device timeline: This expands the history of events for any particular device to give a more thorough view of what has been happening. You can learn more about this feature at https://learn.microsoft.com/en-us/mem/analytics/enhanced-device-timeline.

You can then leverage anomaly detection...

Configuring Endpoint Privilege Management

Endpoint Privilege Management (EPM) is a mechanism for elevating particular applications for end users without granting them administrative rights across the device. This could be for a particular line-of-business application that requires elevation or for your helpdesk to be able to run particular tools on devices. We can configure rules for EPM to allow automatic elevation or have it require approval first.

This recipe will demonstrate how to configure EPM and then add a file rule to allow a particular application to run elevated.

How to do it…

First, we will run through how to configure EPM in the UI:

1. Navigate to Endpoint security and click on Endpoint Privilege Management.
2. We need to start with a settings policy, so click Create and then, in the fly-out, select Windows 10 and later and Elevation settings policy. Then, click the Create button.
3. Give your policy a Name and Description and click Next.
4. On...

Future developments

As mentioned at the start of the chapter, Intune Suite is still being heavily developed, and at the time of writing, there have been two future features that have been announced but not yet released. In this section, we will look at these features based on the information currently available.

Advanced Application Management

The first addition is Advanced Application Management. As you know from Chapter 11, Packaging Your Windows Applications, packaging your applications is relatively time-consuming, and you also have to keep them updated, which can involve regularly checking the vendor’s website, packaging, testing, and deploying.

To make this process simpler, Microsoft is looking to add a curated selection of pre-packaged applications that can be deployed through a simple UI in the portal. These applications will also be kept updated and allow for a simple method of updating pre-deployed applications.

Hopefully, this will also include an API...