Managing Teams devices with MEM and Teams admin center

We’re now in 2020 and lots of has changed since Microsoft Ignite in November including a rebranding of endpoint management with Intune and Configuration Manager to Microsoft Endpoint Manager (MEM). Unifying the solutions under one brand is a major step to further unifying Microsoft endpoint management solutions.

You may be thinking, what happened to Intune and Configuration Manager? The good news is investments are continuing and even better news is where ever you’re at today with your Microsoft endpoint management solutions, Microsoft Endpoint Manager will meet you there. For example if you’re heavily invested in Configuration Manager, continue to utilize and and take advantage of the benefits of the cloud by cloud attaching Configuration Manger to the cloud (MEM Intune). Benefits include data sent from ConfigMgr to Intune for a single view of device information, Azure AD conditional access, and the ability to take action from Intune for ConfigMgr managed Windows client endpoints. Much more is on the way including user experience analytics, Autopilot updates, etc.

To learn about all the innovation and announcements for MEM, M365, and other Microsoft solutions please visit Microsoft Ignite and view sessions there: https://myignite.techcommunity.microsoft.com/sessions

I’ve been so busy the last couple months with travel, events, holidays, I have a backlog of blog posts I need to publish. As we start the new year I’ll start with managing Teams devices running Android with MEM and Teams admin center. As organizations move to Teams for communication and collaboration, Teams devices are also being deployed. As Teams devices are deployed, they naturally will need to be managed, that’s where Microsoft Endpoint Manager and the Teams admin center come in. To learn more about Teams devices please navigate to: https://products.office.com/en-us/microsoft-teams/across-devices

Let’s get started

For this post I utilize a Yealink T58A Teams device and enroll it with Microsoft Endpoint Manager. The setup process was extremely simple, however I’ll step through the process below.

Note: when these devices enroll they enroll under Device Admin not Android Enterprise (which isn’t supported at this time for Teams devices).

When the Yealink Teams device is powered on I’m presented with the sign in screen below.

Once I select Sign in I’m presented with the forms based sign-on from my IDP, in this case it’s Azure Active directory.

After I enter my password and sign in the MEM Company Portal processes joining the device to Azure AD and enrollment into MEM Intune as shown in the screenshots below:

Now that the registration and enrollment process is completed, I’m asked to select what type of account I’m utilizing, in this case I’m using a individual user account so I select “Personal”. If this were a shared device with a generic account I would have selected “Shared”.

With enrollment completed I’m now able to view settings, search the address book, and make calls.

Viewing Teams settings on the device

To access settings, tap settings then Company Portal. Here you can look at Teams version, report an issue, sign out, and access the Company Portal to view device compliance should there be compliance settings configured in MEM Intune.

Looks like my device is out of compliance and asking me to disable debugging, so I disabled debugging as suggested and am confirmed settings again.

Once the device is evaluated again against the MEM Intune compliance settings, my Teams device is now showing it’s compliant.

Microsoft Endpoint Manager admin console and Azure AD

Navigate to Azure AD and search for the device, my is shown below:

In Azure AD, selecting properties under the device show the following information:

In MEM admin center

Search for the device in MEM Intune, below you can see device info, including Android version, user name, as well as if the device is compliant or not.

Drilling down into the device settings we can see more details about the device.

Although we can see the Company Portal version on the device, as shown below, we can see the version in the console.

Microsoft Teams admin center

Next we need to navigate to the Teams admin center to manage the device settings, updates, etc. Do this by going to: https://admin.teams.microsoft.com/ then select Devices > Phones. Drilling down into the phone we see the following information about the Teams device.

It appears I need to update the Firmware and the Teams App and I can do this by selecting Update all and selecting items to be updated and either updating immediately or schedule the update to run at a later date and time.

Conclusion

That’s it for now, as you can see Teams devices provide a streamlined enrollment process by merely signing in. The processes reduces time to setup and rapid productivity for individuals who need communicate quickly.

Send Intune security task notifications to Microsoft Teams, email, etc. using Microsoft Flow

There’s a feature within Microsoft Defender Advanced Threat Protection (MDATP) and Microsoft Intune where MDATP security recommendations can be sent to Intune as a security task. This is helpful if security admins and MDM admins are separate and need to pass information for endpoint management teams to work on. Even if you work on a small team or are a one-person shop, sending security tasks to Intune provides a work item, so if you’re forgetful or get pulled in many directions, you’ll have a task sitting for you. For more details on this feature please visit: https://techcommunity.microsoft.com/t5/Enterprise-Mobility-Security/Microsoft-Intune-security-tasks-extend-Microsoft-Defender-ATP-s/ba-p/369857

The purpose of this post is to create a method to signal and/or alert that there is a new pending security task in Intune. Currently admins need to access the Intune console and check for tasks which is a manual process. I prefer automation and I created a Flow to post a message in a Teams channel and send an email about new, pending Intune tasks sent from WDATP. If you’re thinking, “I’m not a developer…” well the good news is, neither am I! I love Microsoft Flow because it makes creating workflows and automation easy (and I create a lot of Flows to automate tasks).

Let’s get started

Requirements

  • Microsoft Defender ATP
  • Microsoft Intune
  • Microsoft Flow
  • Microsoft Teams
  • A Windows 10 device enrolled with Intune and managed by Microsoft Defender ATP

Viewing a security recommendation and sending a task to remediate to Intune

Navigate to https://securitycenter.windows.com/tvm_dashboard (note if you don’t have a subscription or haven’t set up MDATP, you’ll need to do this first). Look at the Top security recommendation on the right and select one.

Here I see a list of security recommendations.

When “Update Chrome” is selected we can see the number of devices exposed and CVEs (Common Vulnerabilities and Exposures) the update will address.

Select “Remediation options”

Check the box next to “Open a ticket in Intune (for AAD joined devices)”, select a due date, and add notes if necessary.

When finished, select “Submit request”

Head over the devicemanagement.microsoft.com > Security baselines > Security tasks and there should be a pending task. In this case I have two that have a status = Pending.

Select a task and Assign or Reject it, however, don’t do this yet, because we want to get a notification of pending security task in Intune.

Notifications of new pending tasks

Now we know how to send a task from MDATP to Intune, however what would be better is to be informed a task is waiting for us to address, and to set up notifications I use Microsoft Flow.

Creating a new Flow

Navigate to https://flow.microsoft.com, select My flows from the left hand navigation and select New -> Instant-from blank. Give the Flow a name and select create.

Schedule the Flow to run

Search for the “Recurrence” trigger and add it to the beginning of the Flow. Populate the fields to meet your requirements. I set my schedule to kick off everyday at 8 AM mountain time.

Azure AD Authorization to call Graph

This process requires multiple steps so I’ll refer you to a couple sources that may be utilized to configure the authorization steps:

Query Graph

Search for and add the HTTP Flow action. Method = GET, URI = https://graph.microsoft.com/beta/deviceAppManagement/deviceAppManagementTasks

In the header I utilize the authorization info compiled in previous steps.

The next three Flow actions take the information from the graph call and parse it out based on the JSON schema

  1. Search for and add a Compose action and as the “Input” add the Body from the Http action above.
  2. Search for an add a Initialize variable action, Name = JSONObject, Type = Object, Value is the Value from the Compose 2 output in the previous action.
  1. Next we need to parse the JSON so we can select JSON fields to be added to an email and Teams posts. Search for an add a Parse JSON action, Content = JSONObject from the variable above the Parse action. The Schema is generated easily by going to Graph Explorer and querying Graph as shown below. Copy the JSON returned from the response preview pane and in the Parse JSON action, select “Use sample payload to generate schema” and past the JSON output and select done. This will construct your schema.
Use the JSON output from graph explorer (as shown below) to populate the sample payload to generate the schema.

Send to Teams and/or email

Here I walkthrough sending to Microsoft Teams; however, an email trigger is roughly the same process.

  1. Search for and add a “Apply to each” trigger, Select an output from previous steps = the value from the Parse JSON action above.
  2. I only want task with a status of “Pending” so I added a Condition trigger where search for a status equal to “pending”. The Status object comes from the JSON we parsed above.
    • If status of pending = yes, I send an email and post to Teams, if status is anything other than pending, the Flow terminates.
  3. Search for and add “Post a message” action. Search for the Team site, Channel, and then craft your message. More on this below.

The reason we need to add a schema and parse the JSON returned from the Graph call is so we can select the variables returned individually. Below is an example of the fields I selected for my messages sent to Teams.

Viewing Teams posts

The following is an example of an Intune Task sent to teams with the Flow constructed above. If there is more than one pending task, the Flow will post individual messages for each pending task (same goes for emails). As shown below, I happen to have two tasks that are pending, one to Update Chrome and the other to Update Windows 10, lucky me!

That’s it! If you’re utilizing Microsoft Defender ATP and Intune, integrate the two and start sending tasks to Intune today. Use Flow to schedule notifications and send to Microsoft Teams, email, or whatever method Microsoft Flow supports.

Additional References

Logic apps docs: https://docs.microsoft.com/en-us/azure/logic-apps/logic-apps-perform-data-operations#join-action

Use data operations with Microsoft Flow: https://docs.microsoft.com/en-us/flow/data-operations

Follow me on Twitter @mscloudinfa

Entire Flow