Azure tenant and Intune integration

# 1. Login to azure with the Microsoft 365 developer program login
# 2. Add custom domain to the the exiting tenant
# with DNS Checker you can check the records propagation of your domain
Start-Process 'https://dnschecker.org/#TXT/'
# 3. Azure Active Directory -> Mobility (MDM and MAM) -> Microsoft Intune
# 4. MDM user scope -> All (MAM and MDM can create conflicts, here we make use of the MDM)

# Security defaults - Enable multifator authentication for Admins which is a great starting point
# Enabling security defaults is in contrary with Conditional Access Policies
# 5. Microsoft Entra ID -> Properties -> Manage security details

# 1. Intune Tenant Admin customizations
https://intune.microsoft.com/
# Once configured properly you should be able to preview the customization on Company Portal
https://portal.manage.microsoft.com/
# 2. Within the policies in the Intune Tenat Admin customizations you can create brainding for the group of users
# 3. CNAME
# Devices -> Enroll Devices -> CNAME Validation
# In case the CNAME validation did not went well go through the 
Start-Process 'https://learn.microsoft.com/en-us/mem/intune/enrollment/windows-enroll#enable-windows-enrollment-without-azure-ad-premium'

# The deployment guide is available here
Start-Process 'https://learn.microsoft.com/en-us/mem/intune/fundamentals/deployment-guide-enrollment-windows'

# Create CNAME
Start-Process 'https://learn.microsoft.com/en-us/mem/intune/enrollment/windows-enrollment-create-cname'

# In your domain administration panel create:
# 3.1 first CNAME record
# Name: EnterpriseEnrollment.[yourdomain]
# TTL: 3600 (1h)
# Value: EnterpriseEnrollment-s.manage.microsoft.com.

# 3.2 second CNAME record
# Name: EnterpriseRegistration.[yourdomain]
# TTL: 3600 (1h)
# Value: EnterpriseRegistration.windows.net.

# Changes to DNS may take up to 72h to propagate, though if your domain is already spread across DNS servers, once you added the CNAME records properly the 
Start-Process 'https://dnschecker.org/#CNAME/EnterpriseEnrollment.[yourdomain]'
# should bring a positive result and the CNAME validation check on
Start-Process 'https://intune.microsoft.com/'
# should be validated properly immediatelly

Start-Process 'https://www.youtube.com/watch?v=rw0rkXfv2pk'
# 1. Login to Azure portal
# 2. Navigate to Microsoft Entra ID
# Check the available features within the m365 developer Entra ID
# Microsoft Entra ID -> Licenses -> Licensed features (available features)

# get the P2
# 3. Entra ID -> Licenses -> All products -> Try/Buy -> Activate Free trial

Start-Process 'https://www.microsoft.com/en-us/security/business/microsoft-intune-pricing'
# 1. Entra ID -> Users -> pick user -> Licenses
# if the Microsoft Intune Plan 1 is there you should be covered

Start-Process 'https://entra.microsoft.com/'
# search on the top for mobility
# 1. Microsoft Intune should be on the list
# 2. Change the MDM user scope from All to Some and define the group name which define who can enroll the devices in your environment (for example for the pilot of devices), though the better way would be to limit that by the licenses assigned to the users, for instance by dynamic group.

# The best practice is prevent to allow the end users to enroll the device and the applications, so the MDM and MAM should NOT be set to ALL.

Start-Process 'https://intune.microsoft.com'
# 1. Devices -> Enroll Devices -> Windows Enrollment -> Automatic Enrollment

# Allow or block personal devices to be auto enrolled (this setting influence the autopilot based enrollment)

# 2. Devices -> Enrollment Device platform restrictions -> All Users -> Properties -> Platform settings -> Edit (here you can define what is the platform which can be enrolled)
#    Personally Owned - Block

# How to check if the device is not BYOD ?
dsregcmd /status

# +--------------------------------------------------------------------------+
# | Device state - those two fields confirmes the Hybrid Azure AD join state |
# +--------------------------------------------------------------------------+
# AzureADJoined : YES
# DomainJoined  : YES - this in majority of cases means that it's corporate owned

# +--------------------------------------------------------------------------+
# | Tenant Details                                                           |
# +--------------------------------------------------------------------------+

# +--------------------------------------------------------------------------+
# | User State                                                               |
# +--------------------------------------------------------------------------+
# NgcSet          : NO - Next Generation Credential - towards Windows Hello
# WorkplaceJoined : NO - The user device is hybrid AzureAD joined

# +--------------------------------------------------------------------------+
# | SSO State                                                                |
# +--------------------------------------------------------------------------+
# AzureADPrt      : Yes - Azure AD Primary Refresh Token Available

# 3. Start Menu -> Manage your account -> Access work or school
#    The key indicator that the device is joined to the MDM is the fact that 
#    it shold contain the info button, just on the left of the disconnect button
#    it is clickable and should show which policies are applied to the device

#    if the Info button is not there it's clear indicator that the device is
#    NOT MDM enrolled

# 1. Go the the gpmc.msc
# 2. Create a GPO 'Enable Intune AutoEnrollment'
# 3. Computer Configuration -> Policies -> Administrative Templates -> Windows Components -> 
#    MDM -> Enable automatic MDM enrollment using default Azure AD credentials
Start-Process 'https://www.microsoft.com/en-us/download/details.aspx?id=104677'
# 4. Enable | User Credential (the MDM Application is only needed for the device credential)
# 5. Link the policy to the OU with Devices

#    The device credential is only supported for Microsoft Intune enrollment with comanagement for Azure Virtual Desktop, because the Intune subscription is user centric.
Start-Process 'https://techcommunity.microsoft.com/t5/microsoft-intune-blog/understanding-hybrid-azure-ad-join-and-co-management/ba-p/2221201'

# 6. run powershell admin session
gpresult /r /scope:computer
# 7. restart the device

# Now it's time to test whether everything went fine and the device is enrolled

# 8. Start Menu -> Manage your account -> Access work or school
#    The info button should be there.

Stat-Process 'https://intune.microsoft.com'
# 1. Devices -> Enroll Devices -> Enrollment Status Page -> Default profile -> 'All users and devices' -> Settings -> Edit -> 'Show app and profile configuration' -> Yes

Start-Process 'https://www.powershellgallery.com/packages/Get-WindowsAutoPilotInfo/3.5/Content/Get-WindowsAutoPilotInfo.ps1'
#OA3Tool.exe from Windows ADK
$session = New-CimSession
$object = (Get-CimInstance -CimSession $session -Namespace root/cimv2/mdm/dmmap -Class MDM_DevDetail_Ext01 -Filter "InstanceID='Ext' AND ParentID='./DevDetail'")
^ "$env:Programfiles\Windows Kits\10\Assessment and Deployment Kit\Deployment Tools\amd64\Licensing\OA30\oa3tool.exe" /DecodeHwHash="$($devDetail.DeviceHardwareData)"

Install-Script get-windowsautopilotinfo
Set-ExecutionPolicy bypass
Get-WindowsAutoPilotInfo.ps1

Start-Process 'https://intune.microsoft.com'
# 1. Devices -> Windows -> Windows Enrollment -> Deployment Profiles -> Create profile -> Windows PC -> 

# Deployment Mode                  : User-Driven
# Join to Microsoft Entra ID as    : hybrid joined
# Skip AD connectivity check       : NO
# Microsoft Software License Terms : Hide
# Privacy settings                 : Hide
# Hide change account options      : Hide
# User Account type                : Standard
# Allow pre-provision deployment   : NO

# assign the group

# Check
# Devices -> Windows Enrollment -> Devices

# Once enrolled the Intune enforce some policies like the encryption