Prior to deployment, make sure the client machine is enrolled to Azure. Below are the pre-requisites:
- Microsoft Intune subscription – (sign up for a free trial account).
- Create a user, and create a group.
Reference: Official product documentation for Microsoft Intune
Set up Windows 10 automatic enrollment
Use MDM enrollment so that both corporate and bring-your-own-devices can be automatically enrolled.
Reference: Set up enrollment for Windows devices
- In Azure, choose Azure Active Directory > Mobility (MDM and MAM).
- Select Microsoft Intune.
-
You will be navigated to the Configure page.
-
The following fields should be filled out with the following information:
- Select "Some" from the MDM user scope to use MDM auto-enrollment to manage enterprise data on employees' Windows devices. MDM auto-enrollment will be configured for AAD joined devices and bring your own device scenarios.
"Some” is used as the User scope to allow admin to have flexibility on which groups to have the automatic enrollment feature.
Reference: Enable Windows 10 automatic enrollment
- Click No groups selected then choose your Desired group and click Select.
- Select Some from the MAM Users scope to manage data on workforce's devices.
- Click No groups selected then choose your Desired group and click Select.
- Use the default values for the remaining configuration values.
- Select "Some" from the MDM user scope to use MDM auto-enrollment to manage enterprise data on employees' Windows devices. MDM auto-enrollment will be configured for AAD joined devices and bring your own device scenarios.
- Click Save.
-
- From Azure Active Directory > Mobility (MDM and MAM), select Microsoft Intune Enrollment.
-
You will be navigated to the Configure page.
Take the role of an Intune user and enroll a Windows 10 device into Microsoft Intune. Then return to Intune and confirm the device enrolled.
Confirm Windows 10 Desktop version
Before enrolling Windows 10 Desktop, confirm the version of Windows that you have installed.
- Right-click the Windows Start icon and click Settings to display Windows Settings options.
- Select System > About.
- The Settings window will show a list of Windows specifications for PC. Within this list, locate the Version.
- Confirm that the Windows 10 version is 1607 or higher.
The steps presented in this guild are for Windows 10 version 1607 or higher, if version is 1511 or less, continue with these steps.
Enroll Windows 10 Desktop
- Return to Windows Settings and select Accounts.
- Select Access work or school > Connect.
- Select Join this device to Azure Active Directory.
- Sign in to Intune with work or school account (as Intune user), and then click Next. If the method followed is create a user and assign a license quickstart, the user account created can be used to sign in.
- When the "You’re all set!" screen appears, click Done.
- The added account will be shown as part of the Access work or school settings on the Windows Desktop.
Use the Azure Active Directory (AAD) account to Sign in this Desktop.
If the previous steps are followed, but still cannot access work or school email account and files, follow the steps in Troubleshooting steps to follow if you see Access work or school.
Reference: What is Azure Active Directory?
Confirm your device enrollment in Intune
- Sign in to Intune.
- Select Devices > All Devices to view the enrolled devices in Intune.
- Verify that there is an additional device enrolled within Intune.
Use Intune to add and assign a client app to company's workforce. One of an admin's priorities is to ensure that end users have access to the apps they need to do their work.
Prerequisites to be done on the Worry Free Business Security Services web console
- Download Security Agent MSI via downloader.
- Log in to WFBS Services web console.
- Go to Security Agents.
- Under Manual Groups, click the group on where you require to add the client machine to.
- Click + Add Security Agents.
- Click Download Installer.
- A new tab will open. Click Download.
- Indicate where the MSI should be placed after download.
- Click Next, and wait for MSI to be downloaded.
- Get Identifier.
Add the client app to Intune via Line-of-Business App
An app can be included so that Intune can manage aspects of the app. Use the following steps to add an app to Intune:
- Sign in to Microsoft Endpoint Manager admin center.
- Select Apps > All Apps > Add.
- Select Line-of-business app in the App type dropdown box.
- Click Select.
- Choose Select app package file to upload MSI.
- Click OK.
-
You will be navigated to the App Information section.
-
The following fields should be filled out with the following information:
- The Name and Description box will be auto-filled with "Trend Micro Security Agent".
- In the Publisher box enter a publisher name, such as “TrendMicro”.
- Select Device on the App install context.
- In the Command-Line arguments box enter “/quiet Abandon=0 SILENTMODE=1 IDENTIFIER=[YOUR IDENTIFIER]”.
- Use the default values for the remaining configuration values.
- Click Next.
-
Assign the app to a group or enrolled devices
After App is ready to deployed Intune, it can now be assigned to groups of users or devices. Use the following steps to assign an app to a group:
- Select the group on which you want to deploy the agent.
- Click +Add group on the Required section.
-
Choose the Desired group then click Select.
- Click Next.
-
Review the details. Once done, click Create.
- It may take time for the machine to receive the deployment package. You may manually sync the Windows 10 device to speed up the process through the following:
If User Account Control (UAC) is enabled, it may require the user to click Yes to allow agent installer to make changes and let installation to push thru. UAC can be advised to be temporarily disabled to let agent be deployed properly and avoid prompt to show on user end.
For more information about managing User Account Control (UAC) settings via Windows 10 MDM, refer to User Account Control Group Policy and registry key settings.
Check the Installation status
Install and use the Company Portal app to install the [Your group] app made available by Intune. Use the following steps to verify that the app is available to the user of the enrolled device.
- Sign in to Microsoft Endpoint Manager admin center.
- Select Apps > All Apps then select the Trend Micro Security Agent app.
- Check the installation status.
In some scenario, there might be a delay for the installation to reflect on the dashboard status. Installed agents may not reflect on real-time basis.