Menu

Intune

Enable tpm non-compatible tpm 01

Enable BitLocker with non-compatible TPM

, 1

Would you like to enable BitLocker on devices with non-compatible TPM or in simple words “devices without TPM” to secure the enterprise data.

Is this doable? Yes, it is.

Let’s have a look at what settings you need to configure and what are the prerequisites.

Prerequisites

  • Intune enrolled device

Points to consider

  • This cannot be automated if you would like to rely on configuration profiles
  • Additional authentication at startup is required

Solution

Log in the Microsoft Endpoint Manager admin center.
1. Go to Home > Devices > Windows > Configuration Profiles > Create Profile

2. Select Platform as “Windows 10 and later”, Profile type as “Templates”, select Endpoint Protection in the listed templates and click Create

3. Provide Basics information and click Next

4. In Configuration settings, we will just update two Windows Encryption settings and leave the rest as default.
Windows Settings
Encrypt devices: Require
BitLocker OS drive settings
Additional authentication at startup: Require

5. Assign this profile to your intended device group by simply clicking on the Add groups, Select your group and click on Next. For this example, I have assigned newly created profile “Enable BitLocker with non-compatible TPM endpoints” to a group called “C-Auto-Pilot-Pre-Production-02” as a member. SALES-02 computer is a member of that group.

6. I am not changing anything in Applicability Rules, so I will Reveiw + create the profile

Monitoring Part 1

You can check the deployment/compliance status of this profile through the Monitor settings. These settings are available under Monitor node as shown below.

As you can see above, Device status has nothing to display. This is waiting on the device sync which are member of the Assignment group. As soon as the device sync occurs, we will see information populated here. Further is covered in the Monitoring Part 2 below.

End User Experience

Depends on the way it is configured, users will be prompted to say yes or no whether they are using any other type of disk encryption. Below is the box they will see and I have selected a typical response for this which is listed below.

1. Select Yes and it will go ahead to check the system requirements.

2. They will be presented how they would like to unlock the device. It can be a USB flash drive or password protection.

3. For this example, I will select Enter a password option and this will present me to enter the password twice and Next to start encryption.

4. In this step, system will prompt where the recovery key will be stored. Best practice is Save to your Azure AD account and continue by clicking Next.

5. The next step will present two options.
i. Encrypt used disk space only, learn more here (link will be updated)
ii. Encrypt entire drive, learn more here (link will be updates)

I am going to pick the quickest method Encrypt used disk space only and click Next.

6. Further, there are two options.
i. New encryption mode, learn more here (link will be updated)
ii. Compatible mode, learn more here (link will be updated)

Select the appropriate method according to your requirements. I am selecting “New encryption mode” and click Next.


7. BitLocker is ready to encrypt and click on Continue.

You will see the progress, something similar as shown below and it is done.

Monitoring Part 2

There are a few ways to monitor and investigate this. Either you can check Endpoint Manager Admin center or client to see whether this has deployed properly or not.

Endpoint Manager Admin Center

  1. Go to the Configuration Profiles blade, and check Device status. You can click on the device to learn more.

2. Another way of checking is directly looking up the device and then check the Device configuration. You can click on one of the listed Configuration Profiles see more.

Endpoint

  1. Simply you can check the File Explorer and BitLocker can be seen on the drive or you can run a simple PowerShell to view BitLocker status.
  2. Check Info in Access work or school Settings, you should see BitLocker listed in one of the policies managed by your organization.

3. Generate Advanced Diagnostic Report on the Info page in Access work or school Settings. Report will be saved in C:/Users/Public/Documents/MDMDiagnostics/MDMDiagReport.html. Look for BitLocker keyword, this will be listed under Managed Policies.

C:\Users\Public\Documents\MDMDiagnostics

4. Similar information as stated in Step 3 can also be gathered through registry keys. This information is stored in the following:

Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker

5. Event Viewer will have registered events in Applications and Services log > Microsoft > Windows > BitLocker API

Feedback

Your feedback is important and leave your thoughts in the comments below.

surface03

Set up Intune environment

0

Intune is part of Enterprise Mobility + Security (EMS) suite. This is a cloud-based mobile device management (MDM) and mobile application management (MAM) solution.

In this blog, we will look at how to set up Intune environment with a trial license. A trial license can be used for up to two months. Usually, an Intune trial expires after a month and can be extended for another month.

Prerequisites

Microsoft Azure Active Directory Tenant is required to add Intune license. When you try trial license, Azure AD Tenant can be created during this process.

Note: Ensure you are logged out of Microsoft 365 on your browser. I suggest using a private window in your browser to create a new account.

Sign up for Intune

Let’s sign up for Intune. You have two options:
1. Create a new Azure AD Tenant and add-on Intune Trial (this is demonstrated in this blog)
2. Add-on Intune trial to your existing tenant (I will cover this option in the future blog)

Create a new Azure AD Tenant and add-on Intune Trial
Open this Sign Up link in a private window (recommended) of your favourite browser and follow the prompts demonstrated below to create your own account.

  • This is what you see when you click on the above link. Provide an email address and click Next. This email will be associated with the Azure AD tenant. If this email is already associated with any other Azure AD tenant, the system will prompt you to sign in.
  • Click on Set up an account and provide requested information

  • Verify your contact number by sending yourself a text or call. I will just use the text and verify my details.



  • Create your business identity by providing your business name. This will create the alias with onmicrosoft.com domain. Later on you can add your custom domain and make it primary domain.

  • In this step, you will create a new user. This user will automatically become a global administrator. Provide the details, click on Sign up and you will see You’re all set message.

Login to Microsoft 365 Admin Center

Microsoft 365 Admin Center is a centralized admin center where you will find direct links to all the admin centers.

Licenses

Check available Licenses in your tenant click on Billing and then Licenses in the Microsoft 365 Admin Center to view the available licenses. You should see something like below.

Admin Centers

  • Check all the admin centers through Microsoft 365 Admin Center. On the left bottom side, click on Show all
  • You should see something like below:

Sign in to Intune

You can go to the Endpoint Manager in Microsoft 365 Admin Center under Admin Centres. Alternatively, login here endpoint.microsoft.com. This is the home 🏠 of Intune and you will manage devices and applications here.

Yayy!!! you have set up Microsoft 365 Tenant and added Intune subscription as well.

Feedback is very important for me and other users. Please take some time and leave your feedback below. Catch you in the next blog 😀