Skip to content

Commit

Permalink
Merging changes synced from https://github.com/MicrosoftDocs/memdocs-pr
Browse files Browse the repository at this point in the history
… (branch live)
  • Loading branch information
Learn Build Service GitHub App authored and Learn Build Service GitHub App committed Sep 30, 2024
2 parents ec2e013 + 0f21ae7 commit af67a4c
Show file tree
Hide file tree
Showing 5 changed files with 26 additions and 7 deletions.
19 changes: 19 additions & 0 deletions .github/workflows/Stale.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,19 @@
name: (Scheduled) Mark stale pull requests

permissions:
issues: write
pull-requests: write

on:
schedule:
- cron: "0 */6 * * *"
workflow_dispatch:

jobs:
stale:
uses: MicrosoftDocs/microsoft-365-docs/.github/workflows/Shared-Stale.yml@workflows-prod
with:
RunDebug: false
RepoVisibility: ${{ github.repository_visibility }}
secrets:
AccessToken: ${{ secrets.GITHUB_TOKEN }}
2 changes: 1 addition & 1 deletion memdocs/intune/fundamentals/deployment-guide-enrollment.md
Original file line number Diff line number Diff line change
Expand Up @@ -146,7 +146,7 @@ On the platforms that don't require a factory reset, when these devices enroll i

There's an enrollment guide for every platform. Choose your scenario, and get started:

- [Application management without enrollment (MAM-WE)](deployment-guide-enrollment-mamwe.md)
- [Application management without enrollment](deployment-guide-enrollment-mamwe.md)
- [Android](deployment-guide-enrollment-android.md)
- [iOS/iPadOS](deployment-guide-enrollment-ios-ipados.md)
- [Linux](deployment-guide-enrollment-linux.md)
Expand Down
4 changes: 2 additions & 2 deletions memdocs/intune/fundamentals/deployment-plan-protect-apps.md
Original file line number Diff line number Diff line change
Expand Up @@ -32,7 +32,7 @@ The next step when deploying Intune is to add and protect apps that access organ

:::image type="content" source="./media/deployment-plan-protect-apps/deployment-plan-add-apps.png" alt-text="Diagram that shows getting started with Microsoft Intune with step 2, which is adding and protect apps using Microsoft Intune.":::

Managing applications on devices in your organization is a central part to a secure and productive enterprise ecosystem. You can use Microsoft Intune to manage the apps that your company's workforce uses. By managing apps, you help control which apps your company uses, as well as the configuration and protection of the apps. This functionality is called mobile application management (MAM). MAM in Intune is designed to protect organization data at the application level, including custom apps and store apps. App management can be used on organization-owned devices and personal devices. When it is used with personal devices, only organization-related access and data is managed. This type of app management is called MAM without enrollment (MAM-WE), or from an end-user perspective, bring your own device (BYOD).
Managing applications on devices in your organization is a central part to a secure and productive enterprise ecosystem. You can use Microsoft Intune to manage the apps that your company's workforce uses. By managing apps, you help control which apps your company uses, as well as the configuration and protection of the apps. This functionality is called mobile application management (MAM). MAM in Intune is designed to protect organization data at the application level, including custom apps and store apps. App management can be used on organization-owned devices and personal devices. When it is used with personal devices, only organization-related access and data is managed. This type of app management is called MAM without enrollment, or from an end-user perspective, bring your own device (BYOD).

## MAM configurations

Expand All @@ -45,7 +45,7 @@ Microsoft Intune supports two MAM configurations:

### MAM without device management

This configuration allows your organization's apps to be managed by Intune, but doesn't enroll the devices to be managed by Intune. This configuration is commonly referred to as **MAM without device enrollment**, or **MAM-WE**. IT administrators can manage apps using MAM by using Intune configuration and protection policies on devices not enrolled with Intune mobile-device management (MDM).
This configuration allows your organization's apps to be managed by Intune, but doesn't enroll the devices to be managed by Intune. This configuration is commonly referred to as **MAM without device enrollment**. IT administrators can manage apps using MAM by using Intune configuration and protection policies on devices not enrolled with Intune mobile-device management (MDM).

> [!NOTE]
> This configuration includes managing apps with Intune on devices enrolled with third-party enterprise mobility management (EMM) providers. You can use Intune app protection policies independent of any MDM solution. This independence helps you protect your company's data with or without enrolling devices in a device management solution. By implementing app-level policies, you can restrict access to company resources and keep data within the purview of your IT department.
Expand Down
6 changes: 3 additions & 3 deletions windows-365/enterprise/set-up-tenants-windows-365-gcc.md
Original file line number Diff line number Diff line change
Expand Up @@ -80,11 +80,11 @@ If you want to use Microsoft Entra join or Microsoft Entra hybrid join, consider
For the Windows 365 GCC Setup Tool to complete tenant mapping, the Windows 365 Microsoft Entra application must be given permission to access your Azure Government AD tenant through a service principal. The service principal object defines what the app can do in the tenant, who can access the app, and what resources the app can access. Before running the Windows 365 GCC Setup Tool the first time, you must do the following:

1. If not already completed, install the Azure CLI on the computer where you will be creating the service principal. For more information, see [How to install the Azure CLI](/cli/azure/install-azure-cli).
2. Sign into your Azure Government AD tenant by using the Azure CLI steps defined in [Sign in with Azure CLI](/cli/azure/authenticate-azure-cli). Global Administrator permissions are required to create the service principal for the Windows 365 App.
2. Sign into your Azure Government AD tenant by using the Azure CLI steps defined in [Sign in with Azure CLI](/cli/azure/authenticate-azure-cli). Global Administrator permissions are required to create the service principal for Windows App.
3. For more information about working with service principals in Azure, see [Work with Azure service principal using the Azure CLI](/cli/azure/azure-cli-sp-tutorial-1). Grant the Windows 365 Microsoft Entra app permissions to your tenant by running the following PowerShell command: ```az ad sp create --id 0af06dc6-e4b5-4f28-818e-e78e62d137a5```.
4. After the command completes successfully, you should be able to view details about the service principal by running the following PowerShell command: ```az ad sp show --id 0af06dc6-e4b5-4f28-818e-e78e62d137a5```. You should see the Windows 365 application listed in the **All Applications** view in the Enterprise application blade in Azure portal.
4. After the command completes successfully, you should be able to view details about the service principal by running the following PowerShell command: ```az ad sp show --id 0af06dc6-e4b5-4f28-818e-e78e62d137a5```. You should see Windows App listed in the **All Applications** view in the Enterprise application blade in Azure portal.

The Windows 365 App service principal can only access Azure resources necessary to configure custom image and Azure Network Connection (ANC) support in Windows 365. After it's created, the service principal can only be deleted when custom images, ANC objects and corresponding Cloud PCs using them have been deprovisioned. Otherwise, Cloud PC provisioning tasks may fail, and existing Cloud PCs may become inaccessible.
The Windows App service principal can only access Azure resources necessary to configure custom image and Azure Network Connection (ANC) support in Windows 365. After it's created, the service principal can only be deleted when custom images, ANC objects and corresponding Cloud PCs using them have been deprovisioned. Otherwise, Cloud PC provisioning tasks may fail, and existing Cloud PCs may become inaccessible.

## Get started with the Windows 365 GCC Setup Tool

Expand Down
2 changes: 1 addition & 1 deletion windows-365/enterprise/troubleshoot-windows-365-boot.md
Original file line number Diff line number Diff line change
Expand Up @@ -39,7 +39,7 @@ If the user can't access the Cloud PC from the Windows 365 Boot physical device,

1. Check to see if you can sign in to the Cloud PC from either:
- The browser at windows365.microsoft.com.
- The Windows 365 app on another (non-Windows 365 Boot) device.
- The Windows App on another (non-Windows 365 Boot) device.
2. If a user has more than one Cloud PC, make sure they have selected a default Cloud PC to use each time they sign in. To set this default:
- Navigate to https://windows365.microsoft.com.
- In the card for the Cloud PC you want to set as default, select the ellipses (...) > Settings.
Expand Down

0 comments on commit af67a4c

Please sign in to comment.