Co-management for Windows 10 devices
Co-management can meet several needs:
- If you have a Microsoft 365 subscription and want to use the included Windows 10 licenses.
- If you want to manage your Windows 10 devices as a mobile device and thus switch from traditional management to modern management.
In both cases co-management must be used. In previous versions of Windows 10, it was impossible to join a machine to an Active Directory domain and to make the Azure AD Join. It was necessary to make a choice between traditional management (join to an AD domain) or modern management (join to Azure AD).
With System Center Configuration Manager 1710, it is possible to manage Windows 10 1709 workstations with SCCM or Intune at the same time. In this way, a bridge is established between classical and modern management.
The prerequisites for activating co-management are as follows:
- System Center Configuration Manager 1710
- Azure AD
- EMS/Intune license assigned to all users
- MDM Authority set to Intune
- Azure AD join Hybrid
It is necessary to configure the Intune platform. To do this, go to the Intune console (Azure portal) then in Azure Active Directoy click on Mobility (data management) then Microsoft Intune.
In GDR User scope, click All and Save.
Configuring the Service Connection Point
The service connection point is used by devices at the time of registration to detect Azure AD customer information. First, we will retrieve the domain name naming context.
To do this, execute the powershell commande Get-ADRootDSE.
If the SCP (Service Connexion Point) object has already been configured, it must be present in the following location
CN=62a0ff2e-97b9-4513-943f-0d221bd30080,CN=Device Registration Configuration,CN=Services,[Your Configuration Naming Context].
However, if the object has not been configured, it is necessary to create it. First, the MSol PowerShell module must be install.
On your Azure AD Connect server, execute the PowerShell command
- Import PowerShell module :Import-Module -Name « C:\Program Files\Microsoft Azure Active Directory Connect\AdPrep\AdSyncPrep.psm1 »
- Enter Azure AD Credential : $aadAdminCred = Get-Credential
- Initialize AD Sync Domain Joined Computer Sync : Initialize-ADSyncDomainJoinedComputerSync –AdConnectorAccount [connector account name] -AzureADCredentials $aadAdminCred;;
It’s necessary to check that the configuration has been carried out. To do this, the following PowerShell commands must be executed
- $scp = New-Object System.DirectoryServices.DirectoryEntry
- $scp.Path = « LDAP://CN=62a0ff2e-97b9-4513-943f-0d221bd30080,CN=Device Registration Configuration,CN=Services,CN=Configuration,DC=formation,DC=local »
Configure Management Gateway
It is necessary to deploy this role in order to activate co-management on Computer already enrolled up at Intune. If the role is not installed, the following message appears when creating co-management :
Please ensure the proper prerequisites are installed
This point will be documented in a future article
In the SCCM console, expand the Cloud Services node. Right-click CoManagement and select Configure co-management.
A new wizard is displayed, click Sign-in and enter the Intune administrator credentials. Click Next for validate Windows.
From the Automatic enrollment in Intune drop-down list, select Pilot and click Next.
Configure Workloads to specify management by Intune or System Center Configuration Manager
Create a computer collection. This collection will be used by the co-management functionality. In the wizard select the collection with the Browse button.
You can now finish the wizard. You need add Windows 10 computer into sccm collection.
Windows 10 with SCCM Client
The SCCM Client has now been installed on the Windows 10 machine.
The Computer is join to domain AD, we will now also join it to a domain Azure AD. From the Windows 10 computer, open the Windows settings.
Click Professional or School Access and then Connect.
It is now necessary to enter the user name and password.
The Azure AD Join is now OK. And the computer appear in Azure AD.
Windows 10 with SCCM Client
Switch Configuration Manager workloads to Intune