Windows Intune - Planning

When you plan your Windows Intune implementation, you need to define which groups are required. Groups can include specific members and can have dynamic membership rules based on different criteria. You can create groups based on different company needs, such as software deployment and policy deployment.

Windows Intune policies enable you to control the settings of managed devices centrally. Each policy is created from a policy template and contains different configuration settings. Policies are deployed to groups and are applied through the Windows Intune infrastructure.

When you sign on to Windows Intune, you need to create a new onmicrosoft.com domain (or use one that already exists, for instance, through a Microsoft Office 365 subscription). This onmicrosoft.com domain can be shared across all of your Microsoft Online Services.

Windows Azure Active Directory (Windows Azure AD) provides identity management for Windows Intune. In addition to the onmicrosoft.com domain, which is used by default, you can add other domains that your organization owns to allow your users to logon with a company alias. . You can also export users from your existing Active Directory domain, and then import the users to Windows Intune.

You can choice to synchronize your on-premises Active Directory to Windows Azure AD for Windows Intune to use. This by-passes the need to create users manually in Windows Intune and enables the use of additional user attributes, such as manager. To establish Active Directory synchronization, you must install and configure the Directory Synchronization tool, and then enable synchronized users.

An important Windows Intune feature is to provide endpoint protection to client computers. When you add a client computer to a Windows Intune subscription, Windows Intune Endpoint Protection will not be installed, by default if an existing endpoint protection solution is in place. To ensure Windows Intune Endpoint Protection is installed you should either remove the older protection or update the Windows Intune Agent Settings policy to set Windows Intune Endpoint Protection to be used in conjunction with your existing endpoint protection applications on the client computers.

Depending on your company’s firewall or proxy server’s configuration, you may need to configure the firewall or proxy servers to allow client computers to communicate with the Windows Intune service. If the client proxy server settings need to be changed on the individual client computers, or you could use Group Policy or scripts to change the settings of all the client computers that exist behind a specified proxy server.