How to Create Device Configuration Profiles in Microsoft Intune

let's talk for a moment about device configuration one of the reasons we manage devices in the first place is to apply some settings or configuration to the device for example you might want to set how long it takes for the device to go to sleep or what color the desktop background is or whatever you feel you need to configure you need to apply that configuration somehow right device configuration and InTune is delivered using configuration profiles these are packages of config that affect the dev devices they're targeted at so for example let's say I want to set a specific image to show on the lock screen on my devices so when the user is lock their machine and it shows their picture and their their Avatar and they're ready to type their password I want to set a background behind that so I've got a picture I want to use and it's just a case of finding a way to get that setting applied on the device itself what I want to show you first is how to configure the lock screen from in tune standard profiles let's take a look so from the InTune admin Center we'll go to devices just going to minimize this for you so you can see this a bit better we've got a new um interface for managing these devices now and we'll go to Windows we'll choose configuration profiles and now I'm going to choose create new policy we're going to choose the platform with Windows 10 and later and from the profile type we're going to go with templates now one of the issues with configuring a profile this way is that the templates are all kind of set up with a specific name so you now need to figure out which template you want to use in order to find that policy which will allow you to set the lock screen background so let's try typing lock screen no the name doesn't contain that what if I choose admin template will it let me search within them I'll choose admin template choose create and I'll call it um lock screen background version one this is attempt one so we're going to choose next and here I get to search within this looks like GPO doesn't it if you've seen that before this looks like an admin template from group policy and that's pretty much because it is that's exactly what it is so now I can probably filter within this for lock screen can I lock screen doesn't seem to work lock that's finding things with Lo with Block in the word that's not helpful there's lots and lots of options there so screen maybe allow full screen smart screen do not display the lock screen now you can see this is in control panel personalization so let's take a look at control panel personalization so let's get rid of that we'll go with control panel personalization we have force a specific background and accent color or force a spefic a specific default lock screen and log on image that sounds about right okay good so now we can read through this Des description and you can see we can either find an image that's on the desk on the computer itself that we can reference or a UNCC path such as a server now these computers aren't necessarily going to be able to contact that server before the US is logged in the VPN might not have kicked in by then or they may not be in the office and it's not really convenient to push an image to the device itself because if you want to update it we got to push the image doesn't sound great so what we can do instead is use the internet so let's try uh enabled and then I have put this image on blob storage in Azure so all I need to do is tap in the URL which is this one here and you can see it's got a little tick so that means it works and then we can also turn off fun facts tips and tricks and more on the lock screen I'm going to do that because that doesn't feel like a corporate thing to have on a lock screen okay so that's that way of doing it we'll choose okay we'll choose next we'll choose next and I'm going to deploy this to all my devices is because I'm in a you know I'm in a lab environment so it's okay to do that you might want to test this in a in a smaller group but when you're doing it in your environment we'll choose next and create okay so that's now being created it'll take a few seconds it'll show in the policies right here there we go and so now that's one way of configuring this setting you can see it wasn't particularly easy to find that setting when I wanted to find it so let's look at different ways to do that another way of doing that would be let's have a look at what we got so new policy we can choose Windows 10 and later and then we looked at templates earlier on and there are some templates that are pretty easy to use so let's go into templates and we used admin template which is Group Policy right that's just the admin templates from Group Policy put into InTune for us so that we can use them but maybe it's a device restriction so if I use device restrictions choose create and call it lock screen background lock screen background V2 not 12 two choose next hopefully we won't get a 12 we'll choose control panel and do we have anything about lock screen here no display no lock screen experience ah look at that lock screen picture URL so we can put that URL there instead so searching through the templates gives us a way to find these particular settings of if we want to to to find them um so I could choose next and next I will I'll choose next next create I'm not going to deploy this one because deploying a policy which contains two settings that are similar might or probably will conflict in most cases so I've got that second policy but it's not deployed so V2 isn't going to have any effect at all if we do see this apply to the device in a few moments then uh it'll be V1 that's applying I want just go into a few more of these though because there's many many options when it comes to configuring this particular setting and all settings within InTune and that's what I want to really focus on so if I choose create and then new policy we've kind of gone through all of the things that are in templates so there's admin templates for group policy there's also the um the device restrictions policy that I just showed you what about if we look in settings catalog and this says start from scratch and select settings you want from the library of available settings which almost feels like what we've just done but heyy let's try it this way we'll choose create I'm going to go with in tune background sorry lock screen background V3 and choose next and we get to add some settings good now here we have a search bar for settings and we can also look through the categories and just choose the categories on their own and we might be able to find it but I'm I'm not not holding out too much hope there so we'll choose lock screen ah okay that was easier so top one there is in admin templates control panel personalization and then force a specific default lock screen and log on image that looks about right and if you open that up you can see we get the path to the lock screen and also the fact that we can turn off on facts and tips so that's what we did originally in V1 but this is a different experience for finding it right so if I choose this checkbox here you can see just behind that it popped up and it already applied that setting into the this settings catalog and actually what I need to do to configure that is just jump out of this I choose X and then it's already here and it says in the control panel and personalization section 32 of the 33 possible categories are not configured so I've only got this one here which is configured and it says force a specific default lock screen and log on image I'm want to choose enable on that or at least untick disable which toggles it to enabled and you going see just above it for some reason just above it but it's an now put uh field where I can put in the URL and it's also allowed me to turn off fun facts and tips so I'm going to put in that URL again just to show you where it goes there it is and we will choose turn off fun facts and tips now again I'm not going to deploy this I'm going to create it but not deploy it because I don't want to have a conflict in the environment so we'll choose next next don't assign it and choose create and then we have our three possible ways of configuring the lock screen background but that's not it there is more so what if we wanted to create it without using the interface at all without having those Ticky boxes available to us let's look at a more advanced or slow or cumbersome way of deploying this particular setting we'll choose new policy Windows 10 and later this is a template and I'm going to go with custom we'll choose create I'm going to call this lock screen background V4 which choose next and I'll choose add now this is much less user friendly we have uh we get to add some rows of information we have the name the description the Omar URI and the data type now in order for you to have any chance of understanding what this is if you're fresh to this whole uh custom profile thing is for me to explain what an OM URI is surely so there are some situations where a specific setting is not available within in for some reason either Microsoft haven't added it to the interface or it isn't in the settings catalog which is very rare these days it is normally in the settings catalog if it's available to set at all but it is possible to use something called Omar URI and this leverages leverages something called the windows configuration service provider or CSP so CSP serve as a way to configure settings in a uniform way so for example the syntax is quite easy to to follow let's say for a user level policy we would start the syntax with let me type it do sluser and then we would type vendor and this it's the word vendor regardless of whether you're working with Microsoft or not and then we're typing msft for the Microsoft Configuration service provider now we're configuring a policy so we'll type policy and now we're looking at the config area and then this is where it gets more specific to the setting you're trying to set so for example we would type the area name I'll put this with Asterix around it because that's not what we need to type and then also the policy name and then once we've done that we can apply the actual setting using data type so actually I'm going to change this from user to device because it's actually device level setting I want to set and that hopefully will allow us to configure the um the setting so let's just find the setting then we're going to head over to the Microsoft learn and we're in the the configuration service provider support section so we can find the exact setting we need so we're going to scroll down and it's actually under the personalization section it took me a little while to find it but it is under the personalization CSP we'll choose that and what we find when we get to the personalization CSP is that we can find all these things within vendor Microsoft personalization so if we link this back so vendor Microsoft personalization go back to that tab this is the policy so vendor Microsoft personalization and now if we go to lock screen image status is one of the options this represents the status of the lock screen image one successfully downloaded or copied download in progress that's not something you want to set that's more of a status thing just scroll a little bit down and lock screen URL that is an HTTP or https URL to a JPEG jpeg or PNG image that needs to be downloaded so let's grab this entire device string and put that just there and you can see it's now set with the OM URI as lock screen image URL so I'm going to call this configure lock screen image now this name is free text you don't it doesn't need to be related to the policy at all but obviously it should for documentation purposes but it's not something you need to get right so then I can choose data type and now we have to choose between string date time integer Boolean I mean it's clearly not going to be date and time it's probably not going to be integer because I want to put a URL in there so it's probably going to be string so I'll choose that and now I just need to grab that string again with my url url in it we'll put that there and choose save and now we've just gone the long roundabout way of configuring the exact same setting that we configured in V1 and now it's for you to decide which was easier I'm going to choose next next next create and this would apply the same policy to that device for now though I want you to consider which one of these policy types admin templates device configurations settings catalog or completely custom was simpler for you to configure in my opinion the settings catalog was the most simple way to configure the exact setting that I wanted your marage may vary you may choose to have the to use the admin template because you're familiar with Group Policy the point is that it doesn't really matter apart from the custom one which was a a pain to try and find the the setting itself doesn't really matter it's up to you you're in control

Channel: Dean Ellerby MVP

Views: 1,607

Keywords: microsoft intune, microsoft intune tutorial, intune, microsoft intune for beginners, microsoft intune training

Id: FjASwmC8cvw

Length: 14min 21sec (861 seconds)

Published: Fri Mar 22 2024