Last Updated on April 15, 2022 by rudyooms

This blog will be about why it’s important to automate your Microsoft 365 deployments.

I will divide this blog into multiple parts

1. Introduction
2. The Issues
3. The Fix

1. Introduction

Today I was called in to investigate a weird problem. A colleague was trying to set up Intune for a new Microsoft 365 customer.  In a normal situation we are doing this by launching our deployment scripts but this time a new colleague wanted to see which steps need to be taken to enroll a customer into Microsoft 365.

Everything was going fine until the enrollment restrictions part. Enrollment restrictions need to be configured to make sure no Personally owned devices can be enrolled or to block Android device administrators.

If you want to read more about the difference between Personal and Corporate Devices and how you can enroll them, read this blog

2. The Issues

If you read the blog I mentioned above, you will know, that when you are only deploying devices with Autopilot, it’s always smart to block the possibility to enroll personally owned devices. Because when blocking the possibility to enroll personal devices you are making sure only corporate devices could be enrolled!

 But the option to edit the policy as I show below, was missing? I was like: Huh? Did I lose my sight?

Okay? Also no option to edit the existing policy? I was curious what else was broken so let’s try to create a new enrollment restriction policy.

As shown above, it’s greyed out? It’s becoming weird! When trying to change or try to create an Enrollment Status Page (ESP) the button to do so is also greyed out.

Okay…. some weird stuff is going on, that’s for sure! First I checked if I had the proper license to do so. As shown below, the admin user was licensed to use Intune. So what’s next?

3. The Fix

After spending a few minutes on google, I found out the MDM authority needs to be configured under Mobile Device Management Authority. When this option is not configured, there is no option to create or edit an enrollment restriction policy.  

If you want to know which MDM authority is configured, please open the Tenant Administration to check your the Tenant Details

It should be set to Microsoft Intune as shown below

Let’s see what Microsoft has to say about how this needs to be configured.

But within this tenant, no orange banner was shown. And the possibility to configure it, within the Azure Ad portal and opening Intune is obviously gone as this old Intune azure portal is depreciated.

You can guess which option we have got left: PowerShell!!! I quickly realized this configuration is part of our deployment script. So I opened our Tenant deployment script… and there it was, at step 2A: Configure Intune as MDM authority.

# Connecten naar msgraph (install-module microsoft.graph.intune)

Connect-MSGraph
$mdmAuth = (Invoke-MSGraphRequest -Url "https://graph.microsoft.com/beta/organization('$OrgId')?`$select=mobiledevicemanagementauthority" -HttpMethod Get -ErrorAction Stop).mobileDeviceManagementAuthority

# Intune Instellen als MDM Authority

 if($mdmAuth -notlike "intune")
{
    $OrgID = (Invoke-MSGraphRequest -Url "https://graph.microsoft.com/v1.0/organization" -HttpMethod Get -ErrorAction Stop).value.id
    Invoke-MSGraphRequest -Url "https://graph.microsoft.com/v1.0/organization/$OrgID/setMobileDeviceManagementAuthority" -HttpMethod Post -ErrorAction Stop
}

I fired up a PowerShell prompt and copy-pasted the script. After refreshing the enrollment restriction page the options to create or edit the restrictions were instantly available.

Conclusion:

I guess I say this quite a lot, but automating your processes will ensure all options are configured with no human errors.  Of course, you will need to make sure everyone knows what the script does, only firing up a PowerShell script with no background knowledge is stupid.