If you go into Azure you may see that all Apple App Store icons are showing as blank. What’s going on here? Well, it looks like Intune is not the only one affected. Other MDM solutions are having issues with Apple App Store links, either completely breaking or affected in some way. Apple just released iOS 11.4 yesterday, so it’s possible that they did some backend change as well. We’ll find out soon enough!
When controlling access to Exchange email, there are generally two ways to go about it:
The second option is more secure because access to email is not granted until the user’s device is deemed compliant. Both options are enforced through Exchange Activesync Settings, commonly known as ABQ:
How are these concepts implemented in Intune? Well, although there are multiple ways to go about this, Microsoft has documented their suggested process. Let’s cover those steps.
According to Microsoft, the suggested method is to actually become quarantined/blocked on purpose. When that happens, an EAS record will be created in Intune automatically, and the Exchange server will send a notification to the user. This notification can be customized to include steps on how to enroll the device into Intune for management. Below is what the automated email could look like.
After getting the blocked email and following the customized instructions, the user will then be able to go through the enrollment process. For iOS and Android devices, that means downloading the Intune Company Portal app, and then authenticating with an Azure AD Account that has an Intune license applied to it. Once the user’s subscription is verified, a trust will be established between the device and the Intune servers. Once the trust is established, then the device is managed by Intune. On the backend, Intune will take the already-blocked EAS record, and merge it with a now-compliant MDM record.
Intune will check all enrolled devices on a timed interval, and allow any that are compliant to access email. The interval is around 15 minutes supposedly, but this information is not made public. In order to allow a device, Intune connects to the on-premise Exchange servers via Intune Exchange Connector. Once the connection is established, powershell cmdlets are run to mark the EAS device ID as “allowed” and thus able to access Exchange email.
Although above is the process that Microsoft has documented, note that it is not the only way to implement access control in a corporate environment. Another process would be to have users enroll before being blocked. That way, they never get a “blocked” email, which can be confusing to some. Once enrolled and compliant, the Intune Exchange Connector can allow the EAS ID, and the user will be able to access email on their mobile device.
