{"id":14118,"date":"2013-01-24T15:34:02","date_gmt":"2013-01-24T15:34:02","guid":{"rendered":"https:\/\/aidanfinn.com\/?p=14118"},"modified":"2013-01-24T15:34:02","modified_gmt":"2013-01-24T15:34:02","slug":"managing-ios-from-windows-intune","status":"publish","type":"post","link":"https:\/\/aidanfinn.com\/?p=14118","title":{"rendered":"Managing Apple iOS Devices From Windows Intune"},"content":{"rendered":"

This was the most exciting thing I saw at MMS 2012.  I knew what System Center was capable of, but I wasn\u2019t expecting to see iPhones and iPads (as well as Android, etc) being managed by Microsoft from the cloud, using the same solution for managing PCs.<\/p>\n

This week I\u2019ve been setting up a demo environment in Windows Intune \u201cWave D\u201d (thanks to my colleagues at work for the help in setting up the \u201cpartner\u201d).  It\u2019s one thing to manage PCs, but you really score points with customers when you can show a Microsoft product managing the rivals.  I use Ubuntu as my guest OS when showing of Hyper-V.  I want to show of an iPad Mini being managed by Windows Intune \"Smile\"<\/p>\n

The process is \u201cdocumented\u201d on TechNet<\/a>, with links from the Windows Intune console.  I use \u201cdocumented\u201d very loosely.  The information incomplete in my opinion.  So here are my notes:<\/p>\n

A step I missed in this documentation is choosing your mobile device management solution.  I chose the Windows Intune option, instead of using System Center with Windows Intune, which was under Tasks in Administration > Mobile Device Management.<\/em><\/p>\n

The Push Notification Certificate<\/u><\/strong><\/p>\n

The first requirement for managing iOS devices is that you have an Apple ID for your company.  There is no cost to this.  This contrasts with the \u20ac75\/year cost of signing up for a Windows Phone developer account for managing Windows Phone 8.<\/p>\n

Now open the Windows Intune admin console and browse to Administration > Mobile Device Management > iOS > Upload an APNs Certificate.  Confusion point: there is more to this than a simple upload.  Here\u2019s how.  Click Download The APNs Certificate Request.  This downloads a .CSR file certificate request.<\/p>\n

Now you browse to the Apple Push Certificates Portal<\/a>.  Here is where you upload the .CSR file that you just downloaded from Windows Intune.  If like me, you\u2019re using IE, you will likely be prompted about a .JSON file.  Ignore that.  Refresh the page (I muddled about here trying to figure out the JSON thing) and you should end up with something like the below:<\/p>\n

\"image\"<\/a><\/p>\n

Click Download to get a file called MDM_ Microsoft Corporation_Certificate.PEM; this is the certificate that you will be uploading to Windows Intune.  It will uniquely identify your organisation to managed iOS devices (or something like that).  <\/p>\n

Return  to Windows Intune where you downloaded the .CER file, and click Upload The APNs Certificate. Browse in the dialog and select the .PEM file you just got from Apple.  You also need to supply the Apple ID name that was used in the Apple Push Certificates Portal to create the PEM file.<\/p>\n

\"image\"<\/a><\/p>\n

That all sounds messy.  I agree.  But you only have to do it once in your portal \u2026 every year<\/strong>.  Check the previous Apple screenshot and look at the expiry date for the APN certificate.  It only lasts for 1 year.  Set a recurring reminder in your (and your colleagues) calendar to repeat this process in advance of the expiration (you don\u2019t want to be digging up email addresses and passwords).  And document what accounts\/passwords are being used.  Please use a strong<\/em> passphrase for your Apple ID.<\/p>\n

Create User Accounts<\/u><\/strong><\/p>\n

You create user accounts in the Windows Intune Accounts site<\/a>.  You can set up AD synchronisation instead of manually creating your users.  A warning: management of the devices will not work unless you add the users to the Windows Intune user group in the Accounts site.  Open the user, click Group, and check the Windows Intune box:<\/p>\n

\"image\"<\/a><\/p>\n

Enroll the Device<\/u><\/strong><\/p>\n

This is a crude mechanism.  You need to supply the IOS device user (probably via email) with the following information:<\/p>\n