New Microsoft Edge Chromium is coming

Published for International Legal Technology Association on 1/2/2020

On January 15th, Microsoft will be releasing a new version of Microsoft Edge built on Chromium to all supported versions of Windows 10. This new version of Edge Chromium also supports Windows 7, 8.1, and Windows Server. With this release, the legal vertical vendors will be able to stop supporting Internet Explorer. Read on to learn how to prepare for this new change.

Background

When Microsoft released Windows 10 in the summer of 2015, a new browser named Edge was introduced. This new browser replaced Internet Explorer (IE) 11, which Microsoft introduced in 1995 along with Windows 95. Those of us that have been in IT for a bit will remember the browser wars that started in the nineties. Internet Explorer since then has been the default browser in all Windows versions from Windows 95 and through Windows 8.1. IE has been through many upgrades and became bloated as Microsoft added more features and changed compatibility modes a few times. These changes were hard for many organizations to adopt. The rapid nature of change with HTML standards made it hard for legal vertical web sites to adopt to those changes and continue to support Internet Explorer.

With the introduction of Windows 10 and the new Edge browser, Microsoft hoped their new modern browser would compete with Chrome and Firefox. Unfortunately, that didn’t occur. Customers and 3rd parties did not want to invest in rebuilding sites to make them work in Edge.

Because of this, we have had many clients adopt Google Chrome or Firefox as their default browser regardless of Windows version as they knew those browsers on Windows 7, 8, or 10 and Windows Server (Citrix) would have the same experience (in most cases). Other firms chose to set IE 11 as their default while other firms chose Edge. This browser fragmentation caused many issues in the legal vertical.

Today

In late 2018, Microsoft announced that Edge would be redeveloped to use the open-source Chromium platform started by Google with contributions by a global community. The goal of the new Edge Chromium browser, targeted to be released in mid-January, is for more web compatibility (if the site works on Chrome, it should work the same on the new Edge Chromium). Edge Chromium allows for management via MDM, GPO, and endpoint management solutions like Microsoft Endpoint Configuration Manager which I will discuss later. Because the new Edge browser is based on Google’s Chromium platform, it had many of the Google services in the source. Microsoft has disabled or changed over 50 of them such as Google Now, Pay, Extension store, etc.

The full list of what has been disabled or replaced below:

How do we get it?

The official release target is January 15th, as of this writing. To start your testing today, you can join three types of Inside channels at https://www.microsoftedgeinsider.com.

When you launch the site, the default download and the most stable release is the Beta Channel (#1 in the screenshot below). If you would like to try more up to date and frequent Channels update, as Microsoft develops then choose the More platforms and channels link on the site (#2 in the screenshot below). This link will give you access to a Dev Channel which is updated weekly and the Canary Channel which is updated daily. The Canary channel is usually released right after Microsoft updates the code, which is why it is called a Canary build. In the old mining days, a canary would be sent into a coal mine to check for deadly gas.

The channels are also available on other OS platforms. If you click the down arrow below the download button, you will see options for previous Windows client and server versions and macOS.

How do I deploy and manage?

If you are an organization that has automatic updates enabled in Windows 10, Microsoft will automatically deliver the new browser. I would not recommend this as you will want to enable change management and user experience to avoid confusion and calls to the help desk. For those environments, Microsoft has a blocker tool you can deploy to block Automatic Updates from installing on Windows. Please review the Microsoft site here for more information on this.

If you are a firm that has a system management solution like Intune, Configuration Manager (ConfigMgr), or other tools that manage the Microsoft Updates, you will have a little more control.

In Configuration Manager 1910, you can now manage Edge deployment. In ConfigMgr 1910, under Software Library, you now have Microsoft Edge Management node, and once you click that, you will have the option to Create Microsoft Edge Application.

Clicking the Create Microsoft Edge Application button, you will start the wizard, which is similar to many ConfigMgr dialogs.

2020-01-02_19-41-12

The next option is to choose your Channel and version of Edge to deploy. After this, you will have the option to choose the deployment options (Collection, etc.), or you can create the package.

Once the package has been built, the source folder will have the files needed for x86 and x64 versions with a PowerShell script that will be used to call the installation in the Deployment Types.

In Application Management, under Applications, you will see your new application along with the Deployment Types. Just like any ConfigMgr application/package, you can deploy to the Collection of your choosing.

More information on using ConfigMgr is available here. If you are using Intune to manage Windows, you can read more about options here.

What if I don’t have Intune or Configuration Manager?

If you don’t have ConfigMgr and are using tools like Ivanti, Altiris, Quest (formally Dell) Kace, etc. you can create your package using the offline installer. These are full MSIs so you can use the MSI commands to silently deploy using the tool of your choice.

The configuration of the new Edge can be done through Group Policies for domain joined computers or via supported MDM solutions like Intune for non-domain or hybrid joined computers. For the group policy administrative templates, you can download via the same location as the offline installer.

We will have another series of written or video blogs that will discuss further configuration, management, and update options over the next couple of months.

Intune – ADMX-backed admin templates (preview)

We all have been using Group Policies for decades for all of our on-prem domain joined machine. Now Microsoft has introduced, in preview, ADMX template style settings in Intune.

MS Docs for details. https://docs.microsoft.com/en-us/intune/administrative-templates-windows

  • Assumption is you have some Intune knowledge and know how to assign profiles.
  1. To access the Preview, go into your Azure Portal – Microsoft Intune -> Device configuration – Profiles
  2. Create a new profile

  3. Name your profile, choose Windows 10 or Later as the platform, and Profile type is Administrative Templates (Preview)

  4. In the profile, choose Settings and you will see all the policies available (there are few pages).

5. In the filter, search for a policy setting if needed like the screen shot below or sort the columns accordingly.

6. Select a setting like I have below and choose an option (similar to GPO). For the Excel save setting, I chose the default to be Excel 5.0/95 Workbook so I can see the change (as Excel XLS is default anyways).

7. In my test I have chosen several different settings.

8. Assign the profile accordingly to your test group.

9. Monitor deployment status

10. Once the settings are applied, check the device for results.

Windows Defender ATP – Onboarding Endpoint with Configuration Manager 1606 or higher

To be able to review Windows 10 endpoints (Anniversary Update or higher) into Windows Defender ATP, you will need to onboard first. There are several ways to do so including scripts, Group Policy, Intune, Configuration Manager 2012 through current branch 1602. With the release of Configuration Manager branch update 1606, it now includes integrated Windows Defender ATP to be able to monitor and deploy the policies.

  1. To get started, login to the Windows Defender ATP site to download the policies https://securitycenter.windows.com/download
  2. Choose the drop down Select your deployment tool, and select the System Center Configuration Manager (current branch) version 1606

  3. This will download a ZIP file with the onboarding package. Unzip it to where you can access it with ConfigMgr.
  4. Under Assets and Compliance, expand Endpoint Protection where you will see Windows Defender ATP Policies. Select Windows Defender ATP Policies , and click Create Windows Defender ATP Policy from the toolbar or right click.
  5. Follow the wizard to import the onboarding file you downloaded from the site. (NOTE: SCREENSHOT SHOWS OFFBOARDING, BUT SHOULD BE ONBOARDING)

  6. Once done, you will see the policies in the console. Right client or from the toolbar, click Deploy.

  7. You can do this for off-boarding as well. From the same site, you can select to download the off-boarding package and then follow the steps above to import into ConfigMgr.

Enabling iOS 9 Extension for Microsoft Intune in System Center 2012 R2 Configuration Manager SP1 CU1

On September 24, 2015 Microsoft announced support for iOS9 through he iOS9 extension for Microsoft Intune in Configuration Manager.

To enable the extension, go to your SCCM console (2012 R2 SP1 CU1).  Under Administration, expand Cloud Services and click Extension for Microsoft Intune.

2015-10-17_11-15-47

In the right pane, right click the iOS 9 Extension and click Enable (or from the toolbar).  If you do not have CU1, this can fail.

2015-10-17_11-06-33

Accept the License Terms – make sure you read all of it first 🙂

2015-10-17_11-19-09

MDM in Windows 10

Built-In Mobile Device Management capabilities in Windows 10

The MDM capabilities provided in Windows covers the complete lifecycle of the device.

  • Enrollment capabilities to automate the MDM enrollment of the device as part of the Azure Active Directory join process.
  • New controls for configuring and managing the Start menu.
  • New controls over Windows updates, allowing you to control when specific Windows updates are deployed to MDM-managed devices (think “WSUS from the cloud”).
  • New AppLocker and Enterprise Data Protection configuration settings.
  • Integration with the Windows Store and the Business Store Portal (BSP) to enable automated app management.
  • Full device wipe capabilities, even for PCs.

These capabilities are supported on all types of devices, including Windows phone devices, PCs and tablets, and Internet-of-Things (IoT) devices.

MDM in Windows 10

Enroll Windows 10 Enterprise Preview to Hybrid ConfigMgr + Microsoft Intune

The following are quick steps to enroll the Microsoft Windows 10 Insiders Preview (as of build 10130) to Microsoft Intune in a hybrid environment with Microsoft System Center 2012 R2 SP1 Configuration Manager (SCCM).

This assume you have already configured Microsoft Intune into your SCCM environment.

  1. In the SCCM console, navigate to Administration -> Overview -> Cloud Services -> Microsoft Intune Subscriptions.
  2. On the top ribbon bar, click the Configure Platforms button. Click Windows in the drop down

  3. From the Microsoft Intune Subscription Properties, click the Enable Windows enrollment.

  1. Log onto your Windows 10 desktop, go to Settings and choose Network and Internet

  2. Click on Accounts and then Work access. On the Connect to work or school section, click the + Connect

  3. Enter your work email address that are Intune enabled (an account that has synchronization between your on-premise Active Directory and Windows Azure Active Directory). After you click continue, you will be sent to the Microsoft site to authenticate.

  4. Once done, you see the connected account on the main section.

  5. In the SCCM console, you will now be able to see your newly enrolled device as a Mobile device. You will be able to deploy applicable compliance policies just like any other mobile devices in your organization.

-Jay

Hybrid – Intune Mobile Application Management and Conditional Access for Outlook blog NOTE

As most have seen the blog announcing the Intune Mobile Application Management and Conditional Access for Outlook.  At the very bottom, there is a Note about the hybrid customers (SCCM) availability that seems to be missed by few folks when they update to SP1.

Note: These features are currently available in Intune standalone (cloud only) and will be made available to hybrid customers by July 2 as part of an upcoming Intune service update.

Configuration Manager Collection Query for Android Devices

Quick query to dynamically identify Android devices in Configuration Manager 2012 R2

select SMS_R_SYSTEM.ResourceID,SMS_R_SYSTEM.ResourceType,SMS_R_SYSTEM.Name,SMS_R_SYSTEM.SMSUniqueIdentifier,SMS_R_SYSTEM.ResourceDomainORWorkgroup,SMS_R_SYSTEM.Client from SMS_R_System inner join SMS_G_System_DEVICE_OSINFORMATION on SMS_G_System_DEVICE_OSINFORMATION.ResourceId = SMS_R_System.ResourceId where SMS_G_System_DEVICE_OSINFORMATION.Platform like “%Android%”

Microsoft Intune – March Update

Microsoft will be making the next update for Microsoft Intune between March 4, 2015 and March 7, 2015. New Intune standalone (cloud only) features that will be released as part of this service update include:

  • Ability to streamline the enrollment of iOS devices purchased directly from Apple or an authorized reseller with the Device Enrollment Program (DEP)
  • Ability to restrict access to SharePoint Online and OneDrive for Business based upon device enrollment and compliance policies
  • Management of OneDrive apps for iOS and Android devices
  • Ability to deploy .appx files to Windows Phone 8.1 devices
  • Ability to restrict the number of devices a user can enroll in Intune

It’s important to note that the updates are for the stand alone Cloud only and not the integrated with SCCM. Updated to the integrated extensions are usually 3-6 months after the standalone is available.

Jay