diff --git a/education/windows/tutorial-managed-installer/Overview.md b/education/windows/tutorial-managed-installer/Overview.md index 55c33e357d..6b4acfc9ca 100644 --- a/education/windows/tutorial-managed-installer/Overview.md +++ b/education/windows/tutorial-managed-installer/Overview.md @@ -1,69 +1,72 @@ --- -title: Consideration before deploying apps with Managed Installer -description: Learn how to Consideration before deploying apps with Managed Installer -ms.date: 02/24/2023 +title: Deploy applications to Windows 11 SE with Intune +description: Learn how to deploy application to Windows 11 SE devices with Intune as a managed installer. +ms.date: 02/28/2023 ms.topic: tutorial appliesto: - ✅ Windows 11 SE, version 22H2 and later --- -# Deploy apps to Windows 11 SE with Managed Installer +# Deploy applications to Windows 11 SE with managed installer -Currently, Windows 11 SE prevents the installation of 3rd party applications, unless the application is in an [approved list][EDU-1] or the IT admin consults with Microsoft. +Windows 11 SE prevents the installation of third party applications, unless the application is in an [approved list][EDU-1] or the IT admin consults with Microsoft.\ +Starting with Windows 11 SE, version 22H2, you can deploy any applications to Windows 11 SE devices via Intune, without having to contact Microsoft. This is possible because Microsoft has enabled the *Intune Management Extension (IME)* as a *WDAC managed installer*. -Microsoft is changing the 3rd party application installation process by enabling the **Intune Management Extension (IME)** as a *managed installer*. What that means, is that you will be able to install 3rd party applications on Windows 11 SE devices via Intune, without having to contact Microsoft. +In this tutorial, you'll learn how to set up Windows 11 SE devices with the IME as a managed installer, and how to validate the applications deployed via Intune. -The documentation in this GitHub repository covers how to set up Windows 11 SE devices with the IME as a managed installer, and deploy apps via Intune to those devices. +## Introduction + +Windows 11 SE prevents the installation and execution of third party applications with a security feature called *Windows Defender Application Control (WDAC)*.\ +On Windows 11 SE, WDAC applies an *allowlist policy* called *E-Mode*. The E-Mode policy ensures that unwanted apps don't run or get installed. + +When Windows 11 SE was initially released, Microsoft allowed specific application by using [WDAC supplemental policies][WIN-1], with an [allowlist process][EDU-1] done on an app-by-app basis. + +Starting in Windows 11 SE, version 22H2, Microsoft enabled the IME as a managed installer. Applications deployed through Microsoft Intune will be automatically allowed on Windows 11 SE, removing the allowlist process requirement. + +> [!NOTE] +> End-users of Windows 11 SE devices still cannot install and use arbitrary applications without being blocked. Only IT admins can control what apps are allowed. + +Some applications may experience difficulties running due to their type or due to the complexity of how they're installed and executed. In these cases, the IT admin may need to write more policies to enable the applications.\ +IT admins can write and deploy their own WDAC supplemental policies through Microsoft Intune, to allow third party application to run. ## Goals -In this tutorial you will learn: +In this tutorial you'll learn: > [!div class="checklist"] -> - what applications can be installed on a Windows 11 SE device when managed installer policies are enabled +> - Which applications can be installed on a Windows 11 SE device when managed installer policies are enabled > - How to install an application to a Windows 11 SE device > - How to validate that an application is installed and runs successfully > - How to write additional policies to enable incompatible applications > - How to troubleshoot problems related to application installation -## Introduction - -Windows 11 SE prevents the installation and execution of 3rd party applications with a technology called **Windows Defender Application Control (WDAC)**.\ -WDAC applies an allow-list policy called *E-Mode*, which ensures that unwanted apps do not run or get installed. With the use of [WDAC supplemental policies][WIN-1] Microsoft allows specific 3rd party applications to run at the request of IT admins. The [whitelist process][EDU-1] is done on a one-by-one basis, and the turnaround time to request an application to be allowed and have the supplemental policy deployed can be lengthy. - -Microsoft is changing the 3rd party app installation process by enabling the **Intune Management Extension (IME)** as a *managed installer*. As a managed installer, any applications deployed through Microsoft Intune via IME, will be automatically allowed on Windows 11 SE, removing the whitelist process requirement. - -> **Note** -> -> End-users of Windows 11 SE devices still cannot install and use arbitrary applications without being blocked; only IT admins can control what apps are allowed. - -Some applications may experience difficulties running due to their app type or due to the complexity of how the app is installed and executed. In these cases, the IT admin may need to write additional policies to enable the application. This documentation covers how to set up Windows 11 SE devices with the IME as a managed installer, and deploy apps via Intune to those devices. - -IT admins can write and deploy their own WDAC supplemental policies through Microsoft Intune, to allow 3rd party application to run. There won't be any need to work with Microsoft directly. - ## Installation process -There are four main steps to install an application on Windows 11 SE using the managed installer. Each step will be covered in detail in this tutorial. +There are three main steps to install an application on Windows 11 SE using the managed installer. Each step will be covered in detail in the next sections of this tutorial: -![](./images/process.svg) +:::image type="content" source="./images/process.svg" alt-text="Diagram showing the three tutorial steps." border="false"::: -1. **Deploy an application via Microsoft Intune** - Applications are deployed via Microsoft Intune. There are some restrictions on the types of apps that are compatible with managed installers, but this step is the same as it would be for non-Windows 11 SE devices. -1. **Validate the application** - Applications are validated to ensure that they are installed and running successfully. This step is the same as it would be for non-Windows 11 SE devices. Since some applications may be incompatible due to how they are installed, how they execute, or how they update, the known limitations are discussed in a later section of this tutorial. -1. **Create additional policies (optional)** - To allow apps that are not installable or do not behave as intended, additional policies can be created and deployed so that these applications can be used. +1. **Deploy an application via Microsoft Intune** - Applications are deployed via Microsoft Intune. There are some restrictions on the types of apps that are compatible with managed installers, but the process is the same used for non-Windows 11 SE devices +1. **Validate the application** - Applications are validated to ensure that they're installed and running successfully. The process is the same for non-Windows 11 SE devices. Some applications may be incompatible due to how they're installed, how they execute, or how they update. You'll learn about known limitations in a later section of the tutorial +1. **Create additional policies (optional)** - To allow apps that aren't installable or don't behave as intended, more policies can be created and deployed so that these applications can be used -All four of these steps are done by the IT administrator. Once the steps are complete, users of Windows 11 SE devices should be able to run the applications that you've deployed via Intune. +All these steps are done by the IT administrator. Once the steps are complete, users of Windows 11 SE devices should be able to run the applications that you've deployed via Intune. ## Prerequisites -In order to receive policies on your Windows 11 SE device to allow 3rd party app installation controlled by your IT admin, you must have the following: -- Windows 11 SE devices with a minimum version of 10.0.22621.819 (22H2, November Update) and later. -- Your Windows 11 devices must be connected to a tenant with an Intune for Education license. If you do not have an Intune for Education license for your devices yet, refer to [Microsoft Intune for Education][EXT-1] for access to a free trial version. This license is needed for Managed Installer to successfully deploy apps and supplemental policies via Intune. +To receive policies on your Windows 11 SE devices, allowing app installation controlled by your IT admin, you must have: + +- Windows 11 SE, version 22H2 and later +- Intune for Education licenses. The license requirement is for the managed installer to deploy apps and supplemental policies via Intune + +If you don't have an Intune for Education license for your devices yet, refer to [Microsoft Intune for Education][EXT-1] for access to a free trial version. ## Next steps -Advance to the next article to learn how to create... +Advance to the next article to learn which application can be deployed to Windows 11 SE devices, and how to deploy them via Intune. + > [!div class="nextstepaction"] -> [Next: deploy apps](deploy-apps.md) +> [Next: deploy apps >](deploy-apps.md) [EDU-1]: https://learn.microsoft.com/education/windows/windows-11-se-overview#add-your-own-applications [EDU-2]: https://learn.microsoft.com/education/windows/windows-11-se-overview#available-applications diff --git a/education/windows/tutorial-managed-installer/deploy-apps.md b/education/windows/tutorial-managed-installer/deploy-apps.md index 4c8232d1cf..49d7c5f577 100644 --- a/education/windows/tutorial-managed-installer/deploy-apps.md +++ b/education/windows/tutorial-managed-installer/deploy-apps.md @@ -28,7 +28,6 @@ The following table details the applications types that can be deployed via Intu > Before deploying apps, first check which apps will be targeting your Windows 11 SE devices and ensure that they will have their minimum requirements met, and ensure that apps which were previously blocked from installing or running are no longer unintentionally being provisioned once the managed installer policies are introduced. > - ## Win32 apps Win32 apps are installed from Intune via an .intunewin package created by the IntuneWinAppUtil command line tool.\ diff --git a/education/windows/tutorial-managed-installer/images/process.svg b/education/windows/tutorial-managed-installer/images/process.svg index 5ab611c1c5..b80111bc97 100644 --- a/education/windows/tutorial-managed-installer/images/process.svg +++ b/education/windows/tutorial-managed-installer/images/process.svg @@ -1,3 +1,3 @@ -
Deploy an application via Microsoft Intune
Deploy an application...
Validate the application
Validate the applicat...
Create additional policies (optional)
Create additional pol... \ No newline at end of file +
Deploy an application via Intune
Deploy an application via Int...
Validate the application
Validate the application
Create additional policies (optional)
Create additional policies (o... \ No newline at end of file