Microsoft Windows Store for Business and Azure AD Join


With Windows 10 available, many organizations are considering upgrading. There are a lot of reasons to consider upgrading to Windows 10 and if you’re interested in learning more please visit: https://technet.microsoft.com/en-us/library/dn986867(v=vs.85).aspx

If you’re interested in learning more about the Windows 10 Roadmap for Business please visit: https://www.microsoft.com/en-us/WindowsForBusiness/windows-roadmap 


First I’ll walk through the registration of a Windows 10 device with Azure Active Directory (Azure AD), then I’ll walk through setting up WS4B.  After, I’ll access the Windows Store from a Windows 10 device where the private business store resides.

During the setup process, users will have the choice (if you’re not deploying using MDT or System Center Configuration Manager for auto deployment) to choose how they’ll authenticate. They can either perform a traditional domain join or join Azure AD.

To learn more about the differences between domain join and Azure AD join please visit: https://blogs.technet.microsoft.com/ad/2016/02/17/azure-ad-domain-join-windows-10/

If your devices are Azure AD joined and you maintain an AD forest on premises, then you’ll be interested in learning more about how to writeback the device objects to Active Directory on premises.

For more information on writing back device info to Active Directory please visit: https://azure.microsoft.com/en-us/documentation/articles/active-directory-aadconnect-feature-device-writeback/

There’s also the ability to have Windows devices automatically register with Azure AD as they’re domain joined.  Links about automatic device registration across the various Windows OS versions are below:

 

Joining a Windows 10 Device to Azure Active Directory

One of the advantages to joining devices to Azure AD is single sign-on (SSO) benefits. In traditional domain joined environments typically this is provided by way of a federated identity provider (e.g. Active Directory Federation Services or ADFS). However, when devices are joined directly with Azure AD the direct benefit is SSO to cloud applications such as Office 365 and other SaaS based applications that have a federated trust directly with Azure AD.

Let’s walk through how to join a device to Azure AD. The following walks through the OOBE experience, however devices that are already set up can be joined as well.

Note: if the device is already domain joined, refer to the links above for device writeback and registration.

Install Windows 10 and after Windows 10 has completed the setup process, select “Join Azure AD”

clip_image002

Type in a user name and password (make sure the user is licensed for Intune or EMS via the O365 admin portal). Select “Sign in” to enroll the device with Azure AD:

clip_image004

clip_image006

clip_image008

clip_image010 clip_image012

Once registration is complete I’m asked to set up a PIN:

clip_image014

PIN setup process

clip_image016

There are three methods to verify your identity via Multi-Factor Authentication. Select the method that best suits your needs. I chose to use the Mobile App.

clip_image018

Download or open the Azure Authenticator app on iOS, Android, or Windows Phone and scan the QR code or use the code provided:

clip_image020

Because I used the mobile app, Azure Authenticator has now registered the account:

clip_image021

Back on the Windows 10 device, once the QR code is scanned or entered and register with the Azure Authenticator app, the Next button lights up. Select Next.

clip_image023

Select how you’d like to authenticate; I chose to receive a notification on my phone (via the Azure Authenticator app):

clip_image025

clip_image027

On my phone, I select “Verify” to complete the process:

clip_image028

Lastly I need to select a country and enter my phone number and select Next:

clip_image030

Now I’m asked to provide a PIN:

clip_image032

After a pin is entered I’m logged into the device under the Azure AD credentials I registered with:

clip_image034

To prove I’m logged in as and Azure AD registered user, I open a command prompt and type in “whoami” without quotes:

clip_image035

On the backend, my device auto registers with Microsoft Intune for mobile device and application management. Intune will also deploy the policies I’ve configured such as configuring Windows Update, Windows Defender, Enterprise Data Protection, OS Upgrade, and so on.

For example, the following are the Windows Defender settings from the same device I registered, as you can see the settings are grayed out; that’s because my Intune policy was deployed to the device:

clip_image037

What about group policies?

If the device is enrolled and managed by Intune, I recommend sticking with Intune policies. However, if there are group policies that your organization already uses, then the more restrictive policy will always take precedence (either Intune or GP). The Intune admin console will point any conflicts out as well.

 

Windows Store for Business

What is Windows Store for Business?

With the new Windows Store for Business, organizations can make volume purchases of Windows apps. The Store for Business provides app purchases based on organizational identity, flexible distribution options, and the ability to reclaim or re-use licenses. Organizations can also use the Store for Business to create a private store for their employees that includes apps from the Store, as well private Line-of-Business (LOB) apps.

Source and more info: https://technet.microsoft.com/itpro/windows/whats-new/windows-store-for-business-overview


Now that I have my Windows 10 device registered with Azure AD (and enrolled with Intune), let’s take a look at the Windows Store for Business.

Navigate to: http://www.microsoft.com/en-us/business-store and either sign up or sign in with your organizational account.

clip_image039

clip_image041

 

The first thing I do is connect WS4B to Microsoft Intune. To connect the services, select Settings and then Management Tools:

clip_image043

Select “Add a management tool”

clip_image045

Search for Microsoft Intune and select Microsoft Intune from the list:

clip_image046

Microsoft Intune will be added and activated:

clip_image048

Adding Applications

Select “Shop” in WS4B to view and add applications. This is very similar to a volume purchase program (VPP):

clip_image050

Select an app to add, in my case I selected Foxit MobilePDF. Then select “Get the app” – other apps have online and offline options that you can select as well.

clip_image052

The distribute screen will open and we have a few options to select from as shown below. I selected to assign the app to people, in this case all FTE group I created in O365. Once you’ve selected an option select “Confirm” to add the app to the WS4B inventory.

clip_image053

clip_image054

Now I’m taken to the WS4B inventory page where all of the apps added may be seen and modified. Select an app to see who it’s been assigned to.

clip_image056

 

Intune Volume Purchase Program (VPP)

Let’s move over the Intune admin portal to view the VPP apps added by WS4B. After I log into Intune I select APPS then Volume-Purchased Apps. Here’s a brief list of some of the apps that came over from WS4B:

image

 

Windows Store for Business on the Windows Client

Let’s now look at where to access applications in the private store. To view the published apps search for or open the Windows Store on a Windows 10 machine (I’m using the device joined with Azure AD). From there you’ll see a list of tabs and on the far right there’s a new tab for WS4B as shown below:

 

clip_image060

 

In my environment I select “Contoso cbcloudmobility” and see the following apps I’ve published so far:

image

 

When I select Sway, I’m provided an option to install:

clip_image064

 

If you’re wondering if LOB apps can be published, the answer is yes. From the WD4B portal select “Manage” and then “New LOB Apps” from there you can go to the LOB Publishers page to invite publishers.

More details here: https://technet.microsoft.com/library/mt606952%28v=vs.85%29.aspx

clip_image066

 

This concludes the walk-through of registering a Windows 10 device with Azure AD and publishing applications via the Windows Store for Business. Try it out to see how it would work for your organization.

Comments (0)

Skip to main content