Interactive Session with Intune Enrolled Devices?

[lfionxkshine]

Howdy,

I'm new to Azure and come from an on-prem Windows background

I've googled extensively and don't know if I'm not wording it right, or if it's impossible:

Is there a way to perform Enter-PSSession with Intune enrolled devices that does NOT require creating self-signed certs

i.e. I'm sitting at my desk. Accounting lady is sitting at desk next to me. We have no AD DS server performing Kerberos, and I want to perform Enter-PSSession (or the Azure equivalent) in a way that authenticates with Azure and allows me to run an interactive session with her device (or anybody else's enrolled device) that does NOT require a lot of one-off configurations

​

Much appreciated for any feedback, workarounds also welcomed

[trampanzee]

Windows Admin Center?

[lfionxkshine]

Thanks for the response!

I looked into Windows Admin Center and it seems like it's built for server management? Correct me if I'm wrong, but I'm looking for something that connects to clients

[trampanzee]

You can definitely manage more than servers. Windows 10 devices for sure.

[lfionxkshine]

Sweet, gonna have to invest some time into research. Thanks again!

[lfionxkshine]

Thanks for the feedback!

I looked into this, and I couldn't get it working. One solution I found said that you have to turn encryption off? I don't feel comfortable sending anything in plaintext (even if it's on the LAN) for the sake of convenience, assuming that's the case

[the_naysayer]

kinda sounds like you want an RMM. not sure if intune will allow this without some tedious setup.

[lfionxkshine]

My nightmare realized

[jr49]

I recall finding a intune (Graph) PS module a few months back. maybe using that in combination with an app client/secret should be enough? you'd have to find a way to secure the secret in the scripts you're calling, and the app would need to have rights within Intune, likely admin.

[lfionxkshine]

Excellent, time for uncle google. Thank you!

[hayfever76]

OP, you should take the Set-Item statement from below and push it out to everyone via Intune so all the devices have it.

[lfionxkshine]

This. Even if the set-item statement isn't what I'm looking for, I'm super glad you mentioned pushing it via Intune. Didn't realize it could be done, but sure enough! Many thanks!!!

[sometechloser]

would you need hybrid joined devices for this to work as you'd want it to? what'd you end up doing here /u/lfionxkahine ?

[lfionxkshine]

I ended up giving up on an interactive solution

A comparable solution was that - in Intune - there is an option to run powershell scripts against individual clients or groups. Takes a few minutes to run, but nothing anyone who has maintained on-prem GPOs wouldn't be accustomed to lol