Product documentation
Citrix DaaS
View PDF

Create Microsoft Intune enabled catalogs

November 14, 2022
Contributed by: 
C

This article describes how to create Microsoft Intune enabled catalogs using Citrix DaaS. You can enable Microsoft Intune by using the Full Configuration interface or PowerShell.

For information on requirements, limitations, and considerations, see Microsoft Intune.

Use the Full Configuration interface

The following information is a supplement to the guidance in Create machine catalogs. This feature requires the selection of Azure Active Directory joined in Machine Identities during catalog creation. Follow the general guidance in that article, minding the details specific to this feature.

In the catalog creation wizard:

  • On the Machine Identities page, select Azure Active Directory joined and then Enroll the machines in Microsoft Intune. If enabled, enroll the machines in Microsoft Intune for management.

Use PowerShell

The following are PowerShell steps equivalent to operations in Full Configuration.

To enroll machines in Microsoft Intune using the Remote PowerShell SDK, use the DeviceManagementType parameter in New-AcctIdentityPool. This feature requires that the catalog is Azure AD joined and that Azure AD possesses the correct Microsoft Intune license. For example:

New-AcctIdentityPool -AllowUnicode -DeviceManagementType "Intune" IdentityType="AzureAD" -WorkgroupMachine -IdentityPoolName "AzureADJoinedCatalog" -NamingScheme "AzureAD-VM-##" -NamingSchemeType "Numeric" -Scope @() -ZoneUid "81291221-d2f2-49d2-ab12-bae5bbd0df05"
<!--NeedCopy-->

Troubleshoot

If machines fail to enroll in Microsoft Intune, do the following:

  • Check if the MCS-provisioned machines are Azure AD joined. The machines fail to enroll in Microsoft Intune if they are not Azure AD joined. See https://docs.citrix.com/en-us/citrix-daas/install-configure/create-machine-identities-joined-catalogs/create-azure-ad-joined-catalogs.html to troubleshoot Azure AD join issues.

  • Check if your Azure AD tenant is assigned with the appropriate Intune license. See https://learn.microsoft.com/en-us/mem/intune/fundamentals/licenses for license requirement of Microsoft Intune.

  • Check the provisioning status of AADLoginForWindows extension for the machines. MCS relies on this extension to join a virtual machine to Azure AD and enroll in Microsoft Intune. If the AADLoginForWindows extension does not exist, possible reasons are:

    • IdentityType of the identity pool associated with the provisioning scheme is not set to AzureAD or DeviceManagementType is not set to Intune. You can verify this by running Get-AcctIdentityPool.

    • The AADLoginForWindows extension installation is blocked by Azure policy.

  • To troubleshoot AADLoginForWindows extension provisioning failures, you can check logs under C:\WindowsAzure\Logs\Plugins\Microsoft.Azure.ActiveDirectory.AADLoginForWindows on the MCS provisioned machine.

  • Check Windows event logs under Application and Services Logs > Microsoft > Windows > DeviceManagement-Enterprise-Diagnostics-Provider.

Create Microsoft Intune enabled catalogs
November 14, 2022
Contributed by: 
C
November 14, 2022
Contributed by: 
C

In this article

Site feedback | Privacy and legal terms | Cookie preferences | Consent settings | docs.cloud.com
© 1999- Cloud Software Group, Inc. All rights reserved.