MEM – Demystifying Edge legacy and Edge Chromium profiles

by Contributed | Nov 19, 2020 | Technology

This article is contributed. See the original author and article here.

Hello IT Pros,

When we apply different Edge Profiles in MS Endpoint Manager, we may get a little bit of confusion on what Edge types applied to what Endpoint configuration profiles. In this article, I would like to clear the mist covered Edge and its application. Also, we will make Edge Chromium and Legacy run parallelly on the same Windows 10 systems.

I summarize the difference of Edge’s types and Edge’s usage in the following table:

EdgeHTML is the original Edge (Edge version 45 and earlier)	Other name: Edge Legacy, Edge classic Source code is written in C++, support web standard (HTML5, Web SQL, WebGL) and interoperability with other modern browser. Released on 6-2015 with version 19.10149 for Windows 10 mobile and version 20.10158 for desktop. Microsoft plans to provide security patches for legacy Microsoft Edge until March 9, 2021
Edge Chromium (Edge version 77 and later)	Other name: It uses the same rendering engine as Google Chrome but with enhancements developed by Microsoft. Supported OS: Windows 7, 8.1, 10, macOS Edge Chromium for Linux OS is in preview, starting 10-20-2020
To Run Edge Legacy and Edge Chromium side-by-side	By default Edge Legacy is hidden when you upgrade it to Edge Chromium. To make both Edges available, adding the following registry key before you do the upgrade to Edge Chromium: Enable Side-by-side experience using Registry Editing   HKEY_LOCAL_MACHINESOFTWAREPoliciesMicrosoft Right-click on the Microsoft folder, and create a new key with name EdgeUpdate, Create a new 32-bit DWORD with the name Allowsxs and set its value as 1     For the best experience, the Allow Microsoft Edge Side by Side browser experience should be enabled before the new version of Microsoft Edge is deployed Microsoft Edge Legacy will need to be re-pinned to Start or the Taskbar. Sites that were pinned to Start or the Taskbar for Microsoft Edge Legacy will be migrated to the new version of Microsoft Edge.
Managing Edge Legacy in Endpoint Manager (Intune)	Using Endpoint Manager admin centerWindowsconfiguration profiledevice restrictionMicrosoft Edge browser
Managing Edge Chromium in Endpoint Manager	Using Endpoint Manager Admin CenterWindowsAdministrative template profile

Examples:

Using Endpoint Manager, Configuration Profile to set different home pages, startup pages for Edge legacy and Edge Chromium to run parallelly on the same device:

Prerequisite: Make sure the registry key was set to allow running both Edge browsers at the same time as per the above section detail.

1. Create the Endpoint ManagerDevicesWindows 10 or later platform with Administrative Template profile contained the following settings:

Setting to open multiple brower ‘s tabs

2. Create the Endpoint ManagerDevicesDevice Restriction for Windows 10 or later platform.

         Choose Microsoft Edge Browser

3. The two profiles now shown in Endpoint Manager admin center:

3. Testing and Result:

Edge chromium result with correct home pages and multiple tab and web pages opened simultaneously at start:

Edge legacy result with multiple opening tab and web pages according to your Endpoint Manager’s  configuration profile settings:

I hope the information is useful.

Thanks for viewing, until next time.

Reference:

• Microsoft Tech blog: Access Edge Legacy Classic


• Wikipedia: Microsoft Edge versions


• The Windows Club: Run Legacy Edge and Chromium Edge


• Microsoft document: Manage Edge


• Microsoft document: Deploy Edge

Microsoft Endpoint Manager – Demystifying Edge legacy and Edge Chromium profiles

by Contributed | Nov 19, 2020 | Technology

This article is contributed. See the original author and article here.

Hello IT Pros,

When we apply different Edge Profiles in MS Endpoint Manager, we may get a little bit of confusion on what Edge types applied to what Endpoint configuration profiles. In this article, I would like to clear the mist covered Edge and its application. Also, we will make Edge Chromium and Legacy run parallelly on the same Windows 10 systems.

I summarize the difference of Edge’s types and Edge’s usage in the following table:

EdgeHTML is the original Edge (Edge version 45 and earlier)	Other name: Edge Legacy, Edge classic Source code is written in C++, support web standard (HTML5, Web SQL, WebGL) and interoperability with other modern browser. Released on 6-2015 with version 19.10149 for Windows 10 mobile and version 20.10158 for desktop. Microsoft plans to provide security patches for legacy Microsoft Edge until March 9, 2021
Edge Chromium (Edge version 77 and later)	Other name: It uses the same rendering engine as Google Chrome but with enhancements developed by Microsoft. Supported OS: Windows 7, 8.1, 10, macOS Edge Chromium for Linux OS is in preview, starting 10-20-2020
To Run Edge Legacy and Edge Chromium side-by-side	By default Edge Legacy is hidden when you upgrade it to Edge Chromium. To make both Edges available, adding the following registry key before you do the upgrade to Edge Chromium: Enable Side-by-side experience using Registry Editing   HKEY_LOCAL_MACHINESOFTWAREPoliciesMicrosoft Right-click on the Microsoft folder, and create a new key with name EdgeUpdate, Create a new 32-bit DWORD with the name Allowsxs and set its value as 1     For the best experience, the Allow Microsoft Edge Side by Side browser experience should be enabled before the new version of Microsoft Edge is deployed Microsoft Edge Legacy will need to be re-pinned to Start or the Taskbar. Sites that were pinned to Start or the Taskbar for Microsoft Edge Legacy will be migrated to the new version of Microsoft Edge.
Managing Edge Legacy in Endpoint Manager (Intune)	Using Endpoint Manager admin centerWindowsconfiguration profiledevice restrictionMicrosoft Edge browser
Managing Edge Chromium in Endpoint Manager	Using Endpoint Manager Admin CenterWindowsAdministrative template profile

Examples:

Using Endpoint Manager, Configuration Profile to set different home pages, startup pages for Edge legacy and Edge Chromium to run parallelly on the same device:

Prerequisite: Make sure the registry key was set to allow running both Edge browsers at the same time as per the above section detail.

1. Create the Endpoint ManagerDevicesWindows 10 or later platform with Administrative Template profile contained the following settings:

Setting to open multiple brower ‘s tabs

2. Create the Endpoint ManagerDevicesDevice Restriction for Windows 10 or later platform.

         Choose Microsoft Edge Browser

3. The two profiles now shown in Endpoint Manager admin center:

4. Testing and Result:

Edge chromium result:

Edge legacy result:

I hope the information is useful.

Thanks for viewing, until next time.

Reference:

• Microsoft Tech blog: Access Edge Legacy Classic


• Wikipedia: Microsoft Edge versions


• The Windows Club: Run Legacy Edge and Chromium Edge


• Microsoft document: Manage Edge


• Microsoft document: Deploy Edge

Introducing New Policy Reports & more in Microsoft Endpoint Manager Reporting

by Contributed | Nov 19, 2020 | Technology

This article is contributed. See the original author and article here.

By: Laura Arrizza – Program Manager and Spencer Shumway – Program Manager | Microsoft Endpoint Manager – Intune

We are introducing two new reports in the policy configuration space within Microsoft Endpoint Manager to help IT admins troubleshoot where failures may occur across their device configuration profiles and compliance policies. You will be able to use the two reports to see where conflicts and errors are occurring, with the ability to narrow it down to the device and setting level to identify where the issues lie.

In addition, there are a few general reporting infrastructure announcements that customers should be aware of when using all new reports. We’ve called these out at the end of this blog post.

Contents:

• New policy operational reports
  
  
  
  • Assignment Failures operational report for configuration profiles
  
  
  • Non-compliant policies operational report for compliance policy
  
  
  
  


• Reporting Announcements for upcoming changes
  
  
  
  
  • Change to the default columns in Devices Export API call
  
  
  • Localization changes for data export
  
  
  • New Azure Monitor diagnostic setting that maps the Devices list
  
  
  
  

New Policy Operational Reports

Customers can navigate to the “Monitor” section under the “Devices” node to see two new operational reports under the Configuration and Compliance headers. The “Assignment failures (preview)” report shows device configuration data, and the “Noncompliant policies (preview)” report shows compliance policy data.

Figure 1. Monitor | Assignments failures (preview)

Both reports follow a similar structure where the first view of the report shows the list of policies in your environment and the count of devices in a state of failure. The “Assignment failures” report shows the aggregate number of devices in a state of error or conflict, with the ability to filter by profile type and platform. The “Noncompliant policies” report shows the aggregate number of devices in a state of noncompliant or error, with the ability to filter by platform.

Figure 2. Monitor | Noncompliant policies (preview)

Throughout both reports, you can use the upgraded grid controls to search, sort, and filter across all the records. We have included easier page controls and faster export to a zip file containing the csv records of the report view. In addition, the records will be updated automatically to refresh the data within approximately 20 minutes.

Figure 3. Monitor | Assignment failures (preview) overview

From the first view of the report, you can select the policy or profile that has devices in a failure state. This will navigate to the second level of the report showing the list of device/user combinations that are in the failure state with its status. The number of records in view may be higher than the first aggregate since the records are based on a per device per user basis.

Admins have the same capabilities for the upgraded grid controls on this view and the ability to export the information locally. The report can also add extra columns to see extended Azure AD user information or device ID information.

Figure 4. Assignment failures – Android Enterprise

After viewing the devices and users in failure, you can select the device/user record to view all the settings applied on the device from the selected policy. Here, admins can easily see which settings are in an error or conflict state which is causing failure in the first place. Selecting the setting record will open the setting details context pane which provides more insight into troubleshooting. If the setting is in a state of error, the error code can help identify what the error is. If the setting is in a state of conflict, the “source profiles” table can help identify which other profiles are causing the conflict.

Figure 5. Profile Setting Error

Overall, the new reports aim to help streamline the troubleshooting process for admins to identify where failures are occurring across their policies and drill down to the setting level to understand how to mitigate.

Known Issues in Public Preview

The new reports are available in public preview with some known issues that the team will work out before removing the preview tags. See below:

• Administrative template profiles are not supported in the Assignment Failures report.


• Certificate profile types will have settings may appear as “#” in the report view. Work is in progress on how to report status for certificate profiles.  


• Specific RBAC roles have access to the reports:
  
  
  
  • Global administrator
  
  
  • Profile Manager (Built in Role)
  
  
  • Compliance Read-Only Admin
  
  
  
  


• If an admin creates a new scope tag to be applied to the reports, it can take up to 24 hours for the scope tag to take effect. In that time, the policies that are affected by the scope tag may be removed from view in the interim period.


• The setting details pane on the third level of the reports currently only show the error code information if the setting is in error. The string version for the “Error details” is not yet available.

Existing Policy Reports and Roadmap

These two new reports are part of the effort to improve the policy reports across the console. As these are additive reports with fresher data, the records and numbers shown across the console in existing reports may be slightly different (i.e., “Assignment Status” and “Policy Compliance” reports).  We encourage you to try out the new reports and use the existing ones for additional information.

You will continue to see improvements to the policy reporting space over the next few months. This includes adding security baseline and endpoint security records to the new “Assignment Failures” report, replacing older reports with new organizational ones, and ensuring consistency across the console.

Stay tuned for more updates on the What’s New and through this TechCommunity blog!

Reporting Announcements for Upcoming Changes:

• Change to the default columns in Devices Export API call


• Localization changes for data export


• New Azure Monitor diagnostic setting that maps the Devices list

Change to the default columns in Devices Export API call

NOTE: This change only affects those using our new Reporting Export Graph API without any column selections. UI export, which is the more typical way to export the All Devices list, is not affected by this upcoming change.

When you make a request with no select columns provided:

{“reportName“: “Devices”, “filter“: “”, “select“: “” }

you will receive the default column set. This default column set for the devices report contained some columns that were either not user friendly, not useful, or confusing. We will be removing those columns from the default column list starting December 2020. The columns being removed are listed here:

These columns will still be available for selection if you need them, but only explicitly, and not by default. If you have built automation around the default columns of the device export when using the exportJobs API, and that automation uses any of these columns, you need to refactor your processes to explicitly select these and any other relevant columns like this:

{“reportName“: “Devices”, “filter“: “”, “select“: [“PhoneNumberE164Format“, “_ComputedComplianceState“, “_OS“, “OSDescription“]} 

Localization changes for data export

As many customers have noticed, we provide localized and non-localized column information with almost all report exports. It looks something like this for any given column that contains localizable data:

The human readable/localized values are provided in the _loc column, while the actual column contains the enum/dev string values. These enum/dev string values are used to interact with the API and are less likely to change, which make them ideal for automation.

In contrast to this approach, we have a few export experiences that provide only the human readable/localized string data, which looks like this:

We recognize that some customers prefer this approach, especially to avoid column re-mapping when taking data to external tools/sources for reporting.

Currently there is no way to configure which experience you will receive in regard to localization, as each report has a built-in default behavior that remains static. In the future, we are working to add the capability to specify the localization experience you prefer. If you have strong thoughts or feelings about what the new behaviors and defaults should be, or have existing issues with localization, just respond back on this blog post or tag @IntuneSuppTeam out on Twitter!

New Azure Monitor diagnostic setting that maps the Devices list

We have recently enabled a new Azure Monitor Diagnostic setting called Devices for our internal testing. This testing precedes the release of a new Devices category that maps to the All Devices list in Microsoft Endpoint manager admin center. While the setting is visible and can be configured, we will not publish data to your Azure monitor subscription until we officially enable the setting early next year. We do not recommend enabling this setting until that time. As always, let us know if you have questions on this setting by replying back on this post or tagging @IntuneSuppTeam out on Twitter!

Total reports supported by our new infrastructure:

Let us know if you have any additional questions on this by replying back to this post or tagging @IntuneSuppTeam out on Twitter.