Overview

This article details using ADMX templates for configuration deployment from Active Directory Group Policy or Intune Configuration Profiles.

Solution

Table of Contents

• Active Directory Group Policy Management
• Intune Device Configuration
  • Create a Configuration Profile Using Imported ADMX
• Verifying Administrative Template Changes on Client Machines

Active Directory Group Policy Management

1. Extract the Contents: Copy and extract the contents of the provided zip file to a convenient location.
2. Locate the PolicyDefinitions Folder: Identify the appropriate location for the ADMX and ADML files:
   • Central Store (Recommended for Domain Environments): \\\\{domain.com}\\SYSVOL\\{domain}\\policies\\PolicyDefinitions
   • Local Computer (If not using a Central Store): %systemroot%\\PolicyDefinitions
   • NOTE: ADML files must reside within language-specific subfolders within the PolicyDefinitions directory. For example, U.S. English ADML files should be placed in a subfolder named en-US.
3. Copy ADMX Files: Copy both Okta.admx and OktaODA.admx files to the PolicyDefinitions folder:
   • Central Store: \\{domain.com}\SYSVOL\{domain}\policies\PolicyDefinitions`
   • Local Computer: %systemroot%\\PolicyDefinitions
4. Copy ADML Files: Copy both Okta.adml and OktaODA.adml files to the corresponding language subfolder (for example, en-US) within the PolicyDefinitions folder:
   • Central Store: \\\\{domain.com}\\SYSVOL\\{domain}\\policies\\PolicyDefinitions\\en-US
   • Local Computer: %systemroot%\\PolicyDefinitions\\en-US
5. Open Group Policy Editor: 
   1. Press the Windows Key + R to open the Run dialog.
   2. Type gpedit.msc and press Enter.
6. Verify Template Availability:
   1. Navigate to Computer Configuration > Policies > Administrative Templates.
   2. The Okta > Okta Device Access policy settings should now be visible under Administrative Templates.
7. Configuring Group Policy Settings:
   1. Access Policy Settings: Within the Group Policy Editor, navigate to the specific Okta Device Access policy settings to be modified.
   2. Enable Policies: Double-click the desired policy setting, then select Enabled.
   3. Configure Settings: Make the necessary adjustments to the policy options.
   4. Apply Changes: Click Apply and then OK to save the configuration.
      • Example:
        1. To configure AllowedFactors, double-click on AllowedFactors and select Enabled.
        2. In the settings below, enter * in the text box.
        3. Click Apply and then OK to save the configuration.
8. Verify Registry Changes: On a client machine affected by the GPO, verify that the policy settings have been applied by checking the corresponding registry entries. The specific registry keys modified will depend on the policy configured.
   • Example: Navigate to HKLM\Software\Policies\Okta\Okta Device Access and verify whether AllowedFactors is enabled.

NOTE: Keys under HKLM\Software\Policies\Okta\Okta Device Access Backend are for service purposes, do not modify these registry settings.

Intune Device Configuration

1. Navigate to Intune Admin Center: Open the web browser and go to the Microsoft Intune admin center.

2. Access Device Configuration:
   1. In the left-hand navigation pane, select Devices.
   2. Under Manage devices, select Configuration.
3. Import ADMX:
   1. Click on the Import ADMX tab.
   2. Upload Files:
      • ADMX File: Click Browse or drag and drop the Okta.admx file.
      • ADML File for Default Language: Click Browse or drag and drop the corresponding Okta.adml file (for example, from the en-US folder).
   3. Once the files are uploaded, Intune will validate them. If validation is successful, click Next.
   4. Review the summary and click Create.
   5. The imported template will now appear in the list of available imported administrative templates. Wait for the "Upload status" to show "Available".
4. Repeat the above steps to import OktaODA.admx ADMX file and OktaODA.adml ADML file.

Create a Configuration Profile Using Imported ADMX

Once the ADMX/ADML files are successfully imported, a configuration profile can be created to deploy these settings:

1. Navigate to Configuration: Go to Devices > Manage Devices > Configuration.
2. Create Policy:
   1. Click Create > New Policy.
   2. Platform: Select Windows 10 and later.
   3. Profile type: Select Templates.
   4. In the template list, choose Imported Administrative templates (Preview).
   5. Click Create.
3. Basic Information:
   1. Name: Provide a descriptive name for the profile (for example, "Okta_ODA_Intune").
   2. Description: (Optional) Add a description for the profile.
   3. Click Next.
4. Configuration Settings: The settings defined in the ADMX file will be displayed, categorized as All Settings, Computer Configuration, User Configuration.
   1. Browse to Computer Configuration and Okta, Okta Device Access to configure.
      • For each setting:
        1. Select the setting.
        2. Choose Enabled, Disabled, or Not Configured.
        3. If enabled, configure any associated values (for example, text input, dropdown selection) as defined in the ADMX.
           • Example:
             1. To configure AllowedFactors, double-click on AllowedFactors and select Enabled.
             2. In the settings below, enter * in the text box.
             3. Click OK.
   2. Click Next after configuring all desired settings.
5. Scope Tags (Optional):
   1. Assign scope tags if the organization uses them for role-based access control.
   2. Click Next.
6. Assignments:
   1. Included groups: Click Add groups and select the Azure AD user or device groups to which this policy should apply.
      • NOTE: Computer Configuration settings should be assigned to device groups.
   2. Click Next.
7. Review + Create:
   1. Review all the settings and assignments.
   2. Click Create to deploy the profile.

Verifying Administrative Template Changes on Client Machines

After the policy has been assigned and client devices have synced with Intune, verify the changes using the following methods. The default Intune policy sync cycle for Windows devices is approximately every 8 hours. However, a sync can be manually initiated to expedite policy application.

1. Manually Initiating an Intune Sync:
   • From the Company Portal App (if installed):
     1. Open the Company Portal app on the Windows device.
     2. Go to Settings (often represented by a gear icon or found in a menu).
     3. Look for a Sync button or option and click it. This will initiate a check-in with Intune.
   • From the Windows Settings App:
     1. Open Settings on the Windows device (Windows Key + I).
     2. Go to Accounts.
     3. Select Access work or school.
     4. Click on the account connected to Azure AD/Intune (for example, "Connected to <ExampleOrganization>'s Azure AD").
     5. Click the Info button.
     6. Scroll down to the "Device sync status" section and click the Sync button.
2. Once the sync is complete (which may take a few minutes), proceed with the verification methods below.

Event Viewer

Intune uses the DeviceManagement-Enterprise-Diagnostics-Provider event log to record MDM policy application.

1. 1. Open Event Viewer: On the client machine, press Windows Key + R, type eventvwr.msc, and press Enter.
   2. Navigate to the Log:
      1. Go to Application and Services Logs > Microsoft > Windows > DeviceManagement-Enterprise-Diagnostics-Provider > Admin.
      2. Look for Relevant Events: Filter for events related to policy application. Event ID 813, indicates a policy (like an ADMX setting) is successfully applied. Event ID 814 indicates a successful Set command for a policy.

Registry Editor

Since ADMX settings configure registry keys, they can be directly verified in the Registry Editor.

1. 1. Open Registry Editor: On the client machine, press Windows Key + R, type regedit, and press Enter.
      • NOTE: Be extremely careful when navigating and modifying the registry. Incorrect changes can cause system instability.
   2. Verify Registry Changes: On a client machine, verify that the policy settings have been applied by checking the corresponding registry entries (that is, HKLM\Software\Policies\Okta\Okta Device Access). The specific registry keys modified will depend on the policy configured.
      • Example:
        1. Navigate to HKLM\Software\Policies\Okta\Okta Device Access and verify whether AllowedFactors is enabled. 
        2. Check if the registry key and value exist, and if the data matches the configuration set in the Intune policy.

NOTE: Keys under HKLM\Software\Policies\Okta\Okta Device Access Backend are for service purposes, do not modify these registry settings.