Planning to Use Extensions in Configuration Manager
Updated: January 16, 2015
Applies To: System Center 2012 R2 Configuration Manager
Beginning with System Center 2012 R2 Configuration Manager, optional extensions that introduce new capabilities to manage mobile devices using Microsoft Intune are available from within the Configuration Manager console. Configuration Manager administrators can enable individual extensions to gain access to these new capabilities without waiting for the next service pack or major product release to introduce that functionality.
To use extensions, you must first install the Windows Intune connector site system role in your hierarchy and have a Microsoft Intune subscription. The Windows Intune connector is responsible for contacting Microsoft to download the available extensions. After available extensions are downloaded they are available in the Configuration Manager console where you can select one or more to enable in your hierarchy.
After you enable an extension, the capabilities that it introduces appear seamlessly as regular options and settings in the Configuration Manager console alongside existing options and settings. For example, after you enable the extension for email profiles, a new node named Email Profiles appears under Company Resource Access in the Compliance Settings node in the Assets and Compliance workspace. This new option enables you to configure and deploy email profiles to devices along with the other available profiles.
Because different extensions deliver separate sets of functionality, you can find documentation for extensions in the feature-specific areas of the Configuration Manager documentation on Microsoft TechNet. To learn more, use the following links; or from within the Configuration Manager console, select an extension and then click More Information.
Email Profiles extension
iOS 7 and iOS 8 Security Settings extension
Windows Phone 8.1 extension
Enterprise Mode Internet Explorer extension
Conditional Access extension
The information in the following sections applies to all extensions, and can help you learn how to manage extensions and what to expect when you enable or disable them for your infrastructure.
How to Identify the Available Extensions
How to Enable Extensions
How to Upgrade Extensions
How to Disable Extensions
When you are ready to manage the extensions you want to use, and after you have enabled the Windows Intune connector site system role, you can view the available extensions in the Extensions for Windows Intune node, under Cloud Services in the Administration workspace.
|When you use extensions, the first time you open each Configuration Manager console when a new extension is available from Microsoft, you receive a pop-up which informs you about the new extension. This pop-up appears only one time for each console, and does not appear for any console after the extension is enabled.|
Each extension includes a brief description, identifies when the extension was published or updated, and the date that the extension was enabled in your environment. When you have not enabled an extension in your environment, the Date Enabled field is blank. You can read more information about each extension by selecting the extension in the results pane of the console, and then clicking on the More Information link in the in the details pane.
Periodically, new extensions and updates for extensions might become available in the Configuration Manager console. When you have not enabled an extension, only the most recent version of that extension displays and is available to enable. When there is an update for an extension you have already enabled, the update appears as a new item in the console with the same name as the enabled extension but with a newer value for Date Released and a status of Available.
Use the Extensions for Windows Intune node in the Configuration Manager console to enable extensions in your Configuration Manager environment.
You can enable an extension when using a Configuration Manager console that is connected to any site in your hierarchy. However, it is the top-level site in your hierarchy where you installed the Windows Intune connector site system role that installs the extension and updates the site database. Any changes then replicate to other sites in the hierarchy. After the extension installs, Configuration Manager consoles must also update to support the extension.
When you first connect a Configuration Manager console to a site that uses one or more extensions that the console does not yet support, you receive a notification that the console will update. After you accept this notification, the console closes, the update begins, and the process then automatically restarts the console to complete the update. After the console restarts, the new capabilities of the extension are available for use. Updates to a console persist and are available the next time that console starts.
The update to a Configuration Manager console only occurs when a console connects to a site and does not have the same extensions installed as are enabled at the site.
|If you use a Configuration Manager console to connect to a site in a different hierarchy that has a different set of extensions enabled, the console will update to install or remove the applicable extensions based on the that configuration of the new site.|
In the Extensions for Windows Intune node, under Cloud Services in the Administration workspace, select the extension and then click Enable.
Accept the license terms, and then click Yes to start the installation to enable the extension.
Tip During the installation, the Status for the extension displays Enabling extension. After the installation is complete, if you refresh the Configuration Manager console, the status updates to display Enabled.
The time to download and install different extensions varies based on the size of the extension files. Additionally, if you manage extensions from a child primary site, the primary site must pass the command to download and install the extensions to the central administration site where the Windows Intune connector is located.
After the installation completes, you will not be able to view the new elements from the extension in the console until the console restarts and installs the console updates for the extension.
Periodically, an update for an extension that is enabled might be available. An update for an enabled extension appears as a new item along with the enabled extension in the Extensions for Windows Intune node in the Configuration Manager console. The updated version of the extension has same name as the enabled extension but with a newer value for Date Released and a status of Available.
To install the updated version of the extension, select the new version and then click Enable. You do not need to disable the older version of the extension before you enable the updated version. When the updated version installs, the configurations you previously made for the extension are retained. After the new version installs, only the most recent version of the extension displays in the console.
Individual patches or cumulative updates that release for Configuration Manager should not affect extensions. When an update for Configuration Manager would affect the capabilities or function of an extension, an updated version of that extension will be released and can be found in the Configuration Manager console.
Use the Extensions for Windows Intune node in the Configuration Manager console to disable extensions in your Configuration Manager environment. After you disable an extension you will be able to enable it again at any time. You do not need to first disable an extension before you enable a newer version of that extension.
Before you can disable an extension, you must remove all of the configurations for that extension from the Configuration Manager console. For example, if you use the extension for iOS 7 Security Settings and configure configuration items that use any of the new settings introduced by that extension, you must delete those configuration items from the console before you can disable the extension for iOS 7 Security Settings. This includes deleting any previous versions (revision history) of a configuration item that contains those settings. While it is possible to remove only the iOS 7 specific configurations from existing configuration items, you must also remove the same settings from any previous versions of the configuration items that might contain those configurations. After all of the relevant configurations are removed, you will have the option to disable the extension.
To disable an extension, you first select the extension in the console, and then click Disable. The extension will then uninstall and after the extension uninstalls, you must restart the Configuration Manager console so that the extension update for the console can uninstall.
When you disable an extension, the extension uninstalls from the Configuration Manager database and this change replicates to all sites in your hierarchy. Subsequently, when a Configuration Manager console that previously installed the update for the now disabled extension connects to a site, that console updates to remove the extension. This process is similar to that for adding an extension to a site in that the user receives a notification, the update for the extension then uninstalls form the console, and then the console automatically restarts and then re-connects to the site.
After you disable an extension, that extension is not available for use in the Configuration Manager console until you re-enable it. However, the act of disabling an extension (which requires that you first remove the configurations for that extension in the Configuration Manager console), does not remove the configurations from devices that have previously received them. Additionally, the results of disabling different extensions can vary. For example, after you disable Email Profiles Extensions, you can no longer deploy email profiles to new devices. However, the email profiles you have previously configured and deployed to devices remain on those devices, unused, until the device is retired or wiped. Continuing this example, the experience for iOS 7 Security Settings is slightly different. After you disable the extension iOS 7 Security Settings, the configuration items that enforce the iOS 7 settings are no longer configured. However, the iOS 7 settings that were enforced by those configuration items remain in place on devices, but the end user is now free to reconfigure them.
For additional resources, see Information and Support for Configuration Manager.
Tip: Use this query to find online documentation in the TechNet Library for System Center 2012 Configuration Manager. For instructions and examples, see Search the Configuration Manager Documentation Library.