Nodefusion IT Managed Service Provider User Manual

Enhance your professional profile by:

1. Editing the Microsoft 365 profile 'About' tab to include Biography, Skills, Interests, hobbies, and Projects.
2. Adding pronouns (He/Him or She/Her) to the user profile.
3. Connecting your LinkedIn account with your work or school account.

To onboard a user directly in Microsoft Entra:

1. Create the user in Microsoft Entra with complete attributes (Name, Department, Job Title, Company, Employee ID, Usage Location, Hire Date).
2. Set the username to match the primary email address.
3. Assign a Manager.
4. Add the user to required Distribution, Security, or Microsoft 365 Groups.
5. Assign a license (preferably via group membership).
6. Enable mailbox auditing.

To offboard a corporate-owned Android device that has been sold or recycled:

1. Navigate to Intune > Devices > Android > Device > Wipe > Yes.
2. Verify that the device has been successfully removed from Intune.

After OOBE and enrollment, perform the first login:

• Hybrid: Use Windows Server Active Directory credentials.
• Cloud-only: Use the Microsoft Entra account. Use the web-sign option with a Temporary Access Pass (TAP) or Microsoft Authenticator.

Once logged in, the user must set up Windows Hello for Business with a minimum PIN (fingerprint and face recognition are optional).

Use this process to set up a PassKey for faster authentication on macOS. Prerequisite: You must be logged into your Apple account in the macOS System Settings app.

1. Open Safari and go to https://mysignins.microsoft.com/security-info.
2. Log in with your work account and Temporary Access Password (TAP).
3. Select 'Add sign-in method' > 'Passkey'.
4. Follow the prompts: 'Sign in faster with your face, fingerprint, or PIN' > 'Next' > 'Setting up your passkey...' > 'Next'.
5. When prompted to 'Add a passkey', choose to save it in the Passwords app and use Touch ID to save it.
6. Name the passkey and complete the creation process.
7. Select the passkey as the authentication method during future logins.

Before installing Windows or enrolling in management, ensure the following hardware and BIOS/EFI settings are configured:

• Secure Boot: Enabled and reset to SETUP MODE.
• Device Guard: Enabled.
• Virtualization Technology: Enabled.
• Microsoft Pluton: Enabled (if available).
• EFI Partition: Must be larger than 260 MB to accommodate EFI firmware upgrades.
• OS Installation: If the device is not Brand/OEM, reinstall Windows using internal procedures and images.

To offboard a corporate-owned macOS device that has been sold or recycled:

1. In the Intune Admin Center, navigate to Devices > Windows (Note: source mentions Windows path for macOS) > Find device in search and select it > Select Retire/Wipe.

Complete the following one-time setup steps in Microsoft Teams:

1. Set translation settings to Croatian and English.
2. Create voice and face recognition profiles.
3. Record and display name pronunciation on the profile card.
4. Mobile App: Block notifications on the mobile application when active on the desktop.
5. Organization: Pin frequently used channels (e.g., Productivity Team > General) and set notifications to 'All Activity' for primary Groups/channels.

Follow these steps to enroll an iOS device using the web-based method:

1. Open Safari and go to https://portal.manage.microsoft.com/enrollment/webenrollment/ios.
2. Log in with the user's organizational account (using a Temporary Access Password).
3. Select 'Get started' and download the management profile.
4. Go to Device Settings > Profile Downloaded > Install Profile.
5. Install the Root certificate.
6. Confirm installation of default apps when prompted.
7. Configure the Microsoft Authenticator app by logging in and registering with the organization.
8. Log in to Microsoft Defender, Outlook, and Teams using the organizational account.

To set up a fully managed macOS device:

1. Open Safari and go to https://go.microsoft.com/fwlink/?linkid=853070 to download and install the Microsoft Intune Company app.
2. Open Intune and log in with the organizational account.
3. Wait for configuration profiles to download.
4. Log out and log back in twice; when prompted, select 'Enable Now' for FileVault encryption.
5. Save the device recovery key displayed on the screen in a secure location.

To manage high volumes of email, create the following subfolders under the Inbox and apply corresponding rules:

Folders:

• CC: For communication not sent directly to you.
• Alerts: For email alerts.
• Support: For support emails.
• [GroupName]: For each followed Group (e.g., Administration-Team).

Rules:

• Alerts: If 'Recipient address includes' alert $ ightarrow$ Move to Alerts folder.
• Company Support: If 'To' is support@company.com $ ightarrow$ Move to Support folder (Exception: 'I'm on the To or CC line').
• CC Filter: If 'I'm not on the To line' $ ightarrow$ Move to CC folder.