R80.20 Updatable Objects - Intune + Autopilot

[Shahar_Grober]

Hi,

Are there updateable objects in R80.20 for Microsoft Intunes and Autopilot?

Intune:https://docs.microsoft.com/en-us/intune/network-bandwidth-use

Autopilot:https://docs.microsoft.com/en-us/windows/deployment/windows-autopilot/windows-autopilot-requirements...

also, It would be nice if there could be a way to import/upload IP address xml, csv directly to the policy in R80.20 and not only via mgmt API. Or maybe there is something like this which I am not aware of

[PhoneBoy]

I believe we'll have some way to specify your Updatable Objects feed (or maybe upload one) in a later release.
As for Intune/Autopilot, I have not seen these listed in the services for Updatable Objects.
Doesn't mean it can't be added in the future.

[Shahar_Grober]

Thanks PB,

Is it possible to share it with R&D. I believe it is not a lot of effort to add Intune/Autopilot as Updatable Objects

[Dima_M]

Hi Shahar and all,

We're here and listening 🙂  More use cases and vendor suggestions are always welcome.

I'll be glad to discuss the use case further on, please drop me an email...

Thanks,

Dima

[Luke_Pattison · Accepted solution]

Has anyone got this working for unattended out-of-the-box Autopilot deployments?

According to this link Intune is required for Autopilot:

https://docs.microsoft.com/en-us/windows/deployment/windows-autopilot/windows-autopilot-requirements...

There is an AppControl object for Intune, but look into the detail and HTTPS inspection is required. How do you get a cert on to the device for HTTPS inspection when the whole point of Autopilot is to do a zero touch deployment on a fresh machine?

I've tried allowing the updatable objects for Azure Services and Office365 Services, but still get a whole heap of dropped packets to something.deploy.static.akamaitechnologies.com that aren't recognised as any particular app or URL.

I'm starting to think that the only option is to provision a separate build network to each building and just blacklist a few categories for inappropriate or high risk apps and URLs rather than try and make white-listing work. Any other ideas?

[sajin]

Hi, Updatable Object for INTUNE is now available and still am getting blocked by deploy.static.akamaitechnologies.com. Do we need to allow Azure Cloud object along with INTUNE to work correctly.

[Martin_Webster]

Hi,

I'm getting very similar issues.  The following appear in my logs:

a104-75-172-68.deploy.static.akamaitechnologies.com (104.75.172.68)

a23-209-84-4.deploy.static.akamaitechnologies.com (23.209.84.4)

a23-216-100-183.deploy.static.akamaitechnologies.com (23.216.100.183)

a95-100-144-120.deploy.static.akamaitechnologies.com (95.100.144.120)

Intune has made a lot of noise go away.  

When will Autopilot be available as an Updatable Object?

[PhoneBoy]

Probably best to get the TAC involved if you haven't already.

[upmitnetworksec]

is a104-75-172-68.deploy.static.akamaitechnologies.com.working in Intune Updatebale objects because I can see above users' reply it is not working.

[Shahar_Grober]

the problem with intune and autopilot is that it uses many URLs that are not listed anywhere and unfortunately, you have to allow them manually

TAC will not able to assist in this case

a Tip from CPX: Try to contact Check Point overlay team via your local office, they might be able to assist 

[Shahar_Grober]

Quick update, I can see in SDB that Intune was added as an Updatable object.

There is a relatively new SK about it 

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solut...

I am testing to see if it is solving intune/autopilot issues. Will update as soon ...

[upmitnetworksec]

Hello,

can anyone suggest if we allow Microsoft Intune + azure + office 365 updatable object then is it completing the requirement of Windows autopilot and is below URL;'s working when we allow those.

if not then how we can complete the project requirement in checkpoint(Allow Windows Autopilot )

Need urgent help on this.

a104-75-172-68.deploy.static.akamaitechnologies.com.

https://docs.microsoft.com/en-us/windows/deployment/windows-autopilot/windows-autopilot-requirements

[Shahar_Grober]

Intune updatable object should do the Job
and also remove https inspection if possible

[upmitnetworksec]

is a104-75-172-68.deploy.static.akamaitechnologies.com.workign in Intune Updatebale objects because i can see above users' reply it is not working.

[Shahar_Grober]

depends on your policy
This eventually should point you to Microsoft service

[upmitnetworksec]

Hello,

Thanks for reply,But i didn’t get your point what is the policy means ?

if i allow microsoft intune + azure + Office 365 updatebale objects so deploy.static.akami url work or not.

Because i can see when autopilot runs first request goes for Akami url’s.

If this will not allow Akami url,s the  window autopilot won’t work.

Have you tested in your environment while allowing updateable objects.

[Shahar_Grober]

on my environment it is working when we added intune updatable objects but we don't block access to Akamai. eventually akamai will resolve to a Microsoft/FQDN IP so the question if you block access to Akamai in your policy.
if you want to know if under the hood the updatable object contains this url, you will have to ask Check Point support.
I can tell you that we had some issues with https inspection and we had to exclude it from the networks that used for autopilot

[upmitnetworksec]

Hello,

we only allow the networks in firewall so could  you please tell me how i can allow the Akami in our firewall and as of now Url filtering is not enabled.

Also,we have any any drop in our firewall.(Clean up rule)

so not getting any idea how i can allow Akami in My firewall.

 Thanks,

[Netadmin2020]

It s been almost 2 years from the first post. Is there a solution? I have all microst, azure,I tune updatable objects attached but still there are some destinations that are dropped. Thank you

[Giorgio_Giustoz]

Hi, I don't think this is the best solution after 2 years from (R80.20 to R81). There is some news or updates about this issue?

Thank you!