Surface Hub allows IT administrators to manage settings and policies using a mobile device management (MDM) provider such as Microsoft Intune. Surface Hub has a built-in management component to communicate with the management server. There is no need to install additional clients on the device.
The foundational building block of policy settings management in Intune and other MDM providers is the XML-based Open Mobile Alliance-Device Management (OMA-DM) protocol. Windows implements OMA-DM XML via one of many available Configuration service providers (CSPs) with names like AccountManagement CSP, DeviceStatus CSP, WiFi-CSP, and so on. For a complete list, refer to CSPs supported in Microsoft Surface Hub.
Microsoft Intune and other MDM providers use CSPs to deliver a UI that enables you to configure policy settings within Configuration profiles. Intune uses the Surface Hub CSP for its built-in template — Device restrictions (Windows 10 Team) — letting you configure basic settings such as preventing Surface Hub from "waking up" whenever anyone moves nearby within its proximity range. To manage Hub settings and features outside of Intune's built-in profile, you'll need to use a custom profile, as shown below.
To summarize, options to configure and manage policy settings within Intune include the following:
Create a Device restriction profile. Use Intune's built-in Surface Hub template and configure settings directly in the Intune UI. See Create device restriction profile.
Create a Device configuration profile. Select a template focused on a specific feature or technology such as Microsoft Defender or security certificates. See Create Device configuration profile.
Under Profile type, select Templates and then select Device restrictions (Windows 10 Team)
Select Create, add a name and then select Next.
You can now browse and choose from preset device restriction settings for Surface Hub across the following categories: Apps and experience, Azure operational insights, Maintenance, Session, and Wireless projection. The example shown in the following figure specifies a 4-hour maintenance window and a 15 minute timeout for screen, sleep and session resume.
Under Profile type, select Templates and choose from the following templates supported on Surface Hub:
Device restrictions (Windows 10 Team), as described in the previous section.
Microsoft Defender for Endpoint (Windows 10 Desktop)
PKCS certificate
PKCS imported certificate
SCEP certificate
Trusted certificate
Create Custom configuration profile
You can extend the scope of management by creating a custom profile using an OMA URI from any of the CSPs supported in Microsoft Surface Hub. Each setting in a CSP has a corresponding OMA-URI that you can set by using custom configuration profiles in Intune. For details on the CSPs supported by Surface Hub, you can reference the following resources:
The default app for meetings & calls on the Surface Hub varies depending on how you install Windows 10 Team 2020 Update (aka Windows 10 20H2 Team edition). If you re-image a Surface Hub to Windows 10 20H2, Microsoft Teams will be set as the default, with Skype for Business not available (Mode 1). If you upgrade your Hub from an earlier OS version, Skype for Business will remain as the default, with Teams functionality available (Mode 0) unless you had already configured Teams as your default.
To change the default installation, use a custom profile to set the Teams Meeting Mode as follows:
Mode 0 — Skype for Business with Microsoft Teams functionality for scheduled meetings.
Quality of Service (QoS) is a combination of network technologies that allows the administrators to optimize the experience of real time audio/video and application sharing communications.
In Custom OMA-URI Settings, select Add. For each setting that you add, you will enter a name, description (optional), data type, OMA-URI, and value.
Add the following custom OMA-URI settings:
Name
Data type
OMA-URI ./Device/Vendor/MSFT/NetworkQoSPolicy
Value
Audio Source Port
String
/HubAudio/SourcePortMatchCondition
Get the values from your Skype administrator
Audio DSCP
Integer
/HubAudio/DSCPAction
46
Video Source Port
String
/HubVideo/SourcePortMatchCondition
Get the values from your Skype administrator
Video DSCP
Integer
/HubVideo/DSCPAction
34
Audio Process Name
String
/HubAudio/AppPathNameMatchCondition
Microsoft.PPISkype.Windows.exe
Video Process Name
String
/HubVideo/AppPathNameMatchCondition
Microsoft.PPISkype.Windows.exe
Important
Each OMA-URI path begins with ./Device/Vendor/MSFT/NetworkQoSPolicy. The full path for the audio source port setting, for example, will be ./Device/Vendor/MSFT/NetworkQoSPolicy/HubAudio/SourcePortMatchCondition.
When the policy has been created, deploy it to Surface Hub.
Warning
Currently, you cannot configure the setting IPProtocolMatchCondition in the NetworkQoSPolicy CSP. If this setting is configured, the policy will fail to apply.
This module teaches education partners how to set up and configure Intune for Education and manage updates with Windows Update for Business. Part of the Partner Success Series.
Plan and execute an endpoint deployment strategy, using essential elements of modern management, co-management approaches, and Microsoft Intune integration.
