Take the following steps tp prepare the installation files
Download the off-the-shelf installer package and unzip it to a local folder on your PC, e.g. "D:\Software\CLO for Entra ID\Custom Package"
The package contains the following files:
FILE | Description |
|---|---|
| computer-logon-for-entra-id-win64.msi | Agent installer |
config.json | Configuration file |
| domain_policy.json | Domain policy file |
| system_policy.json | System policy file |
| install-clo.bat | Batch commands for custom installation |
| deploy.ps1 | Power Shell commands for Intune deployment |
| remove.ps1 | Power Shell commands for Intune deployment |
| detection_rule.ps1 | Power Shell commands for Intune deployment |
The Deepnet Computer Logon Agent for Entra ID requires a custom configuration file in order to function correctly for the users. You must customise the configuration file with your own data.
Open the config.json in a text editor, such as Notepad
If the application you set up for Computer Logon with MFA supports single tenant
then, replace "YOUR-TENANT-ID" in the configuration file with your Tenant ID in the Entra ID.
However, if the application you set up for Computer Logon with MFA supports multitenant
then, replace "YOUR-TENANT-ID" in the configuration file with the word "common"
Now, replace "YOUR-CLIENT-ID" with the "application (client) ID"
Save the configuration file.
Computer Logon for Entra ID supports many MFA scenarios, including
For each scenario, it provides a separate set of options that allow you to control whether or not MFA is required, and the frequency of MFA requirement etc.
Those options are in the "domain_policy.json" file.
Options for Local Users
| online | offline | |
|---|---|---|
| bootup login | local\offline\MfaPolicy\loginMfa | |
| screen unlock | local\offline\MfaPolicy\unlockMfa | |
| elevated access | local\offline\MfaPolicy\uacMfa |
Options for Domain Users
| online | offline | |
|---|---|---|
| bootup login | azuread\online\MfaPolicy\loginMfa | azuread\offline\MfaPolicy\loginMfa |
| screen unlock | azuread\online\MfaPolicy\unlockMfa | azuread\offline\MfaPolicy\unlockMfa |
| elevated access | azuread\online\MfaPolicy\uacMfa | azuread\offline\MfaPolicy\uacMfa |
If you wish to change some of those options, then you need to edit the "domain_policy.json" file in a text editor, and change the corresponding options.
For instances