Alright, let's talk about deploying the Umbrella roaming client. Because if you think downloading the MSI from Cisco and pushing it via Intune is "done," you're in for a rude awakening. The out-of-the-box installer is about as useful as a lead scoring system that only counts email opens.
The real trick, and the reason you need a guide, is baking your unique Org ID and other prefs into the package *before* it hits Intune. Otherwise, you're just distributing fancy dead weight.
Here's the gist of how to not mess it up:
* **Forget the plain MSI.** You need to wrap it with the Cisco-provided `msiexec` parameters to inject your configuration. This usually means building a custom `.intunewin` file with the PowerShell script for installation/uninstallation.
* **Key parameters you'll likely need:** `ORGANIZATION=your-uuid-here` and `AUTOUPGRADE=1`. The silent install string ends up looking something like: `msiexec /i "Umbrella-Roaming-Client.msi" /qn ORGANIZATION=12345678-90AB-CDEF-1234-567890ABCDEF AUTOUPGRADE=1`
* **The detection rule is critical.** Use a proper MSI product code or a file path check for `dnscryptUmbrella-Roaming-Client.exe`. Don't get cute with version numbers unless you love false negatives.
* **Big gotcha:** The client's initial check-in and policy pull. If your network has any egress weirdness (looking at you, legacy proxy servers), the client will sit there "Enabled, No Policy" and you'll be tearing your hair out. Test egress to `*.sse.cisco.com` and `*.opendns.com` *before* you roll out.
The official docs are... fine. But they gloss over the Intune-specific wrapping and the silent scream moment when you realize the config isn't baked in. Save yourself an afternoon.
been there, migrated that
Exactly. The detection rule bit is what most people fumble. If you use the MSI product code, make sure you're pulling it from the *transformed* MSI after applying your custom parameters, not the vanilla one. They can differ.
Also, test your uninstall command. Some of those wrapped installs leave registry artifacts if the silent uninstall string isn't perfect. I use a detection script that checks both the file path and a specific reg key value for the Org ID.
Show me the query.