Microsoft Enterprise Mobility Suite

Transcription

1 Microsoft Enterprise Mobility Suite Standalone - overview Peter Daalmans peter@daalmans.com IT-Concern John Marcum Enterprise Client Management Architect / johnmarcum@outlook.com BABC

2 John Marcum Enterprise Mobility Microsoft MVP Enterprise Mobility Microsoft MVP 13 years end user device mgmt Sn. Consultant, Author, Blogger I enjoy a cold beer new and then So am I.

3 Agenda Main EMS Components covered Azure AD Premium Microsoft Intune Azure RMS How to get started?

4 Enterprise Mobility Suite

5 What is MS EMS? Enterprise Mobility Suite Azure Active Directory Azure Rights Management Services Azure Remote App Advanced Threat Analytics Intune Identity Manager

6 Identity Azure AD Premium

7 Making hybrid identity simple DirSync Azure AD Sync Azure AD Connect Azure AD Connect Consolidated deployment assistant for your identity bridge components FIM+Azure AD Connector (The difference is the Password) ADFS use cases Tighter AD integration Security Policy Conditional Access Smart Card Authentication

8 Identity: Cloud, Sync or Federated? Cloud identity provides a solution where all identity resides in the cloud Identity sync enables customers to bridge their existing identity into the cloud Federated identity allows customers to retain all authentication on-premises B2B federated identity allows customers to securely share and collaborate with each other

9 Azure Active Directory Premium Active Directory in the cloud Federation and identity provisioning Centrally managed identities Synchronization Single User Identity (SSO) Monitoring and protect access to cloud apps Authentication and Security reports Multi-Factor Authentication (MFA) Empower end Users Self-Service password reset

10 AAD editions comparison 500,000 Object Limit No Object Limit No Object Limit No Object limit for Office 365 user accounts No Limit 10 apps per user Self-Service Password Change for cloud users Yes Yes Yes Yes Premium + Basic Features Identity Synchronization Tool (Windows Server Active Directory integration, Multi Forest) Yes Yes Yes Yes Security Reports 3 Basic Reports 3 Basic Reports Advanced Security Reports 3 Basic Reports Cloud App Discovery* Yes(Basic) Yes(Basic) Yes(Advanced)** Yes(Basic) Group-based access management/provisioning Yes Yes Self-Service Password Reset for cloud users Yes Yes Company Branding (Logon Pages/Access Panel customization) Yes Yes SLA Yes Yes Yes Limited Cloud only features for accessing Office 365

11 Other premium features

12 Self service experience for users Users can edit their profile details to update and add missing information Users can reset their passwords significantly reducing help desk burden and costs. Self-service group management, including dynamic membership calculation in these groups and distribution lists, based on the user s attributes.

13 Monitor and protect access on go-anywhere devices Built-in security features, like you cant be in two places at once. XXXXX Security reporting that tracks inconsistent access patterns, analytics and alerts. XXXXX Ensure secure access by enabling MFA XXXXX

14 Multi-factor authentication Any two or more of the following factors: Something you know: a password or PIN. Something you have: a phone, credit card or hardware token. Something you are: a fingerprint, retinal scan or other biometric. Stronger when using two different channels (out-of-band).

15 Premium Reports Premium reports: Advanced application usage reporting Password reset activity Selfservice activity Identify unexpected logon behavior

16 Premium Reports

17 Integrate on-prem apps with Azure AD End-user portal Access Panel Azure Active Directory Azure AD authentication capabilities: Username and password synced from on-prem AD Federated login to on-prem or other federation servers Multi-factor authentication Customized login screen Authorization based on user or groups SSO to Office365, thousands of SaaS apps and all applications integrated with AAD Authorization Authentication + MFA Reporting & Auditing Application Proxy Security Monitoring Access Panel Portal Reports, auditing and security monitoring based on big data and machine learning. DMZ Connector Connector Resource Resource Resource Corporate Network

18 Demo Azure Active Directory Premium

19 Microsoft Intune MDM, MAM and more

20 Microsoft Intune Mobile Device Management Windows, Windows Phone/Mobile, IOS, Android and Mac OS X Policy and Application Management Compliance reporting Conditional Access to resources Selective Wipe Devices Reset passcode / unlock devices Hybrid / Cloud solution

21 Single management console for IT admins Intune web console (cloud only) Configuration Manager console (hybrid)

22 Comprehensive lifecycle management Enroll Provide a self-service Company Portal for users to enroll devices Deliver custom terms and conditions at enrollment Bulk enroll devices using Apple Configurator or service account Restrict access to Exchange if a device is not enrolled Provision Deploy certificates, , VPN, and WiFi profiles Deploy device security policy settings Install mandatory apps Deploy app restriction policies Deploy data protection policies User IT Retire Revoke access to corporate resources Perform selective wipe Audit lost and stolen devices Manage and Protect Restrict access to corporate resources if policies are violated (e.g., jailbroken device) Protect corporate data by restricting actions such as copy/cut/paste/save outside of managed app ecosystem Report on device and app compliance

23 Microsoft Intune Company Portal(s)

24 Company portal self-service experience Consistent experience across: Windows Windows Phone / Mobile Android ios Discover and install corporate apps Manage devices and data Customizable terms and conditions Ability to contact IT Force the Policy refresh Retire/wipe

25 Microsoft Intune Device Enrolment The new way Conditional access

26 Internal Connector Enrolling Devices Connector Data from Windows Intuneis in sync with Configuration Manager, which provides unified management across both on-premises and in the cloud Dirsync w Pwd Sync Users can enroll devices that configure the device for management with Windows Intune; the user can then use the Company Portal for easy access to corporate applications

27 Conditional access for Office Attempt connection Set device management/ compliance status If not compliant, push device into quarantine Enrollment/compliance remediation

28 Demo Device Enrollment The new way Conditional access

29 Microsoft Intune Application Management

30 Mobile Application Management What can we do? Force compliance before access to the app and data Secure the data within the app Prohibit copy/paste Prohibit screenshots Prohibit save as Force encryption Disable Outlook Sync (MDM-less MAM Only) Secure app by PIN or corporate credentials Secure LOB apps via App Wrapper See for an up to date list of apps:

31 Mobile Application Management Maximize mobile productivity and protect corporate resources with Office mobile apps Extend these capabilities to existing line-of-business apps using the Intune app wrapper Personal apps Enable secure viewing of content using the Managed Browser, PDF Viewer, AV Player, and Image Viewer apps

32 Mobile Application Management Copy Paste Save Paste to personal app Save to personal storage Maximize productivity while preventing leakage of company data by restricting actions such as copy/cut/paste/save in your managed app ecosystem

33 MDM-less MAM Use cases MDM-less MAM: Apps running on devices that are not enrolled in any MDM solution. Apps running on devices that are enrolled in a third party MDM solution

34 Mobile App Config Policy Preconfigure ios Apps with settings App need to support ios App Config Policy See for more info:

35 Enterprise Data Protection What is EDP? Protects data at rest, and wherever it rests or may roam to Seamless integration into the platform, no mode switching and use any app Corporate versus personal data identifiable wherever it rests on the device Prevents unauthorized apps from accessing business data IT has fully control of keys and data and can remote wipe data on demand Common experience across all Windows devices with cross platform support Available as from Windows 10 Redstone

36 Enterprise data protection PROVISIONING: KEYS AND POLICIES User enrolls with enterprise Intune or domain join 1 Intune or SCCM provisions policy and encryption keys User 2 Policies: Enterprise allowed apps Network policies App restriction policy

37 Demo Mobile Application Management

38 Azure Rights Management Protecting the data

39 Azure Rights Management It uses encryption, identity and authorization policies to help secure your files and , and it works across multiple devices.

40 Azure Rights Management Cool Features Protection stays with the file Works both inside and outside the company Easy Audit and monitoring On-prem (RMS Connector) and O365 support

41 Demo Rights Management

42 How to get started? With Microsoft EMS

43 How to get started? Go to ref.ms/ems > Try now Sign up Setup AAD Connect (synchronize accounts) Set MDM authority Configure platforms Enroll! And that is what we are going to do after the break!

44 Share your ideas Share your voice / ideas!

45 Questions

46 And Then

47