Alexander Benoit.

Transcription

1

2 Alexander Benoit

3 Enterprise Mobility? Microsoft s vision Access everything from anywhere Users Data Manage and secure productivity Employees Business partners Customers Apps Integrate with what you have Devices

4

5 Enroll Provide a self-service Company Portal for users to enroll devices Deliver custom terms and conditions at enrollment Bulk enroll devices using Apple Configurator or service account Restrict access to Exchange if a device is not enrolled Provision Deploy certificates, , VPN, and WiFi profiles Deploy device security policy settings Install mandatory apps Deploy app restriction policies Deploy data protection policies User IT Retire Revoke access to corporate resources Perform selective wipe Audit lost and stolen devices Manage and Protect Restrict access to corporate resources if policies are violated (e.g., jailbroken device) Protect corporate data by restricting actions such as copy, cut, paste, and save as between Intune-managed apps and personal apps Report on device and app compliance

6 Intune web console (cloud only) Configuration Manager console (hybrid)

7 Intune standalone (cloud only) Configuration Manager integrated with Intune (hybrid) IT IT Intune web console Configuration Manager console System Center Configuration Manager Mobile devices and PCs Domain joined PCs Mobile devices

8 IT Intune standalone (cloud only) Intune web console Manage and Protect No existing infrastructure necessary No existing Configuration Manager deployment required Simplified policy control Simple web-based administration console Faster cadence of updates Always up-to-date Mobile devices and PCs Devices Supported Windows PCs (x86/64, Intel SoC) Windows RT Windows Phone 8.x ios Android OS X

9 System Center 2012 R2 Configuration Manager with Microsoft Intune Build on existing Configuration Manager deployment Full PC management (OS deployment, endpoint protection, application delivery control, custom reporting) Deep policy control requirements Greater scalability Extensible administration tools (RBA, PowerShell, SQL reporting services) Devices Supported Windows PCs (x86/64, Intel SoC) Windows to Go Windows Server Linux OS X Windows RT Windows Phone 8.x ios Android IT Configuration Manager integrated with Intune (hybrid) Configuration Manager console System Center Configuration Manager Domain joined PCs Mobile devices

10 Mobile device management Mobile application management PC management User IT Microsoft Intune

11 User Microsoft Intune IT Devices enrolled Actions upon device enrollment Deploy , VPN, and WiFi profiles Deploy certificates Deploy and install apps Deploy managed app configuration policies Apply and enforce device configuration settings Collect hardware and software inventory data

12

13

14 Managed apps IT IT Perform selective wipe via self-service company portal or admin console Personal apps Remove managed apps and data Keep personal apps and data intact

15

16 Conditional access policies Corporate apps IP Range User Device State Advanced Windows 10 options Cloud User Group On-premises

17

18 Corporate server Any service supported by Exchange ActiveSync User IT Microsoft Intune Deploy profile upon enrollment Configure account settings and security restrictions Enable certificate authentication Synchronize , task, contacts, and calendar Support for ios, Samsung KNOX, and Windows Phone

19 Managed apps Multi-identity policy Corporate data User Personal data IT Maximize mobile productivity and protect corporate resources with Office mobile apps including multi-identity support Personal apps Extend these capabilities to your existing line-of-business apps using the Intune App Wrapping Tool Enable secure viewing of content using the Managed Browser, PDF Viewer, AV Player, and Image Viewer apps

20 Managed apps User Personal apps Maximize productivity while preventing leakage of company data by restricting actions such as copy, cut, paste, and save as between Intune-managed apps and unmanaged apps

21

22 Azure Rights Management File policies MAM policies Corporate apps Familiar Office experience Seamless enrollment into app management Use for personal and corporate accounts Comprehensive protection App encryption at rest App access control PIN or credentials Save as/copy/paste restrictions App-level selective wipe MDM mgmt. by Intune or third-party is optional Extend protection to a file level with Azure RMS Might be a good solution for these scenarios: BYOD when MDM is not required MDM optional (Intune or 3 rd -party) MDM policies Personal apps Extending app access to vendors and partners Already have an existing MDM solution

23

24 Who does what? Intune: Evaluate policy compliance for device Azure AD: Authenticate user and provide device compliance status Exchange Online: Enforces access to based on device state Attempt connection 1 Office If compliant, access is granted 4 If not compliant, push device into quarantine Quarantine 3 2 Quarantine with remediation steps Azure Active Directory 5 Microsoft Intune 6 Set device management/ compliance status Link to enroll device and compliance remediation steps Enrollment / compliance remediation Mobile device

25

26

27

28