Microsoft Enterprise Client Management Report. Windows Intune* and System Center Configuration Manager*

Transcription

1 Executive Summary The bring your own device (BOD) workplace presents a number of challenges to IT management. Mobile devices come in a wider variety of devices and operating systems in the mobile realm than with productivity workstations and laptops. Policies that address the endless combinations of devices, operating systems, and capabilities can be hard to define and enforce. Moreover, the management framework for user-procured mobile devices is completely different from that for corporate-issued Windows* PCs. Microsoft Exchange ActiveSync* (EAS) has largely been the industry-default tool for managing mobile devices. And while many companies still rely on EAS for mobile device management (MDM), the release of Windows Intune* offers companies a Microsoft alternative that can help bridge the divide between PC management and MDM. Windows Intune is a web-based management console for both mobile devices and desktop computers. Microsoft touts the combination of Windows Intune coupled with the Microsoft System Center Configuration Manager* (SCCM) platform as a single-pane-ofglass solution for managing devices across the enterprise. Though these tools together largely succeed at merging MDM with wider device management, the fact remains that Microsoft is tackling a device landscape whose complexity resists radical simplification. For example, Microsoft s vision of a simple, universal MDM solution is currently left unrealized by the fact that any Microsoft solution must still rely upon EAS to manage Google Android* devices. Moreover, Microsoft might need to wait for the broader market itself to mature: particularly for smaller companies, the ability to remotely wipe data from a mobile device using EAS is the extent of their current mobile management planning. Windows Intune* and System Center Configuration Manager* Like Microsoft Office 365*, Microsoft s cloud-based, softwareas-a-service Office offering, Windows Intune is a web-based subscription service for managing computers and mobile devices. Rather than buy licenses on a per-device basis, companies pay based on the number of users to be managed, with whom multiple devices can then be associated. Microsoft positions it as a relatively simple way to manage many types of devices, but it cannot manage servers or computers based on Apple OS X*.

2 Windows Intune supports user self-service. Users can enroll their own devices to be managed without direct intervention from IT. Beyond managing mobile devices, Windows Intune also provides a web-based portal in which companies can host apps for user download (for example, custom corporate apps or links to apps in the Apple App Store* or on Google Play*). other devices.) This has two consequences. First, a company must configure EAS in addition to Windows Intune. Second, devices managed by EAS are inherently less secure than directly managed ones: EAS depends on the application on the managed device not to be compromised because EAS cannot directly communicate with the device s operating system. Coupling Windows Intune with SCCM fills some of the functionality gaps in Windows Intune. Windows Intune in turn serves as a connector to enable SCCM to manage mobile devices in addition to its usual fare of PCs, Apple Mac devices, and servers. SCCM also affords scalability missing with Windows Intune: managing more than 4,000 users or 7,000 devices grows prohibitively complex with Windows Intune alone, but SCCM can scale to 100,000 managed devices. Remote PCs and Office 365*: Both another Pane in the Glass Both Windows Intune and SCCM have some curious blind spots. For example, counter intuitively for also being a Microsoft cloud-based service, Windows Intune cannot manage Office 365 accounts, whereas SCCM can. On the other hand, SCCM cannot manage computers not joined to the network domain, and Windows Intune is the only option for managing nondomain-joined PCs. This, however, has to be done via the Windows Intune web console, even if other devices managed by Windows Intune are managed through the SCCM console. Common MDM use cases can grow unexpectedly complex with Windows Intune as well. For example, Windows Intune cannot directly manage Android devices, whether using Windows Intune alone or in conjunction with SCCM instead Windows Intune must rely upon EAS to manage Android devices. Agents to directly manage Windows* tablets, PCs, and Windows Phones either come built-in or can be installed. This is not an option on Android devices and is limitation of the Android operating system itself. (ios* devices can download configuration profiles created in Windows Intune to accomplish many of the same management tasks enabled by agents on Synchronizing a company s on-premises management with Windows Intune can also be complex. Companies must use the Active Directory* synchronization tool to propagate changes in the on-premises Active Directory (such as new employees or terminations) with the Windows Intune accounts. Moreover, if IT administrators do not want to manage two sets of employee passwords (network credentials and Windows Intune credentials, such as for user self-service), they must also configure and use Active Directory Federation Services (AD FS). Conclusion Despite the complexities that might arise for organizations coordinating Windows Intune with existing, on-premises systems management, Windows Intune supplies functionality for managing mobile devices and remote PCs that was previously missing from SCCM. Its simple web interface and subscription model can also increase its appeal to smaller companies that might have previously taken an unsystematic approach to device management (if any at all). Such companies might also avoid many of the device-management complexities inherited by larger organizations, particularly if they have no pre-existing infrastructure or are purely cloud based SCCM is a notoriously complex management application that grew to be the industry standard largely by Microsoft s inclusion of it in enterprise agreements for no extra cost. et despite holding some of the greatest promise for small and mid-sized companies, Microsoft might have to wait for the needs of such companies to catch up with the capabilities of Windows Intune (let alone SCCM). For many companies of this size, the relatively rudimentary management capabilities provided by EAS are as far as their mobile management planning extends.

3 Windows Intune Microsoft makes three principal claims about Windows Intune. It positions Windows Intune as a management tool that simplifies mobile device management and improve[s] remote PC management ; that enables IT departments to manage computer and mobile device security in a flexible manner; and that equips IT managers to let their end users work on virtually any device. As with the marketing claims made by any company, these statements are broadly true with a number of important caveats. Claim: Windows Intune simplifies mobile device management and improve[s] remote PC management 2 Windows Intune simplifies and improves mobile device and non-domain-joined PC management to the extent that, from the standpoint of management solutions centered on Microsoft technology, it enables these tasks for the first time. SCCM, the traditional Microsoft workhorse of PC management, was traditionally limited to computers joined to an organization s Active Directory Domain Services (AD DS) domain. While this has changed somewhat with the release of SCCM 2012 SP1, SCCM can nevertheless not manage mobile devices or nondomain-joined Windows client computers (see System Center Configuration Manager 2012 SP1 and Windows Intune below for details). Windows Intune is thus the only Microsoft management tool to tackle mobile devices and remote PCs (and it is beyond the scope of this report to evaluate whether or not Windows Intune manages these more simply or better than third-party solutions). As with other cloud-based Microsoft services (such as Office 365), the current version number of Windows Intune is not as explicit as with Microsoft stand-alone products and solution suites. When first released in 2010, the capabilities of Windows Intune were largely limited to patching managed computers (which led less charitable industry observers to liken it to paying to use Windows Update). The current version of Windows Intune released in 2013 Wave D or version 4.0 has matured significantly since then. It represents a management solution aimed squarely at IT generalists in the small and medium-business (SMB) segment. But while it is relatively straight forward for IT shops to take advantage of the Windows Intune features (getting Windows Intune to synchronize with an AD DS domain in the enterprise takes more work), Windows Intune is still far from being a mature MDM solution (it did not make the May 2013 Gartner Magic Quadrant* for MDM software, for example). Claim: Windows Intune lets you manage PC and mobile device security updates your way 2 This Microsoft claim for Windows Intune focuses largely on extending policy management and endpoint security management to computers that had previously defied such management (remote PCs) and extending compliance monitoring beyond EAS (for mobile devices). As with the previous claim, IT organizations can fairly easily take advantage of the Windows Intune capabilities if it is an organization s only management tool. However, integrating it with AD DS or SCCM in an enterprise environment takes more effort. Moreover, IT organizations need to realize that corporate assets that might be stored in the cloud (such as LOB apps provisioned through the Windows Intune company portal) are hosted by Microsoft in a multi-tenant environment and take precautions accordingly. Claim: Windows Intune empower[s] people to work on virtually any device 3 Windows Intune makes some important contributions to enabling IT management in a bring-your-own-device (BOD) IT environment. It enables direct management of devices running Windows 8.1, Windows RT, Windows Phone 8, and ios operating systems. However, Windows Intune does not support the same level of management for all types of devices. For example, Windows Intune cannot directly manage Android devices: it relies on the Windows Intune Exchange Connector in order to use EAS for managing Android devices. (For details about the differences in Windows Intune management by platform, see the Windows Intune Features and Appendices A and B.)

4 Windows Intune Features Table 1 provides a high-level overview of the availability of various capabilities of Windows Intune for specific platforms to be managed. Detailed discussion of the capabilities follows the table. Table 1. High-level overview of Windows Intune* capabilities Capability Windows 8* Windows 7, Windows RT Windows Phone 8 Apple ios* Google Android* Windows Vista*, Windows XP Application Management es es es es es es Endpoint Protection es es No No No No Hardware Inventory es es es es es es 1 Software Inventory es es es 2 es 2 es 2 es 2 Remote Assistance es es 3 es 3 No No No Reporting es es es es es es Software Updates es es No No No No Compliance Settings es 4 es 4 es 4 es 4 es 4 es 4 1. Basic information only through EAS 3. Through Microsoft Easy Assist* 2. Managed applications only 4. Compliance reporting but no remediation automation Application Management IT managers can deploy the following for Windows, Windows RT, Windows Phone 8, ios, and Android platforms: Managed software packages Links to a web-based applications Applications in the Windows Store For software based on Windows, IT can configure a required installation deployment to be automatically installed on targeted, managed computers without the need for end-user intervention. IT can also make a licensed software application available from the Windows Intune company portal for approved end users to link to, or download, and install on their linked computers or applicable mobile devices. Endpoint Protection Endpoint protection through Windows Intune is only available for computers with Windows that are managed by Windows Intune, but not for mobile devices. The security technology that Windows Intune uses to effect endpoint protection Windows Security Essentials and System Center Endpoint Protection are not available on mobile devices. Hardware Inventory Windows Intune gathers information for inventorying using a software agent based on an implementation of the Open Mobile Alliance Device Management (OMA-DM) protocol to manage computers and devices. This agent comes already built into the Windows 8.1 and Windows RT operating systems but must be installed on computers to be managed that are running Windows 8, Windows 7, Windows Vista*, and Windows XP. Windows Intune also interfaces with the management APIs built into mobile devices based on the following operating systems: Windows Phone 8 ios 5.0 or later Android or later (Note: Windows Intune requires EAS to inventory and manage Android devices.) Software Inventory Windows Intune lists the detected and managed software that is installed on all computers that are managed by Windows Intune. This feature pertains only to computers, not mobile devices.

5 Remote Assistance Remote control actions such as restarting managed computers are only possible through Microsoft Easy Assist with Windows Intune. This feature pertains only to computers running Windows 7 or earlier, not mobile devices (except devices based on Windows RT). Windows 8 has its own built-in remote assistance feature. Reporting Reporting in Windows Intune provides IT managers with information about the software, hardware, and licenses in their organization. These reports can help you confirm current needs and forecast future spending. IT managers can also save and load reports based on reporting criteria, export report data for analysis with other reporting tools, and print reports. Software Updates IT managers can approve and deploy both Microsoft updates and other updates through Windows Intune. To deploy updates other than Microsoft updates, IT creates update software packages and then uploads them to the Windows Intune cloud storage space for deployment to managed computers. This feature pertains only to computers, not mobile devices. Compliance Settings Windows Intune policies provide settings that control software updates, endpoint protection, Windows Firewall settings, and the end-user experience in the Windows Intune Center, which is installed on all computers managed by Windows Intune that run Windows 8, Windows 7, Windows Vista, or Windows XP. Windows Intune also provides settings to control the security of users mobile devices, including Windows RT, Windows Phone 8, and Apple ios devices. (Note: computers running Windows 8.1 can also be managed like mobile devices.) Policy templates include the option to deploy policies with recommended settings to simplify the creation and deployment of policies based on industry best practices. Windows Intune provides compliance reporting but no automatic remediation for non-compliant devices. This can be especially problematic for managed mobile devices, with which a mobile policy might require device encryption in order to connect to a Microsoft Exchange server even if a given mobile device does not support full-device encryption. To help address this, Windows Intune provides detailed information about mobile policy conflicts and recommended actions to take. Like all other MDM solutions on the market, Windows Intune provides a remote device wipe feature. IT managers can issue a remote device wipe command from the Windows Intune administrator console or users can issue their own remote device wipe commands from the Windows Intune company portal user interface. IT can also specify a maximum number of successive unsuccessful password attempts after which the mobile device performs a local device wipe (that is, the mobile device wiping itself without the request being initiated from Windows Intune). The results of a device-wipe depend on the device: those based on ios and Windows Phone 8 reset to factory defaults; only the mailbox managed by EAS is removed on Android devices (and Windows 8.1, Windows 8, and Windows RT managed by EAS). Windows RT devices and computers running Windows 8.1, Windows 8, Windows 7, Windows Vista, and Windows XP and managed by Windows Intune cannot be completely wiped. Windows Intune also permits managed devices to be retired. Retirement removes the record of the device from Windows Intune management. It also impacts application distribution and policies on the retired device. Table 2 details the effects of retirement by platform.

6 Table 2. Effects of retirement by platform Device record removed from Windows Intune* database and console Device record removed from Microsoft Exchange* (no ) Removal of sideloaded keys Already installed applications Installing new applications Policies Windows 8* Windows 8.1, Windows RT Windows Phone 8 Apple ios* Google Android* (EAS managed) es es es es es No No No No es No es es (Application enrollment token is removed) Side-loaded apps will not run Apps cannot be installed Existing Windows Intune policies are removed during uninstall of Windows Intune agent Side-loaded apps will not run Apps cannot be installed Windows Intune policies are retained on the device even after the uninstall of the agent Side-loaded apps are uninstalled Self-service portal is uninstalled (no apps available) Expected behavior is similar to Windows RT N/A Installed apps will still run Apps cannot be installed Expected that policy will be removed N/A Installed apps will still run Apps can be installed Windows Intune policy is removed from Exchange server and the device receives the default Exchange server policy Company Portal The Windows Intune company portal is an end-user focused portal in Windows Intune that provides the end user a means to: Enroll and manage their devices Search for and install licensed software applications Request support from their internal helpdesk The company portal is accessible by all users associated with a Windows Intune subscription and is available from any location with Internet access, including Windows RT and mobile devices. However, end users must use a Microsoft Online Services ID (that is, an ID generated for the end-user by the company account administrator using the Microsoft Online Office Subscription administration website) to connect to the company portal; they cannot connect to the company portal with a Microsoft ID (such as a Microsoft Live ID). The company portal is customized for that platform so that users will only see apps available for their device type. Table 3 lists what actions users can control on their devices by using the company portal. Table 3. Actions users can control on their devices by using the company portal Company portal actions available to users From Windows 8.1* Preview and Windows RT From Windows Phone 8 From Apple ios* From Google Android* Enroll a device es es es No Retire a local device es es No No Wipe a mobile devices es No No No remotely Install line-of-business apps es es es es Install apps from the store to which the device connects (Windows Store, Windows Phone Store, Apple App Store*, or Google Play) es es es es

7 App Delivery with Windows Intune Similar to traditional PC-management solutions, Windows Intune can push software to computers that it manages (required installations). However, this is not an option with mobile devices: IT managers can only post the software to the company portal as an available installation for mobile users. The user-initiated process of installing these software packages on devices without the packages being submitted to the Windows Store, Windows Phone Store, Apple App Store, or Google Play is called side-loading. Table 4 lists the types of applications that can be installed on different platforms. IT managers might also want to make software from the Windows Store, Windows Phone Store, Apple App Store, or Google Play readily available to users. One way of doing this is by creating an app in the company portal that is really just a link to the real app on the appropriate public store. Such wrapper apps on the company portal are called deep links. Table 4. Application types by platform Platform Desktop Modern App Types Applications Side-Loading Deep (.msi,.exe).appx.xap.ipa.apk Links Windows 7* Windows 8 Windows RT ** Windows Phone 8 Apple ios* Google Android* ** Windows 8 Self-Service Portal on Windows RT will show MSI/EXE applications that can remotely install to other computers linked to the user but are not installable on the local Window RT device Windows Intune Mobile Device Security Management Security management for mobile devices is fundamentally different than that for PCs. Whereas security for computers revolves largely around policy enforcement/remediation and endpoint security provided by the management solution, mobile device security management focuses more on integrating with the security infrastructure already put in place by mobile device OEMs. Certificate management is a perennial concern with managing mobile devices. Because mobile devices generally run in a far more locked-down paradigm than PCs, valid certificates can be fundamental to mobile devices being able to run apps. Security paradigms are highly heterogeneous, however: Android devices accept self-signed certificates (indeed, Google views this as a feature of its open architecture as opposed to a security vulnerability) while mobile devices based on Windows RT, Windows Phone, and ios operating systems will not run without a trusted certificate (one issued by a trusted certificate authority in the case of Windows and one issued by Apple in the case of ios). For Microsoft and Apple devices, apps stop running when the code-signing certificates in apps expire. Table 5 details the steps IT must take to resolve this for ios, Windows Phone 8, and Windows RT devices.

8 Table 5. Resolutions for expired certificates Platform Apple ios* Windows Phone 8* Windows RT Resolution for Expired Certificates Renew the Apple Push Notification (APN) certificate and locate the Windows Intune* subscription ios page to upload the new certificate. The new certificate must be created by using the same ID as the original certificate or devices have to be enrolled again. Renew the code-signing certificate and go to the Windows Intune subscription page to upload the certificate. All apps signed with the previous certificate and the new certificate will run. Renew the code-signing certificate and open the Windows Intune subscription wizard Windows RT page to upload the new certificate. Device encryption is another key component of mobile device security management. For a detailed listing of encryption setting by device, see Appendix A. System Center Configuration Manager 2012 SP1 and Windows Intune Microsoft positions SCCM 2012 SP1 coupled with Windows Intune as Unified Device Management, an enterprise management scenario extending from servers to mobile devices. Coupling Windows Intune with SCCM certainly provides greater management capabilities for computers than Windows Intune alone. SCCM also scales more readily than Windows Intune: managing more than 4,000 users or 7,000 devices grows prohibitively complex with Windows Intune alone, whereas SCCM can scale to manage 100,000 devices. For its part, Windows Intune provides a connector by which SCCM can manage devices based on the Windows RT, Windows Phone 8, or ios operating systems. (Both Windows Intune and SCCM rely on EAS to manage devices based on Android.) Claim: Using Windows Intune together with SCCM enables you to identify and manage all endpoint devices...through a single interface 4 This claim that SCCM and Windows Intune work together for a single-pane-of-glass management solution is currently somewhat exaggerated. SCCM cannot manage computers not joined to the network domain, and Windows Intune is the only option for managing non-domain-joined PCs. Management of such computers can only be done via the Windows Intune web console, even if other devices managed by Windows Intune are managed through the SCCM console. Feature Differences Table 6 illustrates the broader capabilities the combination of SCCM 2012 SP1 and Windows Intune has over just Windows Intune alone. The largest differences are the additional desktop and laptop computer platforms that SCCM enables for management. However, SCCM coupled with Windows Intune also introduces some new management functionality beyond that enabled by just Windows Intune, even for platforms that can be managed by Windows Intune alone, such as automated remediation of non-compliant Windows 8, Windows 7, Windows Vista, and Windows XP devices. The combination of Windows Intune with SCCM for managing mobile devices also enables IT managers to update software on Windows RT, Windows Phone 8, and ios devices (although ios users must accept the update).

9 Table 6. Capabilities of Windows Intune* and Microsoft System Center Configuration Manager 2012 SP1* (Emphases in table cells indicate functionality differences of Windows Intune and SCCM 2012 SP1 over Windows Intune by itself) Capability/ Platform Windows 8* Windows 7, Windows Vista*, Windows XP Windows Embedded Windows To Go Apple Mac* Windows RT Windows Phone 8 Apple ios* Application Management Endpoint N N N N Protection Hardware 1 Inventory Software Inventory Remote N 5 N N N Assistance Reporting Software N 4 Updates Compliance Settings OS N/A N N/A N/A N/A N/A Deployment Out-of-band N/A N/A N N/A N/A N/A N/A Management Power N N N N N Management Software N N N N N Metering 1. Basic information only through EAS 4. Device user has to accept the update 2. Managed applications only 3. Compliance reporting but no remediation automation 5. Through Microsoft Easy Assist Google Android* Application Catalog Users of Windows computers can connect to the System Center Application Catalog, where they can browse for, install, and request software. For users who have mobile devices that are enrolled by Windows Intune and Android devices that are managed by the Exchange Server connector, the company portal servers as the equivalent of the Application Catalog for these devices. Company portals enable device users to access a list of available software and also to perform a number of management tasks on their Windows Phone 8, Windows RT, ios, and Android devices. SCCM 2012 R2 introduces apps in the Apple App store and Google Play store to simplify the enrollment process for ios and Android devices, respectively. Exchange ActiveSync* For better or for worse, EAS is the industry-default tool for managing mobile devices. The broad deployment base of Exchange Server gives EAS near-ubiquity while also providing a ready interface with the most widely used feature of mobile devices in the enterprise: . However, reliance on EAS for MDM has significant drawbacks. Because EAS interfaces with mobile devices through the devices applications rather than directly through devices operating systems, EAS is vulnerable to permitting connection to the Exchange server on the basis of bogus information provided by devices with compromised applications. Moreover, EAS provides few remediation options for non-compliant mobile devices other than denying them connection with the Exchange server.

10 Finally, because EAS policies are only enforceable when a device syncs with the Exchange server, a device in the hands of a thief or a terminated employee might never be wiped if the possessor of the device is technologically savvy enough not to let the device connect to the Exchange server. information sent by the device, such as with ios devices. All users are enabled for EAS by default, though an Exchange Server administrator can globally disable EAS for all users in Exchange System Manager. (Administrators can also enable or disable individual users by using AD DS Users and Computers.) However, using EAS for MDM is not an either/or proposition with Windows Intune (and, by extension, with SCCM). Notably, Windows Intune can only manage Android devices through EAS (by way of the Windows Intune Exchange Connector). Beyond this example, IT organizations can concurrently manage mobile devices directly through Windows Intune and/or through EAS. Used on its own for MDM, EAS provides these capabilities: Deployment of password, encryption, and attachment policies (among others) to user groups Definition of dynamic mobile device access rules by device family and device model to set which mobile devices can access the Exchange server Enrollment, renaming, and un-enrollment of managed devices Retirement of mobile devices with the option to wipe mobile devices, such as for lost or stolen devices Exchange Server uses the Allow/Block/Quarantine (ABQ) list to determine which device families and device models can access the Exchange server. Some devices will send device information directly in the EAS protocol to the server (Windows Phone 7.5 or later, BlackBerry 10.0* or later, Android 4.0 or later), while EAS deduces the device type using other If an organization does manage mobile devices using policy settings from both Windows Intune and EAS, the more secure policy settings are applied to devices. For organizations using SCCM, Windows Intune, and EAS for managing devices such as tablets running Windows 8, the resolution of conflicting policies can be less clear, however. For example, if a Windows 8 tablet does not comply with an EAS policy, its Mail modern app (the part of Windows 8 that can be managed by EAS) will not be allowed to connect to the organization s Exchange server. et if this same device is joined to the organization s AD DS domain and there is no Group Policy Object that mirrors the EAS policy of which the device ran afoul, there is nothing to prevent Microsoft Outlook* (if installed on the tablet) from connecting to the Exchange server. For a complete listing of EAS policy settings and a comparison of how they overlap with Windows Intune policy settings, see Appendix A. Devices running Exchange can be managed by either onpremises Exchange servers or the cloud-based Exchange Online service.

11 Conclusion Windows Intune took a leap forward in relevance in 2013 with its direct interface with SCCM 2012 SP1. The Microsoft management solution-as-a-service went from being a tool only suitable to SMBs with no pre-existing management infrastructure to being a connector by which enterprises could use their existing System Center management infrastructure to manage mobile devices. Further quantum leaps do not appear to be just over the immediate horizon, however: Microsoft is not telegraphing big things ahead for Windows Intune as it was in the second half of Improvements to functionality stemming from the launch of SCCM 2012 R2 appear to be incremental at this point. That is a shame because there are some rough edges yet to be sanded off in the combination of SCCM and Windows Intune, most notably the fact that nondomain-joined PCs can only be managed from the Windows Intune web interface and not from SCCM (as mobile devices are in the unified solution). Microsoft must also walk an interesting tightrope with respect to positioning Windows Intune. While much good can be said of its role in the enterprise as the connector for MDM in SCCM, the simple web interface and subscription model of Windows Intune can also increase its appeal to smaller companies that might have previously taken an unsystematic approach to device management (if any at all). Such companies might also avoid many of the device-management complexities inherited by larger organizations, particularly if they have no pre-existing infrastructure or are purely cloud based SCCM is a notoriously complex management application that grew to be the industry standard largely by Microsoft s inclusion of it in enterprise agreements for no extra cost. et despite holding some of the greatest promise for SMBs, Microsoft might have to wait for the needs of such companies to catch up with the capabilities of Windows Intune (let alone SCCM). For many companies of this size, the relatively rudimentary management capabilities provided by EAS are as far as their mobile management planning extends.

12 Appendix A: Mobile Device Settings Table 7 details mobile device settings that IT managers can set through Windows Intune, either on its own or coupled with SCCM 2012 SP1. The settings are color-grouped by policies dealing with passwords, device restrictions, , and encryption, respectively. Table 7. Mobile device settings Setting name Google Android* Windows 8.1*, Windows RT, Apple ios* Windows Phone 8 Require a password to unlock mobile devices 1 Required password type 1 Minimum password length 1 Allow simple passwords 1 Number of repeated sign-in failures before device is wiped 1 Minutes of inactivity before device screen is locked 1 Password expiration (days) 1 Remember password history 1 Allow convenience logon (Windows RT only) 1 Allow camera 1 Allow web browser 1 Allow backup to Apple icloud* (ios only) 1 Allow document sync to icloud (ios only) 1 Allow photostream sync to icloud (ios only) 1 Maximum size of attachments 2 synchronization (days) 2 Allow mobile devices that do not fully support these settings to synchronize with Microsoft Exchange* 2 Require encryption on mobile device 1,3 Require encryption on storage cards 2 1. Policy setting supported by both EAS and Windows Intune. 4. This setting can only be set to es for Windows Phone Policy setting supported only by EAS. 3. The policy setting only applies to mobile devices. Neither EAS nor Windows Intune can detect if BitLocker Drive Encryption* is implemented on a device that supports it. 5. This setting can be set for ios, although device encryption is only instantiated by setting a password on ios devices.

13 Appendix B: Mobile Device Inventory Properties Table 8 details mobile device inventory properties that IT managers can gather through Windows Intune, either on its own or coupled with SCCM 2012 SP1. (Note that regardless of whether IT uses Windows Intune or SCCM and Windows Intune, inventory properties for devices based on Google Android* can only be gathered through Microsoft Exchange ActiveSync*.) Table 8. Mobile device inventory properties Property Windows 8.1*, Windows RT Windows Phone 8 Apple ios* Google Android* Device name Unique device ID Serial number address OS type OS version OS language Total storage space (GB) Free storage space (GB) System enclosure chassis System enclosure International Mobile Station Equipment Identity (IMEI) Manufacturer Model Phone number (masked except last 4 digits) Subscriber carrier Cellular technology used by the device (none, GSM, CDMA) Wi-Fi* MAC Enrolled date (local time) Last contact (local time) Last Exchange status Last policy update status Access state Access state reason Management state ActiveSync ID

14 1 Microsoft. PC and mobile device management in the cloud. 2 Microsoft. Manage PC and mobile device security updates your way. 3 Microsoft. Empower people on virtually any device. 4 Microsoft. Unify management infrastructure. The analysis in this document was done by Prowess Consulting and commissioned by Intel. Results have been simulated and are provided for informational purposes only. Any difference in system hardware or software design or configuration may affect actual performance. Prowess, the Prowess logo, and SmartDeploy are trademarks of Prowess Consulting, LLC. Intel and the Intel logo are trademarks of Intel Corporation in the U.S. and/or other countries. Copyright 2014 Prowess Consulting, LLC. All rights reserved. *Other names and brands may be claimed as the property of others.