Windows 8.1 Devices Deliver. Simplified management through a single pane of glass

Transcription

1 d Windows 8.1 Devices Deliver Simplified management through a single pane of glass

2 Contents Executive Summary... 2 Introduction... 3 Overview... 3 Scenarios... 5 Managing PCs and Mobile Devices... 5 Management from the Cloud... 5 App Development... 6 PC and Mobile Device Management... 7 Key Findings... 7 Managing PCs... 8 Compliance... 8 Software Provisioning Operating System Deployment Asset Tracking Remote Power Management Remote Helpdesk Support Group Policy Control Monitoring Enterprise PCs Managing Mobile Devices Management from the Cloud Managing App Development Key Findings Cross-Platform Apps Creating Secure Apps Application Development and Marketplace Environments Conclusions Confidential Logic20/20, Inc. 2015, all rights r eserved. Page 1

3 Executive Summary This document is intended to explore the difference in the management capabilities between Microsoft Windows 8.1, Apple OS X Yosemite, and Apple ios 8. Given the rise in corporate employees wanting to use their personal devices for work purposes, management tools have become more important than ever. Microsoft understands this and has created a bundle of tightly integrated programs for dealing with device management both on-premises and in the cloud, with the Enterprise Cloud Suite (ECS). The ECS is a robust set of tools that facilitate management of PCs and mobile devices in the enterprise space, offering IT unparalleled granular control over identity, devices, and apps in their managed environment. The ECS unifies many disparate tools that manage different devices and parts of the enterprise and allows for management on a single device, through a single pane of glass. Microsoft has leveraged a 20-year pedigree of building a set of features that enterprise companies rely on to build a set of tools that are tightly integrated to provide the most control over enterprise environments. The ECS consolidates the tools used in traditional desktop management with mobile device management tools to provide administrators control over all of the devices in their organization through a single pane of glass. Mobile device management (MDM) tools are increasingly pervasive in the enterprise marketplace, and businesses are finding that they need to control these devices in their environments just as they would with desktop operating systems. Microsoft uses the same integrated toolset provided for desktop management. Conversely, Apple ios and OS X must leverage third-party tools to achieve a subset of the functionality that the fully-managed Microsoft solution provides. Microsoft offers flexibility in the application development environment offered, with options for traditional C#, HTML5, and so forth. Apple only leverages Objective C and the proprietary Swift language in their development environment. Windows 8.1 helps developers to create applications across all Windows devices in a way that reduces the amount of additional coding necessary. Apple development focuses on making ios apps work across tablet and phone environments, and does not provide much support for making apps work across both OS X and ios. While the Apple stance on app development has evolved to partially address enterprise solutions recently, Microsoft has a long history of developing with the enterprise in mind and include stronger testing capabilities, source, and workflow management tools. Additionally, a fully managed environment including Intune and System Center 2012 Configuration Manager (ConfigMgr) provide a robust management solution and an app store to serve Windows 8.1 devices.these advantages make application development for an enterprise environment more expedient and seamless on Windows 8.1. Confidential Logic20/20, Inc. 2015, all rights r eserved. Page 2

4 Introduction This document is intended to be a feature-level deep dive into comparing the key management features of three competing operating systems: Windows 8.1, ios 8, and OS X Yosemite. The purpose of this comparison is to provide a view of the competitive landscape as it relates to key management features. Each part compares the features of Windows 8.1 devices with similar features in ios and OS X devices. The Apple products have been researched by using publicly available information. Similarly, the Windows 8.1 information also primarily comes from the public domain. The audience for this document is technical and business decision makers, and subject matter experts. Overview Given the growth of smartphone and tablet usage, a trend has appeared in which employees want to use their own mobile devices in the workplace. A vital decision that enterprises must make is how best to manage and deploy devices and platforms. Managing bring your own device scenarios can lead to concern over securing data while still allowing employees to use their devices. A growing market of MDM products have begun appearing that address these concerns. Gartner has projected that 38 percent of companies will stop providing mobile phones and tablets to workers by , making support for BYOD scenarios increasingly important. BYOD strategies are the most radical change to the economics and the culture of client computing in business in decades. The benefits of BYOD include creating new mobile workforce opportunities, increasing employee satisfaction and reducing or avoiding costs. David Willis, Vice President and Analyst at Gartner This document analyzes the field of device management tools and other categories that are relevant to platform and device management in enterprises as they compare between Microsoft and Apple platforms. The following table summarizes the areas that will be examined and how Windows 8.1 compares with the two Apple platforms. 1 Source: Confidential Logic20/20, Inc. 2015, all rights r eserved. Page 3

5 Management Areas Managing mobile devices Managing app development Windows 8.1 vs. ios Windows 8.1 integrates with the ECS, a set of tools that provide robust PC and MDM functionality and management of the entire suite through a single pane of glass. Tools such as Microsoft Azure Active Directory (AD) Premium, Azure Rights Management Services (RMS), Intune, and Office 365 can be used in powerful, secure, and productive enterprise scenarios. Windows 8.1 has brought Microsoft on par with third-party MDM features while offering a more unified and secure device management approach, compared with ios. Windows 8.1 apps are developed with tools that promote adaptive UI designs to make it easier for developers to target both mobile and PC platforms. Developers on the Apple ios platform have to design specifically for ios, then need to do more work to get cross-platform compatibility with OS X. Windows 8.1 also allows for easier sideloading, which provides an advantage over Apple developers who must buy a yearly subscription to distribute in-house apps. Windows 8.1 vs. OS X The ECS integrates with Windows 8.1 to provide MDM functionality that puts it in a strong position against Apple. OS X also offers a mature feature set for MDM, but it relies on third-party vendors for enterprise-level management, which can add additional complexity for administrators for managing devices. Windows 8.1 development tools help developers create apps that require less additional coding to be compatible with Windows mobile devices, in addition to Windows 8.1 PCs. Apple developers have less support in developing cross-platform apps between ios and OS X. Confidential Logic20/20, Inc. 2015, all rights r eserved. Page 4

6 Scenarios The following scenarios demonstrate some of the key features that are compared in this document. The focus will be on IT admins and users. Managing PCs and Mobile Devices IT administrator Shawn is responsible for managing over a hundred devices across his company. His workplace includes not only company computers but also employee mobile devices that must be managed. Thankfully, Shawn is able to accomplish this by using several Microsoft device management solutions together. Shawn uses the Microsoft Deployment Toolkit and Security Compliance Manager together with System Center 2012 ConfigMgr to help automate the compliance management process, so that the devices on the network meet industry and company standards. By using the Microsoft BitLocker Administration and Monitoring tool, he is able to set BitLocker drive encryption on the PCs and BitLocker To Go drive encryption technology for employees portable drives. After getting that work done, Shawn starts to deploy the company s approved software to the computers by using ConfigMgr. While there are many different tools and options available to Shawn for management of devices, the benefit he gets from using the Microsoft solution is that all of these tools are presented through a single pane of glass. While there are third-party solutions for Apple ios that provide a similar level of functionality, OS X is not manageable from an MDM perspective, and the deep integration and single interface that the Microsoft solution provides makes it easier to manage the enterprise. Later that day, Beth, a new hire, has gotten her phone connected to the company system and has just been handed her new computer. When she starts the computer, she must enter the BitLocker password that she was provided to get access to the computer. After she gets access, she is prompted for a Windows Update, which she accepts and waits to download before rebooting. While waiting, she decides to check the company s paycheck app on her phone and finds out that it also requires an update that she is prompted to download. Windows Intune and ConfigMgr provide granular control that allows Shawn to specify exactly what needs to be updated on each device connected to the network, as well as what permissions those devices have. After the updates are complete, her computer and phone are up to date, and she can begin her work. Management from the Cloud Sam is an IT administrator for a company that has offices all over the world with many employees who travel to client sites. By using Intune and ConfigMgr, Sam has set the password functionality on the employee s mobile device and laptop. Several high level employees of the company have access to highly confidential material on their devices, Confidential Logic20/20, Inc. 2015, all rights r eserved. Page 5

7 so Sam decides to assign them to a group that she is able to track separately from the rest of the company for reporting purposes. Rebecca is one of the employees who has a Windows phone containing confidential material. To her horror, she has just realized that she left the device at a restaurant several hours ago. She returns to find the device is gone. She contacts Sam in IT for assistance. When Rebecca calls IT, she mentions that she has lost her phone, which contains confidential material. To prevent anyone from accessing the information and to make the phone useless to the thief, they decide to remotely wipe the phone, rendering it useless. Apple Profile Manager for OS X and ios allows Sam to implement many of these device management features. For example, Profile Manager would allow for a remote wipe in the event of theft, just as with a Windows phone. With the integration of third-party MDM vendors, ios and OS X are able to offer a similar set of features. However, the benefits for using the Microsoft solution are in the granular control that it provides, such as the selective wipe feature. In this case, if Rebecca was to leave the company with her own device, Sam could perform a selective wipe, removing only the company data from the phone. This is not a feature that Apple ios or OS X currently have available. App Development Ryan is a software developer who is interested in developing an app for Windows 8.1 devices, including both Windows 8.1 PCs and Windows 8.1 mobile devices. Wanting the app to work on touch screens, Ryan consults Microsoft Dev Center to learn more about the Windows 8.1 touch language. He also uses several design patterns to help him decide on the layout. All of the basic languages that Ryan knows how to use (C#, Visual Basic, and C++) are also compatible with Windows 8.1. After his app is completed using a universal Windows 8.1 app project, he finds that it was easy to get the code to work on a 4-inch Windows 8.1 phone, an 8-inch Windows 8.1 tablet, and his desktop computer. Because the app that he is developing is a line-of-business app that his IT department has not tested yet, Ryan decides to sideload the app instead of initially publishing it to the Windows Store. As soon as the app is ready for enterprise deployment, Ryan uses System Center 2012 ConfigMgr to manage the deployment. For ios and OS X, Ryan can use only the Apple volume purchase program combined with a third-party MDM solution, which would be a more complicated scenario for him to learn and manage. Confidential Logic20/20, Inc. 2015, all rights r eserved. Page 6

8 PC and Mobile Device Management PC management tools help organizations cut costs involved in PC ownership and management by providing the ability to remotely manage PCs throughout their entire lifecycle. This includes planning, initial deployment, ongoing management, software deployment, disaster recovery, and operating system and hardware migrations. Having the option to select an efficient and cost-effective enterprise management tool is a key consideration for enterprises during the platform selection process. While all MDM services require additional expense, usually in the form of fees per user per month, Apple ios 8 and OS X rely on third-party vendors to provide their management tools. These tools offer a similar set of features to Windows 8.1, but the Microsoft solution is easier to manage by utilizing a single pane of glass through which to control all devices. Key Findings The following section compares Windows 8.1, ios 8, and OS X Yosemite, based on their management capabilities: Compliance, operating system deployment, and application delivery: Microsoft offers free support with its Assessment and Deployment Kit (ADK) and Microsoft Deployment Toolkit (MDT). System Center 2012 ConfigMgr is a separate Microsoft product that provides powerful management functionality that leverages Domain Join and Group Policy control. For OS X and ios, Apple utilizes the NetInstall feature to deploy operating systems and apps to users, and the Profile Manager tool to configure and manage users. This toolset has fewer options for fine-grained control when compared to utilizing the full Microsoft solution including ConfigMgr, which provides the unique selective wipe feature. Third-party tools offer comparable features between OS X and Windows 8.1, but they can add more complexity for IT administrators to implement and manage. Out of the box, Windows 8.1 has a more robust feature set for the enterprise than OS X Yosemite. MDM: Apple ios and OS X offer MDM packages that feature integration with third-party vendors such as AirWatch and MobileIron to provide enterprise device scenarios. Windows 8.1 leverages Intune in the cloud space and System Center ConfigMgr for on-premises scenarios to offer a set of tools that provides the same set of functionality, but with a much more streamlined interface. All devices can be managed through a single pane of glass, making the administration of enterprise scenarios easier on IT workers. Confidential Logic20/20, Inc. 2015, all rights r eserved. Page 7

9 Managing PCs Tools that help enterprises manage PCs help cut the time and costs that are involved with PC ownership and management by offering to manage operating system deployments, software deployments, migrations, and continuing management. A powerful and cost-efficient enterprise management tool is something that all enterprises will have to consider when selecting a platform. This section examines the following PC management features: Compliance (including encryption) Operating system deployment and application delivery Asset tracking Monitoring and support Group Policy control Compliance Microsoft offers free tools with Windows 8.1 called the MDT 2 and Security Compliance Manager (SCM) 3. MDT integrates with SCM to guarantee that the Windows 8.1 deployment is fully secure. Windows 8.1 offers a separate tool known as System Center 2012 ConfigMgr 4, which enhances the compliance features and assists IT with assessing and enforcing compliance measures. This ensures that enterprises reduce their IT risk and that they meet not only industry standards but also their own corporate standards. ConfigMgr automates sections of the compliance management process, which greatly reduces complexity for the client. Administrators can set a baseline of their own choosing or follow industry-standard policy templates that Microsoft provides as part of its IT Governance and Compliance Solution Accelerators 5. These templates can check for operating system version, a required application s installation and configuration settings, and operating system configuration settings. With the baseline in place, ConfigMgr pushes it down to the client agent. The agent regularly confirms the compliance status of the client system against its set baseline. 2 Source: 3 Source: 4 Source: 5 Source: Confidential Logic20/20, Inc. 2015, all rights r eserved. Page 8

10 In addition to all of this, ConfigMgr also has the fully featured ability to report. Administrators can check the compliance of a full environment, which gives them the ability to: Check desktop, laptop, server, and mobile device configurations. Check for unauthorized configurations. Prioritize compliance. Windows 8.1 also features better tools for allowing users to use their own PCs for work. Workplace Join allows users a self-service method of registering their PC or laptop for governance. IT then has fine-grained control over how much access to grant to the registered device and the ability to enforce governance parameters to validate that company policy and security are maintained. If a user wants to deregister their device or leave the company, or if their device is compromised, IT can remove that user s access remotely. Workplace Join allows IT to maintain secure control over corporate assets, without having to obstruct the user s personal assets. OS X comes with the NetInstall and Profile Manager features, which provide basic deployment, configuration, and management of systems; however, it lacks the advanced compliance, reporting, and remediation features of ConfigMgr. Instead of an integrated solution, OS X relies on third-party solutions such as Citrix 6 to meet the features of the more integrated Window 8 solutions. OS X must also rely on third parties for encryption compliance, while Windows 8.1 offers Microsoft BitLocker Administration and Monitoring (MBAM) a strong in-house solution for large-scale management of BitLocker implementations. For Windows 8.1 devices and portable storage devices, this means that BitLocker To Go and BitLocker Driver Encryption protect their data. In 2014, Microsoft launched MBAM 2.5 7, which offers new functionality, such as: The ability to enforce encryption policies on both operating system and fixed data drives. Support for high availability deployments. Support for FIPS-compliant recovery keys on Windows 8.1 devices. Apple has also been working to improve their suite of device management tools to provide a better experience for enterprise ios 8 users. These tools provide control over document downloads from enterprise domains by using the Safari browser and access to documents from icloud Drive. IT administrators are able to manage devices remotely, control user access, verify backups, and authenticate users to enterprise apps with certificate-based single sign-on. 6 Source: 7 Source: Confidential Logic20/20, Inc. 2015, all rights r eserved. Page 9

11 Software Provisioning ConfigMgr is more context-aware than ever in its ability to deliver applications. To choose the best way of delivering an application to a user, it analyzes the network and device capabilities. It can choose a variety of delivery methods, such as: Local installation. Application virtualization streaming. Presentation server. User-centricity is also achievable together with ConfigMgr by using an application model, which lets administrators select specific applications and send them to specific users instead of devices. This means that ConfigMgr is able to grade a user s relationship with their devices and choose the experience that the user should receive. As an example, when a user updates an app on their work laptop, it will use Microsoft Installer; however, if the user accesses it on their unsecured home PC, it might be delivered by using application virtualization to keep data more secure. For organizations using Windows Server 2012 R2, Work Folders offers further convenience for workers on the go. A user can specify folders on their corporate device to sync to their home PC or laptop. Files that are created on their mobile device or home PC will then sync back to the file server in the corporate environment. IT has control over the security of these files by being able to enforce dynamic access control policies, automated rights management, and the ability to require Workplace Join. Another way IT can create a consistent experience for users is Start Screen Control. By using Windows 8.1, IT can control the layout of the Start screen on company-issued devices, so that key apps are easily accessible. The layout can be locked down to prevent users from customizing their Start screens and to create a uniform experience across workgroups or the entire company. These new tools give IT administrators the power and flexibility to control device proliferation across their company a unique and competitive piece of functionality that puts Windows 8.1 and ConfigMgr in a very good position, compared with their competitors. Apple NetInstall allows users to upgrade their computers without the need to disable or attach operating system or third-party software. NetInstall also allows them to manage third-party and Apple installations, name computers, add MDM configurations, and bind to directory services. Apple Profile Manager allows for automatic configuration updates over the air for ios devices. NetInstall offers a set of functions that is less robust than Windows 8.1 and ConfigMgr. For enterprise scenarios, ios and OS X deployments require third-party support to match the control that the Microsoft solution offers. Operating System Deployment Confidential Logic20/20, Inc. 2015, all rights r eserved. Page 10

12 As was previously mentioned in the preceding section on compliance, MDT together with ConfigMgr allows for an automated and extremely customizable solution for configuring and deploying desktops and servers. For the version of Windows that is being used, IT administrators can put together a solution for delivering updates, security fixes, patches, applications, and more in one distribution. IT administrators can also use task sequences to automate the operating system deployment. The Task Sequencer allows IT administrators to group tasks, which makes deployments more efficient and easier. To improve user experience, tighten security, and shrink downtime, there is additional support for a variety of deployment scenarios, including: Computer-to-computer. In-place migrations. Offline or removable media. The strong feature set of the ConfigMgr operating system deployment functionality helps organizations simplify upgrades, reduce the cost of operating system deployments, improve security during deployments, and use native Windows 8.1 toolsets. As a result, IT administrators will find the tool easier to use, and they will not have to spend time learning a third-party solution. Microsoft also offers Windows to Go, a fully manageable instance of the Windows 8.1 OS on a bootable external USB drive. This supports BYOD scenarios by providing users the flexibility of using a fully managed Windows 8.1 desktop to access their corporate environment, without compromising security by incorporating external devices. Apple NetInstall software can create and deploy installation images, and it speeds up the ability for IT to create and distribute equipment. This tool has a similar feature set, when compared with ConfigMgr. ios operating system updates are usually bundled in large patches. In addition to the requirement of updating any third-party MDM solutions, this can result in lack of connectivity and delays in deployment. The complexity of ensuring that the MDM solution and all of the devices that are running the updated operating system are functioning properly can be frustrating to IT administrators. Asset Tracking ConfigMgr uses Windows Management Instrumentation (WMI) data exposed by Windows 8.1 to perform asset tracking, inventory, and device security policy management for on-premises deployments. For BYOD scenarios, Exchange ActiveSync performs configuration of device security policies, and Intune and other MDM services use the same WMI information as ConfigMgr to perform asset tracking and inventory. Confidential Logic20/20, Inc. 2015, all rights r eserved. Page 11

13 Apple ios and OS X use Profile Manager for asset tracking. Remote Desktop 8 is another tool that offers overlapping functionality, such as allowing IT administrators to search, track, and report on a large number of hardware and software attributes across a network. Microsoft and Apple offer solutions which offer comparable features for tracking and reporting devices on a network. However, the full Microsoft solution including ConfigMgr provides a more robust set of features, and includes the ability to manage all devices through a single pane of glass, which makes administration easier for IT. Remote Power Management Microsoft uses ConfigMgr for power management and in Windows 8.1 has included additional report and power management functions, such as: The ability to set policies for individual user groups. The ability to allow users to opt out of power management policies. Reports that show devices that are currently excluded from those policies. Administrators working with OS X can use Apple Energy Saver to remotely perform power management on OS X devices, with features including setting sleep and shutdown times and scheduling system start up. While Energy Saver and ConfigMgr both provide control over power management remotely, the Microsoft solution provides additional granularity in their options. 8 Source: Confidential Logic20/20, Inc. 2015, all rights r eserved. Page 12

14 Remote Helpdesk Support A Windows 8.1 deployment can include helpdesk functionality such as passcode resets and remote device wipes in MDM scenarios, screen sharing on desktop devices, and remote device locking in fully-managed ConfigMgr scenarios. Microsoft also offers an integrated helpdesk support system called System Center Service Manager This change control and helpdesk management product helps enable automation of IT service management, and the reporting features allow for tracking, management, and reporting of information across all aspects of System Center components. OS X Server software helps Apple offer a self-service portal for remote helpdesk support that also offers the basic helpdesk features that Microsoft offers. To match the more powerful, integrated features that Windows 8.1 provides, Apple would have to rely on third-party offerings. Group Policy Control Group Policy control is an area of enterprise security and management in which Windows 8.1 excels. Microsoft has advanced, integrated Group Policy features that allow IT administrators to control a large number of settings for computers in a network s ecosystem, such as: Setting the wallpaper of users. Setting the themes that Windows uses. Setting the default browser. Permitting access to external drives or directories. Permitting the connection of external devices. These Group Policies can be managed through System Center ConfigMgr and Active Directory, which makes it even easier to manage devices that are part of the corporate infrastructure. Enterprise deployments of ios 8 and OS X Yosemite frequently require the inclusion of third-party licensing agreements to offer a comprehensive mobile solution that provides Group Policy integration with enterprise IT infrastructure. While ios 8 includes new tools that provide some of these features, Yosemite does not. In deployments for all three environments, additional tools are required to provide a robust, end-to-end feature set; however, Microsoft has an advantage by offering all of their tools through a single pane of glass that makes administration easier for IT. Confidential Logic20/20, Inc. 2015, all rights r eserved. Page 13

15 Monitoring Enterprise PCs Windows 8.1 has several tools that meet the requirements for monitoring enterprise PCs, such as: Performance Monitor. This visualization tool can be used to analyze system performance by using logs and even real-time data. Event Viewer. This tool can be used to look into error messages. It is able to examine hardware events, system logs, and application logs. System Center Operations Manager. This tool ensures that performance remains predictable and offers infrastructure monitoring. It also provides public and private datacenter and cloud component monitoring. Apple Profile Manager is included with OS X Server and offers a lightweight management system that can be used to monitor OS X devices on an enterprise network. By using the same type of configuration profiles as ios, it will analyze recent activity and keep track of tasks on OS X devices. Apple Remote Desktop also gathers software and hardware information on devices, which assists with the monitoring process. The Microsoft suite of tools used in both local monitoring and network monitoring are tightly integrated with the System Center management environment, which is something that the Apple solution does not match. Managing Mobile Devices As mentioned in the previous sections, PC management tools are used to ease the management of the PC infrastructure for enterprises and assist in cutting costs. For MDM, there have traditionally been separate tools that offer the management of mobile devices. Over the last few years, PC management and MDM products have started merging and offering many of the same features. Currently, the individual versions of the tools offer improved performance in their respective areas. However, the emergence of these bundled tools gives customers more options. Mobile device BYOD is a growing area for corporations. Compared with corporateowned devices, BYOD management solutions provide only enough security to meet enterprise compliance requirements, without causing undue obstruction to activities on the user s mobile device. Employees might want to use their own devices to access sensitive corporate information and do their work, so companies need to come up with strategies for mitigating the risks and providing control over these devices. However, a comparison of the management of mobile devices to the management of PC devices is not in the scope of this paper. Confidential Logic20/20, Inc. 2015, all rights r eserved. Page 14

16 Management from the Cloud The Microsoft modern security and identity solution encompasses a suite of tools that are commonly bundled as the ECS. The ECS includes the Office 365 productivity suite, Windows Software Assurance, and the Enterprise Mobility Suite (EMS). The EMS is another level of bundled software that integrates with Windows 8.1, and it provides hybrid identity management and multi-factor authentication tools that use Azure AD Premium, strong authentication and conditional access with Azure RMS, and robust device security and management with Intune. Azure AD Premium provides tools for managing user identity and access from the cloud, in addition to syncing with existing on-premises deployments. The ability to bridge the gap between cloud and on-premises management offers additional flexibility for IT in enterprise environments. Azure AD Premium also leverages powerful self-service tools to automate tasks such as password reset, group management, and provisioning of software reducing the amount of time that IT must spend on these tasks. Managing identity is one of the most important tasks in today s enterprise world, with the proliferation of BYOD making a rich synchronization of user identities between onpremises and cloud-based devices a critical factor. While the distribution of files and rights outside of a corporate network can be a risk, Azure AD RMS provides comprehensive, policy-based security to protect intellectual property. AD RMS helps to reduce the risk of leaks with a standards-based solution that leverages the extensible Rights Markup Language (XrML) and Attachment Execution Service (AES) 128-bit encryption. Audits of rights-protected information improves compliance, while smooth integration with the rest of the Microsoft stack of products make it easier for users to be productive. Intune 9 is the Microsoft device management solution. It provides reporting, tools, and upgrades for the latest versions of Windows, Windows Phone, in addition to crossplatform support for ios and Android. Intune leverages all of the MDM functionality that the Windows 8.1 OS exposes,, such as wiping devices of data, managing operating system settings, and requiring passwords, as well as more advanced application management capabilities. Through integration with ConfigMgr, IT administrators can manage devices from a single pane of glass 10, which allows for faster and simpler deployments managed through one interface instead of many. Additionally, Intune also includes inventory management, a system overview feature that tracks the status and manages the alerts of devices on the network and allows IT 9 Source: 10 Source: Confidential Logic20/20, Inc. 2015, all rights r eserved. Page 15

17 administrators to group devices according to a variety of characteristics, such as location, department, and function. By setting such groups, administrators can control specific settings and push applications or updates to individual groups that might require them. Apple does not provide a cloud-based, in-house OS X or ios management solution, which is a key Microsoft advantage in the enterprise space. Windows Intune offers tools for managing and distributing apps, securing mobile access and distributing documents, as well as security and management features across devices. For MDM, Apple relies primarily on third-party solutions 11 such as MobileIron and AirWatch. The AirWatch MDM solution is primarily delivered through its cloud service. MobileIron uses its Connected Cloud service for cloud-based requirements, which secures and manages mobile apps, documents, and devices. The Windows ECS provides a platform of multiple technologies that serve as a strong foundation for enterprise environments. All of these technologies can be managed from a single pane of glass and with a robust self-service component, giving IT more time to provide value instead of just handling service calls. Much like Windows 8.1, Apple ios 8 and OS X Yosemite provide MDM functionality out of the box, but require additional tools to leverage these features. While Windows 8.1 offers an end-to-end Microsoft solution that allows IT to administer the entire system through a single pane of glass, ios and OS X instead partner with third-party vendors to support MDM features. While these external solutions provide a similar set of functions when compared with the Microsoft solution, they do not provide the same level of granularity in the management of devices and PCs. Managing App Development Application development environments are constantly improving to meet the evolving requirements of users and developers. Consider the following categories when examining these environments: ARM (Windows 8.1 on Windows phone, Apple Ax ARM for ios on iphone); x86 (Windows 8.1 and OS X) processor compatibility Application security Development environment Quality of the marketplace experience Key Findings Windows 8.1 is designed to work across a variety of devices from x86 desktops and tablets to ARM devices. To facilitate cross-compatibility, Microsoft makes it 11 Source: Confidential Logic20/20, Inc. 2015, all rights r eserved. Page 16

18 easier for the Windows 8.1 apps of developers to work across these various hardware and Windows 8.1 operating system variants. The Apple mobile and desktop platforms vary in both operating system (OS X and ios) and hardware (x86 versus Apple s unique ARM processors). However, development for these platforms is separate, and it is up to developers to design for different screen sizes, processor types, and operating systems. The crosscompatibility of Windows 8.1 is a strong advantage for Microsoft. Cross-Platform Apps The Microsoft goal with Windows 8.1 and Windows RT was to allow developers to easily create cross-architecture applications that they are able to code once and have them work across both x86 and ARM processors even across different screen sizes and hardware types. Developers will still have to design apps with a tablet interface in mind (for example, icons that are large enough to allow for touch) if they want their apps to work well on tablets, and apps that are made exclusively for x86 hardware will not work on ARM processors. However, developers can still take advantage of the ease and potential of cross-platform app development a strong advantage for Microsoft. The ios software development kit cannot be used on OS X. Apps that developers create for iphone are compatible with the ipad, but not vice versa. Because of the proprietary ARM mobile processors (A4, A5, A6, A7, A8) that Apple uses, apps that are developed for ios or OS X are not compatible with each other; OS X is built for Intel hardware. Developers must design with that fact in mind from the beginning or develop several different versions of their application. There are third-party tools that can help bridge the gap between platforms; however, this can come with the additional complexity of using outside tools to convert the software. Creating Secure Apps Windows 8.1 uses App Container to minimize the vulnerability of systems 12. Cookies, cache, and other web-platform data is not shared among an App Container and the remainder of the system. The use of an App Container helps to block read and write access to most system files. The benefit of an App Container is that developers can make apps that interact in a secure manner. The security features for Apple apps include sandboxing and Keychain for its platforms 13. App sandboxing can segment the program from other parts of the system, 12 Source: 13 Source: /Introduction/Introduction.html Confidential Logic20/20, Inc. 2015, all rights r eserved. Page 17

19 in case malicious user data attempts to damage the app. Keychain is encrypted storage for confidential information such as passwords. Microsoft and Apple offer similar security feature sets for app development, but quickly responding to inevitable security issues has been a key focus for Microsoft, one that Apple has yet to match 14. Application Development and Marketplace Environments Across ios, OS X, and Windows 8.1, all three platforms feature development environments that their prospective developers will be comfortable with. Windows 8.1 offers a variety of ways to publish, install, and distribute apps, including: Windows Store: app marketplace for Microsoft. Intune and ConfigMgr: allows creation of a company portal that provides a catalog of enterprise apps. Sideloading: install a Windows Store app without having to publish or download it from the store. Since the introduction of the iphone, Apple has offered the App Store for ios and Mac App Store for OS X, by which users can purchase and download consumer apps from their itunes software. Apple has only recently entered the enterprise app store market, is just beginning to offer apps for commercial use through third-party partnerships. The Apple stance is consumer-first, given the small selection of commercial apps that are available so far in their new enterprise store. Microsoft maintains the advantage in this space, with the clear focus on the enterprise that Intune and ConfigMgr offer. Conclusions As a result of the increased popularity of mobile devices in corporate environments, powerful and secure device management has become more important than ever. Microsoft leverages Windows 8.1 to control of the entire stack of management tools with the ECS and the single pane of glass experience. Conversely, Apple requires integration with third-party vendors. Similarly, Apple has taken an approach to device control that leverages third-party MDM tools, while Microsoft utilizes the same robust set of tools used for desktop management. Windows 8.1 and the ECS are built based on an enterprise-focused foundation, using technologies that are the result of 20 years of product evolution. The Apple solution provides some MDM capabilities but does not have the same focus on enterprise customers compared to Microsoft. Additionally, the tools that are bundled in the ECS provide a level of granularity and security for the enterprise that Apple does not match. 14 Source: Windows 8.1 Competitive Comparison: Security Confidential Logic20/20, Inc. 2015, all rights r eserved. Page 18

20 For managing devices, Windows 8.1 offers a variety of services out of the box, such as MDT, SCM, and MDM all integrated into the ECS. While Apple utilizes in-house solutions such as Profile Manager and NetInstall for basic deployment, configuration, management, and software provisioning, Apple relies on third-party solutions for many advanced features already integrated in Windows 8.1 through the ECS. Apple s MDM vendors do not offer the same level of deep integration and granular control as Windows 8.1. The cloud management field has a variety of vendors that are all attempting to be the go-to solution for enterprises. The Microsoft advantage will always come from the depth of integration that controlling the entire stack of products offers. The single pane of glass approach, where all of the features that are needed to manage the enterprise are concentrated into one powerful tool, provides another key advantage for Windows 8.1 environments. App development environments for Microsoft and Apple both offer comfortable tools for developers to work with. The Microsoft advantage comes in the ability of Windows 8.1 to run apps between different device types, such as Windows 8.1 desktops and Windows phones, while minimizing the additional coding work on the part of the developer. Apple developers must code specifically for different processors and hardware types, and there is limited support for making OS X apps work across ios devices. Both Microsoft and Apple offer strong marketplaces for enterprise applications, but the OS X app store lacks the variety and selection that Microsoft offers, especially when considering the long history of Windows desktop applications. The key differentiator between Apple and Microsoft for management of both onpremises and BYOD devices is that Windows 8.1 was designed with enterprise-level management integrated into its solution, while Apple is only now trying to make up ground and continues to rely heavily on third parties. Confidential Logic20/20, Inc. 2015, all rights r eserved. Page 19

21 Presented By: Logic20/20 Writer: Benjamin Howorth Contributors: Marius Marcu, Anders Westby, Bill Tsang, Michael Niehaus, Martin Booth, Michael Wallent, Justin Bright, Erik Hurley Date: Spring 2015 This paper includes research gathered as of March 13, 2015 regarding Windows 8.1, ios 8, and OS X Logic20/20, Inc. acknowledges the support of Microsoft Corporation, which made possible some of the research presented in this white paper. Publicly available sources were also used as research and are cited in the paper. This white paper is for informational purposes only. The information contained in this document is deemed reliable at the time of writing, but is not guaranteed. Logic20/20, Inc. MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS DOCUMENT. Without limiting any rights under copyright, no part of this document may be reproduced, stored in, or introduced into a retrieval system, or transmitted in any form or by any means (electronic, mechanical, photocopying, recording, or otherwise), or for any purpose, without the express prior written permission of Logic20/20, Inc. Logic20/20 and the Logic20/20 logo are trademark(s) of Logic20/20, Inc. All other trademarks are trademarks of their respective owners Logic20/20, Inc. All rights reserved. Confidential Logic20/20, Inc. 2015, all rights r eserved. Page 20