Microsoft Ignite 2015 4/25/2017 9:57 AM © 2015 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Microsoft Ignite 2015 4/25/2017 9:57 AM Windows 10 + Azure AD + Intune = desktop management and provisioning in the Cloud Daniel Bowbyes & Malcolm Jeffrey M368 © 2015 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

CloudConsult Practice Lead Microsoft Ignite 2015 4/25/2017 9:57 AM Malcolm Jeffrey Technical Trainer Auldhouse Daniel Bowbyes CloudConsult Practice Lead Datacom © 2015 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Dave OneDrive Office 365 Azure Dynamics Microsoft Ignite 2015 © 2015 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Microsoft Ignite 2015 4/25/2017 9:57 AM © 2015 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Microsoft Ignite 2015 4/25/2017 9:57 AM © 2015 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

10 Microsoft Ignite 2015 4/25/2017 9:57 AM © 2015 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Azure AD Join All staff in Dave's Azure AD can log in to the device Microsoft Ignite 2015 4/25/2017 9:57 AM Azure AD Join MDM All staff in Dave's Azure AD can log in to the device Set local administrators 10 Staff can be blocked from logging on to the device MDM enrolment of device can be enforced © 2015 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Intune Enrolment Apply Policy Settings to the device Microsoft Ignite 2015 4/25/2017 9:57 AM Intune Enrolment Intune Apply Policy Settings to the device Push software down to the device 10 Report on the Health of the device against compliance Policies If needed wipe the device © 2015 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

OneDrive Office 365 Azure Intune Dynamics Microsoft Ignite 2015 © 2015 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Azure AD Join OOBE Microsoft Ignite 2015 4/25/2017 9:57 AM © 2015 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Azure AD Join under the hood Microsoft Ignite 2015 4/25/2017 9:57 AM Azure AD Join under the hood © 2015 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

10 Azure Device Registration Service Microsoft Azure Active Directory Microsoft Ignite 2015 4/25/2017 9:57 AM Azure Device Registration Service Microsoft Azure Active Directory Intune 10 © 2015 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Azure AD username and Password (+ MFA if enabled) Microsoft Ignite 2015 4/25/2017 9:57 AM Azure Device Registration Service Microsoft Azure Active Directory Azure AD username and Password (+ MFA if enabled) Intune 10 © 2015 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Azure AD returns ADRS SSO Token, Local admin accounts and MDM URL’s Microsoft Ignite 2015 4/25/2017 9:57 AM Azure Device Registration Service Microsoft Azure Active Directory Azure AD returns ADRS SSO Token, Local admin accounts and MDM URL’s Intune 10 © 2015 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Microsoft Ignite 2015 4/25/2017 9:57 AM Azure Device Registration Service Microsoft Azure Active Directory Win 10 then performs a device registration against ADRS using token provided by Azure AD Intune 10 © 2015 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

ADRS writes a device object to Azure AD Microsoft Ignite 2015 4/25/2017 9:57 AM ADRS writes a device object to Azure AD Azure Device Registration Service Microsoft Azure Active Directory Intune 10 © 2015 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

ADRS issues a device registration certificate to the client Microsoft Ignite 2015 4/25/2017 9:57 AM Azure Device Registration Service Microsoft Azure Active Directory ADRS issues a device registration certificate to the client Intune 10 © 2015 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

MDM URL’s passed to MDM Enrolment Agent Microsoft Ignite 2015 4/25/2017 9:57 AM Azure Device Registration Service Microsoft Azure Active Directory MDM URL’s passed to MDM Enrolment Agent Intune 10 © 2015 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

MDM Agent connects to Azure AD for SSO token to access MDM application Microsoft Ignite 2015 4/25/2017 9:57 AM Azure Device Registration Service Microsoft Azure Active Directory MDM Agent connects to Azure AD for SSO token to access MDM application Intune 10 © 2015 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Azure AD returns MDM SSO Token Microsoft Ignite 2015 4/25/2017 9:57 AM Azure Device Registration Service Microsoft Azure Active Directory Azure AD returns MDM SSO Token Intune 10 © 2015 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

MDM Agent uses SSO Token to start MDM enrolment Microsoft Ignite 2015 4/25/2017 9:57 AM Azure Device Registration Service Microsoft Azure Active Directory Intune 10 MDM Agent uses SSO Token to start MDM enrolment © 2015 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

MDM enrols device and pushes down policy to Windows 10 Microsoft Ignite 2015 4/25/2017 9:57 AM Azure Device Registration Service Microsoft Azure Active Directory Intune 10 MDM enrols device and pushes down policy to Windows 10 © 2015 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Under the Hood – Azure AD Join Microsoft Ignite 2015 4/25/2017 9:57 AM Under the Hood – Azure AD Join © 2015 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Single Sign On to Azure AD Federated Applications Microsoft Ignite 2015 4/25/2017 9:57 AM Azure AD Join & Single Sign On to Azure AD Federated Applications © 2015 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Primary Refresh Tokens Microsoft Ignite 2015 4/25/2017 9:57 AM Primary Refresh Tokens © 2015 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Dave authenticates to Azure AD as part of logon process Microsoft Ignite 2015 4/25/2017 9:57 AM Microsoft Azure Active Directory Dave authenticates to Azure AD as part of logon process 10 © 2015 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Primary Refresh Token (PRT) Microsoft Ignite 2015 4/25/2017 9:57 AM Microsoft Azure Active Directory Primary Refresh Token (PRT) Returned by Azure AD and cached by Windows 10 10 © 2015 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

10 Microsoft Azure Active Directory Office 365 Microsoft Ignite 2015 4/25/2017 9:57 AM Office 365 Microsoft Azure Active Directory 10 © 2015 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Here is my PRT can I please have an SSO token for Office 365 Microsoft Ignite 2015 4/25/2017 9:57 AM Office 365 Microsoft Azure Active Directory Here is my PRT can I please have an SSO token for Office 365 10 © 2015 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Your PRT checks out so here is the SSO token you have asked for Microsoft Ignite 2015 4/25/2017 9:57 AM Office 365 Microsoft Azure Active Directory Your PRT checks out so here is the SSO token you have asked for 10 © 2015 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Here is my Office 365 SSO token give me access please Microsoft Ignite 2015 4/25/2017 9:57 AM Office 365 Microsoft Azure Active Directory Here is my Office 365 SSO token give me access please 10 © 2015 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Under the Hood – Intune Microsoft Ignite 2015 4/25/2017 9:57 AM © 2015 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Microsoft Ignite 2015 4/25/2017 9:57 AM © 2015 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

I’M A DC I’M Azure AD Microsoft Ignite 2015 4/25/2017 9:57 AM © 2015 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Susan Microsoft Ignite 2015 4/25/2017 9:57 AM © 2015 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Microsoft Ignite 2015 4/25/2017 9:57 AM © 2015 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Microsoft Ignite 2015 4/25/2017 9:57 AM © 2015 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Azure AD Connect SCCM Intune Hybrid Connection Microsoft Azure Microsoft Ignite 2015 4/25/2017 9:57 AM Microsoft Azure Active Directory Intune Office 365 OneDrive Dynamics Azure AD Connect SCCM Intune Hybrid Connection Windows Server Active Directory System Centre Configuration Manager © 2015 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Username Primary Password Refresh Token PRT Username TGT Microsoft Ignite 2015 4/25/2017 9:57 AM Microsoft Azure Active Directory Intune Office 365 OneDrive Dynamics Username Password Primary Refresh Token PRT Windows Server Active Directory TGT Username Password Kerberos Ticket System Centre Configuration Manager © 2015 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

SSO Token Kerberos Ticket PRT TGT Microsoft Azure Active Directory Microsoft Ignite 2015 4/25/2017 9:57 AM Microsoft Azure Active Directory Intune Office 365 OneDrive Dynamics SSO Token Kerberos Ticket PRT Windows Server Active Directory TGT System Centre Configuration Manager © 2015 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Windows 10 with Policies Deployed Microsoft Ignite 2015 4/25/2017 9:57 AM Windows 10 with Policies Deployed © 2015 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Windows 10 + Azure AD + Intune Desktop Management in the Cloud Microsoft Ignite 2015 4/25/2017 9:57 AM Intune Windows 10 + Azure AD + Intune Equals Desktop Management in the Cloud © 2015 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Related Ignite NZ Sessions 1 5 Managing Windows 10 with Group Policy and Intune [M393] Fri 10:40am – NZ1 Devices Devices Devices! [M120] Fri 1:55pm – SkyCity Theatre 2 In-place Upgrade to Windows 10 Using New SCCM Tech Preview [M394] Fri 11:55am – NZ1 Find us later at… Malcyj-mct.blogspot.co.nz | @Malcy_J Blog.Bowbyes.co.nz | @DBowbyes Closing drinks Fri 3:00-4:30pm 3 Windows 10 Ask Me Anything [M265] Fri 1:55pm - Marlborough

Resources Microsoft Virtual Academy TechNet & MSDN Flash 4/25/2017 Microsoft Virtual Academy Resources TechNet & MSDN Flash Free Online Learning http://aka.ms/mva Subscribe to our fortnightly newsletter http://aka.ms/technetnz http://aka.ms/msdnnz Sessions on Demand http://aka.ms/ch9nz © 2014 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Complete your session evaluation now and win! 4/25/2017 9:57 AM © 2013 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

4/25/2017 9:57 AM © 2014 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.