Deploy Windows 10 Mobile for the mobile workforce

Deploy Windows 10 Mobile for the mobile workforce
TechReady 23 6/19/2018 1:33 AM BRK3192 Part 1 Deploy Windows 10 Mobile for the mobile workforce Alan Meeus Solutions Architect, Microsoft Services © 2016 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Deploy Windows 10 Mobile BRK3192 Part 1 BRK3193 Part 2 DEPLOY RETIRE
Identity & Deployment Configuration Management Apps & Windows Store for Business BRK3193 Part 2 Health attestation & Conditional Access Windows Information Protection Manage Updates Retire Migration from Windows Phone 8.1 OPERATE One consistent set of device management capabilities across mobile, desktop, and IoT CONFIGURE APPS

Solution Framework Envision Plan Build Deploy Stabilize DEPLOY RETIRE
Requirements Plan Functional Specifications Build Infrastructure and Profiles Deploy Pilot Stabilize Full scale roll-out OPERATE One consistent set of device management capabilities across mobile, desktop, and IoT CONFIGURE APPS

Deploy & Configure Identity & Deployment Configuration Management
6/19/2018 Deploy & Configure DEPLOY RETIRE Identity & Deployment Configuration Management Apps & Windows Store for Business OPERATE One consistent set of device management capabilities across mobile, desktop, and IoT CONFIGURE APPS © 2015 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Mobile workforce persona and requirements
Personal devices IT Concerns: Malware, data separation and protection Owned by the employee (BYOD) Personal account controls the device Highly personalized, with apps Used for business, with restrictions Corporate devices IT Concerns: Security, device configuration and compliance, app management Owned by the organization Work account controls the device Personalization can be restricted Business apps and productivity are the main focus Owned by the organization Multiple users may use the device Focus is line-of-business (LOB) Personal use is not allowed Special purpose devices IT Concerns: Device lockdown and reliability, app management

Corporate owned identity models
6/19/2018 Corporate owned identity models + EMS Synchronized identity AAD Connect On-premises identity Azure AD Federated identity Federation AAD Connect On-premises identity Azure AD + EMS Azure AD Zero on-premises servers + EMS Cloud Identity © 2015 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Why Azure AD Join? Reduce on-premises footprint
Only one identity to manage Self-service Simplified management Easy scale out Reduced cost per device and per user

My Azure Infrastructure
TechReady 23 6/19/2018 1:33 AM My Azure Infrastructure Alan Meeus © 2016 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Identity challenges today
6/19/2018 Identity challenges today Organizations want greater control over the way users provide their identity Users do not like complex passwords Multi-factor is complex and expensive © 2015 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Windows Hello Device-based, multi-factor
6/19/2018 Windows Hello Device-based, multi-factor Replace passwords with private key Unlocked solely through a “user gesture” Based on asymmetrical key pair or certificate IT Pro and user familiarity Single “unlock gesture” provides access to multiple credentials (origin isolated) Azure AD identity provider Azure AD validates and proofs user with OTP, or Multi-Factor authentication Azure AD maps public key to a user account Private key is never shared Keys are always generated in hardware (TPM) Hardware bound keys are attested (Trusted Computing Group Protocols) © 2012 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Windows Hello Biometrics authentication
6/19/2018 Windows Hello Biometrics authentication Using fingerprint, face, iris Integrated biometrics framework False Acceptance Rate 1/100,000 False Rejection Rate 2-4% Live-ness and anti-spoof detection (3D/infrared) Regular password/pin is still available MDM managed © 2015 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Azure AD Join flow Identity Provider Employee 6/19/2018
Create Account or proves identity Create and trust unique key Identity Provider Azure Active Directory (Microsoft Account) User Unlock Windows identity container w/ PIN or Windows Hello 1 Authentication by validating a signed request 2 Employee Authentication token Trusts tokens from IDP 3 Token binding Resource Access Token 4 Relying Party © 2012 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Relying parties Windows Hello in the Enterprise
6/19/2018 Relying parties Windows Hello in the Enterprise Office 365 and Azure AD registered applications AD FS-based applications Unlock Universal Windows apps Connecting to VPN Remote desktops Sign protected (S/MIME) Connect to Wi-Fi © 2015 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Identity Options and Behavior
TechReady 23 6/19/2018 1:33 AM Identity Options and Behavior *1 _ With Azure AD Connect and VPN *2 – Change from Windows 8.1 Primary Account Secondary Account Settings Roaming*1 SSO On-Prem + Cloud*1 AD YES (Server 2016) AD + MSA *2 Azure AD (with VPN) Azure AD + MSA MSA (BYOD) NA MSA + AAD © 2016 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Lesson Learned Windows Hello is not well understood
6/19/2018 Lesson Learned Windows Hello is not well understood Windows Hello does not fully support all scenario’s Application support (e.g. Company Portal) Remote Desktop/App support S/MIME Support Virtual Smart Card Passport requires preparation Supporting Infrastructure End-user communication (and some cleaning-up) © 2015 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Management Client Architecture
Microsoft Ignite 2015 6/19/2018 1:33 AM Management Client Architecture Service/ Server Azure AD Provisioning MDM/Microsoft Intune Office 365 Device Identity Provisioning Engine MDM Client EAS Client Common Device Configurator MDM Configuration Service Providers (CSP) © 2015 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Flexible management options
6/19/2018 1:33 AM Flexible management options Intune standalone (cloud only) ConfigMgr integrated with Intune (hybrid) Intune web console ConfigMgr console Microsoft Intune System Center Configuration Manager Microsoft Intune MDM IoT/Kiosk devices MDM Agent MDM or agent Mobile devices and PCs Domain-joined PCs Mobile devices © 2014 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

SyncML Flow Configuration Service Provider SyncML SyncML
6/19/2018 1:33 AM SyncML Flow Configuration Service Provider A CSP is an interface to read, set, modify, or delete configuration settings on the device SyncML File with all information to configure CSP Sample CSP SyncML MDM Client Common Device Configurator MDM Configuration Service Providers (CSP’s) Intune MDM © 2014 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Sample Policy in Intune MinDevicePasswordLength CSP
6/19/2018 Sample Policy in Intune MinDevicePasswordLength CSP © 2014 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Sample SyncML -MinDevicePasswordLength
6/19/2018 Sample SyncML -MinDevicePasswordLength <SyncML xmlns='SYNCML:SYNCML1.2'> <SyncHdr> <VerDTD>1.2</VerDTD> <VerProto>DM/1.2</VerProto> <SessionID>1</SessionID> <MsgID>1</MsgID> <Target> <LocURI>{unique device ID}</LocURI> </Target> <Source> <LocURI> </Source> </SyncHdr> <SyncBody>  <Replace> <CmdID>2</CmdID> <Item> <LocURI>./Vendor/MSFT/Policy/Config/DeviceLock/MinDevicePasswordLength</LocURI> <Meta> <Type xmlns="syncml:metinf">text/plain</Type> <Format xmlns="syncml:metinf">int</Format> </Meta> <Data>6</Data> </Item> </Replace> <Final /> </SyncBody> </SyncML> Device ID SyncHeader OMA-URI Uniform Resource Identifier SyncML SyncBody Value © 2014 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

6/19/2018 © 2014 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Custom URI settings for Windows 10 devices
References List of CSP’s: HKLM\SOFTWARE\Microsoft\Provisioning\CSPs\.\Vendor\MSFT Custom URI settings for Windows 10 devices Configuration service provider reference

Provisioning Packages
6/19/2018 Provisioning Packages Apply settings in OOBE prior to enrolling / managing devices PPKG Power on Apply PPKG Settings Apply © 2012 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Configuration & security management
DEPLOY RETIRE Certificates Wi-Fi and VPN profiles Assigned access OPERATE One consistent set of device management capabilities across mobile, desktop, and IoT CONFIGURE APPS

Enterprise Certificate Management
6/19/2018 Enterprise Certificate Management Certificate management using SCEP or PFX Certificate-based authentication Accounts/Passport, Wi-Fi, VPN, Microsoft Edge, LOB apps Advanced certificate management S/MIME encryption certificates TPM-protected client certificates API for apps On-device diagnostics with Certificate App © 2015 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Expanded VPN capability set
6/19/2018 Expanded VPN capability set Ease of deployment & management MDM solutions can uniformly manage both Windows and Windows 10 Mobile VPN-based remote connectivity User experience integrated across mobile devices Consistency in store-based plug-in distribution Open to all VPN solution providers, always up-to-date Microsoft SSTP client also available as a Store application Per-app VPN MDM managed app list and port restrictions Integrated with Windows Information Protection Always-on VPN MDM-managed, always-on connection © 2012 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Assigned Access Enables enterprises to define a curated lockdown “experience” per user role, including a list of allowed apps and settings pages, start screen layout, hardware button lockdown/remapping, etc.

Windows Store for business
6/19/2018 Windows Store for business Volume licensing Free and purchased apps License reclaim/re-use Flexible distribution Your company store © 2015 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Windows Store for Business
6/19/2018 Windows Store for Business Steps for IT administrators or organization purchasers Access the web portal Acquire desired apps (free or paid) Manage licenses Deploy using other flexible means © 2015 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Flexible licensing app model
6/19/2018 Flexible licensing app model Online Offline Requires the use of organizational identity based on Microsoft Azure AD for all users Installation managed and deployed by the Windows Store Licenses tracked by Windows Store Updates installed via Windows Update Default licensing model for all Windows Store for Business apps No requirement for organizational identity based on Microsoft Azure AD for users (required for IT pros to acquire apps) Installation files are downloaded and deployed using org’s infrastructure No license tracking on Windows Store side Updates installed via Windows Update Developer needs to opt-in for offline licensing for the app to be available for offline licensing Private store Direct Assignment MDM/EMM Solutions Computer imaging Manual deployment MDM/EMM Solutions © 2012 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Lesson Learned Delegation of Administration Additional payment options
6/19/2018 Lesson Learned Delegation of Administration Additional payment options Faster App acquisition App Categorization Start Store app in the private store © 2015 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Deploy Windows 10 Mobile BRK3192 Part 1 BRK3193 Part 2 DEPLOY RETIRE
Identity & Deployment Configuration Management Apps & Windows Store for Business BRK3193 Part 2 Health attestation & Conditional Access Windows Information Protection Manage Updates Retire Migration from Windows Phone 8.1 OPERATE One consistent set of device management capabilities across mobile, desktop, and IoT CONFIGURE APPS

Please evaluate this session
6/19/2018 1:33 AM Please evaluate this session Your feedback is important to us! From your PC or Tablet visit MyIgnite at From your phone download and use the Ignite Mobile App by scanning the QR code above or visiting © 2014 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Q&A If you have questions please proceed to the Q&A MICROPHONE
6/19/2018 Q&A If you have questions please proceed to the Q&A MICROPHONE © 2015 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Resources Windows 10 Mobile deployment guide
Windows 10 Mobile security guide

Deploy Windows 10 Mobile for the mobile workforce

Similar presentations

Presentation on theme: "Deploy Windows 10 Mobile for the mobile workforce"— Presentation transcript:

Similar presentations

About project

Feedback

Log in

Auth with social network:

Deploy Windows 10 Mobile for the mobile workforce

Similar presentations

Presentation on theme: "Deploy Windows 10 Mobile for the mobile workforce"— Presentation transcript:

Similar presentations

About project

Feedback