Key components of the Enterprise Mobility Suite are Azure AD Premium, Windows Intune and Azure Rights Management. Learn not only what the Microsoft Enterprise Mobility Suite is, but also how one can deploy it in an enterprise organization. During this session, you will gain the knowledge to optimize the adoption of IT, BYOD and SaaS as the core cloud solution components. Key concepts that will be covered are identity and access management, mobile device management and data protection.

1. Enterprise Mobility Suite
SCUG Norway
October 2015
 peter.daalmans@it-concern.nl
 @pdaalmans
 http://ConfigMgrBlog.com #EMSTalk

2. Who am I?
 Peter Daalmans
 Senior Technical Consultant at IT-Concern BV
 @pdaalmans.com / Peter.Daalmans@it-concern.nl
 Microsoft MVP: Enterprise Mobility (ConfigMgr and Microsoft Enterprise
Mobility Suite)
 Communities
 Co-founder WMUG NL (http://wmug.nl)
 Founder and Blogger ConfigMgrBlog.com
 Author
 Mastering System Center 2012 Configuration Manager
 Mastering System Center 2012 R2 Configuration Manager
 Coming up EMS Book
SCUG Norway October 2015 @pdaalmans

3. Agenda
 EMS Components
 Azure AD Premium
 Microsoft Intune
 Azure RMS
 How to get started?
SCUG Norway October 2015 @pdaalmans

4. Enterprise Mobility
Suite
SCUG Norway October 2015 @pdaalmans

5. What is MS EMS?
Enterprise Mobility Suite
Azure Active Directory Premium
Microsoft Intune
Azure Rights Management
SCUG Norway October 2015 @pdaalmans

6. Identity
Azure AD Premium
SCUG Norway October 2015 @pdaalmans

7. Identity: Cloud, Sync or Federated?

 

Cloud identity provides a solution
where all identity resides in the
cloud
Federated identity allows
customers to retain all
authentication on-premises
Identity sync enables customers to
bridge their existing identity into
the cloud
B2B federated identity allows
customers to securely share and
collaborate with each other
SCUG Norway October 2015 @pdaalmans

8. Azure Active Directory Premium
 Active Directory in the cloud
 Federation and identity provisioning
 Centrally managed identities
 Synchronization
 Single User Identity (SSO)
 Monitoring and protect access to cloud apps
 Authentication and Security reports
 Multi-Factor Authentication (MFA)
 Empower end Users
 Self-Service password reset
SCUG Norway October 2015 @pdaalmans

9. AAD editions comparison
No Object Limit No Object Limit
No Limit
Advanced Security
Reports
Yes(Advanced)**
Premium+
Basic
Features
Group-based access management/provisioning Yes Yes
Self-Service Password Reset for cloud users Yes Yes
Company Branding (Logon Pages/Access Panel customization) Yes Yes
SLA Yes Yes

10. Other premium features
SCUG Norway October 2015 @pdaalmans

11. Self-service group
management, including
dynamic membership
calculation in these
groups and distribution
lists, based on the
user’s attributes.
Users can reset their
passwords significantly
reducing help desk
burden and costs.
Users can edit their
profile details to update
and add missing
information
Self service experience for users
SCUG Norway October 2015 @pdaalmans

12. Monitor and protect access on
go-anywhere devices
SCUG Norway October 2015 @pdaalmans

13. Multi-factor authentication
Any two or more of the following factors:
 Something you know: a password or PIN.
 Something you have: a phone, credit card or
hardware token.
 Something you are: a fingerprint, retinal scan or
other biometric.
Stronger when using two different channels (out-of-
band).
SCUG Norway October 2015 @pdaalmans

14. Premium Reports
Premium reports:
Advanced application usage reporting
Password reset activity
Selfservice activity
Identify unexpected logon behavior
SCUG Norway October 2015 @pdaalmans

15. Premium Reports
SCUG Norway October 2015 @pdaalmans

16. Integrate on-prem apps with Azure AD
 End-user portal – Access Panel
 Azure AD authentication capabilities:
 Username and password synced from on-prem AD
 Federated login to on-prem or other federation servers
 Multi-factor authentication
 Customized login screen
 Authorization based on user or groups
 SSO to Office365, thousands of SaaS apps and all
applications integrated with AAD
 Reports, auditing and security monitoring
based on big data and machine learning.
Azure Active Directory
Resource ResourceResource
Corporate
Network
DMZ
Connector Connector
Application Proxy
Access Panel
Portal
Authentication +
MFA
Reporting &
Auditing
Security
Monitoring
Authorization
SCUG Norway October 2015

17. Azure Active Directory Premium
demo
SCUG Norway October 2015 @pdaalmans

18. Microsoft Intune
SCUG Norway October 2015 @pdaalmans

19. Microsoft Intune
Mobile Device Management
Windows, Windows Phone, IOS and
Android
Policy and Application Management
Compliance reporting
Conditional Access to resources
Selective Wipe Devices
Hybrid / Cloud solution
SCUG Norway October 2015 @pdaalmans

20. Single management console for IT admins
Configuration Manager console (hybrid)Intune web console (cloud only)
SCUG Norway October 2015 @pdaalmans

21. Comprehensive lifecycle management
Enroll
• Provide a self-service Company
Portal for users to enroll devices
• Deliver custom terms and
conditions at enrollment
• Bulk enroll devices using Apple
Configurator or service account
• Restrict access to Exchange email
if a device is not enrolled
Retire
• Revoke access to corporate
resources
• Perform selective wipe
• Audit lost and stolen devices
Provision
• Deploy certificates, email, VPN,
and WiFi profiles
• Deploy device security policy
settings
• Install mandatory apps
• Deploy app restriction policies
• Deploy data protection policies
Manage and Protect
• Restrict access to corporate
resources if policies are violated
(e.g., jailbroken device)
• Protect corporate data by
restricting actions such as
copy/cut/paste/save outside of
managed app ecosystem
• Report on device and app
compliance
User IT
SCUG Norway October 2015 @pdaalmans

22. Microsoft Intune:
Company Portal(s)
SCUG Norway October 2015 @pdaalmans

23. Company portal self-service experience
 Consistent experience across:
Windows
Windows Phone
Android
iOS
 Discover and install corporate apps
 Manage devices and data
 Customizable terms and conditions
 Ability to contact IT
 Force the Policy refresh
SCUG Norway October 2015 @pdaalmans

24. Mobile Device – Portals
All portals offer the same experience
(except for Windows Phone)
SCUG Norway October 2015 @pdaalmans

25. Microsoft Intune:
Device Enrolment – The new way
Conditional access
SCUG Norway October 2015 @pdaalmans

26. Enrolling Devices
Users can enroll devices that configure the
device for management with Windows
Intune; the user can then use the Company
Portal for easy access to corporate
applications
Data from WindowsIntune is in sync
with ConfigurationManager, which
provides unifiedmanagement across
both on-premises and in the cloud
Dirsync
w Pwd Sync
Connector
Internal
Connector
SCUG Norway October 2015 @pdaalmans

27. Conditional access for Office 365
7
5
4
2
1
3
6
SCUG Norway October 2015 @pdaalmans

28. Device Enrolment – The new way
Conditional access
demo
SCUG Norway October 2015 @pdaalmans

29. Microsoft Intune:
Application Management
SCUG Norway October 2015 @pdaalmans

30. Mobile Application Management
Personal apps
SCUG Norway October 2015 @pdaalmans

31. Mobile Application Management
SCUG Norway October 2015 @pdaalmans

32. Mobile App Config Policy
Preconfigure iOS Apps with settings
App need to support iOS App Config
Policy
See for more info:
http://ref.ms/mamlist
SCUG Norway October 2015 @pdaalmans

33. Mobile Application
Management
demo
SCUG Norway October 2015 @pdaalmans

34. Soon available:
Mac OS X management
34

35. Mac OS X support for
Enrollment
Deploying policies
Deploying profiles
Remote actions
Reporting
SCUG Norway October 2015 @pdaalmans

36. Mac OS X
demo
SCUG Norway October 2015 @pdaalmans

37. Rights Management
SCUG Norway October 2015 @pdaalmans

38. Microsoft Rights Management
Encrypt and control
Documents
Mails
Prevent unwanted viewing/printing or
access to Corporate data
SCUG Norway October 2015 @pdaalmans

39. Protect data with Rights Management
SCUG Norway October 2015 @pdaalmans

40. Integrating RMS into workflows
SCUG Norway October 2015 @pdaalmans

41. Sharing documents securely
SCUG Norway October 2015 @pdaalmans

42. Rights Management
SCUG Norway October 2015 @pdaalmans

43. How to get started?
SCUG Norway October 2015 @pdaalmans

44. How to get started?
Go to ref.ms/ems > Try now
Sign up
Setup AAD Connect (synchronize
accounts)
Set MDM authority
Configure platforms
Enroll!
SCUG Norway October 2015 @pdaalmans

45. Share your ideas
Share your voice / ideas!
http://microsoftintune.uservoice.com/
http://configurationmanager.uservoice.com/
SCUG Norway October 2015 @pdaalmans

46. Questions
SCUG Norway October 2015 @pdaalmans

47. SCUG Norway October 2015 @pdaalmans