Téléchargé 18 fois
Téléchargé parMicrosoft Technet France
Gestion de Windows 10 et des applications dans l'entreprise moderne
Le document traite de la gestion de Windows 10 et des applications dans un environnement d'entreprise moderne, mettant l'accent sur l'intégration d'Azure AD et la mobilité des utilisateurs. Il souligne l'importance de l'identité dans l'accès aux ressources et détaille les méthodes d'authentification avancées telles que Windows Hello. Enfin, il aborde les questions de déploiement et de gestion des applications via le Windows Store pour entreprises.
Contenu connexe
Similaire à Gestion de Windows 10 et des applications dans l'entreprise moderne
Gestion de Windows 10 et des applications dans l'entreprise moderne
- 1. Gestion de Windows10 et des applications dans l'entreprise moderne
- 2. Antoine Journaux Julien Chabas @AntoineJournaux IngénieurAvant-Ventes Windows @Julien_MSFT Ingénieur Avant-Ventes Mobilité
- 3. Windows 10 enmobilité
- 4. Intégration dans unDomaine Active Directory • Accès aux services depuis un lieu de travail • Utilisation de PC fournis par l’entreprise • Accès aux ressources disponibles sur un réseau local • Accès distant via VPN Une gestion traditionnel de l’IT Périmètre Active Directory N° 4 On-premises Storage, corp data Users
- 5. 66% des salariésutilisent de périphériques personnels pour travailler 25% des logiciels seront disponible “as a Service” (SaaS) d’ici 2020 33% des salariés travaillent en mobilité Un monde hybride N° 5
- 6. Les contraintes dumonde hybride ? L’identité au coeur des usages N° 6 Apps Apps Identités publiques On-premises Storage, corp data Users Gestion de devices Sécurité des données Accès aux ressources Identité
- 7. L’identité au coeurde la mobilité N° 7 Apps Apps Identités publiques On-premises Storage, corp data Users
- 8. Windows 10 etAzure AD Join Windows 10 Azure AD Joined Devices Intune / MDM auto-enrollment La jonction à Azure AD rend possible de connecter des périphériques mobiles d’entreprise Windows 10 à votre sociétés auto-enrollment dans Intune Accès conditionnel Support des environnements hybrides SSO dans les applications cloud ou onPrem sans VPN
- 9. Les choix d’identitéavec Windows 10 N° 9 Windows 10 PC joint à Azure AD Windows 10 PC joint à AD (équivalent à Windows 7) Windows 10 PC joint à AD et enregistré dans Azure AD Azure AD Connect Azure AD Connect
- 10. PC joint àl’AD et enregistré dans AAD N° 10 Windows 10 5 4 1 & 2 5 3 L’enregistrement dans Azure AD 1. GPO to tell the device to register in AAD 2. The device get the information to locate AAD 3. The computer gets access to Azure DRS 4. The computer generate CSR (private/public key pair) for device registration 5. The computer register in AAD DRS, Cert is saved in the machine store Azure AD Connect
- 11. - Déployer WindowsHello sans devoir attendre Nouvelle méthode d’authentification deux facteurs standardisée disponible nativement dans Windows 10 permettant d’utiliser la Biométrie pour s’authentifier dans Windows, les applications, les sites web, les plugins VPN, etc. - Profiter de l’itinérance des paramètres utilisateurs entre machines (au lieu d’un compte Microsoft) - Débloquer de nouveaux scénarios liés à Azure AD (accès conditionnel, Windows Store for business, etc.) Pourquoi enregistrer un PC dans Azure AD ? N° 11
- 12. Démo Comment connaitre monétat ? N° 12
- 13. Control d’accès conditionnel N°13 On-premises applications Application Business sensitivity Other Network location Devices Intune/ConfigMgr managed Compliant with Intune/ConfigMgr policies Domain joined User attributes User identity Group memberships Auth strength (MFA) No need for on-premises infrastructure Azure AD is the control plane Allow | Enforce MFA | Block
- 14.
- 15. Accès conditionnel avecWindows 10 N° 15 1. Access please 2. Prove to me you are compliant 5. Here is my proof 4. Approval3. Request Corporate network • Intégration avec Windows health attestation service • Règle de conformité supplémentaires : • Patché ? • Firewall actif ? • Antivirus et protection temps- réelle actif ? • Et bien plus…
- 16. Analyse des composantslié au boot L’analyse est signée et stockée dans la TPM Le client Health Attestation envoie l’analyse à un service cloud pour validation SecureBoot est proactif Health Attestation est réactif Remote Health Attestation N° 16
- 17.
- 18.
- 19. Pas besoin dedroits d’administrateur pour les installer Ces applications sont containerisé et disposent de privilèges très faibles La sécurité de ces applications est basée sur les niveaux d’intégrité et sur des capacités restreintes Ces capacités peuvent être gérées par l’utilisateur et/ou l’administrateur Les applications du Windows Store
- 20. Windows Store Public N°21 • Toutes les applications du Windows Store • Nécessite un Microsoft Account (MSA) • Les utilisateurs doivent cliquer sur Installer • Les MSA ne peuvent être gérés par les sociétés Windows Store
- 21. Windows Store pourEntreprises N° 22 Volume acquisition and distribution Acquire Store apps and Line-of-Business apps Flexible deployment to meet your needs Designed for organizations Curated for business Apps owned and managed by your organization Easy and familiar for your users Simple discovery and installation of apps Automatic app updates by default To find, acquire, manage, and distribute apps on Windows 10
- 22. Distribution des applications N°23 Offline licensing Computer imaging Manual deployment MDM/EMM Solutions • Compte Azure AD necessaire uniquement pour la partie administration IT • Applications téléchargés et déployés via l’infrastructure client • Pas de suivi d’utilization des licences • Mises à jour via Windows Update • Action des développeurs pour rendre disponible leurs Apps en mode Offline • Compte Azure AD pour tous les utilisateurs • Installation depuis l’application Windows Store • Suivi d’utilization des licences avec Windows Store pour Entreprises • Mises à jour via Windows Update • Disponibilité des toutes les applications du Windows Store pour Entreprises Private store Direct Assignment MDM/EMM Solutions Online licensing
- 23. Distribution des Appsen mode Hybride MDM/EMM Solution N° 24 Organizational apps acquired Inventory synchronized Policies and distribution defined Deployed to users
- 24. Démo Windows Store pourEntreprises Intune + Configuration Manager N° 26
- 25.
- 26.
- 27. Notez cette session Ettentez de gagner un Surface Book Doublez votre chance en répondant aussi au questionnaire de satisfaction globale * Le règlement est disponible sur demande au commissariat général de l’exposition. Image non-contractuelle
Notes de l'éditeur
- #5 Active Directory Domain joined devices – how we do it today.. Accessed from the office. Resources are local – on the same network. Remote access requires special services such as VPN or DA – can be cumbersome. If I work remotely and break my PC my IT guys have to build another machine and ship it out to me or I have to come in to the office. Doesn’t lend itself to a mobile workforce does it?
- #6 66% of employees use personal devices to work. That means: Smartphones. Tablets. Personal PCs. None of these lend themselves to the traditional domain join scenario. ---- 25% of software will be available as a service (SaaS) SaaS is considered to be part of what is referred to as Cloud Computing Companies are using SaaS to pay as they go and get out of the infrastructure business Think Office 365, SharePoint, Dynamics CRM, and Lync --- 33% of employees work away from the office Who are these people? Teleworkers Students You! Why? Convenience to the worker Cheaper for the employer Geographically diverse workforce
- #9 One of the new enrollment options that is available both for BYOD and CYOD scenarios when using Windows 10 is Azure AD join which makes it possible to connect work-owned Windows 10 devices to your company’s Azure Active Directory. With Azure AD Join, you can auto enroll devices in management with Microsoft Intune or a 3rd party MDM. This means that a user can use his or her device and use the corporate credentials to preform Azure AD join and get access to corporate resources in the cloud and on-premises as well as gain benefits such as SSO and auto-enrollment to Intune.
- #11 http://jairocadena.com/2016/01/18/how-domain-join-is-different-in-windows-10-with-azure-ad/
- #12 For corporate owned devices: On Azure Active Directory domain-joined PCs: Windows Oxygen services (Roaming Settings, Live Tiles and Notifications, Store, etc.) will work natively with work accounts – no need to use a personal Microsoft account (a.k.a. Live ID). Windows will use Azure AD as a relay to power these experiences, which means that orgs must have connected their on-premises AD to Azure AD to make this happen. Both sync and federation models will be supported. For organizations that do not have on-premises AD or do not use it for all their users (e.g. EDUs, seasonal workers, and temps): users will be able to log on to Windows with their work account powered by AAD and Windows Passport, to enjoy SSO from the desktop to AAD-backed apps and resources such as Office 365 and LoB applications running in Windows Azure. We will also enable auto-registration of these devices in AAD and auto-enrollment in MDM. This will also work on mobile devices that do not have Domain Joined capabilities, and it will work for managed and federated AAD accounts. This will make it easy for information workers to use their existing work credentials to log in to phones/tablets that are owned by their organization and rehydrate their personalized work environment on these secondary devices. Even better: we’re going to allow users to set up shrink-wrapped Windows devices with their work account (managed or federated in AAD) and configure them as Corp-owned assets right in the Windows First Run Experience (OOBE), without the need for IT to spend time and money on device imaging. What are Oxygen services? “Oxygen services” are core Windows capabilities that are driven by the cloud, including things like roaming of personalization, settings, favorites, credentials, as well as notifications, backup/restore. These services are driven by the “primary” online identity that’s configured in Windows, which we’re calling the “Primary Cloud account”. This account is set at first run, either through OOBE or imaging.
- #13 One final clue: The command line whoami will show the user’s first and last name, concatenated and prefixed with azuread. dsregcmd /status ici le PC est joint à AAD mais pas à AD
- #18 One final clue: The command line whoami will show the user’s first and last name, concatenated and prefixed with azuread. dsregcmd /status ici le PC est joint à AAD mais pas à AD
- #22 So let’s look at the overall picture for Windows 10. You’ll notice that the existing Windows Store end-user (consumer) scenarios remain unchanged: You can still use a Microsoft account to acquire apps, paying with credit cards and various other means. But now we can use the Business Store to acquire apps for the organization, paid for using a purchase order, invoice, or credit card. We’ll provide license management for those apps, enabling organizations to reclaim and reuse licenses (e.g. when an employee leaves the company). We’ll even let you upload your own line-of-business apps. You will be able to deploy apps in a variety of ways. The simplest way would be to leverage the Windows Store itself: Members of your organization could access the Windows Store using an Azure Active Directory account for your organization, see all of the apps that you have made available (including line-of-business apps that you’ve uploaded), and select the ones they want; the Windows Store will take care of the installation. Or you can directly assign an app license to a specific member of your organization; they’ll be notified to “click here” to initiate an installation. [Note that both of these scenarios require each member of the organization to have their own Azure Active Directory account. Typically this is done by setting up synchronization between your existing Active Directory domain and Azure Active Directory.] You’ll also be able to download the installation files for the apps you’ve acquired and put them in your custom images or deploy them using your existing management infrastructure, just like many of you already do today for desktop (Win32) apps. This doesn’t even require an internet connection (other than for the IT administrator who needs to sign into the Business Store to download the installation files). [And these offline and imaging scenarios don’t require users to have Azure Active Directory accounts, except again for the IT administrator who needs to use the Business Store.] And you can still have a “Company Portal” provided by your MDM or systems management solution (e.g. Intune or System Center Configuration Manager). But in addition to sideloading modern apps, you’ll also be able to deploy apps acquired through the Business Store by leveraging new MDM controls. Even if you disable the Windows Store for users, MDM and systems management solutions can instruct the Windows Store to install Business Store-acquired apps on their behalf. [It’s also worth noting that you won’t be able to use as Azure Active Directory account to acquire any app from the Windows Store – you’ll only be able to acquire those specifically acquired through the Business Store. If an organization chooses to allow it, they could still allow members to use their own Microsoft account for other apps.]
- #23 Typical organizational needs : Centrally managed purchasing and app management Volume app acquisition and distribution Licenses owned by organization & can be re-assigned as needed Flexible app distribution options Simple and easy for users
- #24 First, it’s important to make a distinction between “online” and “offline” scenarios. For “online” scenarios, the Business Store Portal and Windows Store are actively involved in the full end-to-end process, leveraging Azure Active Directory accounts for each member of the organization to track licenses, target apps to users, etc. For “offline” scenarios, the Business Store Portal helps with the acquisition of the apps and the installation files for those apps, but after that point, you would use your own infrastructure to deploy the apps and to track what licenses you are using. So it’s “offline” from the Windows Store perspective, as there is no communication with the Windows Store involved in these scenarios. [Because app updates are delivered via Windows Update and WSUS, these “offline” apps will still get updated though, so you don’t need to worry about that.] In the “online” case, you can leverage a private organization store within the public Windows Store. Or you can leverage MDM or other systems management solutions to instruct the Windows Store to install an app (using a process similar to what you can do today with “deep links”, but without any user interaction or Microsoft account requirement). Or you can directly assign apps to specific Azure Active Directory users. For the “offline” case, you can add apps into images (sysprepped and captured). Or you can deploy them using a sideloading-like process (although it’s technically not sideloading, as it is still an official Windows Store app) where the management solution distributes the installation files and instructs Windows to install the app. Or you can even manually install the app using PowerShell or DISM commands. Let’s walk through each of those scenarios…