Identifying a reliable remote working solution

The static on-premises solution was coping, just about. Recognising that they needed a more on-demand solution, they started looking at other options. Fife Council partnered with Microsoft to ensure that solutions were in place to allow employees to work productively and securely when remote in the event that they were unable to work on council office premises in the future.

Windows Virtual Desktop (WVD) was quickly identified as a solution to enable remote working and critical business continuity for Fife Council. WVD could be configured to deliver critical line of business applications and desktops to employees working remotely. Furthermore, Fife Council had already procured Microsoft 365 E3 to enable employees to access Windows in the physical office environment. This meant they didn’t need further license expenditure to enable access to WVD.

Partnering with Microsoft Engineering

In late 2019, Fife Council partnered closely with Microsoft Engineering to pilot WVD for remote workers. This allowed for feedback to be incorporated into service improvements on the Azure side and also within Windows 10 Multi-Session.

Rapid business continuity at scale

When COVID-19 hit communities in March 2020, Fife Council had already deployed the necessary infrastructure to allow remote working. They quickly scaled their WVD deployment from 400 users to over 6000+ users to meet working from home demands. Seamlessly, employees could use their personal devices to access their corporate environment. This meant that Fife Council didn’t have to spend lots of their budget to procure new devices. As WVD runs on Azure and cloud-based infrastructure, Fife Council could scale up the remote working solution overnight. This meant they only have to pay for the infrastructure they use. Use of Windows 10 multi-session has also allowed Fife Council to provide employees with a full and rich Windows 10 client, whilst achieving the cost savings enabled hosting multiple users on multi-session session hosts.

“Fife Council were extremely fortunate to implement Microsoft’s Windows Virtual desktop when we did towards the end of 2019. The technology undeniably helped us soften what was a very severe blow when COVID-19 struck. Without this technology we would have been in a very dark place indeed with thousands of users having no access at all”

– Andy Milne, IT Service Manager at Fife Council

For Fife’s residents, this business continuity enabled by WVD at the local council has meant that vital services have been able to continue. This has a significant positive impact on the local community.

Learnings from Fife Council’s journey to remote working

Based on their experiences, the Fife Council team make the following recommendations to organisations looking to start a WVD Journey.

1. Understand your business justification, first: For us, this was our need to ensure that we had suitable business continuity in place to allow our employees to be productive wherever they are. This quickly changed from a nice to have to business critical overnight.
2. Start with the basics: We initially tried to mirror the ‘in office’ desktop experience via WVD. We quickly realised this was not the best approach and went back to basics. We then built on the basics which ended up being a far more balanced and effective approach.
3. Know your numbers: Take the time to understand the capacity that you need. This then helps you to understand the budget that you require.
4. Start with the WVD service released in public preview in May 2020. We started our journey a while ago. However, If we were to start again now we would absolutely start with the WVD service released in public preview in May 2020 and utilise those new features and capabilities. We are migrating to this now and are excited about what this can mean for the service we can deliver.
5. Understand the clients you need to support. Take the time to understand the end user requirements. Application requirements are paramount, especially as your legacy and specialised applications can be particularly tricky. Collaboration requirements, printing, and file sharing were all areas we had to make some pretty fast decisions on.
6. User choice. We offer a tier system to users based on their technology needs. For some users (Tier 1), email and calendar on their phone using Intune MAM/APP policies is sufficient. Other users (Tier 2) require Office 365 web apps (Word, Excel, PowerPoint, etc). Our Tier 3 users are those requiring the full ‘in office’ experience using WVD. There is a spectrum of solutions that Microsoft has available to ensure companies are able to effectively manage business continuity and mapping users to the right technology is key.

“Windows Virtual Desktop was absolutely essential for us in terms of our response to COVID-19. Like many, we were faced with a continuity issue unparalleled in recent times. For us, this meant not only the continuation of services we already delivered, but also responding very quickly to new demands. To do that, we needed to provide as close to the ‘in-office’ experience as we could to a workforce now working away from our offices. This meant multiplying previous remote working capacities by a factor of 15 almost overnight – something which would have been impossible without a scalable and cloud-based approach which also worked well on a range of Council and self-provided devices. There is little doubt that the Virtual Desktop solution will not only be vital to the future resilience of our public services to the people of Fife, but it will also form a key part of our future device strategy as we seek to develop new, agile and cost-effective approaches going forward.”

– Charlie Anderson, Head of ICT at Fife Council

Find out more

Learn more: Discover the benefits of Windows Virtual Desktop

Read more: Empower employees for secure remote work with Windows Virtual Desktop

Watch the on-demand webinar: The benefits for WVD and how to start your journey

Tools to empower your development team

Read the documentation: How to get started with Windows Virtual Desktop

Explore the learning path: Deliver remote desktops and apps from Azure with Windows Virtual Desktop

About the author

Kirsty is Microsoft UK’s Windows Virtual Desktop Lead. Kirsty started her career at the University of Oxford (Christ Church) where she studied Economics and Management. She has since joined Microsoft and worked with customers in a wide range of industries as a Commercial Executive and more recently in the Azure Business Group.

Blair Lochrie is Microsoft Scotland’s Public Sector CTO, responsible for driving technology strategy across the Microsoft’s Public Cloud. Previously, Blair worked for Microsoft Services across Scotland’s Financial Industry, helping drive adoption of Office 365, Azure and Dynamics. Prior to Microsoft, Blair held a number of roles within BT following graduating from their Modern Apprenticeship Programme – as a result, he is a fierce advocate of early in career programmes and continuous education.

David Rankin represents the Windows Virtual Desktop (WVD) engineering Customer Acceleration Team (CAT) in EMEA. Partnering with strategic enterprise customers to enable successful deployments of Windows Virtual Desktop and leverage their feedback and insights to improve the existing product and develop new product capabilities. David held a number of roles previously within Microsoft Customer Service and Support, developing a passion for the high quality of products, services and end user experiences.

The post How Fife Council enabled productive and secure remote working with Windows Virtual Desktop appeared first on Microsoft Industry Blogs - United Kingdom.

But at the same time, there’s a constant drive within organisations to ensure they stick to their budgets, or save costs. A great way to do this is to realise the value of your existing technology investments. In this blog, I’ll share some of the tools that are available to you as part of your Microsoft 365 and Windows 10 subscriptions to engage your workforce and help your organisation be more productive.

Productivity from day one

Windows Autopilot is a self-service cloud deployment platform in Windows 10. Using Windows Autopilot, IT admins can remotely deploy and configure devices in a zero-touch process right out of the box, whilst utilising your Microsoft 365 and Windows 10 investment.

This means all new users need is their credentials and a device. When they log in, all the tools and apps they need to work are automatically downloaded. They can get started on the important work sooner. No longer do they have to sit waiting for multiple downloads, or login approvals for the IT team.

For your IT team, this means they no longer have to maintain custom images and drivers for every device being used. This reduces the amount of time that IT needs to spend on these processes and the amount of infrastructure that they need to maintain them.

Leveraging cloud-based services, Windows Autopilot can reduce the overall costs for deploying, managing, and retiring devices. It can be managed remotely by tools such as Intune, Windows Update for Business, and the System Center Configuration Manager. This means the whole lifecycle of your organisation’s devices are looked after.

Get Surface devices ready-to-go

The single and best way to use your Microsoft 365 Enterprise E3 or E5 subscriptions and Windows 10 Enterprise is to deploy Surface through Windows Autopilot.

Surface devices and Microsoft 365 work together to give your employees the freedom to work their way. It makes it easier to collaborate and communicate while being protected by the best modern security and manageability platform we have.

With Surface devices, you can choose to register your devices at the time of purchase when purchasing from a Surface partner enabled for Windows Autopilot. New devices are shipped directly to your frontline employees, with a clean build. When employees turn it on for the first time, they are automatically enrolled and configured.

Windows Autopilot automatically sets users up with a Surface that contains all the apps and tools they need to do their work. This means employees are immediately productive right from day one. For those that work remotely or for frontline workers, this means they don’t lose time waiting for a device – they’re able to hit the ground running.

This also lets your organisation’s IT team implement new, agile methods of device management and distribution without having to spend time setting up each device individually.

Empower your employees

Organisations that provide employees with the tools and apps they need outperform those who don’t. 63 percent of employees using these apps said they increased their personal productivity. They are also four times more likely to report their organisation as a desirable place to work.

To unleash these gains, make sure you’re empowering your employees from their very first day with the tools and apps they need by investing in the inbuilt features of Microsoft 365 Enterprise E3 or E5 subscriptions and Windows 10 Enterprise.

By deploying devices through Windows Autopilot, organisations are empowered to achieve more, quicker. And by using Surface devices, your employees will have the freedom to work their way on flexible and secure devices.

When Surface is paired with Autopilot, it makes for a positive complete out-of-the box experience – giving your employees the confidence knowing they have everything they need to accomplish their personal and business goals from day one.

Licensing requirements

Windows Autopilot depends on specific capabilities available in Microsoft 365 Enterprise E3 or E5 subscriptions. It requires Windows 10, Azure Active Directory and an MDM service such as Microsoft Intune.

Software requirements

• Windows 10 version 1703 (semi-annual channel) or higher.

The following editions are supported:

• Windows 10 Pro
• Windows 10 Pro Education
• Windows 10 Pro for Workstations
• Windows 10 Enterprise
• Windows 10 Education
• Windows 10 Enterprise 2019 LTSC

Networking requirements

• Ensure DNS name resolution for internet DNS names
• Allow access to all hosts via port 80 (HTTP), 443 (HTTPS), and 123 (UDP/NTP)

Find out more

Microsoft 365 Enterprise documentation and resources

About the author

Gareth aims to connect people with the tools they need to thrive, so that they feel inspired to contribute and have a sense of belonging to the community around them.

With over a decade of experience in the IT industry, technology adoption is the single biggest driver for him.

As a Surface Specialist at Microsoft, Gareth has the opportunity to showcase best in class technology to a wide variety of customers with the goal of producing meaningful outcomes for all.

The post How to make the most of your existing tech investments: Microsoft 365 and Windows 10 appeared first on Microsoft Industry Blogs - United Kingdom.

Empower your students with modern Windows 10 devices from leading PC manufacturers like HP, Dell, and Lenovo. It not only equips students with the skills for the future but also helps them increase their learning potential. However, when you have budgets to stick to, it can be hard to ensure all students have 1:1 access to these devices.

The Parental Contribution Programme by Freedom Tech helps schools realise their student’s digital potential in a cost neutral way, by passing the costs onto parents.

This programme enables all students to have access to the same modern devices. It aims to be as inclusive as possible with no credit checks for parents. And with an optional payment plan, the costs can be spread over time. Best of all, it includes GAP, Extended Warranty and Accident Damage & Theft cover for the duration of the programme. This ensures the programme stays cost effective to parents who get to keep the devices at the end of the payment period.

Students can increase their learning potential with 24/7 access to a modern learning device. This means they can keep learning outside of the classroom, arming them with the right tools for an ever-evolving technical world and inspiring a new generation of workplace ready whizz-kids. As part of the programme, students get Microsoft Specialists vouchers to further their digital skill set.

For schools, this programme means there is no extra costs that supplying devices would have. Plus, you have IT admin access on the devices which helps you ensure the devices are secure and compliant.

Perins School giving students the opportunity to develop

Perins School is an academy in Alresford for 11 to 16-year-olds. They are committed to providing a rich and educational experience. Their focus is on ensuring every student has the opportunity to progress and develop at their own pace. Therefore, they decided to become a 1:1 school.

Caroline Cleaver, IT administrator explains their journey with Freedom Technology: “Freedom Tech genuinely collaborate with Perins. They are happy to attend our parents evening to ensure that parents and guardians were fully informed about the programme and how to use the portal. They are fully involved in all aspects of the programme. Not every school will have someone like me who is an internal point of contact for the programme. Freedom Tech can help all schools put in place a programme that runs in an efficient and compliant way – regardless of what internal resources they have.”

Students not only use the devices to increase their digital skills. Perins School use it as an opportunity for them to develop accountability and responsibility over their devices.

“We position it to pupils that this is a learning tool which needs respecting and looking after. We set out the school’s expectation that devices need to be brought into school every day, fully charged. When it breaks, they need to bring it in for a repair straight away,” Caroline says.

Perins School’s ability to evolve the programme each year to ensure they best meet the needs of their students has meant that parental take up of the programme was 100 percent for the September 2018 intake.

“We were one of the first schools to run it as a donation model. Many other schools run this type of programme in a more in a traditional payment model, but we are steadfast on making sure that our programme is fully inclusive for all of our pupils,” says Caroline.

Ribblesdale School committing to futureproofing students

Ribblesdale School is a community-focussed school in Clitheroe, Lancashire. Their aim is to equip students with the skills, knowledge and resilience to be successful in adult life in the 21st Century, which lead them to take part in a 1:1 scheme. In fact, their first year of a parental contribution programme saw an 80 percent uptake of parents taking part.

“You only have to take a good look around our school to see, it’s not all flashing lights and technology. We must operate a blended learning approach to do right by our young people and their respective futures. Religious Education and English lessons have been able to use Minecraft Education Edition to cement the learning and drive interaction and engagement in lots of interesting and exciting ways.”*

Paul Edge, Deputy Head Teacher.

Teachers are the key to helping students reach their digital potential. By having modern devices, teachers have access to collaboration tools such as Teams and OneNote. The IT department at Ribblesdale School help set up OneNote and Teams sites to help drive uptake. They also showed teachers how these tools would make the classroom more inclusive and empowering for students.

“We overcame this by challenging our teachers to think creatively about how such functionality could be used through a curriculum lens and how it might empower all students to find their voice through an inclusion lens,” says Paul. “We’re not radical. We just use the tools effectively.”

Find out more

[msce_cta layout=”link_only” align=”center” linktype=”blue” linkurl=”https://freedomtech.co.uk/” linkscreenreadertext=”For more information, visit FreedomTech” linktext=”For more information, visit FreedomTech” ][/msce_cta]

Please note: All offers are subject to credit approval. Tier 1 manufacturer hardware only. Terms and conditions of the rental contract will apply. £196 documentation setup fee will apply to all contracts. Equipment is provided via the reseller whose terms and conditions apply to all sales. winAbility is provided by Freedom Tech Ltd. Freedom Tech Ltd is the trading style of CSI Leasing UK Limited and its subsidiaries.

* Minecraft: Education Edition offers an engaging platform for computer science education, with features designed to help students learn to code, and apply coding across STEM subjects. This flexible curriculum based on CSTA standards is now available for educators to teach foundational Computer Science concepts and help students build computational thinking skills.

The post Students equipped to unlock their learning potential with the latest Windows devices appeared first on Microsoft Industry Blogs - United Kingdom.

Last month, Microsoft released Windows Virtual Desktop (WVD) to the public in preview. The service was first announced back at Ignite 2018. Microsoft describe the service as follows:

Windows Virtual Desktop is a desktop and app virtualization service that runs on the cloud.

Here’s what you can do when you run Windows Virtual Desktop on Azure:

• Set up a multi-session Windows 10 deployment that delivers a full Windows 10 with scalability
• Virtualize Office 365 ProPlus and optimize it to run in multi-user virtual scenarios
• Provide Windows 7 virtual desktops with free Extended Security Updates
• Bring your existing Remote Desktop Services (RDS) and Windows Server desktops and apps to any computer
• Virtualize both desktops and apps
• Manage Windows 10, Windows Server, and Windows 7 desktops and apps with a unified management experience

One point not mentioned that is important – Azure is the only public cloud you can run Windows 10 workloads.

There are a couple of pre-requisites to deploying WVD. First up is licensing, below are the requirements for running WVD

The post Windows Virtual Desktop – First Thoughts appeared first on Microsoft Industry Blogs - United Kingdom.

As we kick off Stress Awareness Month, we wanted to share our thoughts on some of the ways you can manage workplace stress to give your teams time back to do more of what they love.

Making it easier to balance work and family commitments

No longer are we chained to a desk from nine to five. Thanks to technology, we’re now able to work from anywhere, at any time. This means we can work around other commitments and it’s much easier to balance work with family life. With tools like Microsoft 365, your organisation will be empowered to get more done and collaborate effectively, whether they’re at home or in the office, whilst keeping valuable data secure.

Devices such as the Microsoft Surface also make it easier to work more effectively and transform your workplace into a less stressful place. And organisations such as the property company Landsec are completely overhauling their physical work environments and empowering employees with more mobile devices.

“Our suite of Microsoft devices gives us greater freedom and mobility, yet at the same time we know our data and information is secure thanks to Microsoft 365 and Windows 10,” – Alex Roth, Chief Information Officer at Landsec.

Taking the stress out of collaboration

With more and more employees working remotely, or expecting flexible working, it can be difficult for teams to collaborate in real-time. Quite often when people think about collaboration, they think of sitting in more meetings or answering more emails. Which isn’t fun, and can be quite stressful when we have other work to do.

However, with the right technology in place, collaboration becomes more agile and easy. A remote social desktop space takes the stress out of collaboration. In Microsoft Teams, you’re able to co-author, edit and share documents, host meetings, and chat–all in the same application.

Not only does this means everybody has access to the latest information, but it’s easy to collaborate and share the load during busy and stressful times. It also empowers employees to work together in the way that works best for them, turning collaboration from a forced requirement to something that is instinctual and easy.

Initiating effective change management

This cultural change needs to come from the top. Make sure everyone from your leadership team to your frontline worker uses these tools and embraces the progression to a more open culture. And once people see the positive results on their health, performance, and on the business, they will become your greatest advocates.

“Enjoyment, morale and engagement with the business went up the moment we moved into this space and received our new technology. It’s a phenomenal result,” says Carissa Kilgour, Workplace Director at Landsec.

[msce_cta layout=”image_center” align=”center” linktype=”blue” imageurl=”http://approjects.co.za/?big=en-gb/industry/blog/wp-content/uploads/sites/22/2018/12/home_effective-people_800x450-e1551172928959.jpg” linkurl=”http://approjects.co.za/?big=en-gb/business/do-more/effective-people/” linkscreenreadertext=”Find out more about making your people more effective” linktext=”Find out more about making your people more effective” imageid=”8218″ ][/msce_cta]

The post How to improve workplace stress appeared first on Microsoft Industry Blogs - United Kingdom.

According to the NCSC, just under half of businesses have detected at least one breach or attack in the last year. Businesses can gain access to increased security features while providing employees with greater mobility and productivity features with Windows 10 Pro, alongside the wealth of innovative new devices running it.

Stay better protected from modern security threats

Do you know what the most common cyberattacks are for 2018?

1. Botnets – 33 percent of companies reported breaches from botnets, viruses, spyware, and malware
2. Easy mark attack methods such as poorly secured cloud apps, phishing – 72 percent of breaches reported were from fraudulent emails
3. Ransomware – 17 percent of breaches reported were from ransomware

Windows 10 Pro devices provide hardware-enabled security features such as multi-factor authentication, helping prevent phishing attacks, and automatic protection for lost or stolen devices – minimising the risk and financial impact of modern security threats. Many devices include biometric security, such as facial recognition and finger print scanning, and it’s important to educate employees on the importance of using these tools.

Simplify your device management

Most businesses use a wide variety of devices and managing those can be complex and costly. Windows 10 Pro devices have a built-in mobile device management client which makes managing devices easy. And customisable, automatic updates ensure that devices stay current with the latest innovations – on your business’ terms.

Generate greater productivity

Windows 10 starts up to an average 28 percent faster than Windows 7. You can interact more naturally and efficiently with devices using new input methods such as touch, digital pen & inking, and voice. Shift easily from touch and stylus to keyboard and mouse using Continuum. And get more done with the intelligent personal assistant Cortana. And we found that in companies who had a strong digital culture 22 percent of employees consider themselves more productive, compared to just 8 percent of those without a strong culture.

Devices that meet individual needs and budgets

Windows 10 Pro provides choice in respect to devices – including a range of price points and feature sets. Select from a range of high-quality, versatile devices with built-in support for touch, stylus, voice recognition, mobile broadband and more – on form factors from a small, thin 2-in-1 to rugged tablets to touch-screen conference room displays.

Thinking of upgrading your device?

Take a look at some of the Windows 10 Pro devices tailored to meet your innovation, security and productivity needs.

Discover more ways to encourage employee productivity.

Find out more

[msce_cta layout=”image_center” align=”center” linktype=”blue” imageurl=”http://approjects.co.za/?big=en-gb/industry/blog/wp-content/uploads/sites/22/2018/11/Secure-Business-e1551172774832.jpg” linkurl=”http://approjects.co.za/?big=en-gb/business/do-more/secure-business/” linkscreenreadertext=”Creating a secure platform” linktext=”Creating a secure platform” imageid=”8212″ ][/msce_cta]

The post How having the right device and software equals innovation, security, and productivity appeared first on Microsoft Industry Blogs - United Kingdom.

Everyone wants the latest and greatest tech but something is stopping IT teams from migrating employees to modern desktops.

A Windows PC is where the majority of your employees will do most of their work and, for them, it’s always been an easy choice. Most people are already happily using Windows 10 at home. But IT departments seem to be more hesitant. From experience, IT teams often have bad memories from the last major upgrade that make them hesitant about migrating to a modern desktop. Whilst they’re eager to use the latest tech, they don’t want, and can’t afford, any downtime.

You might be experiencing the Rashomon Effect in your business – where two or more witnesses recount an event completely differently. Your employees may only have seen you updating their machine. They think it’s easy and can’t understand why you won’t let them use the latest technology. But we know that it was a company-wide undertaking for you and your IT department.

The workforce craves cutting edge technology

From my experience, employees are left feeling deflated, frustrated and much less productive when their kit is dated. It doesn’t give them the functionality they need to do their best work.

The tech people use at work isn’t as modern as their kit at home. Your employees are eager to get to grips with the very latest technology.

You hardly even notice your devices updating at home as nearly everything’s automated. Last time my phone updated, I was prompted with an update, clicked ‘Update tonight’ and, as if by magic, next time I used my device, everything was sorted.

But it was a different story last time your IT department updated every device across the entire business. For starters, migrating from XP to Windows 7 was pretty complex. Most machines had to be wiped clean. Everything needed to be re-installed from scratch and there were major issues caused by differences in the underlying systems.

Put simply, lots of apps stopped working and had to be re-written, which was costly and time consuming.

Migrating will be easier this time

The move from Windows 7 to Windows 10 is infinitely easier, because compatibility levels are much higher. 99% of commercial software that works on Windows 7 also works on Windows 10, so there’s no need to worry about your apps. In many cases, it’s possible to upgrade rather than start again. Which means you can upgrade Windows 10 on top of Windows 7, keeping all the settings, apps, and data in place. The upgrade will be faster, cost a lot less, and be a much less stressful experience. Your employees will be a lot happier to have their machines updated and up and running quickly, with the added benefit of still feeling familiar too.

Windows 10 closes the gap between Windows 7 and the last decade of cyber threats and it can dramatically reduce complexity for your IT team, making it easier to get a company device ready when someone joins your organisation. What’s more, new AI features make getting things done with PowerPoint and Excel faster and smarter than ever before. Cortana boasts some new productivity tools too.

A report commissioned by Forrester predicted an ROI of 233% for companies implementing Windows 10.

I always recommend this handy tool to IT teams who are looking to migrate to a modern desktop so they can see how much of their organisation’s hardware and software is ready for Windows 10 before you start.

As you can see, keeping your systems up to date has become a lot simpler. When you combine that ease with the invaluable reward of improved employee experience and increased security; it’s a no-brainer.

What’s stopping you?

Learn more

Why cybersecurity is a boardroom issue

Discover how Windows 10 can help protect data, devices, and identity

10 stats that reveal the changing face of IT security

About the author

Robert has been in the IT industry for over 20 years and has a wealth of experience – from running his own IT solutions business to spending time in the IT channel, working with industry names like HP and Intel. Robert has worked at Microsoft for around 15 years across various roles, including Small Business Audience Lead and OEM Sales Manager. In his current role, as UK Product Marketing Lead for Microsoft 365, he’s also responsible for helping partners, from startups to enterprises, understand the value of Windows 10, how to adopt it and how Windows makes it easy to keep valuable business data secure.

The post Migrating to the modern desktop made easy appeared first on Microsoft Industry Blogs - United Kingdom.

It covers five categories: identify, protect, detect, respond, and recover. The measures covered in the document will grow with time to address new threats and vulnerabilities to ensure those who follow it remain secure and compliant.

With 43 percent of businesses surveyed by Ipsos MORI for the Cyber Security Breaches Survey 2018 identifying at least one breach or attack in 2017, it’s a useful framework for organisations to base their cyber security strategy on. Breaches in cyber security not only affect business in downtime and recovery costs, but there may also be huge reputational consequences and GDPR fines to face as a result.

Identify

“Departments shall put in place appropriate cyber security governance processes.”

In order to put effective governance processes in place, departments first need to understand the security risks associated with their sensitive information and operational services. According to the Cyber Security Breaches Survey 2018, only 27 percent of businesses have formal cyber security policies, a rather scary statistic given that 74 percent of UK businesses say cyber security is a high priority for their organisation’s senior management.

Office 365 Secure Score analyses security and gives departments an overview of how secure their Office 365 configurations are and the risks they face. Think of it as a credit score for security – it will evaluate and suggest ways to further secure your Office 365 services. Departments can then use this to develop processes and strategies to tackle these risks.

For sensitive information or resources, Azure AD Privileged Identity Management helps manage, control, and monitor privileged user access.

Tip: Develop a strong identity strategy.

“Departments shall identify and catalogue sensitive information they hold.”

In the age of mobile devices and the cloud it’s important to ensure sensitive information is safe, a key first step in this is identifying the data held. Azure Information Protection helps departments detect sensitive information and secure email, documents and sensitive information no matter where it is stored or who it is shared with. The Azure Information Protection Scanner can also be used to identify what data types reside on-premise, automatically classify it, and protect it.

In addition, Office 365 has discovery features and retention policies to help identify where data is stored across services such as Exchange, SharePoint, and Teams. Retention policies can ensure that there is a valid reason for holding sensitive information.

Tip: Strengthen your security posture by protecting your data.

“Departments shall identify and catalogue the key operational services they provide.”

Departments must know what technologies and services they require to remain secure, what other dependencies the services have, and the impact of loss of service.

Geo-redundant storage (GRS) is designed to ensure at least 99 percent durability of data. It replicates data to a secondary region that is away from the primary area where the data is held. In the event of a regional outage or disaster where the primary region is not recoverable, the GRS will ensure data is not lost.

“The need for users to access sensitive information or key operational services shall be understood and continually managed.”

Often, the first safeguard against threats and breaches is to maintain strict and reliable access control. Privileged Identity Manager provides control and management of your most sensitive accounts, ensuring they have the minimum access to key operational services, ensuring access is only granted based on need.

Azure AD can act as a single authentication platform allowing for effective identity lifecycle management to ensure access is not held for any longer than necessary. It also allows for reviews of group memberships which can be tracked for auditing and compliance to prevent privilege inflation.

Tip: Learn more about identity-driven security.

Protect

“Access to sensitive information and key operational services shall only be provided to identified, authenticated and authorised users or systems.”

Departments need to ensure that only those users who are authorised have access. A key component to a modern authentication solution is multi-factor authentication which is built into Azure AD and provides a single authentication platform that departments can use to provide access to authorised individuals and systems.

Conditional Access provides another level of control based on location, user, application, and device before allowing users access. This allows for efficient, and secure access controls to be put in place, and is particularly important for multi-device employees and departments with BYOD policies.

“Systems which handle sensitive information or key operational services shall be protected from exploitation of known vulnerabilities.”

It’s important to come up with a procedure to track and record all assets and ensure infrastructure is protected. Microsoft InTune and SCCM can be used to track software and hardware assets. InTune can also be used to help manage mobile devices and assets, including remotely wiping data if required.

As an evergreen operating system, Windows 10 is continually kept up to date and patched. Windows Defender ATP allows departments to detect and respond to advanced cyberattacks, as well as spot devices that are missing patches, or have security controls disabled or changed, making them vulnerable.

Tip: Integrated and intelligent cybersecurity solutions that work together maximise protection.

“Highly privileged accounts should not be vulnerable to common cyberattacks.”

Privileged Identity Manager and Azure AD can control the scope and access of user accounts, including enforcing multi-factor authentication on not just Microsoft services, but third-party services as well.

For social media, system, or infrastructure accounts, Azure AD supports single sign-on, obliviating the need to share or store shared passwords.

Detect

“Departments shall take steps to detect common cyberattacks.”

Attackers using common cyberattacks should not be able to gain access to sensitive information without being detected. Departments should clearly define what must be protected and why.

Microsoft 365 ATP can detect advanced cyberattacks across the whole attack kill chain, ensuring that no matter how an attack starts or propagates it can be detected and responded to quickly.

Tip: Proactively manage cybersecurity using threat intelligence.

Respond

“Departments shall have a defined, planned and tested response to cyber security incidents that impact sensitive information or key operational services.”

An incident response and management plan, with clearly defined actions, roles, and responsibilities must be implemented and tested regularly. Findings from the most recent Cyber Security Breaches Survey suggest that only 13 percent of businesses say they have an incident plan.

Office 365 Threat Intelligence includes the Attack Simulator that allows departments to conduct realistic attack scenarios to help create a culture of awareness and education.

Microsoft’s cloud security evolves to protect against the latest threats and technologies. The Intelligent Security Graph, for example, powers real-time threat detection, response, and remediation for Microsoft products and services. Windows Defender Advanced Threat Protection (ATP) allows departments to ingest custom data and correlate this against activity to detect known threats, as well as automatically investigate and remediate a wide range of cyberattacks, ultimately allowing departments to scale their response capabilities.

Tip: Keep up to date on the latest news, webinars, training and more.

Recover

“Departments shall have well defined and tested processes in place to ensure the continuity of key operational services in the event of failure or compromise.”

There should be contingency plans to ensure departments can deliver essential services in case of a cyberattack. These plans need to be tested and well-practised to ensure they work and would not be affected by any failure or compromise.

Azure Backup is built within the Azure platform, meaning it reduces restoration time if a failure or compromise was to occur. It also helps keep data safe from ransomware with multi-factor authentication, alerts when there is suspicious activity, and counteracts unauthorised retention or deletions. Azure Site Recovery replicates workloads to a secondary location. In the event of a failure or compromise on the primary location, it fails back to the secondary location to minimise downtime in key operational services.

Tip: Find out more about effective security management.

Learn more

Find out more on how to secure sensitive information and reduce risk
Learn about the top threats of 2018
The anatomy of a breach

Disclaimer: This document has been drafted with reference to the Minimum Cyber Security Standard (version dated June 2018) which could be updated from time to time and the most recent version can be viewed at https://www.gov.uk/government/publications/the-minimum-cyber-security-standard. This document includes extracts from the June 2018 version of the Minimum Cyber Security Standard which may have been summarized, paraphrased or shortened; there is no substitute for reading those standards in full. Nothing in this document constitutes legal advice, a legal offer or legal representations. It may not contain the most up to date information or guidance.

The post Microsoft security and the minimum cyber security standards appeared first on Microsoft Industry Blogs - United Kingdom.

By Paul Winstanley, Microsoft System Center Configuration Manager Consultant, SCCM Solutions Ltd. He has 22 years experience in IT and is a community leader at Windows Management User Group (WMUG) and blogs at sccmentor.com. He was recently awarded MVP in Enterprise Mobility.

Microsoft has recently unveiled Autopilot, a new and emerging solution designed to allow you to setup and pre-configure devices for your environment, with little or no infrastructure in place.

The idea behind Autopilot is to remove some of the complexity of your current operating system deployment, reducing the task down to a set of simple settings and operations that can get your device ready to use, out of the box, quickly and efficiently.

Autopilot is a cloud-centric solution, your devices will need line of site to the Internet to pick up settings and configure correctly.

The Windows 10 Creators Update is required to get you started with Autopilot. Current configuration choices are limited but this is expected to grow with the Fall update due imminently.

If you are already aware of the Apple Device Enrollment Program (DEP), then Autopilot is similar. A unique hardware identifier can be pre-registered before the device is turned on, and when shipped to the user and connected to the Internet all the configuration, branding, software and compliancy can be pushed down to the device.

The following pre-requisites must be in place for Autopilot to work:

• A device, pre-installed with Windows 10 Creators Update (1703 release) and with Internet access
• Sufficient rights to the Azure portal
• Intune account, or another MDM solution, to manage devices
• Sufficient rights on the Windows Store for Business
• An Azure AD premium P1 or P2 subscription

You can try Autopilot right now. The following details what you need to do to experience this first hand.

Gather data for Autopilot

You’ll need to gather some information from your device. The idea with Autopilot is that your suppliers will be able to populate this information for you, but you can upload this information yourself.

You can either collect this information from within the OS and reset the machine, or you can invoke a CMD prompt from the OOBE phase, when the device powers on for the first time, to do this press Shift+F10.

Three bits of information are required and to collate this run the following commands (Note the last two commands are PowerShell commands and that you need administrator rights to execute):

wmic bios get serialnumber

Get-ItemPropertyValue "hklm:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\DefaultProductKey\" "ProductId"

$wmi = Get-WMIObject -Namespace root/cimv2/mdm/dmmap -Class MDM_DevDetail_Ext01 -Filter "InstanceID='Ext' AND ParentID='./DevDetail'"
$wmi.DeviceHardwareData | Out-File "($env:COMPUTERNAME).txt"

The resultant information needs to be stored in a .csv file and the format needed is comma separated as follows:

Device Serial Number,Windows Product ID,Hardware Hash
9695-7543-8434-9503-5022-9771-82,00330-80000-00000-AA342,T0GoAQEAHAAAAAoA4wHXOgAACgCetcetc

You can repeat this process for all the devices you wish to Autopilot and add them to the same .csv file.

Configuring Autopilot in the Windows Store for Business

With data collected and ready to upload, go to the Windows Store for Business portal and log in. Then click Manage\Devices

Click the AutoPilot deployment drop down and choose Create New Profile

At present the following choices are available to the Windows 10 Creators Update:

• Skipping Work or Home usage selection (Automatically enabled)
• Skipping OEM registration, OneDrive and Cortana (Automatically enabled)
• Skipping privacy settings
• Preventing the account used to set-up the device from getting local administrator permissions

Enable Skip Privacy Settings and Disable local admin account creation on the device. Then click Create.

Next you need to import the device or devices from the csv file that was created. To do this, click the Add Devices link.

Select the .CSV file for import.

Enter a relevant name for the group of devices you are importing.

Notice that the devices are being imported and you have to wait for this process to complete.

With the device/s imported, the next step is to assign the Autopilot profile to the device. Select the device/s and click the Autopilot deployment drop down and choose your profile. Once again, you will be informed that the request is being processed.

Once the profile has applied, you will see it assigned against against the device.

You are now in a position to fire up your Windows 10 device and let Autopilot do its work.

Autopilot in action

Before you fire up your Windows 10 device, make sure that you are auto enrolling your devices in Intune, or other MDM solution. Microsoft has an excellent guide on how to do this here.

With your Windows 10 device Internet connected, you’ll be prompted to choose the region and keyboard settings that you prefer. After this is done your device will inform you that things are happening

After a restart, you will be presented with your work login. It’s as simple as that.

With your MDM solution of choice in place, you can start to push down applications, compliancy and settings to the device or end user. For example, you can push the latest Office 365 release direct from Intune, and this will stream down in the background.

It’s going to be interesting to see where Microsoft takes Autopilot with the next release, the Creators Update, and what impact this will have overtime on traditional on-prem Windows image deployment mechanisms.

Further viewing

Microsoft has published a couple of Autopilot videos that are worth taking a look at.

• Windows AutoPilot
• Introducing Windows Autopilot deployment

The post Implementing Windows Autopilot – the future of device deployment appeared first on Microsoft Industry Blogs - United Kingdom.

By David Cattanach

Is Windows 10 going to be free? Will Windows 10 be the last ever version? Will 2015 be a great summer? Well, let’s tackle the second question here.

What’s New?

Currently, you might buy a PC and it will come with Windows pre-installed. You’ve paid for the OEM (Original Equipment Manufacturer) licence of Windows. You’ll get feature updates and security patches from time to time and you can choose to install them or hide them. It’s up to you or you organisation’s IT policy.

With Windows 10, you won’t have a choice. Windows updates will be applied when they’re ready. So in a way, Windows 10 will be the last version because you will never have to pay for the next version of the client OS on the same PC; new features will just be installed. If you need to buy a new machine, you’ll pay for the OEM licences part of the PC’s purchase price and then Windows will just be kept up to date for the lifetime of the device.

You may be concentrating on the negative here that updates will be automatically installed. Think about three huge positives though:

1. 1. You never need to pay for Windows again on the same machine and you’ll always have the latest version
   2. No more wipe and reload upgrades
   3. Software vendors and developers can almost guarantee that 90% of Windows users will have the same build

The third point there should make you smile if your PC has ever crashed or you’ve needed to phone support because an application isn’t working. There are so many combinations of OS, patches, drivers, runtime files and versions around that reliability and consistency are devilishly hard to achieve. Applications and peripherals should work far better if the manufacturers and developers can work to a stable and single platform.

Windows Enterprise and Windows Education edition customers will be required to maintain their Software Assurance (SA) in order to enjoy new feature updates. So we have a subtlety here; whilst enterprise customers will not need to pay for the Windows licence again on the same device, they will need to maintain their SA annuity. We’ll explain why in the last section of this post.

Why is Windows Becoming a Service?

The world of software is changing to cloud – a.k.a software as a service. With that change comes different release cadences. If you’ve been in IT for a while you’ll be familiar with the terms 3.5 inch floppy, modem and three-year release cycles. Office 365 has a monthly release cadence. Azure enjoys weekly updates. This is the way of the world; goodbye versions and hello evergreen services. Innovation has become faster and users expect new features quicker.

What if I Don’t Want to Automatically Install Updates?

Windows 10 is going to have three broad demarcations of users: consumers, business users and mission-critical business systems. For each type there is something known as a ‘branch’.

Consumers will be subject to the Current Branch (CB) and will receive Windows updates as they are released. Of course, they will have gone through extensive testing via engineering builds, internal testing, early adopters and the Windows Insider program beforehand so several millions of users will already have installed these updates.

Business Users will default to Current Branch but have the option to select Current Branch for Business (CBB). This allows them to defer feature updates for up to eight months after they’re released to the Current Branch. This provides ample time for testing, compatibility work and fixes and just to wait and see how the hundreds of millions of Current Branch users get on with the updates. The updates can be deferred but they will need to be installed within that eight-month time-frame. Organisations will be able to control and manage how updates (including critical and security updates) are deployed using tools such as System Centre Configuration Manager, Windows Server Update Services or a new Windows 10 service called Windows Update for Business.

PCs running life-dependent, highly secure or mission-critical systems, for example in a life-support centre or a military aerospace controller etc. have the option to deploy point-in-time releases known as Long Term Service Branch (LTSB). These will not be updated with new features but will have security and critical updates applied, although the organisation can manage and control the distribution of these updates. LTSB releases will be supported for at least 5 years (10 years if the customer has software assurance). New LTSB releases will be made available every two-three years and customers will have the option whether to install them or not.

In short, if you don’t want to receive Windows OS updates, you will need to be on the LTSB and that requires certain Windows editions.

Long Term Service Branch is only Available for Windows Enterprise edition

Windows Home edition must be on Current Branch. Windows Pro can be on either Current Branch or Current Branch for Business. This means that both of these editions will be evergreen (CBB allows the updates to be deferred but only for up to 8 months).

Windows Enterprise edition is available with or without software assurance. Windows Enterprise without SA allows the customer to deploy a point-in-time LTSB release, or previous ones (downgrade rights in other words) and for that release to still be supported for 5 years. Windows Enterprise edition with SA also gives customers the rights to new LTSB release when they become available (every 2-3 years). They can choose whether to install new releases or not. SA also means the customer gains extended support so their chosen release will be supported for 10 years.

Even if a customer does have LTSB requirements, it’s unlikely that all of their devices will require it so customers with Windows Enterprise with SA (or indeed Windows Education with SA) will be able to mix Current Branch, CBB and LTSB according to their needs.

One important point to note is that Enterprise edition without SA will not enjoy updates on Current Branch either. Customers with Home and Pro editions will always get the latest features for the life of the device. Enterprise edition without SA will not. The release that’s installed will eventually become out of date and the customer will need to buy a licence again to update.

Windows 10 Enterprise Edition with SA is available through all Microsoft Volume Licensing Programs (Open, Open Value, Select+, MPSA, EA, etc.). You can visit this blog post to read about how to upgrade to Windows 10.

Resources

• Getting started with Windows 10 for IT Professionals

The post Windows 10 Licensing Logic appeared first on Microsoft Industry Blogs - United Kingdom.