{"id":10769,"date":"2016-03-18T17:26:18","date_gmt":"2016-03-19T00:26:18","guid":{"rendered":"https:\/\/www.microsoft.com\/insidetrack\/blog\/?p=10769"},"modified":"2023-06-09T15:24:39","modified_gmt":"2023-06-09T22:24:39","slug":"mobile-device-management-at-microsoft","status":"publish","type":"post","link":"https:\/\/www.microsoft.com\/insidetrack\/blog\/mobile-device-management-at-microsoft\/","title":{"rendered":"Mobile device management at Microsoft"},"content":{"rendered":"
This content has been archived, and while it was correct at time of publication, it may no longer be accurate or reflect the current situation at Microsoft.<\/p>\n<\/div>\n<\/div>\n
Bring your own device is no longer just a trend\u2014it is arguably the dominant workplace culture. More employees are using personal devices for work, creating a unique set of challenges for IT teams that must balance user convenience and data security. Microsoft uses Enterprise Mobility Suite and other services to manage identity, devices, and applications. Now, simplified and integrated IT solutions enable employees to be productive on any device.<\/p>\n
In a bring your own device (BYOD) work environment, users expect to be able to work from any location at any time, on the device of their choice. Moreover, users now typically have several identities, meaning that they use their devices in both work-related and non-work-related contexts. For example, they might bring a personal tablet to a business meeting and expect to access files on a team\u2019s Microsoft SharePoint site, or they might present a Microsoft PowerPoint presentation over Microsoft Skype for Business. They\u2019re likely to check both work and personal email accounts on their phone, and may use their phone camera to take photos of whiteboard sessions to help them remember what a work group collaborated on during a meeting. On both types of device, they\u2019re likely to have a mix of apps, some for personal use and some for work.<\/p>\n
But as the traditional boundaries between work and personal life blur the use of these devices, it\u2019s critical that devices be managed in a way that is acceptable to the entire business. Data policies, such as encryption, password length, password complexity, and password duration, must provide corporate data security on all devices while maintaining the privacy of workers\u2019 personal information.<\/p>\n
IT must be able to identify, with certainty, who a user is and if a device should have access to corporate resources. Current trends suggest that workers change jobs and companies several times over the course of a career, so IT needs a way to account for this flux of people and devices. What should IT do if a device is lost or an employee leaves the company? What is the best way to ensure that corporate resources are wiped from a personal device that should no longer have access to them?<\/p>\n
In short, the situation for IT is about managing data, managing access to that data, and handling the use of multiple accounts and identities on a device.<\/p>\n
Microsoft Digital has been involved in mobile device management (MDM) for several years and is evolving strategies and best practices to ensure the proper balance between convenience and security as BYOD becomes the norm in organizations of all sizes.<\/p>\n
Microsoft Digital approaches MDM a bit differently today than it did in the past. Even as recently as 2013, the focus was much more on providing access to applications. Now, however, the focus is on access as defined by certificate and profile provisioning. In the future, the focus will be on conditional access that is based on the state of the device as interpreted through the MDM system and Microsoft Azure Active Directory.<\/p>\n
The Microsoft Intune and Microsoft Azure teams are working together to provide solutions so that Microsoft Digital can address a range of related issues: identity and access management, mobile device and app management, and information protection. The first step is to make Microsoft Digital cloud-based and enable a mobile workforce.<\/p>\n
For employees who use multiple devices for work, a key convenience\u2014a requirement, even\u2014is to have single sign-on (SSO) and a common identity, so that they can get their work done on whatever device suits them at the moment. A common identity enables application access management, regardless of whether those applications are on the device or in the cloud. This ensures that the user can have a consistent experience across devices and remain as productive as possible.<\/p>\n
Microsoft Digital\u00a0is delivering identity and access management by providing that SSO experience, using federation to manage access to external resources, and consistently managing identities across on-premises and cloud-based identity domains. This helps Microsoft Digital address the matter of managing access.<\/p>\n
The following are some specific features:<\/p>\n
Azure Active Directory syncs with on-premises Active Directory Domain Services through Azure AD Connect. Azure Active Directory enables self-service password changes and resets, and self-service group management for internal users. It also supports multifactor authentication, so that internal users don\u2019t have to carry around their smart cards.<\/p>\n
Multifactor authentication<\/strong>\u00a0provides an additional layer of security in case a device falls into the wrong hands or is used improperly. When a user attempts to log on or perform an action that is subject to multifactor authentication, the application or service confirms the user\u2019s identity by sending a text, making a phone call, or using a mobile app. Typically, this additional authentication factor is a numeric code, such as a personal identification number (PIN), and may only be intended for a single use. The user must respond (usually within a limited period, such as 10 minutes) before the application or service allows him or her to proceed.<\/p>\n Credential caching<\/strong>\u00a0enables enterprises to determine how long credentials can be cached on a device. This allows the enterprises to customize the user experience when users access applications and resources on devices. For example, enterprises can specify how long credentials pass through during logon or device registration, so that users do not have to enter their credentials so many times.<\/p>\n Users prefer a consistent experience when they access and work with their line-of-business (LOB) apps, no matter what device they use, how often they use it, and what platform it runs. Device enrollment should be simple, and the process for finding and working with apps and other internal resources should be familiar. In addition, policies should help users feel secure that their personal data is protected on devices that they also use for work, and it should be possible to remove devices that users no longer want included in a managed environment.<\/p>\n Users can enroll a device relatively quickly in Intune. Notably, the process is opt-in rather than opt-out. This sets a friendlier tone for the experience, because it doesn\u2019t feel like a mandate. Users recognize the value of being able to use personal devices for work, and voluntarily enroll them.<\/p>\n Similarly, when users no longer want to use a device for work, they can easily remove it by using the Intune console (the web portal for information workers). For example, if a device has been lost or stolen, the user can either remove it for himself or herself, or request that Microsoft Digital do so. When a device is removed, corporate assets are automatically removed from it. Devices can be completely wiped or just selectively wiped. See the \u201cDevice retirement\/wiping\u201d section later in this document.<\/p>\n Intune provides a single administrative console that it can use to manage all enrolled devices. One administrative advantage of this solution is the ability to create reports, such as security and audit reports.<\/p>\n For users who connect to corporate resources on mobile devices, Microsoft Digital now relies on its Company Portal to provide a kind of \u201cone-stop shopping\u201d experience for installing and using the Microsoft Windows or LOB apps that they need. Currently, users on iOS or Android platforms install the Company Portal from a separate site. For users on Windows or Windows Phone platforms, the Intune service pushes the Company Portal out to the device.<\/p>\n The Company Portal includes approximately 350 apps\u2014and the number is growing at a rate of 10 to 15 new apps per month. Provisioning also includes updates of existing apps\u2014as many as 35 to 40 are updated per month. Each month, there are approximately 30,000 application installations, and availability of the service has been more than 99 percent.<\/p>\n One goal that Microsoft Digital has for the Company Portal is to create apps that package streams of content and functionality for specific roles and use cases. For example, for users in field sales and marketing, the GearUp app provides a quick reference to every product that Microsoft sells, including value propositions and competitive differentiation. For users who do a lot of business travel, an app is available to instantly track expenses while they are on the go, helping users complete expense reports more quickly for improved compliance.<\/p>\n Whether they are related to encryption, passwords, security, email management, or another fundamental issue, policies are the cornerstones of MDM in an organization. In Intune, users see a dialog box that informs them about policies. They can then select to allow apps and services from Microsoft Digital, or they can cancel device enrollment.<\/p>\n Although users do not always fully appreciate this fact, policies are a form of protection for them too. Their own personal data on the devices that they use for work is more secure when other users and devices in the same environment are managed by policies. For more information about compliance settings for mobile devices, see the \u201cPolicy and security configuration\u201d section.<\/p>\n From an application standpoint, user and device provisioning is an important piece of the mobility landscape in organizations. For example, after app deployment, the app owner can use tools such as Operations Manager in Microsoft System Center to discover issues such as application dependencies, monitor application components, and isolate the cause of issues that are found during monitoring. They can even triage and remediate in Microsoft Visual Studio to fix any issues in the code. From an IT perspective, apps must be managed securely within the overall MDM service. LOB apps should be signed and should be accessed only by managed users.<\/p>\n Microsoft Digital has several goals for information protection, such as keeping corporate data secure, managing data rather than the user, and providing access to data on any trusted device. Techniques for achieving these goals include encryption and policies, as mentioned earlier.<\/p>\n Additionally, Intune enables access to company resources through certificate profiles. When certificate profiles are used to configure managed devices with the certificates that they need, device users can connect to on-premises company resources by using connections such as Wi-Fi or a virtual private network (VPN). When Microsoft Digital deploys certificate profiles, it provisions devices with a trusted root certificate for the company\u2019s public key infrastructure (PKI) and configures them to request device-specific certificates.<\/p>\n Microsoft Digital will be offering conditional access features to help improve the precision of access and protection. For example, users who require just read-only access to a file or resource will be restricted from editing, printing, or forwarding it. One of the most significant scenarios for conditional access is email provisioning, but other scenarios include certificate provisioning and profile provisioning. Taken together, these techniques help address data management.<\/p>\n Although Microsoft Digital is evolving its approach to MDM, it\u2019s important to consider, from a tactical perspective, how exactly it performs MDM. The information in this section describes, in detail, a deployment solution for a hybrid environment that includes both System Center Configuration Manager and Intune. Although smaller organizations might need only Intune (a stand-alone rather than hybrid environment), most medium to large organizations, including Microsoft, already have Configuration Manager and use it in combination with Intune.<\/p>\n MDM consists of a series of components that work in concert:<\/p>\nMobile device management<\/h3>\n
Device enrollment<\/h4>\n
Provisioning of the Company Portal<\/h4>\n
Policies across mobile devices<\/h4>\n
Mobile application management<\/h3>\n
Information protection<\/h3>\n
Deployment<\/h3>\n
Architecture<\/h4>\n
\n