Microsoft Enterprise Mobility Suite is poised to conquer the mobility world - so now is the time to join and embrace. The Microsoft EMS consists of several cloud services, such as Azure AD Premium, ADFS, Multifactor Authentication, Azure RMS and Intune. In this session, we’ll explore the components of Microsoft EMS, including: how they relate to each other, how to get access to them and how you can start a proof of concept in your company. Get your EMS environment enrolled the right way from Day 1 Learn the differences between an EMS standalone and a hybrid implementation (seen as an extension of your on-premise private cloud). An example of this would be self-service password reset. Learn to identify the components of Microsoft EMS so that you are able to use it in your environment Look at different use cases for mobility with EMS, starting from the identity that your enterprise content has Session Takeaway: You’ll leave this session with the information that you need to manage and protect mobile devices with EMS, and you’ll be able to show your boss that you no longer need an on premise infrastructure to manage your mobile workforce.

1. Briforum London 2015
How to Get Started with the Microsoft
Enterprise Mobility Suite

2. Key Takeaways
Why is managing your mobile workforce important?
What is EMS and why do you need it is your Enterprise?
How do we get started with EMS?
How to Get Started with the Microsoft Enterprise Mobility Suite 2

3. Peter Daalmans
Senior Technical Consultant
Peter.Daalmans@it-concern.nl
How to Get Started with the Microsoft Enterprise Mobility Suite
https://twitter.com/pdaalmans
https://www.linkedin.com/in/pdaalmans
http://configmgrblog.com

4. Kenny Buntinx
Managing Consultant
Kenny.Buntinx@kbsolutions.be
How to Get Started with the Microsoft Enterprise Mobility Suite
https://twitter.com/KennyBuntinx
http://be.linkedin.com/KennyBuntinx
http://scug.be/blogs/sccm

5. Enterprise Mobility Suite

6. 2015 Enterprise Mobility Predictions
Say goodbye to BOYD
Say Hello to Data Protection
Organizations will generally have three types of devices
Employee Owned, Company Managed (EOCM)
Company Owned, Company Managed (COCM)
Company Owned, Company Dictated (COOD)
Source:
http://simon-may.com/yet-another-predictions-post-mobility-2015/
How to Get Started with the Microsoft Enterprise Mobility Suite 6

7. • SCCM is undisputed winner of
PC Mgmt w/ >70% share
• You need to look into a MDM
solution today
• We believe Microsoft is the
long-term winner
How to Get Started with the Microsoft Enterprise Mobility Suite
Growth is all in Mobile Devices
349 315 296 294 293 292
725
1,010 1,131
1,283
1,434
1,579
162
231
270
308
340
368
0
500
1,000
1,500
2,000
2,500
2012 2013 2014 2015 2016 2017
Tablet
Smartphone
PC
Devices Shipments (MM)
Source: IDC

10. Licensing
Microsoft Intune (Standalone)
Enterprise Mobility Suite
Microsoft Intune
Azure Active Directory Premium
Azure Rights Management
Enterprise Cloud Suite
Enterprise Mobility Suite
Office 365 Enterprise E3
Windows Software Assurance
http://www.microsoft.com/licensing/about-
licensing/briefs/enterprise-cloud-suite.aspx
How to Get Started with the Microsoft Enterprise Mobility Suite 10

11. Azure AD Premium
Identity

12. Azure Active Directory Premium
Active Directory in the cloud
Federation and identity provisioning
Centrally managed identities
Synchronization
Single User Identity (SSO)
Monitoring and protect access to cloud apps
Authentication and Security reports
Multi-Factor Authentication (MFA)
Empower end Users
Self-Service password reset
How to Get Started with the Microsoft Enterprise Mobility Suite 12

13. Azure Active Directory free and premium offerings
feature comparison

14. Identity: Cloud, Sync or Federated?

 

Cloud identity provides a
solution where all identity
resides in the cloud
Federated identity allows
customers to retain all
authentication on-premises
Identity sync enables customers
to bridge their existing identity
into the cloud
B2B federated identity allows
customers to securely share and
collaborate with each other

15. Common Identity with Sync and Federation
User attributes are synchronized including the password
hash, Authentication can be completed against either
Azure or Windows Server Active Directory
User attributes are synchronized, Authentication is
passed back through federation and completed
against Windows Server Active Directory
Synchronization
Federation
AD FS provides conditional access to
resources, Work Place Join for device
registration and integrated Multi-Factor
Authentication
*Write back of attributes to support
cloud first and co-existence

16. Azure Active Directory
Identity
Demo

17. Enabling users
Self-service password reset
Self-service Profile access

18. Self-service group
management, including
dynamic membership
calculation in these groups
and distribution lists, based
on the user’s attributes.
Users can reset their passwords
significantly reducing help desk
burden and costs.
Users can edit their profile
details to update and add
missing information
Provide users with self-service experiences

19. Self-service password reset
Demo

20. Security Reports
Self-service Profile access
Multi Factor Authentication

22. Multi-Factor Authentication

23. How to Get Started with the Microsoft Enterprise Mobility Suite 25
What is multi-factor authentication?
Any two or more of the following factors:
 Something you know: a password or PIN.
 Something you have: a phone, credit card or hardware token.
 Something you are: a fingerprint, retinal scan or other biometric.
Stronger when using two different channels (out-of-band).

24. Security Reports
Demo

27. Microsoft Intune

28. Microsoft Intune
Mobile Device Management
Windows, Windows Phone, IOS and Android
Policy and Application Management
Compliance reporting
Conditional Access to resources
Selective Wipe Devices
Hybrid / Cloud solution
How to Get Started with the Microsoft Enterprise Mobility Suite 30

29. Single management console for IT admins
Configuration Manager console (hybrid)Intune web console (cloud only)

30. Comprehensive lifecycle management
Enroll
• Provide a self-service Company
Portal for users to enroll devices
• Deliver custom terms and
conditions at enrollment
• Bulk enroll devices using Apple
Configurator or service account
• Restrict access to Exchange
email if a device is not enrolled
Retire
• Revoke access to corporate
resources
• Perform selective wipe
• Audit lost and stolen devices
Provision
• Deploy certificates, email, VPN,
and WiFi profiles
• Deploy device security policy
settings
• Install mandatory apps
• Deploy app restriction policies
• Deploy data protection policies
Manage and Protect
• Restrict access to corporate
resources if policies are violated
(e.g., jailbroken device)
• Protect corporate data by
restricting actions such as
copy/cut/paste/save outside of
managed app ecosystem
• Report on device and app
compliance
User IT

31. Company Portal(s)

32. Company portal self-service experience
Consistent experience across:
Windows
Windows Phone
Android
iOS
Discover and install corporate apps
Manage devices and data
Customizable terms and conditions
Ability to contact IT
Force the Policy refresh
How to Get Started with the Microsoft Enterprise Mobility Suite 3434

33. Mobile Device – Portals
All portals offer the same experience
(except for Windows Phone)

34. Device Enrolment – The new way
Conditional access

35. Enrolling Devices
Users can enroll devices that configure
the device for management with Windows
Intune; the user can then use the
Company Portal for easy access to
corporate applications
Data from Windows Intune is in
sync with Configuration Manager,
which provides unified
management across both on-
premises and in the cloud
Dirsync
w Pwd Sync
Connector
Internal
Connector

36. Conditional access for Office 365
7
5
4
2
1
3
6

37. Device Enrolment – The new way
Conditional access
DEMO

38. Application Management

39. Mobile Application Management
How to Get Started with the Microsoft Enterprise Mobility Suite 43
Personal apps

40. Mobile Application Management
How to Get Started with the Microsoft Enterprise Mobility Suite 44

41. Mobile Application Management
DEMO

42. Rights Management

43. Microsoft Rights Management
Encrypt and control
Documents
Mails
Prevent unwanted viewing/printing or access to
Corporate data
How to Get Started with the Microsoft Enterprise Mobility Suite 47

45. Integrating RMS into workflows

46. Sharing documents securely

47. Rights Management
Demo

48. Corporate Data Removal
Full Wipe vs. Selective Wipe

49. Options for corporate data removal
How to Get Started with the Microsoft Enterprise Mobility Suite 53

50. Selective/Full Wipe
DEMO

51. Questions
How to Get Started with the Microsoft Enterprise Mobility Suite 56

52. How to Get Started with the Microsoft Enterprise Mobility Suite 57