Download as PDF, PPTX
Uploaded byDavid J Rosenthal
Mobile Device Management for Office 365 - Atidan
Microsoft Intune provides mobile device management (MDM) capabilities for Office 365. It allows organizations to enroll mobile devices used by employees and set policies to control access to corporate resources. Intune integrates with Azure Active Directory and Office 365 to enable features like conditional access control, selective wiping of Office 365 data from devices while leaving personal data intact, and reporting on device compliance. It also provides broader mobile application management and mobile PC management capabilities through integration with System Center Configuration Manager.
More Related Content
Similar to Mobile Device Management for Office 365 - Atidan
Mobile Device Management for Office 365 - Atidan
- 1. David J. Rosenthal CEO,Atidan May 4, 2015 Ignite Conference, Chicago, IL Mobile Device Management for Office 365
- 2. Agenda Trends aroundmobility and BYOD MDM for Office 365 overview Demo admin setup & end user experience
- 4. iOS and Androidapps Enforce app password Wipe just the app Entire org or individuals (no groups) Exchange ActiveSync Devices supporting EAS Enforce device password Wipe entire device Entire org or individuals (no groups) Other appsOWA for Devices No controls
- 5. Protect your data Enable your usersUnify Your Environment Devices Apps Data Helping organizations enable their users to be productive on the devices they love while helping ensure corporate assets are secure
- 6. Enroll • Provide aself-service Company Portal for users to enroll devices • Deliver custom terms and conditions at enrollment • Bulk enroll devices using Apple Configurator or service account • Restrict access to Exchange email if a device is not enrolled Retire • Revoke access to corporate resources • Perform selective wipe • Audit lost and stolen devices Provision • Deploy certificates, email, VPN, and WiFi profiles • Deploy security policy • Install mandatory apps • Deploy app restriction policies • Deploy data protection policies Manage and Protect • Restrict access to corporate resources if policies are violated (e.g., jailbroken device) • Protect corporate data by restricting actions such as copy/cut/paste/save outside of managed app ecosystem • Report on device and app compliance User IT
- 7. Inventory mobile devicesthat access corporate applications Remote factory reset (full device wipe) Mobile device configuration settings (PIN length, PIN required, lock time, etc.) Self-service password reset (Office 365 cloud only users) Provides reporting on devices that do not meet IT policy Group-based policies and reporting (ability to use groups for targeted device configuration) Root cert and jailbreak detection Remove Office 365 app data from mobile devices while leaving personal data and apps intact (selective wipe) Prevent access to corporate email and documents based upon device enrollment and compliance policies Self-service Company Portal for users to enroll their own devices and install corporate apps Deploy certificates, VPN profiles (including app-specific profiles), and Wi-Fi profiles Prevent cut/copy/paste/save as of data from corporate apps to personal apps (mobile application management) Secure content viewing via Managed browser, PDF viewer, Imager viewer, and AV player apps for Intune Remote device lock via self-service Company Portal and via admin console PC management (e.g. inventory, antimalware, patch, policies, etc.) OS deployment (via System Center ConfigMgr) PC software management Single management console for PCs and mobile devices (through integration with System Center ConfigMgr)
- 8. Microsoft IntuneBuilt-In Device Management Conditional Access Selective Wipe Built-InMicrosoft Intune LoB app User-centric approach
- 9. Before mobile devicescan access Office 365 data, they must be enrolled and healthy. 1. A user downloads the public OneDrive app on a personal iPad 2. The user is shown a page that directs them to enroll the iPad 3. The user steps through the enrollment process 4. The OneDrive app is now MDM enabled 5. The user is able to access their OneDrive data
- 10. Device Polices • Controlwhat mobile devices can connect to Office 365 Data • Set device configuration policies such as pin lock • Enforce data encryption on devices Admin Controls • Built-In management in Office 365 Admin Center, and PowerShell • Configure device policies by groups • Product level granular control Device Reporting • Device compliance reports • Mobile usage and trends in our organization • API support
- 11. The IT admincan wipe Office 365 data from the user’s device. When they trigger the wipe, all of the data cached or stored by the apps will be deleted, while all of the user’s personal content remains intact. 1. An employee uses Office 365 apps and data on a mobile device. The employee leaves the company. 2. The IT admin logins into Office 365 Admin Center to perform a selective wipe 3. The Office 365 data is removed from the Office applications leaving personal information intact
- 12. * Native emailclients that use ActiveSync will support Conditional Access, and Selective Wipe ** Office on Windows Phone (Combined App)
- 13. Configure Microsoft Intune withOffice 365
- 14.
- 28. Action required toaccess your organization’s email This email was automatically generated by Microsoft Exchange. You are receiving this message because your IT department requires that you enroll your device in order to access Exchange email. This helps to protect corporate information in your organization. Follow the steps listed on this site to enroll your device, verify compliance, and activate your email. Please contact your IT department with any questions or problems.
- 29.
- 34.
- 35.
- 36.
- 37. Contoso company…Contoso deviceenro… www.microsoftintune/contoso/devicemanagement.com
- 38. Contoso company…Contoso devicee… www.microsoftintune/contoso/devicemanagement.com
- 52. Contoso Contoso IT ContosoDashContoso Data Store Contoso Viewer Outlook
- 61.
- 62.
- 64.
- 65. Pasting content notallowed This content is managed by Contoso. The destination is not. Pasting this content is not allowed by your administrator. paste close
- 90.
- 93.
- 94.
- 95. Contoso IT Device NotEnrolled To Access emails and other company resources CONTOSO 11:18
- 96. Contoso IT Device NotEnrolled Thu 1/16, 11:18 To: Contoso Employees To access emails and other company resources, your device needs to be enrolled with Contoso. To enroll your device follow the instructions below: Step 1: Enroll your Device Step 2: Once you’ve enrolled your device. Click here to activate
- 97. Redirecting to deviceenrollment... https://portal.manage.micro
- 99.
- 100.
- 101.
- 102.
- 103.
- 104. Contoso IT Device NotEnrolled To Access emails and other company resources CONTOSO
- 105. Contoso IT Device NotEnrolled Thu 1/16, 11:18 To: Contoso Employees To access emails and other company resources, your device needs to be enrolled with Contoso. To enroll your device follow the instructions below: Step 1: Enroll your Device Step 2: Once you’ve enrolled your device. Click here to activate
- 106.
- 107. Jame s Activation Successful! Your access toemails and other company resources has been granted. https://activate.aad/contoso/
- 108.
- 109. Contoso IT Device NotEnrolled To Access emails and other company resources CONTOSO
- 110. Office 365Users ontheir devices Azure AD Report device compliance Enroll device, evaluate & enforce compliance with device management policies Microsoft Intune IT Admin
- 111. (Workplace Join + management) 4 Conditionalaccess control - Exchange ActiveSync (EAS) Azure AD DRS EAS Client EAS Server Intune Get email EAS ID, username, password 1 Lookup device compliance state 2 Register EAS email client 6 Create EASID to device ID binding 7 Set device management/ compliance status 5 Device object - device id - isManaged - MDMStatus - EASIDs Azure AD Push device into quarantine Quarantine email Quarantine email Step 1: Enroll device Step 2: Register EAS client 3
- 112. © 2015 MicrosoftCorporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION. office365@atidan.com
- 114. Corporate Complete mobile applicationmanagement • Securely access corporate information using Office mobile apps, while preventing company data loss by restricting actions such as copy/cut/paste/save in your managed app ecosystem • Extend these capabilities to existing line of business apps using the Intune app wrapper • Enable secure viewing of content using the Managed Browser, PDF Viewer, AV Player, and Image Viewer apps Manage all of your corporate apps and data with Intune’s mobile device and application management solution Personal Managed Browser & Viewer Apps
- 115. Mobile device management •Deploy certificates, WiFi, VPN, and email profiles automatically once a device is enrolled for management • Enable bulk enrollment of task-worker devices to set policies and deploy applications on a large scale • Provide a self-service Company Portal for users to enroll their own devices and install corporate apps PC management • Provide lightweight, agentless management from the cloud • Connect Intune to System Center 2012 R2 Configuration Manager to manage all of your devices including PCs, Macs, Unix/Linux Servers, and mobile devices from a single management console • Provide real-time protection against malware threats on managed computers • Collect information about hardware configurations and software installed on managed computers • Deploy software based upon policies set by the administrator User
- 146.
- 148.