Microsoft: Modern Devices Management

1. Modern Devices Management
AtanasGergiminov
SystemEngineer-PolyComp

4. 150M
Devices managed by
ConfigMgr & Intune
1.1B
Azure Active
Directory Identities
700M
Windows 10 PCs
450B
Authentications
per month
135M
Office 365 monthly
active users

5. Management Powered by the Cloud
On-premise
Traditional OS Deployment
Win32 app management
Configuration and GPO
Bitlocker Management
Hardware and software inventory
Update management
Cloud managed
Unified Endpoint Management – Windows, iOS, macOS, Android
Modern access control – Compliance, Conditional Access
Modern provisioning – Autopilot, DEP, Zero Touch, KME
Modern security – Hello, Attestation, ATP, Secure Score
Modern policy – Security Baselines, Guided Deployments
Modern app management – O365 Pro Plus, Stores, SaaS, VPP
Full M365 integration – Analytics, Graph, Console, RBAC, Audit

6. Unified Endpoint Management

7. The How
Intune web console
Mobile devices and PCs
IT
ConfigMgr console
Microsoft Intune
Mobile devices
System Center
ConfigMgr
IT
Domain joined PCs
ConfigMgr integrated with Intune (hybrid)Intune standalone (cloud only)
Microsoft Intune
System Center Configuration Manager
with Microsoft Intune
Build on existing Configuration Manager
deployment
Full PC management (OS Deployment,
Endpoint Protection, application delivery
control, rich reporting)
Deep policy control requirements
Scale to 100,000 devices
Extensible administration tools (RBA,
PowerShell, SQL Reporting Services)
Cloud-based Management
Microsoft Intune
No existing Configuration Manager
deployment
Simplified policy control
PC+MDM: 4K users, 6K PCs, and 7K devices
MDM Only: 25k users and 50k mobile
devices
Simple web-based administration console

8. Modern access control

9. Microsoft Cloud
3rd Party SaaS Apps
On Premises Apps
Microsoft Azure
Monitor users /
prevent data leak
Block various actions
Restrict download
Enforce MFA
Block sign-in
Allow sign-in
Access Control
Session Restrictions
OS Platform
Is Compliant / Domain joined
Is lost or stolen
Device Risk
Device
User identity
Group membership
Session Risk
User
Mobile or Cloud app
Per app policy
App
Location
IP range
Country / Region
ApplicationsPolicy Controls
Conditional Access
Policy Conditions
Windows
Defender
Azure AD
Identity
Protection
Service
Microsoft
Cloud App
Security
ODSP limited
access

10. Modern provisioning

11. BYOD CORP OWNED
iOS deployment scenarios

12. Android Enterprise continues to evolve

13. Android deployment scenarios
BYOD
Intune App Protection
Without Enrollment
AE Work Profile
Corp Owned
AE Dedicated (kiosk) AE Fully managed

14. macOS deployment scenarios
+ EMS

15. EMS + Jamf
Intune device compliance for Jamf managed Macs
8. Block access from
noncompliant devices
7. Allow access from
compliant devices
4. Intune evaluates compliance
Microsoft EMS
9. User-friendly remediation
experience provided by Intune and
Jamf
2. Mac is registered with Intune
6. Azure AD enforces Conditional
Access
1. Mac is managed by Jamf Pro
3. Jamf sends macOS device
inventory to Intune
5. Generates compliance report
Intune Azure AD

16. Traditional Windows deployment // The old way
Build a custom image,
gathering everything else
that’s necessary to deploy
Time means money, making
this an expensive proposition
Deploy image to a new
computer, overwriting what
was originally on it
DRIVERS POLICIES
OFFICE & APPS
SETTINGS

17. Modern Windows deployment // The new way
Un-box and turn on
off-the-shelf Windows PC
Device is ready
for productive use
Transform with minimal
user interaction

18. Windows Autopilot overview
Register
devices,
Configure
profile
Self-servicedeploy
Device IDs
Ship
Employee unboxes
device, self-deploys
Intune
and Azure AD
Windows Autopilot
Service
Device sync
Autopilot profile sync
Hardware Vendor
Existing
Devices

19. Windows app management

20. Intune Win32 Software Distribution
PowerShell Scripts
Mobile MSI
Limited to single file MSI for
Win32 apps
Challenge for customers to deploy
complex Windows apps
PowerShell Scripts
Mobile MSI
MSI, EXE, MSP
Leverage MSIX packaging tool to convert your
existing Win32 apps to MSIX
Use new Intune capability to directly deploy Win32
apps (MSI, EXE and MSP/MST)

21. Application Model Diagram

22. Prepping the content
Download tool
Generates app
manifest
Encrypt
installation files
Convert
installation files

23. App Install
Content Delivery
Network
IT
Create app
User
App
Assign Windows
app
App
Request App
Evaluate