Transcript Empowering people-centric IT Mobile Device Management Desktop Virtualization Hybrid Identity Access and information protection Users Devices Apps Data Mobile Device Management √ Unify your environment Enable users Protect your data On-premises and cloud-based management of devices within a single.

Empowering
people-centric IT
Mobile Device
Management
Desktop
Virtualization
Hybrid Identity
Access and
information
protection
Users
Devices
Apps
Data
Mobile Device Management
√
Unify your environment
Enable users
Protect your data
On-premises and cloud-based
management of devices within a
single console.
Simplified, user-centric application
management across devices
Comprehensive settings
management across platforms,
including certificates, VPNs, and
wireless network profiles
Access to company resources
consistently across devices
Simplified registration and
enrollment of devices
Synchronized corporate data
Protect corporate information by
selectively wiping apps and data
from retired/lost devices
A common identity for accessing
resources on-premises and in the
cloud
Identify which mobile devices have
been compromised
Over the air device enrollment
Self service portal for end users
User-targeted available app deployment
User and device settings management
Device inventory
Users can enroll devices that configure
the device for management with
Windows Intune; the user can then use
the Company Portal for easy access to
corporate applications
Users can register BYO
devices for single sign-on
and access to corporate
data with Workplace Join.
As part of this, a certificate
is installed on the device
IT can publish access to corporate resources with the
Web Application Proxy based on device awareness
and the user’s identity.; multi-factor authentication
can be used through Windows Azure Active
Authentication (formerly PhoneFactor)
Data from Windows Intune is in
sync with Configuration
Manager, which provides
unified management across
both on-premises and in the
cloud
As part of the registration
process, a new device object is
created in Active Directory,
establishing a link between the
user and their device
•
•
•
•
•
•
•
How to ensure successful enrollment:
Admin must configure mobile device management in the ConfigMgr console
Admin must enable enrollment for specific device types
Admin must allocate an Intune license to the user and must enable Active
Directory user discovery
User must enroll one device at a time and have less than 20 mobile devices in
the system
Windows Phone 8 Only: WP8 code signing certificate must be configured
properly
iOS only: Apple Push Notification Service certificate is must be configured and
not expired.
iOS 5.0+ is required
Personal vs. Corporate
Owned Devices
App inventory
By default, user-enrolled devices
are “Personal”
Admin can specify corporateowned devices
Personal devices – Inventory of applications
installed by ConfigMgr/Intune only
Corporate devices – Complete inventory of
all applications on the device*
App Management
Global condition to differentiate
app installs on corporate versus
personal
* Windows and Windows Phone allow inventory of MDM provisioned apps only
Category
Win 8.1 PC & RT
WP8.1 (New!)
iOS
VPN



Wi-Fi




Certificates






Email
Android
Password




Device restrictions








Store access
Browsers

Content Rating

Cloud Synch



Encryption




Security




Roaming


Windows Server Work Folders


* Note: Table applicable to direct MDM and not EAS
Resource Access Configuration
Features*
Configure VPN profiles
Support for Windows 8.1 Automatic VPN
Wi-Fi protocol and authentication settings
Email account profiles
Management and distribution of certificates
Benefits
Platforms
End users get
access to
company
resources with no
manual steps for
them
Windows 8.1
Windows 8.1 RT
iOS
Android
Windows Phone 8.1 (New!)
18
Support for VPN
standards
SSL VPNs from Cisco, Juniper,
Check Point, Microsoft, Dell
SonicWALL, F5
Subset of vendors have Windows
VPN plug-in
PPTP ,L2TP, IKEv2
Automatic VPN
connection
DNS name-based initiation
support for Windows 8.1 and iOS
Application ID based initiation
support for Windows 8.1
Manage and distribute certificates
Manage Wi-Fi protocol and authentication settings
Provision Wi-Fi networks that device can auto connect
Specify certificate to be used for Wi-Fi connection
Deploy trusted root certificates
Support for Simple Certificate Enrollment Protocol
(SCEP)
Intune
SCCM Connector
Network Device
Enrollment Service
(NDES)
SCCM
Certificate
Registration
Point
SCCM
plug-in
Device
CA
IW
Desktop
Admin
Intune
SCCM Connector
Network Device
Enrollment Service
(NDES)
SCCM
Certificate
Registration
Point
SCCM
plug-in
Device
CA
IW
Desktop
Admin
1. Install NDES role
a) Install PKI client auth
certificate
2. Add Certificate
Registration Point site
system role
a) Specify root CA cert
for client auth cert
from 1a.
b) Self-signed server
auth cert is created
3. Install Policy Module on
NDES
a) Specify client auth
cert from 1a.
b) Specify server auth
cert from 2b.
Reference: Using a Policy Module with the Network Device Enrollment Service
Reference: Using a Policy Module with the Network Device Enrollment Service
Manage Exchange ActiveSync accounts
Configure account settings and security restrictions
Enable certificate authentication
Support for iOS and Windows Phone 8.1
NEW in January ‘14 release!
Delivered as Configuration Manager Extension for
Windows Intune
Admin is
notified that
an extension
is available
when
console is
launched
Admin goes
to
Extensions
for Intune in
console, and
enables the
extension
Extension is
activated in
ConfigMgr
• (Extension
enables on all
site system,
then console
updates are
avail)
Admin
restarts
console, and
console is
updated with
the extension
Admin uses
feature
delivered by
the extension
Admin may
wish to
disable the
extension
Mobile Device Management Review
√
Unify your environment
Enable users
Protect your data
On-premises and cloud-based
management of devices within a
single console.
Simplified, user-centric application
management across devices
Comprehensive settings
management across platforms,
including certificates, VPNs, and
wireless network profiles
Access to company resources
consistently across devices
Simplified registration and
enrollment of devices
Synchronized corporate data
Protect corporate information by
selectively wiping apps and data
from retired/lost devices
A common identity for accessing
resources on-premises and in the
cloud
Identify which mobile devices have
been compromised
Enterprise Mobility Suite
EMS will enable customers with:
Hybrid Identity Management
• Group management & Self Service Password Reset
• Security audit reports & MultiFactor Authentication
• Connection between AD / Azure AD
Mobile Device Management
• Mobile device settings management
• Mobile app management
• Selective wipe
Data Protection
• Information protection
• Connection to on-premises assets
Enterprise Agreement Prices starting at $4 per user per month*
* Limited time EA Level A promo pricing. Requires 250 seat minimum purchase and underlying CAL Suite license (CoreCAL/ECAL/BridgeCAL)
Session
Title
Timeslot
FDN02
Enabling Enterprise Mobility with Windows Intune, Microsoft Azure, and Windows Server
Monday, May 12 11:00 AM - 12:00 PM
PCIT-B212
Design Considerations for BYOD
Tuesday, May 13 10:15 AM - 11:30 AM
PCIT-B213
Access Control in BYOD and Directory Integration in a Hybrid Identity Infrastructure
Wednesday, May 14 3:15 PM - 4:30 PM
PCIT-B310
Empowering Your Users and Protecting Your Corporate Data
Monday, May 12 1:15 PM - 2:30 PM
PCIT-B313
Hybrid Identity: Extending Active Directory to the Cloud
Monday, May 12 4:45 PM - 6:00 PM
PCIT-B314
Understanding Microsoft’s BYOD Strategy and an Introduction to New Capabilities in
Windows Server 2012 R2
Tuesday, May 13 8:30 AM - 9:45 AM
PCIT-B321
Deploying the New RMS for Cloud-Friendly and Cloud-Reluctant Customers
Tuesday, May 13 5:00 PM - 6:15 PM
PCIT-B322
Deploying and Managing Work Folders
Wednesday, May 14 10:15 AM - 11:30 AM
PCIT-B324
How to Rapidly Design and Deploy an Active Directory Federation Services Farm: The Do's
and the Don'ts
Wednesday, May 14 8:30 AM - 9:45 AM
PCIT-B326
Providing SaaS Single Sign-on with Microsoft Azure Active Directory
Thursday, May 15 10:15 AM - 11:30 AM
PCIT-B327
Introducing Web Application Proxy in Windows Server 2012 R2: Enable Work from
Anywhere
Wednesday, May 14 3:15 PM - 4:30 PM
PCIT-B328
Microsoft Identity Manager vNext Overview
Wednesday, May 14 5:00 PM - 6:15 PM
PCIT-B330
Active Directory + BYOD = Peace of Mind
Thursday, May 15 8:30 AM - 9:45 AM
Code
Title
Time
FDN02
Enabling Enterprise Mobility with Windows Intune, Microsoft Azure, and Windows Server
Mon, May 12 11:00 AM
PCIT-B311
What's New in Enterprise Management with Microsoft System Center Configuration Manager and Windows Intune
Mon, May 12 1:15 PM
PCIT-B215
What's New in Microsoft System Center 2012 R2 Configuration Manager Infrastructure
Mon, May 12 3:00 PM
PCIT-B410
Microsoft System Center 2012 Configuration Manager: MVP Experts Panel
Mon, May 12 4:45 PM
PCIT-B216
Infrastructure Deployment for Mobile Device Management with Microsoft System Center Configuration Manager and Windows
Intune
Tue, May 13 8:30 AM
PCIT-B317
Enrollment and Management of Mobile Devices with Microsoft System Center Configuration Manager and Windows Intune
Tue, May 13 1:30 PM
PCIT-B320
Microsoft System Center Configuration Manager Community Jewels
Tue, May 13 5:00 PM
PCIT-B323
Application Management with Microsoft System Center Configuration Manager and Windows Intune
Wed, May 14 8:30 AM
PCIT-B325
Protecting Your Corporate Data with Microsoft System Center Configuration Manager and Windows Intune
Wed, May 14 10:15 AM
PCIT-B340
What’s New with OS Deployment in Configuration Manager and the Microsoft Deployment Toolkit
Wed May 14 5:00 PM
PCIT-B336
Managing Mac OS X Clients and Linux Servers Using Microsoft System Center Configuration Manager
Thu May 15 8:30 AM
PCIT-B339
How Microsoft IT Manages Their Microsoft System Center Configuration Manager Application Lifecycle with Zero Touch
Thu, May 15 10:15 AM
PCIT-B333
How Microsoft IT Solves BYOD Using Microsoft System Center 2012 R2 Configuration Manager and Windows Intune
Thu, May 15 1:00 PM
Code
Title
Time
PCIT-IL200
Introduction to Microsoft System Center 2012 R2 Configuration Manager
Mon, May 12 3:00 PM
Wed, May 14 5:00 PM
PCIT-IL201
Upgrading from Configuration Manager 2012 SP1 to Microsoft System Center 2012 R2 Configuration Manager
Thu, May 15 10:15 AM
PCIT-IL300
Deploying Windows 8.1 to Bare Metal Clients
Wed, May 14 1:30 PM
Thu, May 15 1:00 PM
PCIT-IL305
Basic Software Distribution with Microsoft System Center 2012 R2 Configuration Manager
Tue, May 13 5:00 PM
Wed, May 14 3:15 PM
PCIT-IL306
Implementing Endpoint Protection in Microsoft System Center 2012 R2 Configuration Manager
Tue, May 13 10:15 AM
Thu, May 15 8:30 AM
PCIT-IL307
Managing Microsoft Software Updates in Microsoft System Center 2012 R2 Configuration Manager
Tue, May 13 1:30 PM
Wed, May 14 8:30 AM
PCIT-IL308
Migrating from Configuration Manager 2007 to Microsoft System Center 2012 R2 Configuration Manager
Wed, May 14 10:15 AM
Code
Title
PCIT-H302
Deploying a Microsoft System Center 2012 R2 Configuration Manager Hierarchy
PCIT-H303
Deploying Microsoft System Center 2012 R2 Configuration Manager
PCIT-H304
Deploying Windows 8.1 to Bare Metal Clients
PCIT-H309
Implementing App-V 5.0 in Microsoft System Center 2012 R2 Configuration Manager
PCIT-H310
Implementing Endpoint Protection in Microsoft System Center 2012 R2 Configuration Manager
PCIT-H311
Implementing Linux Clients in Microsoft System Center 2012 R2 Configuration Manager
PCIT-H312
Implementing Role-Based Administration in Microsoft System Center 2012 R2 Configuration Manager
PCIT-H314
Managing Clients with Microsoft System Center 2012 R2 Configuration Manager
PCIT-H315
Managing Content in Microsoft System Center 2012 R2 Configuration Manager
PCIT-H316
Managing Software Updates in Microsoft System Center 2012 R2 Configuration Manager
http://channel9.msdn.com/Events/TechEd
www.microsoft.com/learning
http://microsoft.com/technet
http://microsoft.com/msdn