Adnan Cloud Solutions Architect. SAFFA living in Netherlands, work globally. Microsoft Trainer +25y (xrl MSLearning)

Size: px

Start display at page:

Download "Adnan Cloud Solutions Architect. SAFFA living in Netherlands, work globally. Microsoft Trainer +25y (xrl MSLearning)"

Geoffrey Warren
5 years ago
Views:

Adnan Hendricks Cloud Solutions Architect SAFFA living in Netherlands, work globally Microsoft Trainer +25y (xrl MSLearning) Microsoft MVP + 5 Years

2 Adnan Hendricks Cloud Solutions Architect SAFFA living in Netherlands, work globally Microsoft Trainer +25y (xrl MSLearning) Microsoft MVP + 5 Adnan@ microspecialistconsulting.com Cloud Solution Architect & Readiness Trainer Former MS Consultant in MS MCS. Courseware technical writer, Speaker, Events Org

4 Beat the Windows 10 Deployment Clock January 14, 2020 End of Support for Windows 7 Less than 500 days away Are you ready? 4

Modern Workplace - Work from anywhere - Choose the device you want or bring your own - Quick, friendly out-of-box experience - Self-service - Integrated and cloud-based security - Simpler application

5 Modern Workplace - Work from anywhere - Choose the device you want or bring your own - Quick, friendly out-of-box experience - Self-service - Integrated and cloud-based security - Simpler application delivery through Store/SaaS - Data intelligence for better business insights - Minimize on-prem infrastructure costs - Unified identity, device and app management - Self-service deployment without imaging

7 Intune & Azure Active Directory Cloud Modern Management

8 Device Compliance Patching Software Distribution AD & ConfigMgr On-premises

9 Device Compliance Patching Software Distribution AD & ConfigMgr On-premises Intune & Azure Active Directory Cloud Modern Management

10 Hybrid AAD Joined (DJ++) + ConfigMgr agent Hybrid AAD Joined (DJ++) + Intune MDM

11 Azure AD ConfigMgr Intune Windows client Setup Hybrid Azure AD ConfigMgr If hybrid, migrate users off first Standalone only Windows License users for Azure AD Onboard to AAD License users for Intune Enable Windows 10 Auto-enrollment ** Set up Internet facing client

12 How to shift to the modern desktop Core steps and processes for large-scale deployment of Windows 10 and Office 365 ProPlus

13 END-TO-END IMPROVEMENTS FOR SECURITY AND INFORMATION PROTECTION TEAMWORK AND PRODUCTIVITY ENHANCEMENTS CONNECTED WITH OFFICE 365 Why move? AND IF YOU RE STILL ON WINDOWS 7 OR OFFICE 2010, SUPPORT ENDS STARTING JANUARY 2020

14 Directory services are moving to the cloud as the fabric for connecting to cloud-based services across apps and services What s different compared to the last big desktop deployment? In-place upgrades are viable and recommended for applying new versions of Windows UEFI replaces the traditional BIOS and is needed along with 64-bit for many of the modern security and protection capabilities in Windows Microsoft Intune can manage Windows 10 policies, your connected apps and be configured for co-management with ConfigMgr Office 365 ProPlus is the preferred option of Office desktop apps and uses a new package type called Click-to-Run Office 365 ProPlus and Windows 10 are now use semi-annual feature updates and cumulative monthly updates

compatibility status Work through hardware and app inventory and use info to target devices ready for deployment

15 Windows Analytics Device and App Readiness Inventory devices and apps under management Prioritize devices and apps based on counts and importance Windows Analytics Upgrade Readiness helps assess apps and devices against known compatibility status Work through hardware and app inventory and use info to target devices ready for deployment Continue triaging and expanding target devices until deployment is complete Implement required fixes for browser-based apps

Directory and Network Readiness Azure Active Directory deployed for targeted

language packs and user state Delivery Optimization, P2P caching, LEDBAT and

networking considerations: OneDrive Known Folder Move, Outlook Data Files,

16 Directory and Network Readiness Azure Active Directory deployed for targeted users Network bandwidth requirements calculated for OS, apps, drivers, language packs and user state Delivery Optimization, P2P caching, LEDBAT and compression controls configured to control bandwidth Plan Office-related networking considerations: OneDrive Known Folder Move, Outlook Data Files, etc. Deployment rings and group phases planned based on readiness and network capacity

apps that won t be brought forward Prepare for Office 365 ProPlus

17 Office & LOB App Delivery Ensure required apps are available for managed software distribution Prepare new apps to replace or supersede apps that won t be brought forward Prepare for Office 365 ProPlus (Click-to-Run) app delivery, customization and user-based, subscription activation

for methods to be used: OneDrive Known Folders, User State

18 User Files & Settings Target scenarios where user state migration is required: PC replacement or wipe and load Plan for methods to be used: OneDrive Known Folders, User State Migration Tool or custom solution Prepare required storage infrastructure

10 and Office 365 ProPlus Assess security considerations of deployment process, access to deployment shares and how user state is migrated

19 Security & Compliance Assess current client-side and server or cloud-based security solutions in place Test impacts of 3rd party disk encryption and anti-malware, then plan your deployment and AV software accordingly Plan for new security and compliance capabilities in Windows 10 and Office 365 ProPlus Assess security considerations of deployment process, access to deployment shares and how user state is migrated Configure endpoint settings and policies: Group Policy, MDM, Data Loss Prevention Configure security and compliance services for cloud-based components and EDR

OS Deployment & Feature Updates Assess hardware replacement cycle Prepare hardware and application testing for each new feature update, verify hardware vendor support for each feature update Plan for

20 OS Deployment & Feature Updates Assess hardware replacement cycle Prepare hardware and application testing for each new feature update, verify hardware vendor support for each feature update Plan for in-place upgrades for Windows 10 releases, refresh, replace and bare metal deployments for Windows 7 to Windows 10 Establish deployment plan with validation feedback loop Establish process for rollback, remote users or no infrastructure deployment scenarios (offline media) Carry out deployment plan and establish repeatable process for new users and ongoing PC replacements

Windows- & Office-as-a-Service Prepare for semi-annual feature updates to Office and Windows Establish Insider team and process to evaluate new Windows

21 Windows- & Office-as-a-Service Prepare for semi-annual feature updates to Office and Windows Establish Insider team and process to evaluate new Windows and monthly Office updates Prepare for updates to software distribution and update management tools as needed Operationalize semi-annual deployment processes

Simplify Windows 10 management and lower TCO with EMS Users Apps Simplified

Cloud updates mean you don t need to have onpremise update servers.

Office 365 ProPlus MGMT Integrated data protection EMS Control what updates

Self-service deployment Make any new PC enterprise-ready via a simple

com Username Password Windows 10 Proactive insights Get ongoing proactive

com Next Certificate Automatically configure devices when your users login

22 Simplify Windows 10 management and lower TCO with EMS Users Apps Simplified management & security Embrace cloud-based management and transition at your pace while staying in control. Microsoft 365 Always up to date Deliver the latest features and security. Cloud updates mean you don t need to have onpremise update servers. Agentless Unified identity, device and O365 ProPlus mgmt. Office 365 ProPlus MGMT Integrated data protection EMS Control what updates are deployed, to whom and when. Self-service deployment Make any new PC enterprise-ready via a simple self-service experience. Contoso Corp. Sign in Sign in with contoso.microsoft.com Username Password Windows 10 Proactive insights Get ongoing proactive insights to diagnose and fix issues before they happen. @contoso.com Next Certificate Automatically configure devices when your users login with their company credentials. Use cloud intelligence to upgrade Windows 10 and Office 365 ProPlus with confidence. Microsoft Intune Enterprise Mobility + Security Learn more at microsoft.com/intune Learn more at microsoft.com/ems

23 Co-Management Architecture With ConfigMgr and Intune ConfigMgr console Azure portal Mobile devices Intune ConfigMgr Site Servers Windows 10 AD Domain-joined & AAD Joined Windows 7/8.x

24 Existing ConfigMgr managed devices ConfigMgr agent AD Domain Joined ConfigMgr agent AD Domain Joined AAD Joined ConfigMgr agent Intune MDM AD Domain Joined AAD Joined New devices AutoPilot Intune MDM AD Domain Joined AAD Joined ConfigMgr agent Intune MDM AD Domain Joined AAD Joined

25 Adopt & Connect Transition to Modern ConfigMgr Content Delivery to Cloud Content Delivery Win32 to Modern Apps Kerberos to Modern Auth GPO to MDM Policy Imaging to Signature Image WSUS to WUfB Adopt Windows 10 Modernizing with a co-management bridge AD/AAD connect Adopt Office 365/ProPlus Today 1/2020

26 Adopt & Connect Transition to Modern ConfigMgr Content Delivery to Cloud Content Delivery Win32 to Modern Apps Kerberos to Modern Auth GPO to MDM Policy Imaging to Signature Image WSUS to WUfB Adopt Windows 10 Modernizing with a co-management bridge AD/AAD connect Adopt Office 365/ProPlus Today 1/2020

27 - Extend your on-premises directory with Azure AD. - Azure AD Join your AD domain-joined devices - AD + Azure AD Join new devices through Auto Pilot - Users see settings and data across devices (Enterprise Roaming of Settings) - IT can control access via Azure AD device-based conditional access. - Users sign-in conveniently and securely with Windows Hello for Business. - Transition GPO to MDM - Pilot Azure AD Join to identify AD auth dependencies - Gradually move traditional management tools that rely on computer identity to their cloud equivalents or AAD enlightened versions (e.g. ConfigMgr with CMG, WSUS to WUfB) - AAD Join new devices (AD Joined machines remain AD joined until retired) - Eliminate PC dependency on domain controllers - Better battery life and performance of the device

29 Adopt & Connect Transition to Modern ConfigMgr Content Delivery to Cloud Content Delivery Win32 to Modern Apps Kerberos to Modern Auth GPO to MDM Policy Imaging to Signature Image WSUS to WUfB Adopt Windows 10 Modernizing with a co-management bridge AD/AAD connect Adopt Office 365/ProPlus Today 1/2020

31 S E T T I N G S P O L I C I E S Time O F F I C E & A P P S D R I V E R S 1. Build & maintain custom image, gathering everything else that s necessary to deploy 2. Wipe original OEM Windows image and replace with custom image Money

Employee driven Self-Deployment Custom imaging

Windows EULA employees not permitted to accept on

vs Org Owned disambig, Privacy Settings, OEM

always Admin majority of enterprises want standard

32 Employee driven Self-Deployment Custom imaging expensive, limits HW choice, impairs talent acquisition Windows EULA employees not permitted to accept on orgowned devices Non-trivial decision making (Personal vs Org Owned disambig, Privacy Settings, OEM Registration) generates Helpdesk calls OOB account is always Admin majority of enterprises want standard accounts on corp-owned devices ANNA ANDERSON Administrator OEM/Reseller Ship Deliver direct to Employee Off-the-shelf and Shrink-wrapped Devices Employee unboxes device, self-deploys

34 Let s start with region. Is this right? United Arab Emirates United Kingdom United States Yes

35 Is this the right keyboard layout? US United States-Dvorak for left hand DVORAK L United States-Dvorak for right hand DVORAK R United States-International QWERTY Albanian QWERTZ Yes

36 Want to add a second keyboard layout? Add layout Skip

37 Let s connect you to a network ContosoMNGuestWiFi Connect automatically Connect Contoso Corp Contoso Corp 2 Network4 Skip for now Now let's get you connected to a network. That way you get updates, apps and cat videos as soon as possible. How about the first one on the list? Want to use that one?

38 Let s connect you to a network ContosoMNGuestWiFi Connect automatically Connect Contoso Corp Contoso Corp 2 Network4 Skip for now Now let's get you connected to a network. That way you get updates, apps and cat videos as soon as possible. How about the first one on the list? Want to use that one?

39 Welcome to our Guest Wi-Fi Agree & Connect By clicking on the connect button you agree to our Terms of Service and have reviewed the Contoso Privacy Policy.

40 Welcome to our Guest Wi-Fi Agree & Connect By clicking on the connect button you agree to our Terms of Service and have reviewed the Contoso Privacy Policy.

41 Just a moment

42 Now we can go look for any updates

43 Welcome to ContosoMN! Enter your ContosoMN Need help? Please sign in with your ContosoMN address Change account Privacy & Cookies Terms of Use Next

44 Welcome to ContosoMN! Enter your ContosoMN Need help? Welcome to ContosoMN Change account Privacy & Cookies Terms of Use Next

45 Welcome to ContosoMN! Enter your ContosoMN password. Need help? Welcome to ContosoMN Change account Privacy & Cookies Terms of Use Next

46 Please wait while we setup your device

47 Just a moment

48 We re getting everything ready for you.

49 This might take several minutes.

50 We want everything to be ready for you.

52 Windows AutoPilot Service Upload Device IDs Configure AutoPilot Profile Device IDs Self Deploy Hardware Vendor IT Admin Ship Deliver direct to Employee Employee unboxes device, self-deploys

54 Windows AutoPilot Service Upload Device IDs Configure AutoPilot Profile Device IDs Self Deploy Hardware Vendor IT Admin Ship Deliver direct to Employee Employee unboxes device, self-deploys

55 Windows AutoPilot Microsoft 365 powered device

60 Let s start with region. Is this right? United Arab Emirates United Kingdom United States Yes

61 Is this the right keyboard layout? US United States-Dvorak for left hand DVORAK L United States-Dvorak for right hand DVORAK R United States-International QWERTY Albanian QWERTZ Yes

62 Want to add a second keyboard layout? Add layout Skip

63 Let s connect you to a network ContosoMNGuestWiFi Connect automatically Connect Contoso Corp Contoso Corp 2 Network4 Skip for now Now let's get you connected to a network. That way you get updates, apps and cat videos as soon as possible. How about the first one on the list? Want to use that one?

64 Let s connect you to a network ContosoMNGuestWiFi Connect automatically Connect Contoso Corp Contoso Corp 2 Network4 Skip for now Now let's get you connected to a network. That way you get updates, apps and cat videos as soon as possible. How about the first one on the list? Want to use that one?

65 Just a moment

66 Now we can go look for any updates

67 Welcome to ContosoMN Enter your ContosoMN Need help? Please sign in with your ContosoMN address Change account Privacy & Cookies Terms of Use Next

68 Welcome to ContosoMN! Enter your ContosoMN Need help? Welcome to ContosoMN Change account Privacy & Cookies Terms of Use Next

69 Welcome to ContosoMN! Enter your ContosoMN password. Need help? Welcome to ContosoMN Change account Privacy & Cookies Terms of Use Next

70 Please wait while we setup your device The other part is, if you have your device get set up with local active directory domain joined, how do I get the SCCM client installed on the machine? You can use Intune to basically upload your ConfigMgr MSI into Intune. Intune can install that ConfigMgr on to the machine as a part of your Autopilot experience once your device ends up being managed by Intune.

71 Your device will reboot now. We ll continue setting up your device after reboot

73 Connecting to your organization s network

74 Other User Contoso\AnnaAnders Sign in to: CONTOSO How do I sign in to another domain? Sign-in options

$Contoso\AnnaAnders.$ Sign in to: CONTOSO How

75 Other User Contoso\AnnaAnders. Sign in to: CONTOSO How do I sign in to another domain? Sign-in options

76 We re getting everything ready for you.

77 Setting up your device for work Applying Security setup security complete policies (1 of 1) Encrypting Security hard drive to keep your data safe Adding network connections (1 of 1) Network setup complete Adding Contoso WiFi network Applications Installing applications (1 of 1) Installed Application application installation 0 of complete 18 Installing Contoso Electronics Leave everything to us. (Don t turn off this device.)

79 Co-Management using Windows AutoPilot Apps Policies Updates Reporting Intune AAD Config Manager AD

80 Adopt & Connect Transition to Modern ConfigMgr Content Delivery to Cloud Content Delivery Win32 to Modern Apps Kerberos to Modern Auth GPO to MDM Policy Imaging to Signature Image WSUS to WUfB Adopt Windows 10 Modernizing with a co-management bridge AD/AAD connect Adopt Office 365/ProPlus Today 1/2020

A new way to build, deploy and service Windows Quality Updates A single cumulative update each month with no new features Security fixes, reliability fixes, bug fixes, etc.

82 A new way to build, deploy and service Windows Quality Updates A single cumulative update each month with no new features Security fixes, reliability fixes, bug fixes, etc. Supersedes the previous month s update Feature Updates Twice per year with new capabilities New features and innovation APIs and security capabilities Very reliable, with built-in rollback capabilities Simple deployment using in-place upgrade, driven by existing tools Try them out with Insider Preview

84 Traditional deployment (every 3-5 years) Apps Infra Imaging Deploy Windows as a service (twice per year) Apps Infra Imaging Deploy

86 1 Configure Insider PCs Lab or secondary PCs Enough to explore new features, measure compatibility 2 Identify special PCs Deploy Windows 10 Enterprise LTSB Limited numbers (we hope) 3 Recruit volunteers for pilots Willing participants who will provide feedback Cover the broadest set of apps and devices possible 4 Divide broad population of PCs Standard deployment best practice Focus on risk reduction, minimizing disruption

87 Adopt & Connect Transition to Modern ConfigMgr Content Delivery to Cloud Content Delivery Win32 to Modern Apps Kerberos to Modern Auth GPO to MDM Policy Imaging to Signature Image WSUS to WUfB Adopt Windows 10 Modernizing with a co-management bridge AD/AAD connect Adopt Office 365/ProPlus Today 1/2020

90 MDM Check out the 1703 MDM security baselines here: Security Baselines

91 Adopt & Connect Transition to Modern ConfigMgr Content Delivery to Cloud Content Delivery Win32 to Modern Apps Kerberos to Modern Auth GPO to MDM Policy Imaging to Signature Image WSUS to WUfB Adopt Windows 10 Modernizing with a co-management bridge AD/AAD connect Adopt Office 365/ProPlus Today 1/2020

93 Traditional Application Management Modern Application Management

96 Policy Conditions Policy Controls Applications Azure AD Identity Protection Service Windows Defender User Device User identity Group membership Session Risk OS Platform Is Compliant / Domain joined Is lost or stolen Device Risk Microsoft Cloud App Security Access Control Allow sign-in Block sign-in Enforce MFA Session Restrictions Microsoft Cloud Microsoft Azure 3rd Party SaaS Apps Mobile or Cloud app ODSP limited access Restrict download App Location Per app policy IP range Country / Region Block various actions Monitor users / prevent data leak On Premises Apps

97 On-premise Cloud attached Cloud managed Traditional OS Deployment Win32 app management Configuration and GPO Bitlocker Management Hardware and software inventory Update management Unified Endpoint Management Windows, ios, macos, Android Modern access control Compliance, Conditional Access Modern provisioning Autopilot, DEP, Zero Touch, KME Modern security Hello, Attestation, ATP, Secure Score Modern policy Security Baselines, Guided Deployments Modern app management O365 Pro Plus, Stores, SaaS, VPP Full M365 integration Analytics, Graph, Console, RBAC, Audit

98 Thank You!

Today s focus Microsoft 365 powered devices

2 Today s focus Microsoft 365 powered devices 3 A complete, intelligent, secure solution to empower employees Office 365 Windows 10 Enterprise Mobility + Security Unlocks creativity Built for teamwork