Hello, and thank you for coming
to our session regarding
some great upcoming improvements
to the Microsoft device compliance
workflows for macOS.
Today, presenting during this session,
we have myself, Travis Cynor.
I'm a senior product manager at Jamf.
And alongside me,
I'm thrilled to have our technical expert
on the latest Microsoft integration, Ben.
Ben, you want to go ahead
and introduce yourself?
Hi. My name is Ben Whitis.
I'm on the product specialist team
at Jamf, and I mainly focus
on Jamf Connect, Jamf Protect,
and the conditional access integrations.
Wonderful.
So our session agenda will
look something like this.
Ben and I will provide a brief overview
about what is the Jamf and Microsoft
device compliance integration,
the history of the Jamf, Microsoft
partnership and integration,
we'll distinguish the differences
between the two Microsoft APIs
that Jamf integrates with,
both the partner device management API
and then the latest partner compliance
management API,
and then at the end,
Ben will be providing a demo to showcase
some of the new macOS functionality
that's coming with this integration.
So with the Jamf and Microsoft
partnership, we have a multitude
of integration points.
Together, we connect users with Azure,
as the IDP, which allows end users
to extend authentication
to their apps via SSL.
Jamf Pro is able to deploy, configure,
and update Microsoft applications
automatically–for example,
like the old 365 applications–
so that users have preconfigured
and ease of access
to their Microsoft-specific
work resources.
And the latest integration point
is around security and compliance
to ensure only trusted users
and compliant devices gain access
to Microsoft work resources.
The perimeter-based security model
that organizations have traditionally used
is no longer effective when it comes
to protecting the data that's outside
of the corporate firewalls.
To solve this challenge,
Microsoft Enterprise Mobility Security,
EMS, Conditional Access,
and Jamf Pro's data telemetry capabilities
ensures that company data can only
be accessed by trusted users and devices
that are using trusted apps.
High level.
Whenever corporate data is requested,
the Jamf and EMS integration
is able to quickly determine if access
to corporate data
should be trusted or revoked
via conditional access controls.
Conditional access
is different across all organizations,
so providing administrators
the flexibility to create
compliance policies based off their needs
is very important.
We'll cover this in further detail
later on.
So how has Jamf and Microsoft grown
with our compliance integrations?
In 2017 was really the start
of Conditional Access journey
between our organizations for Mac.
Customers were looking for a way
to enforce Conditional Access policies
across their Mac fleet,
but there were three key functions
required to make this magic come together.
The first, admins needed a way
to sync their Mac inventory data
with the Microsoft Endpoint Manager,
formerly called Intune at the time.
This also opened up the ability
to do a single pane of glass reporting
experience within Endpoint Manager.
The second, inventory data needed
to be analyzed by Microsoft Endpoint
Manager compliance engine
to generate and report and then make
intelligent decisions about
the user's identity
and the device telemetry
coming from Jamf Pro
to enforce Conditional Access.
The third was to provide
a user-friendly remediation experience
for noncompliant devices
so that users can take action
to actually become compliant.
So Mac Conditional Access workflow solved
a critical market problem.
But as iOS and iPadOS has continued
to grow in popularity
within the enterprise,
the need to have the same compliance
controls for the iOS and iPadOS platform
became evident.
And so in 2019, Jamf and Microsoft
introduced the ability to support
iOS device compliance.
A key difference with this integration
is around the compliance calculation.
And it was shifted from being analyzed
in Microsoft Endpoint Manager
to now have Jamf Pro handle
the compliance accounts.
Then Jamf would push the device compliance
flag of a yes or no to Azure.
Fast forward to now in 2022,
Jamf and Microsoft received
critical customer feedback,
and there's a real need
for more granular control
over what compliance means
for our organization.
As I mentioned, in 2017, there were only
certain data fields that were supported.
However, by leveraging the same compliance
calculations Jamf Pro does with iOS,
for now with macOS, admins can now achieve
that granular compliance control
they've been requesting.
This ongoing analysis of device data
is being calculated using the Jamf Pro
computer smart groups.
Going a bit deeper into the journey,
let's review a flow diagram from 2017's
initial Jamf and Microsoft macOS
Conditional Access integration.
Starting from the left to the right
in the flow diagram,
you have a Mac enrolled into Jamf.
The integration is established
between Jamf Pro
and the Microsoft Endpoint Manager.
And the end user is already known
to Microsoft through Azure Cloud,
Azure Active Directory,
but the device is not.
So to register the device, the end user
navigates to Jamf Self-Service
on their Mac for opening Microsoft's
Company Portal app to authenticate.
The device is now registered
into Microsoft Endpoint Manager,
and Jamf Pro pushes the device data
to Microsoft to be utilized
throughout the ongoing compliance
calculation process, which is what
the middle diagram here demonstrates.
Depending on how the compliance policy
rules are configured, let's say,
for example, the device must be
FileVault encrypted and managed
by Jamf Pro,
Conditional Access controls are then
enforced, granting or revoking access
to Microsoft work resources.
So here's an example of the data
Jamf Pro pushes to Microsoft Endpoint
Manager that can be used
to calculate compliance.
As you can see,
there's a list of variables
that Jamf Pro sends on to Microsoft.
So some of the key ones
would be like FileVault encryption,
passcode policies, et cetera.
Moving to 2019, when iOS device compliance
received support, you'll notice
the experience is a little different.
With this integration between Jamf
and Microsoft, the end user enrolls
their iOS/iPadOS device into Jamf.
Next, the end user registers their device
using Jamf Self-Service
and the Microsoft iOS Authenticator app.
And the information about the device
is sent to Azure.
However, the difference is
how compliance is calculated.
First iteration with the Mac,
compliance is calculated
on Microsoft's side.
However, given that the device inventory
data is already in Jamf Pro,
Microsoft revamped the integration
and enabled the ability for Jamf
to perform the compliance calculation.
This was a major improvement
for IT administrators
because instead of only being limited
to specific data points
to define compliance for their end users,
organizations can now leverage
the power of Jamf smart groups
to really choose anything about the device
for compliance in that form.
This includes configurations
like passcodes, apps, and anything
related to the device inventory.
In addition to this, and because
of the way Jamf smart groups operate,
it becomes almost impossible for a device
to fall out of compliance
once it is registered.
If it does fall out of compliance,
those smart groups can be scoped
to configuration profiles in a way
that itself remediates,
adding even more protection to ensure
end user devices are maintaining
a secure and compliant state.
So given the new architecture for iOS,
it made sense to bring
the same flexibility
and more granular control over to macOS.
In this diagram, end users on the Mac
must enroll their device into Jamf Pro,
and the registration experience is still
user self-service and still uses
the Microsoft company portal,
like always for the–
like as before for the Mac.
The device analysis and compliance
calculation leverages the power
of Jamf smart groups to perform ongoing
device analysis and help double-check.
If the device is compliant,
access to company resources is granted.
If not, it's revoked
and remediation occurs.
So again, similar to iOS and macOS
device compliance on this new
architecture pattern,
in using Jamf smart groups,
it becomes difficult for a macOS device
to become noncompliant.
However, if it does,
admins have the greater capabilities
to ensure remediation occurs automatically
so that end users can focus on their work
at hand versus taking on IT tasks
to try and become compliant.
Next, Ben is going to dive
into what inventory gets sent
over to Microsoft Azure
with the latest macOS integration
and then share a demo of this
new experience with you all as well.
Ben, over to you.
Thanks, Travis.
I'd like to start by just comparing
the raw data
that we send between the two,
the old integration
and the new integration.
I think it's a really good illustration
of the key differences here.
On the screen right now is two JSON blobs.
The one on the left
is from the original 2017 integration.
This is just a computer inventory update.
On the right is a device update
using the new API.
On the left, you can see
all the attributes that Jamf Pro sends
to Azure for compliance calculation.
You can see there's FileVault status
in there.
There's whether or not SIP is enabled,
password expiration,
all that kind of stuff.
On the right, you can see Jamf Pro isn't
really sending much beyond,
"Here's the device I'm talking about,
and here's whether or not it's compliant."
Because the 2017 partner device management
integration sends device attributes
directly to Endpoint Manager,
compliance is calculated using Intune's
built-in compliance policies,
which have to be scoped to the user.
As Travis mentioned,
the partner compliance management
integration uses Jamf Pro smart groups
instead to determine compliance status.
The screenshot on the right here
is an example of a smart group that shows
the kind of things we might want
to look at when determining
compliance status.
So for example, stuff like,
is Jamf Protect running?
Is FileVault enabled?
Is there a specific
config profile installed?
And how recently have we received
inventory data from the machine?
The ability to calculate compliance status
using Jamf Pro smart groups
also opens the door for a wider variety
of compliance requirements.
This includes previously inaccessible
inventory data, like extension attributes.
Again, think about,
do you have an antivirus installed?
Or maybe you wanted the user to accept
a EULA before they can access their email.
Really anything you can think of
and script.
Jamf Pro sends whether or not the device
is compliant, as devices fall in and out
of the compliance group.
This compliance status is then
accessible in Azure AD
for Conditional Access policies.
With the partner compliance management
integration, compliance status
can be verified in a few different places,
including by checking in Azure AD
or by looking at whether or not
the computer is a member
of the smart computer group.
Additionally, this data is also
accessible via the Jamf Pro API.
This is new to the new integration.
This API endpoint also discloses
the Azure AD ID of the computer,
which should be helpful in some
automation scenarios.
It's worth noting here that this endpoint
is also available for the existing
mobile device integration.
And lastly, before I wrap up,
I wanted to talk about
the user experience.
The partner compliance management
integration brings a lot of improvements
to configurability
and generally the amount of time
it takes for a computer to become
compliant in Azure AD.
But there are several other new
developments since the 2017 launch
that are worth mentioning.
First, an additional key was added
in Jamf Pro 10.38 that allows the user
to use a native Apple web view
rather than their default web browser.
This cuts down on the variability
and complexity of the registration flow,
and I would honestly recommend this
for any environment that's compatible
with the WK web view.
Second, the Azure AD SSO extension offers
a significant improvement.
With the SSO extension configured
to allow access to the JamfAAD agent,
the registration flow is cut down
to a single sign-in and company portal.
All other authentication prompts
are handled or bypassed
by the SSO extension.
On the next slide, I'll show a demo
of these two enhancements put together.
I'm using a simple script here to prompt
the user to open up Self-Service.
Opening Self-Service also provides
an opportunity to share instructions
with the user that will help them
through the registration process.
This pop-up is the SSO extension.
The user only needs to sign in to this
once for the SSO extension to start
handling requests.
We'll see that later on.
Now, after the user clicks Done
in Company Portal,
JamfAAD will launch to collect
the user's Azure AD credentials.
Because JamfAAD uses Microsoft's
authentication library,
this request is automatically handled
by the SSO extension.
There are also no prompts
for keychain access either.
Once that window is closed,
the computer is registered.
And lastly, before I hand it back
to Travis, I know you've probably seen
this screen before,
but I just wanted to show what a computer
record looks like in Azure AD
once it's been registered
and is compliant.
I'll also mention here that, like iOS,
these device records will only show up
in Azure AD.
So don't go looking for them
in Endpoint Manager.
That's all I have for hands-on demos.
And I'll hand it back to Travis
to wrap things up.
Thanks, Ben.
I'm loving the enhancements
with the web view
and how that streamlines
the registration process.
Overall, very excited for this improved
experience with the Jamf and Microsoft,
macOS device compliance integration.
Kind of to wrap up, the Jamf and Microsoft
partnership is a great example on how
the Apple ecosystem continues to grow
and the importance in offering
seamless partner integrations
so that customers can have confidence
knowing their Apple devices
are managed and secure.
It's been exciting to see how the Jamf
and Microsoft partnership has evolved
over the years, and I'm looking forward
to receiving feedback on the enhancements
we discussed today.
And so to learn more, free to check out
the website where we host
the Microsoft Partner integrations.
And then to formally announce,
we are targeting general availability
for this new partner compliance management
API integration for macOS
Conditional Access in Q4 of 2022.
Thank you all.