Coming up we take a look at deploying and managing Microsoft 365 powered devices
with capabilities that make it possible to also provision new devices using Windows AutoPilot
and deliver apps and services including Office 365 ProPlus on a line of business apps.
We'll look at simplifying the management of identity, devices, apps and data
with an integrated management experience.
And planning Windows 10 deployments at scale with tools that help you to focus
with readiness efforts and stay compliant and up-to-date.
Keep watching as well to learn more about new co-management capabilities
coming soon that allow you to take advantage
of cloud based modern management at your own pace.
Microsoft Mechanics
So I'm joined by Microsoft Corporate vice president, Brad Anderson.
Brad, welcom to Microsoft Mechanics.
It's great to be here, I've been looking forward to this.
So with Microsoft 365 we've actually brought together Windows 10 Office 365
and enterprise mobility and security.
But, it's not just a grouping of products is it?
What's the rationale behind it all?
Yeah, this name Microsoft 365
it's a lot more than just a branding or a name.
If you think back 25 years ago when we created Office
It was a seminal moment in the industry
and we forever thought about what productivity in the office suite meant differently.
I think we're going to look back in this moment when Microsoft 365 was announced,
because it's going to have that same kind of a fundamental change
in terms of what does a modern workplace look like
that both empowers users and provides IT what they need.
And so as I think about the work we've been doing you know I go back five or six years ago.
We pulled together leaders from across the company.
Identity, Management, Security, Office, Windows.
And we sat down we said,
hey how does this all play out and what are the needs going to be in the future.
And for us it was obvious that all these things we're going to need to converge
because in a modern workplace it's all being delivered from the cloud.
All those pieces have got to work in harmony
to deliver that modern workplace that is both loved by users
and trusted by IT.
That's what we've been building with Microsoft 365.
So Brett can you make this real for us by taking us through maybe how the user would see things?
Yeah, there's a number of things we wanted to show you here.
Let's start with where it all begins in provisioning of the device.
Now historically when organizations have received new devices they get shipped to IT.
And IT goes through a process to image them.
You know that takes time and that cost money and we wanted to streamline that.
And so our intent here was, how do we enable so that devices can be sent directly to the user?
They take it out of the box they put it on their desk
and have it automatically provisioned and tailored to their needs
with the user only have to answer five questions.
Okay, so you've got a machine that's just coming out?
Brand-new PC, let's walk you through the process now.
Okay so I'm going to go start a provisioning and it's going to ask me for my my language,
my location, my keyboard,
and it's going to come up and ask me for the network information key.
That's four questions right?
Now I do want to call out here, notice I'm not on the corporate network.
Modern provisioning assumes that a user can be anywhere in the world.
So you do not have to be on the corporate network.
A new device can be shipped to a user anywhere in the world.
So I'm going to go ahead here and connect.
It's going to ask me for my information on my network and I'll put that in.
Now what's happening right now is the device is now communicating with one of the Microsoft 365 services
and look it already knows that this device
has been assigned or purchased by my company and assigned to me.
And it's already beginning to personalize the experience.
So what actually happens there and how did that occur?
So this is a new service called AutoPilot .
And when a news PC is purchased
as its purchased the OEM actually notifies AutoPilot
of who the customer is and what purchase that was.
You can even get to the point you say this is the user
This is Azure Active Directory identity is who it's assigned to.
So the first time the device powers up it communicates with AutoPilot.
And AutoPilot knows who owns it.
The company and individual and starts that personalization right off.
So let's go ahead and put my password in.
Now what's happening now as I authenticate is
I'm authenticating to Azure Active Directory.
It first validates that I am who I say I am.
And now it's setting up this device.
The settings, the applications and everything personally tailored to me
based upon my unique role and my unique responsibilities.
Based upon my identity.
Now this device is ready for me to use.
Teams has been deployed.
You can see that things can be put on the Start menu and onto the task bar.
It's ready to go in minutes.
What used to take hours now takes minutes.
with the end-user doing the provisioning.
So I'm going to come and I'm going to open up Teams.
Now one of the great things about Microsoft 365
powered devices is I'm automatically signed in.
It did not asked for my password.
I can see here things that my team is working on.
In this case they want me to go and edit a document, so I'm going to go open up this document.
Now this particular document is a customer case study
of fruit of the Loom who actually is using Microsoft 365.
And so we've been going through the process with the customer for them to review it and approve it.
Now a couple things to point out here.
Notice that confidential watermark?
This is using the Azure information protection component of EMS.
And so you now see Office 365 and EMS working together
to make sure this document is protected.
If I come and take a look here on the file menu,
you can see that this is also using Windows Information protection
which allows us to keep corporate documents
separate from personal documents on devices.
Now in this particular case,
the document has been approved by the customer.
So I'm going to go and change this from being confidential to public.
And so just like that the rights are changed on the file.
And now this document can be published up for the web.
We can start pushing organizations to look at it.
But the ability to be able to actually have a file becomes self protected
through Azure information protection
Is a unique capability to Microsoft 365.
It was really cool the way that everything just came down and was provisioned on the device.
You have the Azure information protection add-in right there inside of Word.
You didn't have to do any configuration.
What did you actually do as the IT admin to make that happen?
So let's actually take a look at that.
So I'm going to go ahead and go into the console here now.
So the first thing we are going to start with is provisioning of the operating system.
So here your looking at the administrative console for Intune,
one of the Microsoft 365 components.
So I'm going to go do a search here.
And you can see here I've got my baseline
Microsoft 365 power device configuration here.
Now as I open this up and go look at the properties
what you're going to see is I have one place where I can now go configure
all of the settings and all the configurations from Windows 10.
Ok, so you can see here I can go put in policies for passwords,
for the store, I can put in policies for things like storage
as well as like Windows Defender.
Everything that you can configure that needs to be personalized or set up on a device
can now be configured through Intune
Then as the device contacts AutoPilot
and Intune starts to configure devices,
it uses this configuration to do that.
That looks like a pretty comprehensive list.
It is and it's very simple, it's a very easy way to get it done.
Because that's how we provision and configure the operating system.
Now let's talk about what we do with the apps.
Remember we deploy in Office and other other applications.
So I'm gonna take a look at the applications pane here.
And what you can see here is I have all different kinds of application that I can provision.
On iOS, on Android and on Windows.
Now let's go take a look at one of the newest innovation that we've done here.
I'm going to take a look at Office.
One of the things that we've done is we now have the ability to be able to configure and deploy
Office ProPlus.
So you can take a look here and I'm going to the properties.
And what this is going to give you now is a view into all of the configuration
of Office as a suite, not the individual components
but Office as a suite.
I can go and I can select which application I want to deploy.
And through here you I can go and configure all the settings
so that when a new device gets configured or a user goes in and provisions Office
everything is set up according to how I want it done.
Now one of the new things that we've just just added in recently
is what we call Intune management extensions.
And what this does is it extends the capabilities of the MDM layer in Windows 10
adding new capabilities.
You think about some of the things that config manager
and Active Directory administrators have been accustomed to.
Things like the ability to run scripts or set group policy settings.
Let's show you one of the newest things.
So let me show you again one of the newest innovations we've added
into Microsoft 365 and specifically Intune.
So what I'm going to show you here is
this brand new set of capibilities that we call the Intune management extensions.
The first thing I'm gonna show you here is
you now have the ability that you can run any PowerShell script
on any Windows 10 devices being managed by Intune.
And so it's very easy to do and you can take a look here that I've actually set up a script
to go ahead and deploy the HR app.
One of the things that the MDM layer has needed a little bit of help with is
deploying Win32 apps and EXE apps.
This is a way to do it.
So you can see here I've gone I've created a PowerShell script.
I simply point to it here and I go to the folder and select it.
I've now embedded that PowerShell script inside of Intune.
I can go make the assignments to which users or groups that I want to be done.
Then I can configure when I want it to be run.
Now one of the things it kind of give you a teaser here.
You're also going to see us add right below that PowerShell scripts a new set of capabilities
to deploy Win32 apps and EXE apps
which is one of the things the MDM layer in Windows 10 has not been able to do.
That'll be a part of these Intune management extensions.
And really gives the the administrators coming from config manager and Active Directory
a similar set of capabilities that they've been accustomed to.
So, in the same portal you have exactly what you need to manage Windows platform security,
app deployment.
You also showed us Azure information protection.
Where about did you configure that?
Alright, let's go take a look at that now.
So one of the things about Azure information protection
is we are able to empower the user to classify documents as they are creating it.
Now you can create custom labels for each organization.
Now here you're taking a look at the Azure Information Administration console.
And you can see that these are the categories that I have configured.
And each one has a different set of security associated with it.
I can also go and build unique policies
for individuals and individual teams.
I'm going to go underneath scoped properties
and I'm going to take a look at the policy that has been built for the customer experience team.
This is our team working with customers to help them get deployed.
So if someone on the customer experience team
is working on that confidential information for customers,
they can actually mark that as customer information.
It will classify it as confidential, but also lock it to just that team being able to open it to see that data.
That's great from a protection point view of vital customer information.
Yeah, and again it's personalizing to the unique needs of the user
and their context and their role within the organization.
Okay Brad, this is great for setting up new users
and I can see the value there.
But what about existing users, they're also a challenge.
How do we deal with their devices?
Yeah, you know one of the promises of Microsoft 365
powered devices is that they are always up to date.
So let me show you some of the things we've built into Intune and Microsoft 365
to help organizations deploy updates to Windows.
So what you are looking at here is what we call the deployment rings capabilities of Intune.
And let me walk you through a common policy.
So what we are recommending to customers,
is that they set up rings of deployment
where you start with a smaller group
and as it gets deployed and get more confidence in the updates,
You bring it out broader until you deploy it to the whole company.
Here's my policy.
What I do here is I have about one percent of my organization that I classify in the insiders.
And on day zero when a new set of capabilities comes out from Microsoft
they automatically get deployed to those insiders.
Then I wait a couple of days and it automatically goes out to a broader group.
This is about 10 percent of the organization spread out to the entire company.
Then I deploy those updates and I deploy those new versions of Windows or updates to Windows.
And then I watch to make sure everything is working.
And then after seven days, I deploy that to everyone.
And I broadly deploy that across the company.
Now Simon if something happens I can literally come in and I can do a right-click
and I can pause those updates.
And so it's all automated.
But, if for some reason something happens it's literally
just a right-click pause.
And I pause the deployment across the organization.
The key here is with Microsoft 365,
your devices are always up to date.
Now here's why this is important.
If organizations want to have the most performant,
the more secure, the most reliable devices,
the key is to stay updated and keep updated with the updates that are coming up for Microsoft.
And people can also use Windows Update compliance
in order to to understand exactly how many updates have been deployed
and which updates are missing inside of their organization.
And we have a Microsoft Mechanics video that we just released
that you can go and watch if you want to learn more about that.
So Brad lots of folks out there are trying to get started on their journey to Microsoft 365.
What are we doing to help them?
We know that historically upgrading from one version of Windows to another
has been a long and expensive process.
And so what we're doing is we're taking the telemetry
and all the knowledge and intelligence that we have in our cloud
exposing that back to organizations
and helping IT professionals really focus and prioritize their work
to accelerate their Windows 10 deployments.
In what kind of ways, are we're looking at the apps that they're needing to deploy?
We're looking at a whole bunch of things, so let's take a look at it.
So what you are looking at here is what we call windows analytics,
part of Microsoft 365.
And this is actual data from Microsoft.
You can see here inside of Microsoft we literally have 23,000 unique applications
running across all of our all of our users and devices.
Now we have lots of dog food lots of individual unique versions
of the Office apps across the Office team.
But imagine starting there.
Where do you start to understand which apps are gonna have problems?
And which ones are not you're going to naturally work with Windows 10?
So look at what we do.
We start to give you prioritization and give you a focus of where to spend your efforts at.
So first of all we say listen the bulk of these applications
is more than 22,000 are very rarely used so you can ignore them.
And we successfully walk you through down here which ones are business critical,
which ones are mission critical,
and you very quickly can get a list and a view of the applications
that you need to go verify that they are going to work and there's not going to be any problems.
Because we know how often they're being used,
and how critical they are to the business.
That should be great for unblocking deployments.
App compatibility has historically been one of the biggest challenges of upgrading.
But we continue to do more.
So now we're going to help you understand
when you do have application that have issues,
how to resolve them.
So you take a look here we know that there are 206 applications
in your environment that have issues.
You can take a look here you can see you know there's some that our attention is needed.
There's some that our fixes are available.
Those fixes may be coming from the ISV.
The ISV may have come up and notified Microsoft
that hey we have an update to our app and this makes it compatible with Windows 10.
You can come and take a look here we can show you which drivers you need to be concerned about.
And again you can start drooling into which drivers need to update.
to make sure that it'susers are updated and they have that great experience.
Now these next two screens are some of my favorites.
First of all we're going to help you understand that you've got these 20 low-risk applications.
Let's help you understand what the use case of those is and if you need to worry about them.
The first thing you're going see here is this concept of highly adopted.
This is where we're aggregating data from across all of Microsoft.
And we can see that these particular applications,
these four are really broadly deployed around the world on Windows 10.
We know they work so we give you that information.
Likewise here we have a bunch of applications that have been adopted, in this case 16.
So again we're aggregating data from across Microsoft and all the terms we get
to help organizations rapidly be able to understand app compatibility.
I love this particular screen right here.
This says, if you want to unblock 10% of your devices to upgrade to Windows 10,
these are the things you need to go address which are these 29 specific apps or drivers.
If you go look at these 105, you can unblock 80%
of your PCs to be able to upgrade it.
Now again, it's focused and allows me to spend my time where I get the best impact at.
And then when you're ready to deploy we're constantly updating this screen right here.
You can see in this case there are 25 PCs
that are ready to be upgraded.
I come and I can click right down here on export.
And guess what that does?
It automatically exports a config manager
so that the upgrade is scheduled and you're up and running
with those 25 devices getting them upgraded to Windows 10.
It literally is that simple.
That is very cool how quick you can do that do that.
Do we have any capabilities to maybe work with Office add-ins?
Those have been a little bit trickier in the past.
Yeah, one of the well-known issues in upgrading from one version of Windows to another,
many organizations also upgrade Office at the same time.
One of the challenges is do the Office plug-ins work?
So again in this concept of proactive insights,
one of the promises of Microsoft 365.
We can give you a view of all the Office add us that are to be in place.
In this case there are 286 unique add-ins being used.
And you can see here what are the most commonly used add-ins, how often are they used.
Again it's about prioritizing to make sure that as you go to a new version of Office,
you have these plugins ready to go.
So the user experience when the upgrade is done
is the same as it was before.
The plugins that they were using are going to work in the new version of Office.
Everything you showed me here is a great set of management capabilities for customers that
are already in the cloud doing modern management.
What about those customers that haven't got there yet?
Can we do anything to help them get to the cloud?
That's actually the bulk of our customers right?
If you think about it the majority of the world
today is using AD
and config managers that manage Windows PCs.
And what we're wanting the world to do and what they want to do to get to
modern management cloud management
is to move from AD to AAD and config manager to Intune in EMS.
Now you know this has been a challenge because it's just very hard to come in and overnight
and say hey where's going to move from Active Directory to Azure Active Directory
and config manager to Intune.
So with the new release of Windows we've done something remarkable.
A single Window 10 device now
can simultaneously be Active Directory joined and Azure Active Directory joined.
Now what that enables us to do is a single device can be managed both by config manager
and by Intune at the same time.
That gives you this bridge
to where an organization can continue to use what the tools and the processes that they've used for years
start to add the cloud and then migrate one workload at a time.
So what I see happening with this is organization will come up and say hey,
I'm going to use both config manager and Intune.
First I'm going to go ahead and start using conditional access from the cloud.
Then maybe I'lll move and start doing updates and patching from the cloud.
Then I'll do software distribution.
So what that allows organizations to do is
move to the cloud and modern management at their own pace
and what sense for them.
So Brad, why should people move to Modern Managment?
What's the advantage of it?
You know by moving to cloud services for modern management
organizations can massively simplify the work they do,
make themselves more secure,
decrease their cost and deliver the best user experience.
In traditional management
there are natural dependencies between the server, software and platforms that you use.
For example, you may have needed to update your systems management software,
SQL Servers, domain controllers, and Windows Server version in the past
in order to stay current and take advantage of the foundational updates.
So when a new requirement comes along
we build a feature and you need to update some or all of those pieces.
In the cloud we're constantly updating the services.
It's Microsoft responsibly to maintain consistency across all those dependent services.
So as a new requirement comes along we can add capabilities more quickly
while ensuring consistency.
It's really good to see these new co-management capabilities.
I know that that's a capability that lots of folks are going to be pleased about
It's really going to help people to be able to get to these modern management techniques faster.
What's next on the horizon?
This is a constantly evolving area
and our goal is to continue to deliver integrated and simple management experiences
with Microsoft 365
that support great user experiences and teamwork.
So please keep giving us your feedback, we're getting more and more integrated.
Of course you can learn more about co-management
and the progress of everything that we've shown you today
by following the sessions from Ignite in the links below.
Thanks Brad, it was great to have you on the show.
And thank you very much for watching Microsoft Mechanics.
Stay tuned for the latest in tech updates.
See you next time.
Microsoft Mechanics
www.microsoft.com/mechanics.