Welcome to Microsoft Mechanics.
Coming up on the show we take a look at the updates
to Microsoft Intune on Azure.
With new admin experience in the Azure portal
including role-based access controls,
tighter integration with Azure Active Directory
with groups and more.
And lastly, reporting and automation capabilities
with the Microsoft Graph API.
Microsoft Mechanics
So i'm joined by Craig Marl from the Microsoft Intune team, welcome to the show.
Thanks for having me Simon.
We've been on a path to modernized Microsoft Intune for a while now.
What was behind these changes?
So with Intune we really set out to modernize how you manage apps and devices from the cloud.
And as part of that journey we realize that as you need to manage more devices
across a diverse set of platforms and an ever wider range of scenarios,
we really needed to modernize the service to better meet those needs.
So the decision to move Intune into Azure
and adopt a microservices architect gives us a great number of advantages.
We can scale to vastly increase the number of devices.
We can deliver features and functionality faster
and deliver better resiliency, security and availability
all while allowing you to manage the service of our APIs and scripts
as well as our great new web UI.
So how do these great capabilities actually translate into what we'll see in Microsoft Intune?
So the first piece of good news is that now
all of Intune management is within Azure portal.
There's no longer any need for silverlight
and it works on virtually any browser on any device.
So by way of example I've got Intune open here
in the Azure portal on my mac in safari in fact.
Now one of the great things about the portal
is that I can actually create custom dashboards.
So here for example I've created a dashboard that has tiles from Intune,
Azure Active Directory,
as well as some live tiles
giving me information about my sign-ins from the Active Directory.
Now let's say for example I want to just supplement this with some information from Intune.
I can switch over to one of the Intune views.
Let's say I want to pick my OS distribution.
I can pin that over to my Azure dashboard
and then when I navigate back
there's my information all right there,
the first thing I see when I log in.
Now the other great thing is that because everything is in html5
you know longer need to use any additional tools to add apps to Intune.
So here for example, I can go straight into Intune.
And I can add applications directly from the store.
Now because we integrate directly with these app stores.
What actually happens is instead of having to type in all the information over and over,
I can just perform a search and try and get into the store itself.
So let's say for example I wanted to give people
Word With Friends, because that's always a classic.
I can just perform a search.
It pulls right up.
And with a couple of clicks
that app is pulled directly into Intune.
So it's an easy management experience all in one place
with greater visibility.
And Microsoft Intune is obviously part of enterprise mobility and security,
or EMS for short.
How are we actually going to bring all of those components together
inside of the Azure portal?
So one of the great examples of how we're bringing EMS together is really around groups.
So groups are now shared across Azure AD, Office 365,
Microsoft Intune and a whole bunch of other Microsoft services
If I go into Intune and I select groups,
this takes me across the Azure Active Directory blade.
And this is the same list of devices and groups that I'd see across all of my services.
Now something new that we've added is the ability to do device groups.
So here I have a device group that's for all iOS devices.
In the past without this capability,
I would have had to add devices manually.
But instead I can actually specify rules
to look for all devices with a type of iOS.
And I can do simple rules,
or I can do a complex rule like I've shown here
where I'm looking for all devices that are type iPhone or a type iPad.
Now anytime a device that meets this criteria shows up in my directory,
any policies and apps that I've assigned to that group
will automatically apply to these devices.
So this experience is much more streamlined than it's been before.
And it's completely integrated with Azure AD.
Are there other examples where we're doing that type of integration?
There are.
So a great example is conditional access.
So instead of before where there was Azure Active Directory and Intune,
places to go and configure conditional access.
Now it's all together in one single place.
So in this example,
I create a policy here for Exchange online.
And I made sure that the access controls require that
the user is coming in from a compliant device.
So once the user gets policies from Intune and they're compliant,
they'll be able to get you email.
If they don't, they won't.
We have another show that's just dedicated conditional access, so take a look at that show.
I also know that role based access
is an area where people have been really looking for what we're going to do there.
What have we been doing?
So we've invested heavily into highly customizable roles and permissions.
Not only can you define granular permissions,
but you can also scope where a user can exercise the permissions.
For example, here I have created a custom role just for help desk.
And what I've done is I've given that role very limited permissions.
Limited set of device actions.
And in fact I've scoped this down
so that they can only perform these actions against a specific group.
In this case this is my iOS devices.
So now i can assign somebody this help desk role
and they can reset a device, reset passwords,
but only for folks in that group and only on those said devices.
So does this just work with device groups?
No it works with all kind of groups.
A group is a group is a group
Any group that exist in your Active Directory you could use.
You could use it based on region, Department or anywhere you want to slice it.
So those are like amazing investments in the UI.
Have we done anything for folks that maybe prefer to automate Everything?
Yeah, we absolutely have.
So everything you see in the UI is exposed to the Microsoft Graph API.
Because of this you can script and automate a bunch of common tasks.
As an example I can show you how we can leverage
reporting and visualization used in Power BI.
Here I've built a dashboard in Power BI
that's connected to Graph.
It pulls information from Azure Active Directory.
I can see things like unfamiliar sign-ins,
it pulls information from Intune
so I can see a breakdown of my devices by OS.
On the right hand side here, I've got AD users,
a breakdown of my operating systems from Intune as well.
And then of course I've got a list of the number of users in my directory
and I can see things like how long devices check in for and when they check in.
Now fairly common scenario is
to show devices haven't talked to servers in a while
so that we can clean them up periodically.
Now I could do this manually in the UI.
But it tends to be something I'm likely to do every month or so.
So really I've written a PowerShell script that automates this.
So I just go into PowerShell
and it's going to connect to the servers.
It's going to pull all the information from graph,
find those devices enrolled,
and then go delete them from Intune.
This is great.
This is a lot of stuff that people have been really asking for for quite sometime.
How can these folks actually try these things?
So if you're already an Intune customer,
it's most likely that your tenant has actually been provisioned.
If not, you can expect to be migrated pretty soon.
And you'll see a link on top of Silverlight
that takes you to the new portal.
You can also follow the link below and actually create yourself a new trial tenant
to go test these things out.
Great, thanks very much for joining me today on Microsoft Mechanics.
And thank you for watching.
Don't forget to keep watching for the latest in tech updates.
We'll see you next time.
Microsoft Mechanics
www.microsoft.com/mechanics