Coming up
we will give you an inside look at the latest
in Mobile Application Management capabilities
in Microsoft Intune.
Including how you
can define policies to stop data leakage
manage apps without needing device enrollment
and how to setup this valuable protection
for users most used Office apps.
Microsoft Mechanics
I'm joined by Dilip
from the Enterprise Mobility team.
Dilip, welcome to the Microsoft Mechanics studio.
Thank you, Simon.
Great to be here.
So, users expectations
and the applications of the devices are
constantly changing.
what are we doing with Microsoft Intune
in order to help address that?
As you know
there are so many millions of mobile devices.
Personal devices
that are connecting up to work email
and getting those emails, documents, and files
downloaded onto these devices
and IT departments
want to secure that information.
And typically
they do this by
requiring the user to enter into a mobile device management solution.
But, end users don't want to give up
control of their devices.
So, because of that
we are introducing this new feature in Intune called
Mobile Application Management
without enrollment.
So, what it gives is IT the ability
to secure the applications and the data
on the devices
without enrolling and managing the entire device itself.
Without enrollment sounds like a really great idea.
Can we take a quick look at it?
Sure.
So, what I'm going to do here
is show a
demonstration of the Intune
Mobile Application Management portal.
So, this is now part of the
Microsoft Azure portal.
But, that doesn't look like the regular Intune Portal
it has to be Azure.
Yeah, so what we've done is
integrated the Intune Mobile Application Management features
with every other capability
that you see from a management perspective
for IT departments.
Whether it's managing your SQL databases.
Your virtual machines
your app services.
All these are now part of the same portal.
So, you don't have to switch ID admin console.
So, Intune MAM
features plugins straight into that portal.
And, I presume were going to start seeing more
of the Intune capabilities actually landing
inside of the Azure portal.
Yes, this is the beginning
and we have all the features like
mobile device management, is also going to show up in the portal.
What we will see here is
how in three simple steps
are we going to show
that you can secure your mobile applications?
So first
you are going to see that
in the App policy.
I'm going to go in and create an application policy
that is used for securing your applications and data.
As you can see here
the first policy knob that I turn on
is the ability to prevent
back up to a personal storage like an icloud.
And then
I also have set a policy here
that prevents the application
to do a Save As
or take the data out of your corporate email
or SharePoint
to a personal storage like a
personal OneDrive
or Dropbox or Box kind of location.
I also now set a policy that
that prevents this application
from a user from copying and pasting this data
out of their corporate email contacts or
application
into any other personal storage.
So, the other capabilities that I'm going to show today
in the demo
is the ability to require that
at a per application-level
you use a pin or a touch ID
with your fingerprint
in order for you to be able to access the application.
That's pretty cool.
How do we get the policy assigned to the application?
So, the next step is
you go in and click on the targeted applications.
As you can see
we have already built in all the key office applications
as a part of this.
So you have OneDrive, Excel, Word, PowerPoint,
Outlook, and all the apps.
We are also introducing a preview of Skype for Business.
The next step is
we are also working with partners like Adobe and Box
and that will also be added to this list.
We are also
allowing the line of business applications
developed by your own IT departments
to take advantage of this
by integrating with Xamarin and Cordova
That's pretty amazing.
This means that you have all of the apps
that you might want to use on a regular basis
are actually
going to be integrated with Microsoft Intune.
Yes.
And, in addition to that
moving on from step 3.
what we can do is
not only take these applications and target them
but, also target to specific users
and security groups.
And, the benefit here isn't targeting them to devices
You're targeting them to users.
So any device that this user logs in
automatically gets the protection
with the Intune Mobile Application Management policies.
The other benefit is
these are security groups
that you had in your on-premise active directory
that are now synchronized with the cloud for Office 365
And, without needing any additional infrastructure
right away with Intune
you are able to take advantage of those groups
and target the users in those groups.
This is great.
I don't have to create anything new
inside of my active directory.
I can just use what I have already inside of Office 365
that makes sense to my organization.
And, the admin experience looks really cool.
What does it look like from the
users experience point of view?
Sure.
I've got here
my personal iPad,
One of the first things I want to show you
is this particular device
is not managed by any mobile device management solution.
You can see that I'm go into the General tab.
And, you can see that there's no MDM profile on this device.
What I did was
as an end-user
I went directly into the Apple App Store
and downloaded a bunch of apps
that I want to use to connect for work purposes.
I have my Outlook app.
My OneDrive app.
Word, Excel, and PowerPoint here.
First thing I'm doing is launching the OneDrive app.
One of the things you notice is
this app supports multi identity support.
This means, it can connect to my personal OneDrive.
As well as to the corporate OneDrive.
So, in this case
you're actually connected to the personal OneDrive.
You can look at my personal photos
my shopping list.
And then, as you can see
I'm going to switch to the corporate context
within the app.
so when I click on this
you get this prompt
that says your IT department is protecting this app.
They have set this Intune MAM policy
and that's what causes this prompt to happen.
So, I'm going to hit Okay.
The first thing it asks me is
because I had set a policy in the admin console
that required a pin for every app launch.
I have to now enter my pin.
So, once I enter my pin
now I am into the corporate OneDrive.
and you can see that I have access to my business plan documents.
So, what I'm going to do next
is show Word
which is another application
which is also
able to connect different kinds of identity storage.
My corporate identity
and personal identity.
But now since I'm connecting to my corporate identity
and trying to open the business plan document
it once again gives me the same warning.
And then when I try and connect up.
So, it will show me the business plan documents.
When I click on the document
It's downloading the document.
and opening it in Word, which is now a managed application
that is subject to policies.
Let me start editing this document.
So, let's assume that this is super critical
important data for your business
and I'm trying to copy this
out of this corporate OneDrive Word document
into a personal application
which is not a managed application.
So, here I have launched the Notes app
within the iPad.
When I try to go and do a paste
you will notice that
the past operation is blocked
because, Intune detected that this was corporate data
and that you're trying to take it into a personal application
and personal contacts that's not managed
so that operation is blocked.
So, what we then do
as an end-user is
if he tries to work it around in a different way.
Lets assume
that he tries to take this data out
and connect to his personal One Drive.
Open a Word document there
and try to copy it there.
Let's see what happens there.
So, once again
I'm trying to do a copy here.
Lets select the data.
Hit copy.
and go back into a personal OneDrive.
Let me open up a new document here.
And, in this particular personal document that I've started out
what I'm going to do is
again, try to do a paste
but, you will notice there is no paste operation enabled now.
So, because this is a managed application
we detected that you are not in your corporate context
and you switched to a personal context.
So, we automatically disable the paste operation within the application
So now
this user tries to be even more malicious
and he tries to go in and say okay,
I'm going try to copy this document out
to a personal Dropbox
or account set up on this device.
So, what happens there.
So, I'm going to go back
into my corporate OneDrive
into the business plan document.
Open that document
and what I do here
instead of trying to do a copy-paste of some segments
of the document
I'm trying to copy the entire document off this iPad.
So, I try to hit duplicate
and then I try and select the Dropbox on my personal account
and hit duplicate.
And, once again you can see that
Intune MAM policies
are protecting the corporate data
and it's blocking you from doing this save into a personal location.
This is really cool
from an end users point of view.
I'm actually getting the control of my own personal data
and all the usage of the applications.
But, IT is still in control of the corporate data
and able to protect that
and prevent me from doing something that's a little bit silly.
It seems like a really great approach to solving this kind of problem.
What kind of things are we doing with MAM in the future?
There are two main areas we are investing in.
One as you saw here
was the ability to deliver mobile application management policies.
What we are enhancing is the reporting
and compliance capabilities around it.
The second thing we are doing is
working with a large set of industry leading partners.
These applications as you can see here
on this website.
Which is listing all the applications in the app gallery for Intune.
We have Adobe, we have Box
we have SAP
and a few other vendors who are partnering with us
and expanding the list of mobile applications
that you can actually now apply these policies to.
This is an amazing group of extra features
that are coming to Mobile Application Management.
Thank you very much for joining me
in the Microsoft Mechanics studio, Dilip.
Thank you very much for watching, as well.
You can try all of this today at the links below.
And, if you're already using Microsoft Intune
don't forget to check out the latest in the Azure portal.
And, of course to stay up to date with everything in tech
keep checking back to Microsoft Mechanics.
See you later.
Microsoft Mechanics
www.microsoft.com/mechanics