welcome to office mechanics coming up on
the show if you if you're used to
managing devices it used to be about
locking down the entire device now with
the cloud and BYOD it really transcends
that to be able to protect files at the
data level we're going to talk about
that in the next ten minutes and all the
things that we're doing from office 365
in tune and Azure stay tuned I'm joined
again by NASA's Pataki's welcome nice to
be here so we think about mobile device
management what are we really trying to
solve for so we are trying to solve the
enterprise mobility challenge and in
order to do that we have to see it from
two different perspectives the end user
in the IT and end users want to access
everything from everywhere and being
able to access their personal data and
their business data from any device so
when you think about it from the IT
perspective we also want permissions
based access we want to make sure
regardless of what device you're on it
should be platform agnostic the identity
the person who needs access to the data
can only access that data and also we're
doing something here around segregated
personal and work information and for
that specific point I want to clarify
that users want to access let's say
their Facebook's and their Twitter's
next side-by-side with their corporate
in their data they won't that separation
so it means you learn to carry two
devices around like you may have done in
the past and also we think about
management it's really moving down to
the data versus just the device level so
we want to be able to protect at the
file level anything on that device yes
actually we protect in many different
levels but everything starts from
identity we want to be sure that you
have secure single sign-on
the second step is to go in manage
applications in devices and one of the
things that we're doing with office is
were actually instrumenting those
applications to make sure they can be
managed one of the cool things now with
office 365 and Windows Intune is I can
roll through Word Excel PowerPoint it's
not just about connecting mail to that
device but also connecting through those
other apps so onedrive for business for
example becomes that enrollment
mechanism so regardless of how I connect
the data I need to be able to protect
that and you know by getting that by
getting that separation and users get
their devices but it doesn't have to be
manage devices of their enterprise and
besides identity and mobile and
application management we can go even
deeper we can protect data we can have
encryption that will follow data
wherever they are even when they leave
the device let's have a look at some
demonstrations of all this working
because we have some really cool things
to show across all the different
workloads that we have from office 365
also into in tune and azor so we're
gonna move to my device here and you'll
see that I have a brand new compliance
Center in office 365 and that's got a
few new capabilities it's got archiving
device management data loss prevention a
lot of these apply regardless of whether
I'm using a mobile device or whether I'm
using a traditional PC just to show you
what I can do from a conditional access
perspective I want to make sure that the
devices that connect to my
infrastructure are actually healthy too
some of the new things that we can do in
terms of access requirements that
weren't in Exchange ActiveSync
for example are the ability to check for
rooted or jailbroken devices those
things I can do right within my console
here to make sure that these types of
devices that we can ensure are safe are
able to connect to to the devices can't
connect to my corporate resources some
of the other things that I can do as
well some configurations a lot of people
ask me well can I stop people from
screen-printing their device yes we have
all of that built in so I can do things
like walk screen capture right on the
device you can see it here but I have I
have now new capabilities that might not
have been things in within Exchange
ActiveSync in the past so we have
additional controls also around 50
different PowerShell controls we can do
there in terms of having even more
granular control over the device but
I'll cancel out of that cause I want to
show you how you do selective wipe with
an office 365 if we go and look at our
list of manage to buy
here we'll see that we have a few
devices in our tenant we've got now a
couple of new capabilities noticed I'll
just zoom into that those capabilities
so if we think about what we had before
we had something called full wipe so if
we look at full wipe what that will do
and I'll be careful not to press that
because somebody's a device will get
wiped and reset back to its original
factory state what would happen there is
the device would get set back to the
state that it would wouldn't you unboxed
it now a selective wipe we can basically
just remove the information the data and
reset the applications to where they
were when you initially installed them
before you signed in to try to access
data so that means that you can leave
everything back on the device that
pictures everything else untouched so
that users can use the the device that
they typically own and that way they're
not to carry two devices with them so
really exciting stuff natively inside of
office 365 but it gets even better when
we add into into that right right so let
me explain that in the concept now this
is a personal device that it's enrolled
in in here and the user doesn't really
want to have a fully locked device you
just want to have a managed environment
and manage applications so you can see
here in my iPad that I have different
applications and if I click to my notes
for example I can get into them with no
problem but if I click one of the manage
devices you will see what will happen
so this inhyun enroll device has outlook
the moment I will click around outlook
you see that I need to provide the pin
so by using this secure pin I have
access now to this manage application
and let me show what I can do through
that manage application let's say I'm
looking at this specific mail and I'm
trying to to copy that part of my day of
my email then let's suppose that I will
try to paste that part to a personal
application let's say knows if I go here
you will see that paste is not even an
option so whatever I copied from the
manage application controlled by engine
wasn't even possible to paste it here if
I go toward let's say let's open word
which is also I protect the device I can
now by clicking here you will see paste
is possible and I can paste it because
also word is protected so you see that I
can do both of these things and if I
will try to save that word document
let's say and the same goes for Outlook
and attachments of Outlook and stuff
like that if I go to save the device I
have many different options if I try to
save it in my Dropbox which is a
personal space you will see that I will
I'm not even able able to do that
because this is not allowed but if I go
to the own Drive of conditional of the
contoso cloud onedrive I am able to
share it or let's let's so actually that
lets say saying you see it says your
administrator doesn't allow saving to
personal locations so well this is my
device I have a full separation between
what is mine and what is business
control now that's okay about office
applications and office of 65 probably
what about others has applications right
because it really goes beyond just
protecting the device because you have
other business applications maybe other
personal applications you might try to
connect you via the web or other
mechanisms this sense also gives you a
way to protect the logins with those we
have abilities now with an azure active
directory to do a lot more in terms of
protecting experiences exactly and if
you remember my point on having secured
single sign-on this is what I'm going to
do right now so I'm going to an
application a mobile application that is
available in all mobile devices and of
course in iPads so and I will log in as
a user I will be that user for now
better arrogancy I was recognized the
environment change to my familiar colors
and I will use my password the thing you
are going to see now it's a single place
that I will be able to sign in to many
different size up Legation so you see
office 365 but you can see box and
Enterprise Twitter account and
everything everything is here the
enterprise leader account is protected I
don't know the actual password I can
just sign in from here I can see my
workday account and look at that those
ugly icons are icons from web
applications hosted on-premises publish
through Azure Active Directory premium
to this device and I can take
conditional access and special
protection to
different applications here so if I
click Twitter probably I will be there
with no protection but if I decide to go
to my on premise application let's say I
am going to go to my legacy sales
tracking application which is an
application from on-premises and click
on that icon you will see now that I
will be prompt for a second factor of
authentication so I'm expecting for that
phone call this is really great because
it means that I only need to know that
one set of credentials to get all these
different services now it is coming in
ok I'm going to answer you have to
believe me that the real nice lady says
not so see if it was you press your pin
and you will be in but if it was in you
press zero pound and your account will
be blocked and an alert will be created
so although probably someone has your
device and your password he doesn't have
your mobile device your phone so you can
block him this is real protection this
is great because it works again on even
sites that might have only a single
factor of authentication now you can
require that even if it's a your
company's Twitter account or company's
Facebook account those things you can
protect via multi-factor authentication
via that same login that you would have
to access even internal services all in
one place even with an iPad and we saw
with the phone multiple factors of
authentication right and now I'm going
to show you also how you can discover
all those SAS applications that your
end-users are using so I'm going now to
a management console let's pretend that
now I'm an administrator and I'm going
to Porto da da sure calm and there you
will see a new capability that we have
announced recently at the keynote on
Monday and I am admin for this case so
one of the things that you're gonna want
to do is actually figure out what people
are using right exactly this is my gold
map so I know that I have to protect
their office applications I know that I
had to protect their box and there are
other applications of you have just seen
but let's see are you sure that you know
exactly what your end users are using
let's do that we have a tool to do that
and yes we have the tool is called cloud
app discovery it's available through as
you like to direct
and I'm going to click here to add
Jacques to cloud up discovery image or
Active Directory and you will see that
you have the capability to see what
exactly your users are using in our case
we have 462 new applications discovered
in our managed devices environment and
52 users are using these applications
and I can drill down and see exactly
which these applications are how much
they are use and by that you have you
can say that ok I see that my users are
using let's say search forge a 10 of
them and they are using this application
heavily and I see that this application
is still and managed let's change that
let's bring those users under the manage
environment and give them secured single
sign-on and all the benefits that you
have seen so when I discover the
application I can click manage from here
and bring them in or I can go even
further click on the application and get
a view of how many users and how much
they are using the application and even
further which users I can see their
names I can see their devices so I can
decide if this is an important
application to bring in this is not even
enough okay now you know your users what
your users are using but you don't know
from where they're accessing that and if
they are really your users so in order
to help you even more with that without
your Active Directory premium we have
this security advanced security
reporting and I am going to show you a
few of these reports so in the reporting
part of Azure Active Directory premium
now that we know which applications we
have to secure now we have a mobile
application management and office 365
and the M now that we have everything
let's be sure that our users are using
their applications consistently and
safely and so if a user is accessing an
application or from an anonymizer from
tor anonymizer you can know that now if
he's trying to access the same
applications from two different places
at the same time let's say sign is from
geographies he cannot be in north korea
and it's a koala noise at the same time
so probably something is wrong with this
guy and you can take actions you can
click on him and block him because
she cannot be she cannot come from North
Korea to here in 14 minutes
so either you block him or you can
enable multi-factor authentication for
him so really taking it again beyond all
of just the devices itself and really
going with a lot more intelligence
around how people are logging in we can
manage the management we can have
manageability there in place without
sacrificing end-user productivity right
yes this is really important we can give
security with productivity at the same
time that's about all the time we have
to show today in terms of mobile device
management the things that we're doing
to go beyond the device of course you
can keep current with all of these
discussions on the office plug you guys
have your own blog as well right of
course this is enterprise mobility suite
Microsoft comms la CMS and you will see
all the things that we have just
discussed thanks for watching and good
bye for now
you