- Welcome to Microsoft Mechanics.
If you are an admin managing endpoint devices
or in sec-ops concerned about secure access
to your resources or the team on point
for supporting end users wherever they are,
keep watching, because in the next few minutes,
we'll break down the essential things you need
to know about the new Microsoft Intune Suite,
that goes beyond UEM to bring you one unified solution
with a new collection
of advanced cross-platform capabilities deeply integrated
in the familiar Microsoft Intune admin center.
These capabilities span endpoint privilege management,
advanced analytics, micro-VPN for personal devices
and Remote Help for your users,
with more capabilities to come.
All capabilities
that today typically require multiple siloed tools
with multiple portals that then need to be integrated;
as well as different utilities
to perform specific functions or enforce policies.
Users in this case suffer
because all the different agents deployed
reduce performance and impact reliability as they work.
And when you add to that the complexity you face
of keeping devices healthy
and secure as more of us work outside
of the corporate network with hybrid work,
the management overhead can be significant.
The good news is it doesn't have to be this hard.
Not only can you reduce the costs
of having multiple solutions in place through consolidation,
but as I'll show you,
with a single solution, you can also reduce the complexity
and take your endpoint management to the next level,
while leveraging Microsoft's unique breadth of integrated
and intelligent services,
which includes integrated best
in class solutions to protect against cyberattacks.
Let's look at examples
of how this transforms unified endpoint management
across the lifecycle,
first by looking at a core aspect
of Windows endpoint provisioning.
Where, as you provision new devices
with local user accounts,
one of the most pivotal decisions you'll make is whether
or not to provide them
with local admin permissions.
This isn't a trivial issue,
some apps will require frequent elevation of privilege,
and need an administrator account to run,
so blocking this can prevent users
from getting their work done.
At the same time having this level
of privilege increases the security risk
of privilege escalation attacks,
such as malware and or credential theft
Our new "Endpoint Privilege Management" capability
solves for this.
To keep these operations more secure,
unlike other Just-in-Time solutions
where the account is elevated
for a period of time with unlimited scope,
elevation is instead performed per approved operation only,
to avoid running unauthorized processes
at elevated privilege.
Endpoint Privilege Management is enabled in Intune
at the tenant level, with granular controls
to leverage built-in Windows OS protections.
Using policies, you can define the elevation type,
either automatic or user confirmed
along with required additional validation.
These allow you to balance security requirements
with multiple tiers of end user experience.
Automatic allows users to run pre-approved apps
at elevated access without any prompts,
and user confirmed, on the other hand,
prompts the user for an additional confirmation.
And soon we'll be adding "Support approved."
This is a first look at the experience.
For apps that require infrequent or one-off elevations
of privilege, users can request elevation
and optionally submit business justification.
And once they hit "send," the request
goes to IT for approval.
From here, the support tech has the authority
to manually approve the elevation request.
And the user is able to continue running
that process with the required elevation in place.
Then beyond Windows,
for your mobile devices another core decision
is whether user-owned devices running
on your corporate network,
will require enrollment into management.
There may be cases where users
aren't comfortable surrendering control of their devices,
or as an organization you want a clear separation
of personal and work use.
In the past, you might solve for this
by making users carry two devices,
with one dedicated for business use,
but now you don't have to.
Our new secure VPN access works at the app level,
called Tunnel for MAM,
it serves as an extension
to Intune's Mobile Application Management.
This allows users to securely access on-premises apps
and resources from personal devices.
It works on both iOS and Android platforms
and removes the need for full device enrollment.
When you attempt to access a resource within your perimeter,
it will only work for the apps you approve.
This prevents company data from moving onto the device
for personal use, as you can see here,
where the file and its contents are contained
within the managed Microsoft Edge Browser app.
Then, only the apps from your MAM policies are permitted
to view that content,
while also protecting user privacy.
Beyond the enlightened Microsoft Edge app,
you can also enlighten your own mobile line
of business apps to leverage Tunnel
for MAM using available Software Development Kits.
And from there, you configure Tunnel
for MAM by defining your App Configuration Policies
in the Intune admin center,
and enabling Microsoft Tunnel VPN.
This works together
with the MAM app protection policies
you already have in place.
Next, continuing
down our unified endpoint management lifecycle path,
another major benefit is how the Microsoft Intune Suite
can transform your management activities
from reactive to proactive using advanced insights.
Here, Microsoft's unique advantage comes
with the massive signal received
across our Windows install base, in addition
to our best-in-class integrated services
for identity management,
enterprise security and productivity apps,
which ensures a deeper more comprehensive view
of trending incidents impacting your devices and users.
And we're working towards ensuring
that these collected insights will lead
to proactive resolution,
before your users even contact the helpdesk.
The advanced endpoint analytics intelligently
detects anomalies and unexpected issues
across your managed endpoints.
It then provides targeted insights down
to specific affected devices.
And for each, you'll see a detailed timeline
of the user experience with the detected issue.
Then, for the support calls that do come in,
you will also have more flexibility
to run remediation scripts on demand
for individual devices to diagnose,
troubleshoot, and fix common issues.
For deeper investigation
where you need to look at active support cases and history,
the troubleshooting blade in Intune now
gives you a single view of your tickets
through deep integration with ServiceNow.
Here for example, we've filtered on a specific user,
and not only we can see the information collected by Intune,
but in the same view, and in context,
we can now see a summary of matching ServiceNow incidents
and the deep links allow you to learn more
about the incident in the ServiceNow console.
Of course, where more hands-on help
is required or you need to better support hybrid workers,
the Intune Suite also adds Remote Help enhancements
to improve security and compliance.
As a cloud-based service,
it removes the need for expensive on-prem infrastructure.
All actions are governed using Role-based Access Controls.
And you will be able
to enforce conditional access policies with Remote Help.
Notably, as a helpdesk technician,
you can securely connect to both enrolled
and unenrolled devices.
And once the remote help session
has been started and is running,
users have peace of mind in being able
to validate the technician's identity
to avoid helpdesk spoofing attempts.
And you, as an admin,
before connecting to a remote session,
can see device compliance warnings to alert you in advance.
You'll also be able use the clipboard
to copy text or files
from your local device onto the user's device
And direct on-screen actions using annotations
with a laser pointer.
By the way, full featured text-based chat support
is coming soon, along with support
for Android devices using Remote Help.
Where you can launch the Remote Help session
to view the screen and request full control right
from the Intune admin center.
The unattended option lets you access managed devices
while they are not in use,
allowing you to set configurations
or troubleshoot issues remotely,
as long as those devices are powered on
and connected to the Internet.
This complements Intune's support for Frontline Workers
and works with
enrolled Android Enterprise Dedicated devices.
And one more thing,
cross-platform specialty device management
is also now part of the Intune Suite.
So that was a quick overview of Microsoft Intune Suite,
our single solution
spanning integrated advanced capabilities
to simplify endpoint management while reducing costs,
especially if you're using multiple solutions.
If you don't see all the capabilities
in your Intune Admin center today,
as mentioned, they'll be rolling out soon.
And to learn more, check out aka.ms/IntuneSuite.
And keep watching Microsoft Mechanics for latest updates,
subscribe to our channel, and thanks for watching!