hi everyone welcome to our session so my
name is a sovereign of Ave and this is
Karin I'm a program manager on the
intern team and Karin is a engineering
engineering leave today we're gonna be
talking about the internet CK how you
can use it to protect your line of
business apps and also the capabilities
of at the Intune PowerShell module so
how many of you are familiar with what
Microsoft Intune is awesome
so for some of you who may not be as
familiar this is kind of a summary of
what Microsoft Intune is so it's
basically a cloud-based service in the
enterprise mobility management space
that helps you enable your workforce to
be productive while keeping your
corporate data protected in the apps and
whatever resources your end-users need
to access so similar to other Azure
services that you may have used
Microsoft Intune is available to
configure in the azure part portal
these are some of the things you can do
with Intune you can manage your mobile
devices and your PC while your workforce
uses to access company data you can
manage the mobile apps that your
workforce uses you can protect your
company's information by controlling the
way that your workforce accesses and
shares it between other apps or other
users and you can also ensure that your
devices and apps are compliant with
whatever company's security requirements
that your organization may determine so
what is the internet CK so the
Internet's DK enables what we call
internet protection policies and what is
the purpose of internet protection
policies why would you want them so the
purpose essentially is to protect and
separate your corporate apps data and
identities from the personal ones so
this diagram is kind of just simulating
what it looks like on an user device so
you basically have various apps that you
use for doing your work day-to-day some
of these apps are multi definitely
identity like work Word Excel PowerPoint
and outlook where you have a corporate
account but you can also use it with the
all account but in order to actually use
it your I your IT or probably have some
requirements in order to be able to
access whatever corporate data there is
so in tune helps enforce and set those
types of policies so a protection
policies are built into all of the
Microsoft Office apps mobile edge and
other product of these apps at Microsoft
builds you can also enable this into
your own line of business apps if you're
an app developer for your organization
and there are some popular third-party
apps that are public store apps but are
used widely and various enterprises that
also have the Internet's DK integrated
now I'm gonna talk about what we have
done in the last year with the intern
STK they've been a couple of changes
that we've made that are a developer
focused and might be of interest to
those of you are interested in using the
into an SDK so in tune now leverages
Google's safety net ap is for enrolled
and unenrolled devices so why this is
beneficial is now app developers do not
have to do the work to integrate the
Google Google safety net ApS into their
own app so they can ensure that their
apps are running on non rooted devices
by just running by just integrating the
engine sdk and applying in tune policies
so the safety net api's can be apply ten
users using enrolled devices or unenroll
devices now and essentially what these
do will is detect if the device has been
rooted or compromised in any way and a
popular apps such as android pay and
netflix are using these api's in order
to ensure that these devices are not
running on and rooted devices and
potentially bypassing things like
payment services for example another
change that has happened is that we've
grown our ecosystem of apps that support
the internet's deep a with a lot of a
lot more Microsoft apps such as
Microsoft's dream to do power apps as
well as other third-party apps that are
popular in enterprise
the Internet's DK now is now for Android
it's not released as a Gradle plug-in so
essentially that the benefit of that is
that it's an improved experience for the
app developer and a lot of the
replacements of
placement to your apps classes that need
to be made happen automatically with the
Gradle plugin instead of manually having
to do that the internet ck I don't know
if I mentioned but it's also available
for iOS this is just this particular
line that's just specific to Android
we've also released a suite of sample
apps so if you go to our github page
which I'll show a link to shortly you
can see the capabilities of the internet
CK actually applied within context of a
sample app they're available in
objective-c
Swift's xamarin xamarin forums and Java
and one of them will be used in the demo
that we're doing later and as usual we
are preparing for in two days here and
support for the new release of both iOS
and Android
now our two Karen to talk a little bit
about what has changed with the
PowerShell piece hi everyone you can all
hear me perfect so my name is Karen I am
an engineering lead with an in tune and
one of the areas that my team owns is
our integration with ms graph so we have
a good coverage of into knowledge here
are people familiar with ms graph yep
I have people already use the in tune
PowerShell module for ms graph anyone
perfect okay so um if you were listening
to some of her Josh's talk earlier he
reiterated a lot about how important ms
graph is to the m 365 story it's that
unified view of the Microsoft API is
that allows people to really feel like
this suite as one product and from our
side of it for in tune every action that
we expose through the admin UI they're
all powered by ms graph so anything that
can be done through the UI can also be
done directly through our graph
endpoints this has a lot of benefits for
us it creates that similar experience
with all the other end 365 suites it
gives that one endpoint that people have
to know how to use and a set of
technologies that can be used to
communicate with our API that's the same
as that everything else focusing in on
the last one
the set of technologies the main thing
that people ask for when we were
releasing this was PowerShell PowerShell
was really important and when we
released the
an MS graph we natively had PowerShell
support problem with it was it was a bit
cumbersome it wasn't as smooth as it
could have been you had to craft the web
request yourself you to get the our
access token you had to do a lot of the
heavy lifting and we did put some
samples up there but they were nowhere
near a complete representation of our
API space so we listened to the feedback
and we released the Intune PowerShell
module and with this it gives you that
first that first class experience in
PowerShell for leveraging the Intune
api's you have actual command lists
which represents all of our
functionality inside there and you can
use that to script up whatever you wish
against it and as we release on a
monthly cadence and we light up new API
is these new API is in m/s graph v1 will
also appear in our PowerShell in our
PowerShell module we also took some of
our more involved scenarios some of our
complicated ones one of the and we
really samples for them to show how they
can be simplified through scripts one of
the ones I'll show later on is our line
of business app upload but we believe
that's one of our most difficult
scenarios to try and understand what's
going on so we put a sample out there
and I'll show you that in a moment and
finally the last thing that we released
as part of it was a PowerShell
it was an integration with cloud shell
which for anyone who's familiar with
cloud shell it's that password list
seamless experience that works very very
well now I'm going to jump out of the
presentation and do something that I
intended to do when I started talking so
as we release this demo as we released
this module people really did like it we
got great feedback around leveraging
this PowerShell module made it much
easier to script the day-to-day tasks
that people are doing and it was very
beneficial how do we lose the screen
okay we came out of the presentation
sorry experiencing technical
difficulties
okay what were waiting for that I'll
talk to it so because it's build I
wanted to take a little bit of a
different slant on it than just saying
scripting the day-to-day tasks that an
admin would normally do I wanted to look
at it from the developers perspective
and how the PowerShell module can help a
developer in their day-to-day tasks so
what I have here once the screen will
come back at some point is a Azure
DevOps repository which has a clone of
the mam SDK sample app so it's an it's
an app it's building an apk that's
integrated with our mam SDK when we
build it the output of it will be the
apk there will be a drop that includes
it and what we've done is we have hooked
that to a release which will go download
our PowerShell module at the moment it
actually has credentials inside it that
are stored securely will authenticate
with ms graph takes the apk that's been
downloaded and uploads it to engine the
benefit of this is that now as a app
developer if I check in any changes if I
make any improvements to the app I don't
have to go through long convoluted
manual process in order to be able to
upload and deploy my apps out to a set
of test users great we're almost back
instead I get a continuous integration
continuous deployment system where as I
check in it will build it will upload at
the in tune it can deploy to a group of
users or to a group of users or devices
thanks and then it will work now that
we're here ok says throw me off you can
see that the build that I kicked off has
not yet finished so I'll do my best
impression of cooking show and here is
one I made earlier I have we go into
this release we will see there are four
tasks at the end of it
okay
four tasks at the end of it we have
downloading the sample script that I
referred to earlier and then we have
actually uploading it to in June and
just to show you how easy it was to
actually put these to put these together
we'll go to edit the deployments we'll
look at the tasks installing the SDK
it's in the power it's in PowerShell
downloading the sample the sample script
that we have simple matter of downloaded
from our github repository
and then uploading the apt engine it
authenticates it takes the app and it
uploads it and just to show you what it
looks like at the end of the day this is
the app that I uploaded to it and each
version that we have published here
actually maps to the release that we've
built so between today and yesterday I
have done this 32 times and that is the
and that is the experience so leveraging
Intune and ms graph and azure devops we
create a continuous integration
continuous deployment experience for app
developers so thank you very much and
now I shall hand you back thanks Karen
so what Karen just showed you was this
demo so what do we do now that our app
is uploaded into the engine console how
am i applying and selecting which our
protection policies I want to target to
this app that I have integrated the
internet CK into so in order to go that
in order to do that you would have to go
to the Intune protection policies page
which is here so this is a test policy
that I made ahead of time and
essentially there are a couple of things
that you have to make sure you do so to
start off you want to pick what settings
you want to apply it so we divided them
into settings relate to data protection
access into the app itself and
conditions based on which the app should
launch or not launch some of the
settings that we have our in particular
are restricting cut copy paste
restricting the ability to save into
unmanaged locations route detection
applying a Intune pin to the app itself
so if you wanted any user to enter pin
to access any corporate apps they would
need to meet whatever the pin
requirements were set as per Intune
policy as well as other condition
conditions that you can set under
conditional launch such as how many
times they can enter the pin what
devices the app should be able to run on
in terms of Android manufacturer or iOS
model so that's basically what that
looks like
and then you want to pick which apps it
should apply to so the optech keyring
uploaded would ideally need to have
policy targeted as per this page this is
a mix of both our third-party and
Microsoft apps so here I've targeted it
to Outlook and onedrive as you can see
some of our most commonly used apps
without protection and then the last
thing you want to make sure you do is
assign it to a user so all of these
users are the ones that are in your
Active Directory and I've assigned it to
a group called Group asari which has
just me in it for now so essentially
once you've done all of that when your
end user who is in the group that I've
just picked when they try to sign into
the app that has been applied policy
they will have to make sure that they
abide by whatever policies the admin has
set and this happens because the app has
the Internet's DK integrated into it so
if anyone wants to see kind of what that
would look like on the app come talk to
us after we have a testing Android and
test iOS device that we can show you
what a policy might look like for the
end-user so to conclude just want to
give you guys some tools that you can go
to to look for more information so we
Oliver developer tools for the SDK are
available on our github site as well as
the intern powershell sdk under the urls
above if you have any questions about
the internet ck mail us at this alias
we'll respond to you if you're
interested if you need to know does this
work for me does but is this supported
on the platform that i'm using to
develop my apps and lastly we'll be here
at build if you want to talk to us and
see if these scenarios and
this feature set is right for you that's
all thank you for coming