Listen Now

In this episode of The Endpoint Zone, Brad and Simon discuss how Microsoft Endpoint Manager brings all your managed devices together into one view across your estate. This unique approach allows devices managed by Configuration Manager or Intune to show up in the Endpoint Manager. From here you can manage settings, apply remote actions, and view analytics to gain insight into your estate. Also, demos, demos demos!       Related StoriesEndpoint Zone with Brad Anderson Episode 2002How Microsoft uses Condtional Access - Endpoint Zone 1812 

In this episode of The Endpoint Zone with Brad Anderson, Brad and Simon discuss the current state of IT in the COVID-19 pandemic. They talk about how organizations are moving from a state of response to COVID-19 and new work from home practices to a sustained hybrid-workplace model. In this new model IT will need to seamlessly enable end users to both work from home and from the offices with fluidity. Brad and Simon discuss how organizations are making this move.Brad and Simon also discuss and demo the new Endpoint Security experience in Microsoft Endpoint Manager and the importance of IT Admin / SecAdmin handoffs. Simon shows you the new experience centralizing security management for Windows, macOS, Android and iOS. You'll see how Microsoft Defender ATP comes into this experience to deliver security on Windows and macOS.       Related StoriesThe Endpoint Zone with Brad Anderson 2004 - Working from homeThe Endpoint Zone 1910Endpoint zone 1906 - co-management vs co-existence 

This episode of The Endpoint Zone with Brad Anderson is the first during our "new normal" of working from home! In this episode Brad and Simon talk about how customers are getting their workforces up and running at home while keeping them secure with Microsoft Endpoint Manager. They discuss Cloud Management Gateway for Microsoft Endpoint Configuration Manager (fka SCCM) and how Conditional Access will help secure your organization during this time.Brad and Simon also share their experiences of working from home full time and lots of resources.       Related StoriesThe Endpoint Zone with Brad Anderson episode 2005The Endpoint Zone 1910Endpoint zone 1906 - co-management vs co-existence 

In this month's Endpoint Zone with Brad Anderson, Brad and Simon talk about what Brad learned from his recent customer visit to Canada. Brad and Simon discuss the latest trends and developments in the endpoint management space including the concept of "cloud cadence". With a cloud cadence your endpoints and endpoint manager stay in constant sync, always able to instantly take advantage of the latest updates. Simon demos some of the most exciting new features of Endpoint Manager.       Related StoriesThe Endpoint Zone 2007The Endpoint Zone 1910Endpoint zone 1906 - co-management vs co-existence 

In this episode of The Endpoint Zone Brad and Simon talk about their favorite up coming Ignite sessions. They also explain where Microsoft lands in Gartner Magic Quadrants and how and why you should be looking to deeply integrated management options for Microsoft 365. Brad also takes you through Desktop Analytics, which was just made generally available.       Related StoriesEndpoint zone 1906 - co-management vs co-existenceThe Endpoint Zone with Brad Anderson episode 2005The Endpoint Zone with Brad Anderson 2004 - Working from home 

In this episode of The Endpoint Zone with Brad Anderson, Brad and Simon talk about Windows PCs in the modern workplace and what it means to manage them. They spend time delving into the reasons why co-management is better than co-existence and why ONLY Intune and ConfigMgr can provide co-management. Also as mentioned, here's a link to the Microsoft Office Twins Challenge       Related StoriesThe Endpoint Zone 1910The Endpoint Zone with Brad Anderson episode 2005The Endpoint Zone with Brad Anderson 2004 - Working from home 

In this episode of The Endpoint Zone with Brad Anderson we take a look at when you'd use ConfigMgr and/or Intune and why co-management is a unique thing, that only Intune and ConfigMgr can do. Why you would use them instead of any other UEM solution. This is a really demo heavy episode with:Where we take a look at the new integration between Microsoft Defender ATP and Microsoft Intune that surfaces SecOps actions in Intune for the IT admin to complete.Rip and replace upgrades are how many customers need to move to Windows 10 from Windows 7, Simon and Brad show you how ConfigMgr makes this easy with Autopilot.Then we take a look at Autopilot white glove, an experience where you can give your employees a "concierge" like experience for new devices.Automatic deployment and upgrade of Office Pro Plus directly from Microsoft 365 with Intune.We'll take a look at managing BitLocker with Intune, including key escrow and reportingBrad announces support for Zebra devices and Simon shows you how to manage those devices from Intune.Simon shows you how Microsoft 365 experiences are enabled across all your devices with Intune.       Related StoriesThe Endpoint Zone with Brad Anderson episode 2005The Endpoint Zone with Brad Anderson 2004 - Working from homeThe Endpoint Zone 1910 

The FastTrack organization is a large group of expert engineers who specialize in helping all types of organizations deploy Microsoft 365 apps.  There is simply no group in the world with more specialized skills on this subject, nor is there anyone else with greater access to the innerworkings of the platform. How do I request FastTrack assistance? To make a request for assistance from FastTrack, first go to FastTrack for Microsoft 365.  Once you're there, click on the "Sign In" prompt, and enter your org ID.  After you've authenticated, go to the dashboard and follow the prompts to find the "Request for Assistance" form. Your submission will then be reviewed and routed to the appropriate FastTrack team, and they will address your specific needs and eligibility.  At the M365 FastTrack site you will also find expert-created documentation, best practices, tools, and resources.        Related StoriesThe Security Benefits of Conditional AccessUsing Co-Management to Execute Remote ActionsClient Health Monitoring with Co-Management 

Getting cloud connected with Co-management adds new functionality to your existing Configuration Manager deployment, without changing how you already work. When you enable co-management, you immediately begin benefitting from the cloud. You can apply that value to your existing management infrastructure and processes. In this co-management Blastoff series, you'll find how you can quickly drive new management value. Co-management is built to create features and tools you can use right now.       Related StoriesThe Security Benefits of Conditional AccessUsing Co-Management to Execute Remote ActionsClient Health Monitoring with Co-Management 

If you missed the memo over the summer, as of 14 August 2018, hybrid mobile device management (Intune integrated with Configuration Manager) is a deprecated feature with support ending on 1 September 2019.  For more information on what this means, check out this documentation. The short version:  Intune standalone is now Microsoft's recommended deployment topology and it is required for Co-Management. From this point forward, if you want to enable Co-Management, you must move from an Intune hybrid configuration to Intune standalone. If, at any point in the process, you need assistance migrating away from Intune hybrid, just use the "request assistance" option at:  Microsoft.com/en-us/FastTrack/       Related StoriesThe Security Benefits of Conditional AccessUsing Co-Management to Execute Remote ActionsClient Health Monitoring with Co-Management 

As you work towards onboarding your organization to Co-Management, a significant hurdle for some teams is getting Current.  For Co-Management, Windows 10 1709 (released in January 2018) is required.  Your organization may be in the process of planning or implementing this update, and, once you are updated and Auto Enrollment is configured, your clients will be automatically enrolled to Co-Management.The great news is that upgrading Windows 10 is enabled by default!  In most cases, upgrade problems are related to AAD tenant configurations that have not been updated.  To learn how to update these configurations, check out this documentation. If, at any point in the process, you need assistance with your Windows 10 upgrade, just use the "request assistance" option at:  Microsoft.com/en-us/FastTrack/      

If your environment currently has Windows 10 devices locally domain joined, you will need to Hybrid Azure AD join your devices before you can enable Co-Management in ConfigMgr. Hybrid Azure AD joining your devices is a process that automatically registers your on-premises domain-joined devices with Azure AD.  For more context on this process, check out the Introduction to device management in Azure Active Directory, as well as this documentation about How to plan your Hybrid Azure AD join.       

Unwrapping a new PC is incredibly exciting, but we've all felt a bit of dread when thinking about how long it will take it get all our settings and apps just right so that we can start being productive.  Co-Management solves this device provisioning problem with Windows Autopilot. Whether you are looking to set up and pre-configure new Windows 10 devices, or reset, repurpose and recover existing devices – Autopilot provides a simplified experience for both IT and the end user. Autopilot also reduces the time, resources, and complexity associated with deploying, managing, and retiring/recycling devices.  And, while all this is going on, the experience for your end users is streamlined and easy right out of the box. Windows Autopilot supports multiple scenarios, all of which are maximized with Co-Management:Your end users can drive their own new-device deployments into either Active Directory (Hybrid Azure AD Join) or Azure Active Directory.You can set up self-deploying new device deployments into Azure Active Directory, for shared devices and kiosks.With Windows Autopilot for existing devices, you can use ConfigMgr to migrate an existing device from Windows 7 and Active Directory into Windows 10 and Azure Active Directory.For detailed info on how to enroll Windows devices in Intune using Autopilot, check out this detailed documentation.      

There's no simpler way to say it than this:  In the cloud, Identity is the new control plane.  This fundamental principal of security and management means that securely connecting users to applications and resources (no matter where they exist or how they are used) is what will set apart world-class organizations. This huge shift in how we approach IT is embodied by Azure AD.  Azure AD allows you to seamlessly link your users, devices, and applications – across both cloud and on-premises environments.  Bringing your devices to Azure AD enables you to take advantage of Azure AD's full potential to better improve productivity for your users and security for your resources. Having devices in Azure AD is the foundation for both Co-Management and device-based conditional access. When you have Windows 10 deployed, Azure AD provides two options for corporate-owned devices to suit your organization's varied needs:  Azure AD Join and Hybrid Azure AD Join.      

The health of our network is directly connected to the health of the devices moving in and out of it.  Intune has the unique ability to talk to unhealthy clients and act as a watch dog for your organization, even when a client is not on your corporate network.  When you use Co-Management to combine this power with ConfigMgr's ability to report back 98% of known healthy clients, you can detect, assess, and provide great visibility across all clients, in real time.  Intune also adds the support needed for compliance upgrades across all connected clients. Getting started with this feature is simple – to borrow a very famous advertising slogan, here are the three steps:Use Windows 10 1709 (or later) and enable Co-Management.Use ConfigMgr 1806 (or later).There is no step 3. To begin using these features, you do not need to move any workload over to Intune. In upcoming release we'll add additional functionality into CCMeval, the identification of potentially unhealthy machines (in both ConfigMgr and Intune) will get even easier.      

 IT must be able to ensure that every device they manage is reachable – no matter where it is – whenever it connects.  IT must also provide each device and device user with everything needed to stay productive while protecting the apps and data being used.  With the device actions supported by Intune, these critical functions can be solved (as the name implies) remotely.  Why you need it: Remote device actions give IT unparalleled management controls on the device without interfering with personal data.  These remote device actions allow IT to delete company data on lost or stolen devices, rename a device, restart a device, review device inventory, and remote control into a device.  This is an important and simple way to protect corporate data stored on these devices – whether it is in e-mail or OneDrive. Additional real-time actions include restarting a device, wiping out pre-installed OEM apps with the a fresh start reboot, and performing a factory reset on any Windows 10 device. To learn how to remote control a Windows 10 device via the third party program TeamViewer, use this documentation.      

 Simply put, Conditional Access is EMS flexing its might.  Surprisingly often, regular uses of ConfigMgr overlook how much they can use Conditional Access (CA) and take advantage of the simple, cloud-attached benefits. CA is a perpetual-motion machine which ensures that corporate resources are only accessed by trusted users on trusted devices using trusted apps.  It has been built from scratch in the cloud and, whether you're managing devices with Intune or extending your ConfigMgr deployment with Co-Management, it works the same way. With Co-Management, Intune evaluates every device in your network to determine how trustworthy it is – and it does this in two key ways: Intune ensures a device or app is managed and securely configured based on any way you choose to set your organization's compliance policies (g. make sure all devices have encryption enabled and are not jailbroken). This is a pre-security breach, configuration-based evaluation.For Co-Managed devices, ConfigMgr also does configuration-based evaluation such as required updates or apps compliance – and Intune combines this evaluation along with its own assessment.Intune detects active security incidents on a device thanks to the intelligent security of Windows Defender Advanced Threat Protection and other mobile threat defense providers. These partners perform ongoing behavioral analysis on a devices to detect active incidents and pass this information to Intune for real-time compliance evaluation. This is a post-security breach, incident-based evaluation. You can listen to Brad Anderson discuss CA in depth (with live demos!) in this section of his keynote at Ignite 2018.       

In this episode of the Endpoint Zone with Brad Anderson you'll hear from Microsoft's Chief Information Security Officer, Bret Arsenault, about how Microsoft protects it's employees mobile devices.      

To learn more about Desktop App Assure: https://aka.ms/DesktopAppAssureTo request assistance with your apps today: https://aka.ms/DesktopAppAssureRequest      

Coming up in this episode of the Endpoint Zone with Brad Anderson Brad talks to the CEO of JAMF software, Dean Hager. Brad and Dean discuss the JAMF Casper integration with Microsoft Intune and Microsoft 3365 [01:00] Some context on JAMF[03:40] "We're Apple guys"[07:40] Whiteboarding ow JAMF and Conditional Access work together[10:45] Demo[17:00] Insight into where the JAMF / Microsoft partnership is going next