MDM & GP Tips Blog

Jul 2019
10

Two (not Jeremy) blog posts about Windows Update for Business' Rings

Windows Update for Business is the method where you can use Group Policy, SCCM or Intune to describe "rings" for your business. In these rings, you express "who is going to go first" to get updates.

Then, who will go next, and so on.

I explain these rings in details in my new MDM book.

But I wanted to share two Microsoft blog entries on this important topic, since it comes up from time to time. These are good extra sources of information.

https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/Deployment-rings-The-hidden-strategic-gem-of-Windows-as-a/bc-p/664595

-https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/Tactical-considerations-for-creating-Windows-deployment-rings/ba-p/746979

Hope these help you out!

Nov 2018
05

What can I get from Office 365’s MDM versus Intune?

When it comes to Mobile Device Management, it can be a little confusing keeping all the various MDM offerings straight.  For many organizations that utilize Office 365 for their email and/or other office suite applications, O365 MDM may be quite appealing due to one captivating detail…its free!  Yes, MDM for O365 is included with many Office 365 commercial subscriptions.  Free is indeed a good thing.

Free of course usually denotes some limitations and shortcomings.  This is the case with O365 MDM as it does not have near the feature rich options nor device coverability of Intune.  Intune either requires a paid subscription or can be purchased with Enterprise Mobility Suite.  Cost is one of the main differences between the two.

Mobile Device Management for Office 365 is designed for securing and managing mobile devices.  This includes such things as iPhones, iPads, Android devices, Windows Phones and tablets that are connected to Exchange Online.  You can create MDM policies to secure these devices by remotely wiping them or removing sensitive information.  This is one of the most important security management features for corporate mobile devices.  Other functions of O365 MDM include:

  • Remotely wipe emails from any device
  • Set up device policies like password requirements and security settings
  • Ensure email and documents can only be accessed by company managed mobile devices
  • Access reports and alerts concerning the jailbreaking of devices
  • Review reports concerning which devices are not compliant

O365 MDM is a good fit for a company that fully utilizes domain joined services to manage their traditional workstations and laptops and need to manage and secure mobile devices as well.  For those organizations that want to go all in and manage all of their Windows 10 computer devices (including traditional PCs) using an MDM solution, Intune is the only choice between the two.  With Intune, it is possible to manage your devices without any on premise infrastructure as long as they are all Azure joined.

Another key difference is how you access each of the CSP interfaces.  O365 MDM is accessed using the Security and Compliance Center as is shown below.

 

Intune on the other hand is accessed through the Azure portal.

 

Intune has a lot more functionality than O365 MDM such as the following:

  • You can integrate Intune with System Center Configuration Manager to coincidingly manage both on and off prem devices
  • Supports Mac OS X as well as Linux and Unix servers
  • Deploy your internal line-of-business apps and apps in stores to users
  • Provide additional security for web browsing
  • Implement Mobile Application Management policies for all your users

Which one is best depends on the needs of your organization. 

Nov 2018
01

What is Intune for Education?

Microsoft puts a lot of emphasis on the education market.  In an effort to cater to the K12 educational organizations, Microsoft offers a separate product called Intune for Education.  While large metro school districts that have students numbering in the tens of thousands or more will most likely opt for the full Intune Console, Intune for Education is a very attractive alternative for private schools and public schools with a student body of less than 10,000 students. 

First off, Intune for Education is simpler.  Smaller school systems often lack high level fulltime inhouse IT staff with the knowledge base to granularly administer advanced settings for their enterprise.  Often a single staff member is assigned the duty of supporting everything.  In some cases, schools may rely on teachers themselves to manage their classroom students and devices.  This is where Intune for Education comes in.  It has a simplified management interface that is inviting and extremely user.  Task creation is wizard driven so that the user is guided through the setup process.  The interface makes use of graphical icons that make it less intimidating for teachers and non-technical staff.  Below is an example of the Express Configuration area that is designed to quickly achieve a desired task.

 

Simplicity does come at a cost.  Intune for Education lacks the advanced configuration functionality that the full console version boasts.  It does do a great job of the essentials however such as the basic management of users and devices (both Windows 10 and iOS), deploying mobile apps and ensuring basic security compliance.  It is a simplified Windows 10 experience, but for many schools, that is all that is needed.

Intune for Education is designed for the modern day educational organizations.  For instance, teachers can create “Take a Test” profiles.  These test profiles secure the browser during an online testing experience.  These secure testing profiles prevent students from using other computer or internet resources during a test.  Intune for Education also integrates with other Microsoft products such as School Data Sync and Minecraft Education Edition.

 

Screenshot originally from: https://docs.microsoft.com/en-us/education/windows/take-tests-in-windows-10

And then of course, there is cost.  Intune for Education is affordable for smaller school systems that face challenging budgets.  Currently, educational customers have two options.  The first is a “one and done” per device fee at the time of the device’s enrollment.  This license is good for the life cycle of the product.  The other option is to license it per user on an annual basis.  The good news here is that student account are free.  School administrators will have to run the numbers to decide which option is best for them.

Keep in mind that Intune for Education is for “schools” only and Microsoft does verify this.  While Intune for Education isn’t for everyone in education, it certainly makes sense for some.