Welcome. Managing People, Devices & Information in Office 365. Please take a moment to fill out the yellow cards.

Size: px

Start display at page:

Download "Welcome. Managing People, Devices & Information in Office 365. Please take a moment to fill out the yellow cards."

Dina Bradley
6 years ago
Views:

1 Welcome Managing People, Devices & Information in Office 365 What do you hope to learn today? Please take a moment to fill out the yellow cards. Our presenters will review the cards to ensure that we cover the topics/areas of interest. We will collect them before we get started. Thanks!

3 Collect Learn Today Cards What do you hope to learn today? Please take a moment to fill out the yellow cards. Our presenters will review the cards to ensure that we cover the topics/areas of interest. We will collect them before we get started Thanks!

4 System Source & Microsoft: Microsoft Certified Partner since 1980 s Silver Learning Solutions Train 6,000 students/year Our Instructors rate 20% higher than Microsoft National Average Customer Satisfaction Scores. Silver Infrastructure 1,000 s of Microsoft implementations Small Business to Enterprise Non-profit Education

5 System Source & Microsoft:

6 Agenda (Dave s portion) What is Office 365 Identity Management Azure AD Cloud, Synchronized, Federated accounts Azure AD Features Examples Multi-Factor Authentication / Self Serve Password Reset Single Sign On Using Azure AD for SaaS SSO Native Office 365 Mobile Device Management

7 What is Office 365?

8 What is Office 365? Office 365 is mostly a SaaS solution Your connectivity to and use of Office 365 and other Microsoft Cloud services are flexible. Subscribe to one service only or a suite of services Subscription plans offer various levels of features You can use only the Cloud for login and data Synchronize directories and/or Federate to control accounts locally Integrate the Cloud services with on-premises services (Hybrid) so data and services can span both locations

9 What is Office 365? Exchange Online Archiving Encryption Skype for Business Real-time Communication Office Collaboration Rich client Web client Apps SharePoint Online OneDrive Yammer

10 Plans

11 Plans

12 Plans

13 Plans

14 World-Class Data Centers

15 Office 365 Trust Center Clear messaging with plain English Details for security experts Links videos, whitepapers

16 Identity Management How does Office 365 (and Azure) integrate with my environment?

17 How does Office 365 integrate with my environment? Office 365 services (Exchange, SharePoint, Skype for Business) can be on-premises, in the cloud or a combination (hybrid) Microsoft offers hybrid configurations for Skype for Business, SharePoint and Exchange. Available features vary with service and subscription plans. Interoperability between Exchange, SharePoint and Skype for Business has some limitations but integration is improving. DirSync and ADFS is a requirement* for hybrid deployments User accounts can be in the cloud or on-premises User accounts can be managed in the cloud or on-premises

identity management capabilities including

privileged account management, role based

18 Where are your Office 365 Accounts? Microsoft Azure Active Directory Azure Active Directory (Azure AD) is Microsoft s multi-tenant cloud based directory and identity management service. Azure AD also includes a full suite of identity management capabilities including multi-factor authentication, device registration, self-service password management, self-service group management, privileged account management, role based access control, application usage monitoring, rich auditing and security monitoring and alerting. Azure Active Directory Active Directory

19 What is Azure Active Directory? The Azure Active Directory service comes in three editions: Free Basic Premium The Free edition is included with an Azure or Office 365 subscription. The Basic and Premium editions are available through a Microsoft Enterprise Agreement, the Open Volume License Program, and the Cloud Solution Providers program.

20 Every paid subscription to Office 365 comes with a free subscription to Azure Active Directory. You can use Azure AD to manage your apps and to create and manage user and group accounts independent of Office 365. To activate this subscription and access the Azure management portal, you have to complete a one-time registration process.

21 Office 365 Subscription Domains The default domain when opening a subscription is <DomainName>.onmicrosoft.com This domain is fully functional and can be used for login and . This domain will be used for internal routing in coexistence scenarios. Your production domains are added to the subscription for login and . Login IDs are in UPN format Note When using Directory Synchronization you would match your local Active Directory UPNs to a domain(s) configured in your subscription.

22 Local AD Integration with Office 365 Cloud identity Cloud identity with directory synchronization Federated identity Single identity in the cloud Suitable for small organizations with no integration to on-premises directories Single identity suitable for medium and large organizations without federation* Single federated identity and credentials suitable for medium and large organizations

23 On-Premises ADFS Implementation Multiple ADFS Servers and Proxy (Web Application Proxy) WID Replication and NLB for redundancy

com is recognized as a Federated Domain.

24 On-Premises ADFS Implementation Users are redirected to the ADFS server for authentication portal.microsoftonline.com example.com is recognized as a Federated Domain. User will be redirected to local ADFS server. A SAML token is generated and used to authenticate the user to Office 365 resources.

25 Managing Cloud Identities Accounts are independent of your local AD Managed through the Office 365 portal DEMO

26 Synchronizing Identities Azure AD Connector (DirSync) tool. Installed on 64-bit domain controller. Builds a connector between Azure AD and your local AD. Synchronizes selected objects every three hours by default.

27 Managing Synchronized Identities Accounts are managed in local AD and synchronized Every three hours by default Password changes immediately Account disabled on normal cycle Passwords synchronized oneway unless the Azure AD subscription is upgraded. Exchange attributes need to be managed using an onpremises Exchange Server / Console or through ADSIEdit (not recommended).

28 Managing Federated Identities Federated IDs are managed on-premises. There is no synchronization delay since users are directed to the local AD for authentication. Disabling an account or changing a password is immediate. Access to Office 365 resources is dependent on your AD and ADFS being available!

29 Multi-Factor Authentication and Self Serve Features (Samples of Azure AD features)

30 Multi-Factor Authentication (MFA) Office 365 offers two-factor authentication. Office 365 MFA covers Exchange Online SharePoint Online Lync Online Dynamics CRM Online Project Online Office 2013 Pro Plus on-premises App Passwords are used for Office applications App Password A 16-character randomly generated password used with Office applications in lieu of the second authentication factor. Note The roadmap is to add true MFA to Office applications

31 Multi-Factor Authentication (MFA) Demonstration User setup and administration, user controls

32 Self Serve Password Reset Azure AD Free - cloud-only administrators can reset their own passwords Azure AD Basic or Basic with a Paid O365 Subscription - cloud-only users and cloud-only administrators can reset their own passwords Azure AD Premium - any user or administrator, including cloud-only, federated, or password synced users, can reset their own passwords (requires password writeback to be enabled)

33 Self Serve Setup Setup through Azure AD Enable service for the users Setup required parameters

34 Self Serve Use Part of portal login process

35 Single Sign On Using Azure AD for SaaS SSO

36 SaaS Authentication Challenge

37 Azure AD as the control point

38 2500+ Pre-integrated SaaS Solutions

39 The On-Premises SSO Portion (ADFS)

40 Azure AD SaaS SSO

41 We need to discuss if this should be in my portion of the presentation or a part of Steve s EMS (InTune) presentation. I have about an hour s worth of material without MDM.

42 Office 365 MDM Device Types You can use MDM for Office 365 to secure and manage the following types of devices. Windows Phone 8.1 ios 7.1 or later versions Android 4 or later versions Windows 8.1* Windows 8.1 RT* * Access control for Windows 8.1 and Windows 8.1 RT devices is limited to Exchange ActiveSync.

43 Office 365 MDM Enrollment and Polices These apps will prompt users to enroll if there is a policy applied to the user. Exchange Exchange ActiveSync includes native and third-party apps, like TouchDown, that use Exchange ActiveSync. Office and OneDrive for Business

44 Office 365 MDM Enrollment and Policies The following diagram shows what happens when a user with a new device signs in to an app that supports access control with MDM for Office 365. The user is blocked from accessing Office 365 resources in the app until they enroll their device.

Office 365 MDM Enrollment and Polices User logs in with an enrolled device that isn t compliant with a security setting in a mobile device management

45 Office 365 MDM Enrollment and Polices User logs in with an enrolled device that isn t compliant with a security setting in a mobile device management policy that applies to their device. They are blocked from accessing Office 365 resources in the app until their device complies with the security setting.

46 Setting up MDM in Office 365 Set up MDM for Office 365 Activate the feature and configure the environment. Configure MDM policies Configure Security Groups and Device policies. Enroll devices When users access Exchange, SharePoint or OneDrive using the MDM-enabled applications, they are required to enroll their devices. Manage devices You can wipe enrolled devices and run reports.

47 Set up MDM Setup DNS EnterpriseEnrollment CNAME EnterpriseEnrollment.manage.m icrosoft.com 3600 EnterpriseRegistration CNAME EnterpriseRegistration.windows. net 3600

48 ios APN Certificate Create a CSR Generate certificate as Apple s site Download and upload the certificate to Office 365

49 Policies Security Settings

50 Policies Other Settings

51 ActiveSync Policies ActiveSync polices are in the Exchange admin center You can create multiple policies and apply different settings to different users

52 Wiping a device Full wipe: Deletes all data on a user's mobile device, including installed applications, photos, and personal information. When the wipe is complete, the device is restored to its factory settings. Selective wipe: Removes only organization data and leaves installed applications, photos, and personal information on a user's mobile device. When a device is wiped (full wipe or selective wipe), the device is removed from the list of managed devices. You can set up a mobile device management policy that automatically wipes a device after the user unsuccessfully tries to enter the device s password a specific number of times.

54 Break

55 Enterprise Mobility Suite for SMB Steve Deming Technology Strategist

56 Agenda What PAINS does EMS solve for? Overview and Key Points Technical Components of EMS Getting Started

admit by will 2017 using have admit will two nonapproved require or more to violating

applications own to support security devices in in polices for their 2017** work jobs

***CEB Executive Guidance - http://www.executiveboard.

57 Are organizations prepared? 50% 90% 93% 80% 80% 50% 90% 93% of of of employees enterprises employers of employees admit by will 2017 using have admit will two nonapproved require or more to violating employees software-as-a mobile information operating to supply service systems their applications own to support security devices in in polices for their 2017** work jobs *** purposes **** * *Gartner Press Release link ** CEB Survey of 165,000 employees ***CEB Executive Guidance - **** 59

58 Cross Platform Device Management Microsoft Enterprise Mobility Suite Microsoft Partner Confidential SMB LIVE 2015

59 Enterprise Mobility Suite (EMS) Device Management, Access Control, Information Protection Hybrid and Cloud Identity Mobile Device Management Data Protection Enabled via Azure Active Directory Premium: Single sign-on across multiple SaaS applications Self Service Password Reset & Group management Security audit reports & Multi Factor Authentication Watch the hybrid identity demo Enabled via Microsoft Intune Mobile device settings management Mobile app management Selective wipe Watch the mobile device management demo Enabled via Azure Rights Management Service: Information protection Connection to on-premises assets Watch the information protection demo

61 What is Azure Active Directory? A comprehensive identity and access management cloud solution. It combines directory services, advanced identity governance, application access management and a rich standards-based platform for developers It is available in 3 editions: Free, Basic and Premium (Premium in EMS)

62 Identity as the control plane

63 Preintegrated SaaS apps in the application gallery

64 Example: A holiday resort is using multiple social media and online travel sites to promote their offers and stay in touch with travelers. Due to the seasonality of their business, their staff changes a lot during a year, including many interns during high season. All of them require easy access to these websites. 1 Using the management portal in Azure Active Directory Premium, the company easily enables new staff members to access all of the required social media and travel sites. 3 2 With single sign-on, the team members access any of the sites quickly and easily with their same, consistent company login. The team is able to be more productive, eliminating time spent managing multiple passwords. Then when the off-season begins, the temporary employees logins are deactivated and their access to the sites is immediately shut off. If they had been using their own separate logins, they could access and make unauthorized posts to these sites. Instead, the company is protected and easily able to manage access for seasonal staff. 67

Mobile device management Mobile application management PC management User IT Intune helps organizations provide their employees with access

66 Mobile device management Mobile application management PC management User IT Intune helps organizations provide their employees with access to corporate applications, data, and resources from virtually anywhere on almost any device, while helping to keep corporate information secure.

67 Enroll Provide a self-service Company Portal for users to enroll devices Deliver custom terms and conditions at enrollment Bulk enroll devices using Apple Configurator or service account Restrict access to Exchange if a device is not enrolled Provision Deploy certificates, , VPN, and WiFi profiles Deploy device security policy settings Install mandatory apps Deploy app restriction policies Deploy data protection policies User IT Retire Revoke access to corporate resources Perform selective wipe Audit lost and stolen devices Manage and Protect Restrict access to corporate resources if policies are violated (e.g., jailbroken device) Protect corporate data by restricting actions such as copy/cut/paste/save outside of managed app ecosystem Report on device and app compliance

68 Managed apps User IT Maximize mobile productivity and protect corporate resources with Office mobile apps Personal apps Personal apps Extend these capabilities to existing line-of-business apps using the Intune app wrapper Enable secure viewing of content using the Managed Browser, PDF Viewer, AV Player, and Image Viewer apps

69 Managed apps User Personal apps Maximize productivity while preventing leakage of company data by restricting actions such as copy/cut/paste/save in your managed app ecosystem

70 Managed apps Company Portal Are you sure you want to wipe corporate data and applications from the user s device? IT OK Cancel Perform selective wipe via self-service company portal or admin console Personal apps Remove managed apps and data Keep personal apps and data intact

71 Customer Example: The sales team at a small construction company is always on the go, and they often use personal mobile devices for work. The company wants to ensure company data and apps on employee devices is protected especially when one of their sales reps leaves to join a competitor. 1 3 A sales rep has a cell phone with company s, contacts, and Office applications combined with personal data, apps, and family photos. Selective Data Wipe The sales rep leaves the company to join a competitor. Using selective wipe IT can remotely remove the company information including customer data and business apps from the employee s phone without touching or losing his personal data. 2 Copy and paste With Microsoft Intune, the company can manage and protect all of the mobile devices and apps used at work. Intune works with Office to prevent the employee from copying sensitive data from company apps and pasting it into personal ones. 7

73 Help customers protect their information, wherever it goes. Enable information sharing, while keeping data protected. Microsoft Azure Rights Management Service (RMS) Enable customers to easily apply rights management protection to information and files. Help protect information sent in by preventing viewing, editing, and forwarding. Restrict editing, copying, and printing files to specific people and groups. 78

74 Protect data to secure mobility Encrypt data Manage rights Enforce policy Share internally Azure Active Directory RMS Share externally

75 Customer Example: A mortgage company works with customers over phone and to process loan applications. The company needs to make sure sensitive customer information stays protected, wherever it goes. 1 To process a loan application, a 2 With Microsoft Azure Rights mortgage broker requests a Management Service (RMS), the data social security number and credit in the is protected, so editing, card details from a customer via copying, and printing the customer s . The customer s her information is restricted to the broker personal data to the broker. and his immediate team. 3 The broker then sends an containing the customer s personal data to the loan processing team. Using Azure RMS, the is restricted from forwarding or editing. So the broker can benefit from the convenience of , while knowing that data stays protected after he clicks the send button. 8

81 Identify and authorize user Active Directory Premium User Apply device policies Apply application policies IT Apply content policies Rights Management Enterprise Mobility Suite

EMS IT Manageability benefits for O365 customers Cloud and hybrid identity management Mobile device management Information protection Enterprise Mobility Suite Azure AD for O365 + Single Sign on for

82 EMS IT Manageability benefits for O365 customers Cloud and hybrid identity management Mobile device management Information protection Enterprise Mobility Suite Azure AD for O365 + Single Sign on for all cloud apps Advanced MFA for all workloads Self Service group management and password reset with write back to on prem directory Advanced security reports FIM (Server + CAL) MDM for O365 + PC Management Mobile App Management (prevent cut/copy/past/save as from corporate apps to personal apps) Secure content viewers Certificate Provisioning System Center integration RMS for O365 + Protection for on-premises Windows Server file shares Protection for multiple file types, such as PDF and CAD Basic Identity Mgmt via Azure AD for O365: Single Sign on for O365 Basic Multifactor Authentication (MFA) for O365 Basic Mobile Device Management via MDM for O365 Device Settings Management Selective Wipe Built into O365 Mgmt Console RMS Protection via RMS for O365 Protection for content stored in Office (on prem or O365) Access to RMS SDK Bring your own Key

83 Why Microsoft? Other Options in the Market Cloud identity management Mobile device & app management Information protection Okta Salesforce Identity AirWatch MobileIron Ping Identity Symantec Kaseya Centrify Good Adobe LiveCycle Seclore Fasoo Why Microsoft? EMS: One Vendor, One Contract, One SKU Azure Active Directory Premium Microsoft Intune Azure Rights Management Service

Manufacturer Authorized Training Insures

85 Manufacturer Authorized Training Insures Learning Content Matches Software Offering the most Microsoft Official courses in Maryland Accepting Software Assurance Training Vouchers! 100% of Baltimore area VMware training in our classrooms 100% of Baltimore area Oracle training in our classrooms All courses offered locally and online

86 elearning

87 Your Teams Local and Remote Expert Instructors Tailored Curriculum Organizational Focus and Insight Convenient Training Consistently 19 percentage points higher than national average for Microsoft Certified Trainers Combine chapters from multiple courses Add company specific content Develop hands-on labs using your data Specific to your culture and objectives Small or large groups, in one location or many

88 Your Teams Local and Remote Offsite Locations Flexible Scheduling and Delivery Formats Distraction-free learning Instructor Led Training (ILT) Live Virtual Training (LVT) Attend our ILT sessions from home or work. Project Based Training (PBT) Informal Coaching Dual monitors display digital curriculum and labs simultaneously Mobile Curriculum and Classrooms Integration of Video

89 Our Process Account Manager Tools Our Process Understand your needs Assess skill levels Instructor Develop content Register Easy registration Attend Your site, our site and live virtually from your home or office Evaluate Give course feedback using independent evaluation tool Report Attendance and evaluation reports Reinforce Post-class support

90 Customized Training Curriculum

91 Management Corporate/ Development Accounting Topics Training plans customized for each audience in your organization Teaching Time in Hours Introduction to SharePoint 2010 Navigating a SharePoint Site Navigating the Home Page and the SharePoint Site Navigating the Site Content Tree Navigating the Ribbon Interface Browsing Lists on a SharePoint Site Browsing Document Libraries Using the Recycle Bin Working with Lists Discovering Default Lists in a Site Adding and Editing List Items Deleting and Restoring a List Item Attaching Files to List Items Sorting and Filtering a List X Setting up Alerts Working with Libraries Creating a New Document SCAN Documents S: DRIVE Editing Documents Adding Documents X X Co-authoring Creating a Picture Library and Adding Pictures Checking Documents In and Out Working with Version History - Major 10 Working with Version History - Major/Minor X Using Alerts Deleting and Restoring Documents Working with List Settings X 15 X Configuring Content Approval and Versioning

92 January-12 February-12 March-12 April-12 May-12 June-12 July-12 August-12 September-12 October-12 November-12 December-12 January-13 February-13 March-13 April-13 May-13 June-13 July-13 August-13 September-13 October-13 November-13 December-13 January-14 February-14 March-14 April-14 May-14 June-14 July-14 August-14 September-14 October-14 November-14 December-14 January-15 February-15 March-15 April-15 May-15 June-15 July-15 August-15 September-15 October-15 November System Source Learning Center Instructor Top Box Graph Consistently 19 points higher! 0 System Source MS Overall CPLS Overall 3 per. Mov. Avg. (System Source MS Overall) 3 per. Mov. Avg. (CPLS Overall)

93 Course Name MS20346C Managing Office 365 Identities and Services Microsoft Office 365: Web Apps (with Skype for Business) Length 5 Days 1 Day

94 Microsoft Office 2016 and 365 Private Courses Any one-day Access, Excel, Word, PowerPoint, Outlook or Office 365 Web Apps course: Only $143 per student for a class of 10 Save $153-$258 per student Reserve your dates by 2/29 to secure discounted pricing!

95 Learning Center Offer Evaluations Door Prizes Lunch! THANK YOU!

Why EMS? What benefit does EMS provide O365 customers. Manage Mobile Productivity. deployment. SaaS Apps. LOB Apps. Mobility Management

Why EMS? What benefit does EMS provide O365 customers LOB Apps SaaS Apps Mobility Management Simplify app delivery and deployment Manage Mobile Productivity Increase IT Productivity Consistent experience