management options December 2017
Table of contents User mission management objectives 2 servicing options 2 What s significant? 4 What s next? 5 About the author 6 As mobility comprises the workplace of the future, managing a variety of devices becomes a challenge. There are typically disparate management solutions one for ios and Android devices and another for traditional Windows-based devices. provides powerful new management and servicing capabilities to bring together all types of devices. User mission management objectives User mission goals are paramount for the correct management and service options for. You need to develop a strategy for transforming legacy windows management processes to a new paradigm. Modern deployment delivers apps from stores. Endpoints continue to evolve, and you need a management solution that will address your full mission needs, evolving as the devices and environments evolve. Here are some key questions to ask: Are all Windows devices in scope, including Windows server? Are other types of devices with different operating systems such as ios, Android and Linux servers in scope? Do you want a common management console for all devices? Do you want the solution to rapidly evolve as the OSs, devices and servicing environments evolve? Do you want the management solutions on your premises or sourced from the cloud? As will now be updated twice per year, which servicing option is right for you? servicing options Although you don t have control of ios and Android version updates, you do have a choice of how is updated. There are three service options: Semi-Annual Channel (Targeted), Semi-Annual Channel and Long-Term Servicing Channel. You will need to decide which is best for each type of user and device in your organization. Here are descriptions of each: Semi-Annual Channel (Targeted). New features are packaged with security and critical updates and are published by Microsoft twice per year, in March and September. Most organizations will subscribe devices used by early-adopter employees and application testers to this channel. The purpose of this channel is to provide an early opportunity to test new features and to validate application compatibility. Semi-Annual Channel. Four months after an update is provided to Semi-Annual Channel (Targeted) devices, it will be deployed to devices subscribed to the Semi- Annual Channel. Most organizations will subscribe most devices to this channel. Quality updates comprising critical updates and security features will be released on a monthly schedule to all devices subscribed to this channel, or on rare occasions may be released more frequently. Once a version is deployed to this channel, it will have an 18-month period of service, after which it will stop being serviced by Microsoft. Long-Term Servicing Channel. This process supports the traditional method of testing then deploying new features. New features will be delivered in a Long-Term Servicing Channel update and can be rolled out when your enterprise is ready. Quality updates critical updates and security features will be released monthly or more frequently as needed. With Long-Term Servicing Channel, new features will be released much less frequently; Microsoft expects to publish featured upgrades every 2 to 3 years. 2
Some feature upgrades may not be incorporated into a Long-Term Servicing Channel release. This can be a challenge if it is a feature you may want or need sooner. You must consider these tradeoffs carefully, as the direction is toward the continuous release model using Semi-Annual Channel. The fundamental tradeoff is between frequency of changes versus the scope and scale of changes. With Semi-Annual Channel, you receive a steady stream of smaller changes and enhancements that are adopted when Microsoft releases them. At the other extreme, Long-Term Servicing Channel gives you long periods that are essentially change freezes, punctuated by occasional periods of large-scale change. Quality Figure 1. rapid release train Feature teams 10s of users 10s of thousands of users Several million users Hundreds of millions of users Enterprise ready Current branch for business Broad internal validation Limited external flights Windows insider preview Current branch Long-term servicing branch What are the management options? System Center Configuration Manager SCCM is an on-premises management solution for managing Windows devices, Apple Mac devices and Linux devices. Organizations that do not want to use a cloud-based solution such as Microsoft Intune are likely to continue using SCCM. Additionally, organizations with a large number of older applications and/or a large number of business applications may choose to continue using SCCM. SCCM does not support ios or Android devices. Microsoft Intune Intune is a cloud-based solution for managing ios, Android and Windows devices as well as lightweight PC management, but it is not for managing servers. Microsoft designates Intune as Intune Standalone when used without integration with SCCM. Setup is quick and easy, as it is a cloud subscription service that doesn t require any on-premises equipment. Currently, Intune is updated monthly, and this frequency is expected to increase. Intune is designed for lightweight management scenarios and mobile device deployments. Administration can be done anywhere from the web-based console. You ll like the powerful management features that enable you to distribute apps to ios, Android and Windows targets including support for legacy Windows installer apps. Co-management Co-management may offer organizations the best of both worlds. Under comanagement, a given device can be managed by SCCM, by Intune or it may be managed by both. There are facilities for defining management groups, assigning devices to groups and then defining how devices in each group are managed. For example, some groups may have their policies managed by Intune and their operating systems managed by Windows Updates for Business. Other groups may have their policies and operating systems managed by SCCM. The management of applications can be in Intune or SCCM, depending on what works best for that particular application. Co-management allows you to choose the model that works best for each user and device. 3
What s significant? App store Microsoft has adopted modern app distribution using stores in addition to supporting traditional app distribution methods. The Microsoft Store is for distributing your apps to anyone. You ll use the Windows Store for business to distribute apps targeted to your enterprise your own private store. Your apps submitted to the Microsoft Store are tested for security, compliance and content prior to store publication. Apps submitted to your Windows Store for Business are under your control. You can make them available to a few employees or to all employees the choice is yours. Windows Store for Business is realized in the cloud, so your employees will need Azure AD accounts, and they can self-enroll. You can distribute apps from the store or take the traditional Windows installer approach. SCCM release train change and management support As with the rapid-release model, Microsoft announced that SCCM will be on a similar release train to keep pace with changes. There will be cases in which an older version of SCCM will not be able to manage devices running the latest versions of. This means that you need to keep your SCCM environment current, or you may not be able to support releases or resolve potential security issues. This is a significant change to the management environment for most organizations. You ll have to verify that your instance of SCCM is up to the task. t all versions support management and deployment. Intune MAM for mobile device productivity apps Microsoft Office productivity apps on mobile devices such as Word, Excel, OneDrive, Onete and Outlook are only managed by Intune mobile application management (MAM). Today, some entities use Microsoft s productivity apps in their traditional office environment with laptops and PCs. They use third-party apps provided by an MDM vendor for email and browsing. Other entities prefer a consistent user experience across their enterprise, whether mobile, in the office or anywhere else, and they want the consistency of the Microsoft Office productivity apps. If you re using Microsoft Office productivity apps on your mobile devices, Intune is in play for MAM services whether the target is Windows, ios or Android and no matter which third-party EMM suite you currently use. Intune MAM works with third-party EMM solutions, with Intune managing Microsoft Office apps and the third-party EMM solution managing devices. Rapid releases Intune Standalone is updated monthly, and SCCM is moving to a quicker schedule. You ll have to stay on top of the release trends for Intune and SCCM and how they apply to Hybrid MDM. Table 1 provides SCCM versions and the capabilities required for support. Release management? deployment? Table 1. SCCM releases supporting System Center Configuration Manager 2007 System Center Configuration Manager 2012 Yes, with a hotfix Yes, with SP2 and CU1 Yes, with SP2, CU1 and the ADK for System Center Configuration Manager 2012 R2 Yes, with SP1 and CU1 Yes, with SP1, CU1 and the ADK for 4
Device, endpoint and server management choice You have numerous options for device, endpoint and server management. Shown in Table 2, a major feature consideration matrix can help you with your management choice. Release management? deployment? Table 2. Major feature consideration matrix Number of endpoints and devices to manage Role-based administrative control required Greater than 50,000 Less than 50,000 Required Supplied roles OK Advanced reporting capabilities SQL reports required Built-in reports OK devices under management with no internet access Full app inventory required for personal devices Manage PCs and servers in traditional fat-client manner Intranet only Yes Yes Internet access for devices under management On-premises infrastructure desired Yes (may have MDM limitations) Use of external tooling and scripts Yes Rapid MDM feature updates Yes Manage all devices, PCs, servers from a single portal Yes What s next? Choose your servicing option. For early adopters and devices used to test application compatibility, the choice is Semi-Annual Channel (Targeted). For most applications except the most critical, the choice is Semi-Annual Channel. For mission-critical endeavors that require extra scrutiny and less frequent change, choose Long-Term Servicing Channel. If in doubt or you have a unique situation, let DXC help you sort through the details. Your decision to stay with legacy SCCM, to move to Intune standalone or to deploy SCCM/Intune co-management is a major one. Co-management is an extremely powerful and valuable solution for large, complex environments. DXC recommends staying focused on your end user mission management objective, device pool size and required management features, and weighing the benefits, complexities and risks in your decision. These solutions are moving and morphing rapidly, so you must consider the feature and release trend for each solution more than the current product state. You ll also have to weigh your management solution deployment process timelines against product and service trends. DXC sees the trend moving to evergreen from the cloud. Intune and SCCM features are converging, but both products still have complexities. These choices require guidance from a trusted advisor who has walked the walk. Let DXC help you navigate through these options to transform your device, PC and server management workload. 5
About the author Ed Wilmes is the chief mobility architect for the DXC Workplace and Mobility Practice within the U.S. public sector region. An Open-Group certified master architect and PMI-certified PMP, he has 3 decades of experience in mobility, security and cloud solutions. Wilmes created the DXC Enterprise Mobility Architecture and Enterprise Communications Architecture, as well as IoT and digital ID solutions. In addition, he helped develop mobile technology that led to the formation of a multibillion dollar wireless service provider from a venture-funded startup. Ed Wilmes holds a B.S. in electrical engineering from St. Louis University and an M.S. in electrical engineering from Missouri University of Science and Technology Learn more at www.dxc.technology/gov About DXC Technology DXC Technology (DXC: NYSE) is the world s leading independent, end-to-end IT services company, helping clients harness the power of innovation to thrive on change. Created by the merger of CSC and the Enterprise Services business of Hewlett Packard Enterprise, DXC Technology serves nearly 6,000 private and public sector clients across 70 countries. The company s technology independence, global talent and extensive partner network combine to deliver powerful next-generation IT services and solutions. DXC Technology is recognized among the best corporate citizens globally. For more information, visit www.dxc.technology. www.dxc.technology 2017 DXC Technology Company. All rights reserved. MD_7203a-18. December 2017