Deploying Microsoft 365

Here’s an overview of the administration options that are available for you in Microsoft 365 Business.

You’ll see how to add Microsoft 365 Business licenses as well as what each contains. You learn about the device and application policies that you can configure in Microsoft 365 Business as well as see the back end deployment inside Azure.

If you need to manage Microsoft 365 Business or are wonder how it all works in the back end then take a look at this tutorial.

Microsoft Cloud Update–November 2017

Microsoft Cloud Updates – November 2017 from Robert Crane

All the latest news from the Microsoft Cloud including updates on Office 365 and Azure.

Microsoft 365 Application Management for Windows 10 mappings

I wrote a previous article that showed the mapping from the Microsoft 365 Business Windows 10 Device Configuration settings to those in the Intune console in Azure. You can read that article here:

Microsoft 365 Windows 10 Device Management settings

What I am now going to cover is the Application Management for Windows 10 policy. That is the software and information that resides on Windows 10 devices.

Start by navigating to the Admin center in your Microsoft 365 Business tenant.

Locate the Device policies tile and select it.

You may see a number of policies here but one should be named Application Management for Windows 10 as shown above. Select this.

If the policy doesn’t exist you can create a new one. When you do you will see the above settings.

If you expand the display for each option you should see a list of all the options and their status as shown above.

The question now is, how do these map to settings in Intune?

To view the settings in Intune you’ll need to login to the Azure portal for that tenant and then navigate to the Intune option.

The easiest way to find the Intune settings is to do a search in the top right and then select Intune from the results.

You should see the Intune console displayed as shown above.

From the menu, under the Manage section, select Mobile apps.

From here select the App protection policies option under the Manage section. This should display a policy on the right that matches the one you have in the Microsoft 365 Business console (here Application Management for Windows 10). Select the policy name to continue.

You will notice that when you create a new Application Management for Windows 10 policy that you have the option to set Encrypt work files to be on or off.

However, after you set it to on and save the policy you can’t change it to off as shown above. Thus, once Encrypt work files is set to on, it stays and can’t be changed.

This setting maps to the Windows Information protection mode in the Required settings of the Application Management policy in Intune as shown above.

When Encrypt work files is set to on, the option in Intune is set to Block. This basically prevents Office 365 data from being used in non Office 365 applications on Windows 10. Thus, you can’t save an Office 365 file to a consume storage platform like Google Drive.

When Encrypt work files is set to off, the option in Intune is also set to off as shown above. Thus, Office 365 files can be shared with any application.

If the option to Prevent users from copying company data to personal files and force them to save work files to OneDrive for Business is set to on, then I can ‘t see how this is enforced by the policy as there doesn’t appear to be any settings for this like there is with iOS and Android policies. I’ll need to investigate this one further.

The next setting is Manage how users access Office files on mobile devices.

If the Require a PIN or fingerprint to access Office apps is set to on, the use Windows Hello for Business as a method of signing into Windows in the Access section of the Advanced Settings of the policy is also set to on as shown above.

The Microsoft 365 Business policy options Reset PIN when login fails this many times and Require users to sign in again after Office apps have been idle for settings are located at the bottom of this same policy as shown above.

The next option Recover data on Windows devices appears to map to the Data protection area of the Intune policy.

I haven’t quite worked this setting out yet. I’m unsure whether you need to upload your certificate BEFORE you apply the policy to machines or you can do it at any time AFTER the policy has been applied. One would think that you need to do it BEFORE and retain the certificate to decrypt files later. However, I need to dig deeper here and do a follow up article.

The Protect additional network and cloud locations in Microsoft 365 Business option maps to the following areas in Intune policy.

The final option, Files used by these apps are protected

map to

the Protected Apps area of the policy as shown above.

Remember, there is a similar policy for both iOS and Android that I’ll cover soon. There are also a few things here I need to do more research on but you should now have a better idea of how the Microsoft 365 Business settings map to Intune.

Also, as I understand it, you can’t make changes to the policies in Intune, they all need to be done via the Microsoft 365 Business console.

So, when you create a Application management for Windows 10 policy in Microsoft 365 Business, these are the mapping that occur to Intune under the covers.

CIAOPS Need to Know Office 365 Webinar–November 2017

laptop-eyes-technology-computer

November is once again super busy but I’m still going to give my monthly webinar focused on Office 365. I am scheduling this month’s free Office 365 webinar on Friday the 1st of December from 11am – 12pm. There is lots of news to cover (especially from the upcoming Microsoft Summit in Sydney) and we’ll also be doing a deep dive into SharePoint best practices. Not a session to miss.

You can register for free at:

November Webinar Registrations

The details are:

CIAOPS Need to Know Webinar – November 2017
Friday 1st of December 2017
11am – 12am Sydney Time

All sessions are recorded and posted to the CIAOPS Academy.

There of course will also be open Q and A so make sure you bring your questions for me and I’ll do my best to answer them.

The CIAOPS Need to Know Webinars are free to attend but if you want to receive the recording of the session you need to sign up as a CIAOPS patron which you can do here:

http://www.ciaopspatron.com

or purchase them individually at:

http://www.ciaopsacademy.com/

Also feel free at any stage to email me directly via director@ciaops.com with your webinar topic suggestions.

I’d also appreciate you sharing information about this webinar with anyone you feel may benefit from the session.

Pitching Microsoft 365

Pitching Microsoft 365 from Robert Crane

Here is a recording of a presentation I recently gave that focused on how to successfully pitch Microsoft 365.

In short, you need to build on the benefits provided by Office 365, then standardise the business on Windows 10 and finally bring all devices under management using the Enterprise Mobility Suite (EMS).

Microsoft 365 Windows 10 Device configuration mappings

Microsoft 365 Business allows you to configure Windows 10 devices that are connected. This management is typically done by Intune at the back end while Microsoft 365 Business provides a simplified interface over these settings. However, what settings in Microsoft 365 map to Intune?

The best place to start to understand this mapping is the following document from Microsoft:

How do protection features in Microsoft 365 Business map to Intune settings

Start by navigating to the Admin center in your Microsoft 365 for Business tenant.

Locate the Device policies tile and select it.

You may see a number of policies here but one should be named Windows 10 device configuration as shown above. Select this.

You should be taken to the Edit policy dialog as shown above.

Select the Edit hyperlink at the right of the Windows 10 protection line (the second option from the top).

If you expand the display you should see a list of all the options and their status as shown above.

The question now is, how do these map to settings in Intune?

To view the settings in Intune you’ll need to login to the Azure portal for that tenant and then navigate to the Intune option.

The easiest way to find the Intune settings is to do a search in the top right and then select Intune from the results.

You should see the Intune console displayed as shown above.

From the available options, select Device Configuration. From the blade that appears then select Policies. You should then see a policy that matches the one in the Microsoft 365 for Business console (here Windows 10 device configuration).

Select the policy name.

From the new blade that appears select Properties.

This should open another blade like shown above. The last option on this blade should be Settings. Select this.

This will open a Device restrictions blade with lots of different settings as you can see above. This is where most the mapped settings from Microsoft 365 are.

Working from the top, the Help protect PCs from web-based threats using Windows Defender Antivirus maps to Windows Defender Antivirus as shown.

However, only 3 of the 28 options are set and they are:

Next in Microsoft 365 Business is Help protect PCs from web-based threats in Microsoft Edge,

This maps to SmartScreen for Microsoft Edge in Windows Defender Smart Screen.

The next option is Turn off device screen when idle for:

which maps to Maximum minutes of inactivity until screen locks in Password.

The option Allow users to download apps from Windows store maps to a Custom URI that I haven’t been able to locate in Intune.

I’m still researching what that actually maps to. More soon.

Next is Allow users to access Cortana

maps to Cortana in General in Intune.

Next, Allow users to receive Windows tips and advertisements from Microsoft.

which maps to Windows spotlight in Intune.

Finally, Keep Windows 10 devices up to date automatically

is actually configured from the Software updates option in Intune.

From the main Intune blade select Software updates. From the blade that then appears select Windows 10 Update rings. Then form the new blade select Update policy for Windows 10 devices.

Select the policy and then Properties from the blade that appears.

At the bottom of the Properties page select Settings. This should then show a blade like that shown above.

If the Microsoft 365 Business setting is ON the Service Branch will be set to Semi-Annual Channel (Targeted) like so:

If the Microsoft 365 Business setting is OFF, the Service Branch will be set to Semi-Annual like so:

You can review these update channels here:

Assign devices to servicing channels for Windows 10 updates

So making any changes in the Microsoft 365 Business console will be reflected in the Intune console. However, if you change these settings in Intune and then try and update them you seem to get an error like so

I would have thought that I could change the settings in any console but that doesn’t appear to be the case. I currently can’t find any confirmation of this but I will publish anything I find. So for now the guidance is – only make changes in the Microsoft 365 Business Admin Center.

There are a number of other policies in Microsoft 365 Business that I’ll cover in upcoming posts.

Deploying Office on the desktop with Microsoft 365

Microsoft 365 has handy functionality to help administrators roll out software to Windows 10 machines that are connected directly to Office 365. One of these tools is the ability to roll out Office desktop software automatically. Here’s how you make it happen.

You’ll firstly need to have licensed Microsoft 365 in your tenant. Next, you’ll need to have user Windows 10 machines directly joined to Office 365.

You’ll then need to login to the Office 365 portal as an administrator and navigate to the Admin center as shown above.

In the Admin center you’ll find a Device actions tile as shown above.

In that tile you’ll see an option Manage Office Deployment. Select that.

If this is the first time you have configured these deployment options you’ll need to select the + Add a group at the top of the page.

In this case, the All Users group will be selected but you could certainly target the deployment at specific groups of users.

Click the Select button at the bottom of the page to continue.

Next you want to install or uninstall Office for the selected group of users. Here, we’ll select Install Office as soon as possible.

Click Next to continue.

Check that the configuration is correct and select the Confirm button at the bottom of the page.

Select Close on the next dialog to continue.

If you now move to the user’s Windows 10 machines that is connected to Office 365 and launch the Task Manager you’ll be able to see how the process is executed on the desktop.

After a short time you’ll see an Office Deployment process kick off.

A short time later you’ll see a Microsoft Office Click-to-Run (SxS) process commence.

You may see multiple versions of this process running throughout.

Next, you’ll see the Microsoft Office Click-to-Run Integrator process kick off.

If you continue to monitor the running processes you’ll see installation processes for Office applications like OneDrive and Skype for Business run.

When the user runs an Office application for the first time they will prompted to Accept some terms and conditions then continue as shown above.

When the Office software launches it will automatically be logged in as the user so there is nothing more for the user to do.

The whole deployment process is completely silent and user receives no prompts until they run an Office application for the first time. If you want to see what’s happening you’ll need to look in the Windows Task Manager as shown here.

So, if you use Windows AutoPilot you can also deploy Windows 10 automatically to a desktop. Thus, with Microsoft 365, an administrator can automatically deploy both Windows 10 and Office software to an Office 365 user’s desktop without the need to even see the desktop or the user!

This is just the beginning of what you can do with Microsoft 365 so stay tuned for more articles on how using Microsoft 365 makes it easier for IT Administrators.