Modern Device Management with Microsoft 365 Business Premium–Part 1

The way that devices running Windows 10, iOS, Android and MacOS get managed with Microsoft 365 Business Premium can be daunting to those who aren’t familiar with it. The common way that it is explained is from the inside out, that is via policies in Intune first, rather than starting with the big picture and working in.

I therefore thought that I’d do my best to explain it from what I see is a more logical way to understand what is going on.


The starting point is the Microsoft 365 Business Premium tenant in which everything lives.


Inside a Microsoft 365 Business Premium tenant is an Azure AD tenant. See my article:

Deploy Office 365 and Azure together

for more information.


Inside the Azure AD tenant is Active Directory (AD) (i.e. Azure AD).


Inside Azure AD are user identities (i.e. login credentials).


Also inside Azure AD are devices.


The first type of device that can be used, are devices that are totally stand alone. They have no connection to the tenant or are joined in any way. Given a larger canvas, these would live outside the tenant, however for convenience and space, I’ll simply represent them where they are.

If you want to access Microsoft 365 Business Premium services on such devices, you typically do so just using a browser. There is no device (MDM) or application management (MAM) of these devices as well as no compliance to ensure they meet requirements like an up to date operating system.


The next set of devices are those that are simply ‘registered’ with Azure AD. You do this by following these steps:

Register your personal device on your organization’s network

for more information see:

Azure AD registered devices

Once a device is registered it will appear in Azure AD.


You typically find that in the Azure Portal under the Azure Active Directory service and then selecting Devices as shown above.


You will see that registered devices are displayed as Azure AD registered as shown above.

Azure AD registered devices typically have no application control (MAM), no device management (MDM) or compliance. The one advantage you do get over stand alone devices is that access to Microsoft 365 resources, like files, is easier and subject to less prompts to enter credentials.

Registered Azure AD devices are a typical scenario you see for BYOD in a pure Office 365 environment. That is, environments WITHOUT Intune.


The final type of devices are Azure AD Joined devices. The way that you join a device to Azure AD is covered here:

Join your work device to your organization’s network

and for more information about Azure AD joined devices see:

Azure AD joined devices


Azure AD joined devices will be shown as above with the join type as Azure AD joined. You will also note that these devices have MDM (device) management being Office 365 Mobile and a field for whether they are Compliant.


If you select an Azure AD joined device you largely get an inventory, as shown above, of that device, plus the ability to Enable, Disable and Delete the device via the top menu. Another benefit is the ability to capture BitLocker keys as well, which are shown at the bottom of the device if BitLocker is configured on the device.

Thus, the benefits of Azure AD joined devices is that they have some basic device management (via Office 365 mobile) as well as ability to be check for compliance. You can also, for example, do a device level wipe (i.e. factory reset) which you can’t do with the prior device connection methods. Azure AD Joined devices are also able to have easier access to Microsoft 365 services as with the previous two device connection methods.

Azure AD joined devices are a typical scenario you see for company issued devices in a pure Office 365 environment. That is, environments WITHOUT Intune where the company provides the device to employees.

Thus, Office 365 has a basic MDM and compliance capability which is detailed here:

Set Up Basic Mobility and Security

How you configure the Office 365 Mobile policies is found here:

Create device security policies in Basic Mobility and Security

You may need to use the direct URL:

to see these.


If you look at what these policies provide you see


for Access Requirements and


for Configurations.

Both of these options are quite limited and don’t provide any specific device OS/type targeting. They also roll compliance (Access requirements) and configuration together into a single policy, which lacks a certain amount of flexibility. In essence then, this is why the out of the box device management that comes with Office 365, known as Office 365 Mobile is ‘basic’. This is why something with more power and granularity is required if you are serious about device management.

You will note that, Office 365 Mobile management does not provide any real application management (MAM). This prevents doing things like push install to devices.

In summary, what has been covered so far is the out of the box device management capabilities you get with all Office 365 tenants. We can extend this much further using Microsoft 365 Business Premium and the power of Intune to manage devices. However, I’ll save that for an upcoming article as I want to break these concepts up into digestible chunks for people. So next we’ll take a look at how we can extend this basic device configuration using Intune.

The changing security environment with Microsoft 365

First, a quick trip down memory lane. Back when Microsoft released Windows XP it had no local firewall (yep, I know, hard to believe now). After that fact being exploited by malicious software to spread through networks, Microsoft added a firewall to Windows XP in Service Pack 1. However, it didn’t automatically enable it. It remained something optional that was on the user to enable. Of course, given that most people are never going to enable a security feature that is optional, security issues continued. Then, with Service Pack 2, Microsoft enabled the firewall in Windows XP and it has been on ever since.

Most software is generally not configured as securely as it could be out of the box. In the case of Microsoft, it has to cater to a very, very broad audience with very different needs and configurations. Thus, it has fallen to the IT Professional for the business to implement the appropriate security using the features provided.

This equates to the Windows XP Service Pack 1 days. That is, the security capabilities are included but not enabled. And just like those days, only a very small percentage of them seem to get implemented. Multi Factor Authentication (MFA) is a great example of this. From Microsoft Ignite 2019 (i.e ONLY last year):

“it was discussed that out of all the Azure tenants globally, less than 8% of them WORLD-WIDE have enabled MFA.  99.9% of attacks on accounts are prevented by MFA.” – Reference

Even though EVERY Microsoft/Office 365 and Azure tenant includes MFA for identities, less than 8% have enabled it. This is hard to rationalise given the reality that doing so would prevent almost 100% of attacks. Clearly, it harkens back to the Windows XP Service Pack 1 days – if it ain’t on by default, then it will probably NEVER be turned on, no matter how much protection it provides.

So I hope you can appreciate, that in one aspect the IT security landscape hasn’t changed much from back when we had Windows XP (2002 if you check Wikipedia). I think however that this is in fact driving what I see as the ‘new’ security landscape for Microsoft 365.

The first big change with Microsoft 365 security is that Microsoft is beginning to move from Windows XP Service Pack 1 approach to a Service Pack 2 approach. That is, security enabled by default.

The first example of this is the End of support for Basic authentication and actively disabling it which you can read about here:

Deferred end of support date for Basic Authentication in Exchange Online

The next example is Security defaults.

Security defaults make it easier to help protect your organization from these attacks with preconfigured security settings:

  • Requiring all users to register for Azure Multi-Factor Authentication.
  • Requiring administrators to perform multi-factor authentication.
  • Blocking legacy authentication protocols.
  • Requiring users to perform multi-factor authentication when necessary.
  • Protecting privileged activities like access to the Azure portal.

If your tenant was created on or after October 22, 2019, it is possible security defaults are already enabled in your tenant. In an effort to protect all of our users, security defaults is being rolled out to all new tenants created.

and from – Introducing security defaults

“We will expand first to apply security defaults to all new tenants as well as applying it retroactively to existing tenants who have not taken any security measures for themselves.”


The next example are the new templated Exchange Online policies found in the Administration console which I have detailed previously here:

New templated email policies


Basically, this is a ‘Microsoft Security Baseline’ for securing Exchange online to best practices. You can read more about these at:

Preset security policies in EOP and Office 365 ATP

I can see a future where at least the Standard protection policy is applied to all new tenants out of the box.


Next, if you go and look in Microsoft EndPoint Manager you will see a growing number of similar baseline policies. I say growing, because a

New Security baseline for Office

is on the way.

At the moment, the smart approach is to use these baseline policies from Microsoft and then adjust or add as required to suit your own environment (i.e. Windows XP Service Pack 1 approach). Again, I see the day, in the not too distant future, where these baselines will be enabled by default (i.e. Windows XP Service Pack 2 approach).


Where I see a major difference between the Windows XP Service Pack 2 approach (i.e. security on by default) is with the introduction of Artificial Intelligence (AI). Thanks to telemetry from tenants and activities being fed back into the Microsoft Cloud, AI and Machine Learning (ML) can be used to look for anomalies. The best example of this Azure Sentinel.

In this new world of AI, you need to spend less time looking at individual events. In essence, you allow the AI to do that and determine what looks suspect based on EVERYTHING it sees in your environment and what it sees across the whole ecosystem. I can see a future where not only will the AI analyse all this data in a blink of the eye but it will also start taking action. For example, if you haven’t disabled basic authentication, it will disable it automatically because it knows that doing so is recognised by its algorithm to protect data to a high degree. I also believe we will also soon have the option for the AI to start taking ‘pro-active’ action to re-configure spam filtering to provide the best protection and adapt automatically to new methods of attack.

In short, I see a day, in the not to distant future, when all possible security options will be enabled by default and then AI will not only monitor but automatically adjust services and settings as required to meet the changing threat landscape. All of this will be driven by the growing volumes of telemetry that Microsoft collects from tenants big and small.

This all seems pretty marvellous, having a self adjusting security posture but perhaps the bigger question to consider is, what role does the IT Professional who is supposed to be setting this security configuration up manually today play in this future? Does a role for manual IT security configuration exist in the future? If not, where will the opportunities be in the IT security realm?

A couple of new additions to Azure Sentinel

If you have a look inside your Azure Sentinel console you should some new options.


The first is a new option in the Office 365 Data connector to allow you to bring Teams data from the Office 365 Unified Audit Log into Sentinel. All you need to do to enable this is open the Office 365 connector and select the Teams check box as shown above.


Once the data starts flowing in, the you’ll be able to run Kusto queries on the log data as shown above. This query will produce a quick report of all the Teams sessions over the last day. The KQL for this is:


| where TimeGenerated >= ago(1d)

| where RecordType == “MicrosoftTeams”

| summarize count () by UserId

| sort by count_

With Teams data now flowing into Sentinel you can start creating all sorts of interesting reports.


The next new item is the Entity behavior as shown above. Here is what it does:


Basically, it is going to give you the ability to be more granular when looking at data as well as providing more AI (Artificial Intelligence) across that data looking for anomalies.


Just scroll down the page and Turn it on.


Now when you visit the link you’ll see:


and selecting an account will show you information like:


Which is a great summary for that user over the time period you selected.


The Threat intelligence option provides the above options, which to be honest, I haven’t fully figured out how to use effectively yet. I may not as yet have enough data in this tenant to make full use of it. I’ll have to wait and see.

Overall some really handy additions to Azure Sentinel that I’d be encouraging you to take advantage of to improve you security analysis. If you are looking to get started with Azure Sentinel, don’t forget my online course:

September poll


For September I’m asking people:

Have you ever paid, or helped someone else pay, a ransom after a ransomware attack?

which I greatly appreciate you thoughts here:

You can view the results during the month here:

and I’ll post a summary at the end of the month here on the blog.

Please feel free to share this survey with as many people as you can so we can get better idea of how much ransom is being paid out there. I’ll bet is more than most think. Let’s see.

August poll results

August’s question was :

Are you considering or using Microsoft Defender ATP in place of other third party anti virus and end point security solutions?

and the results are:


A much stronger result for Defender ATP that I thought! 93% of respondents are looking at using Defender ATP! Wow, shows you that Defender ATP is really starting to kick some goals out there and make waves.

The anonymous September question for you is:

Have you ever paid, or helped someone else pay, a ransom after a ransomware attack?

which can be found at:

appreciate if you could take a moment and let me know your experiences.

Need to Know podcast–Episode 251

FAQ podcasts are shorter and more focused on a particular topic. In this episode I speak about Windows Information Protection (WIP) is.

This episode was recorded using Microsoft Teams and produced with Camtasia 2020

Take a listen and let us know what you think –

You can listen directly to this episode at:

Subscribe via iTunes at:

The podcast is also available on Stitcher at:

Don’t forget to give the show a rating as well as send us any feedback or suggestions you may have for the show.


FAQ 15

CIAOPS Patron Community

Windows Information Protection


Need to Know podcast–Episode 250

I’m joined in this episode by MVP Lisa Crosbie to talk about what’s new in the Power Platform, especially Project Oakdale or as it was known when we recorded it, Microsoft Dataflex. Lisa shares with us what this technology is all about, how it integrates and the benefits it can provide businesses.

There is also cloud news and updates from Microsoft at the top of the show, as usual to keep you up to date.

This episode was recorded using Microsoft Teams and produced with Camtasia 2020

Take a listen and let us know what you think –

You can listen directly to this episode at:

Subscribe via iTunes at:

The podcast is also available on Stitcher at:

Don’t forget to give the show a rating as well as send us any feedback or suggestions you may have for the show.




Lisa Crosbie on YouTube

Lisa Crosbie on Linkedin

The UP podcast

Power App in a day

Dataflex in now Project Oakdale

Available for preorder today, Surface Duo is purpose-built for mobile productivity

Microsoft Surface Duo Press Briefing

Microsoft Office 365—Do you have a false sense of cloud security?

Introducing EDR in block mode

End users can now report “This wasn’t me” for unusual sign-in activity

What’s new: Azure Sentinel and Microsoft Defender ATP improved alert integration

CIAOPS Getting Started with Azure Sentinel online course

Microsoft Whiteboard in Teams Adds Sticky Notes and Text, Improves Performance

Maximize cost control with new auto-shutdown setting

Need to Know podcast–Episode 249

FAQ podcasts are shorter and more focused on a particular topic. In this episode I speak about what Office 365 Alerts is and provide some best practice suggestions.

This episode was recorded using Microsoft Teams and produced with Camtasia 2020

Take a listen and let us know what you think –

You can listen directly to this episode at:

Subscribe via iTunes at:

The podcast is also available on Stitcher at:

Don’t forget to give the show a rating as well as send us any feedback or suggestions you may have for the show.


FAQ 14

CIAOPS Patron Community

Azure Information Protection