#Modern Workplace

Historically, safeguarding proprietary information mandated total control over the physical hardware. However, with the shift toward SaaS-based apps and the rise of remote work, the paradigm has moved toward securing the data itself rather than the device. Staff and external partners are no longer restricted to corporate-owned and managed Windows devices, thanks to the robust controls available within Microsoft 365. Organizations can now focus on a versatile strategy that closes visibility gaps without overstepping onto personal or third-party hardware. Microsoft is bolstering the defensive features within   Edge for Business, Entra, Intune, and Purview . Recent enhancements to profile handling and authentication now enable firms to insulate browser-centric tasks on PCs governed by other entities. These advancements synchronize Purview’s real-time data oversight with Intune’s structured deployment frameworks, allowing administrators to deploy a unified security blanket rather ...

When it comes to managing devices using Intune, organization can either enroll using MDM (Mobile Device Management) and\or MAM (Mobile Application Management). Normally, most organizations go for MDM for managing corporate devices and MAM for managing BYO devices. In case of MDM, enrollments involving manufacturer and OS version, as shown below - But how do you this in MAM? Well the answer lies in the A pp P rotection P olicy (APP). Conditional launch settings validate aspects of the app and device prior to allowing the user to access work or school account data, or if necessary, remove the work or school account data. APP consists of many conditional launch parameters and I am going to cover 2 scenarios for Android and iOS OS platforms. APP Conditional Launch using Manufacturer Let's say an organization wants to restrict MAM enrollments against Samsung BYO devices only. This can be achieved by configuring the Device Manufacturer(s) setting under Conditional launch as shown below ...

  Credits: Microsoft In my recent blog about device tagging for macOS devices in Defender , I had mentioned about covering tagging feature for iOS\iPadOS platform as well. In this blog, I will cover the specifics for achieving this and my experience overall. The new Microsoft Defender apps Before we get into tagging, I want to touch base upon the recent change involving the renaming and feature offering of the MDE app both in Apple  and Google Play stores. The MDE app is now called Microsoft Defender: Security  in Apple store and is called Microsoft Defender: Antivirus in Google Play store, thus enabling All-in-one security functionality across both personal and work accounts.  Under the personal account, Microsoft Defender will function as a multidevice security app 'Microsoft Defender for individuals' allowing individuals and families to protect their data and devices by offering malware protection, timely security notifications, security tips, and reco...

While working on a customer requirement involving implementation of Intune APP (App Protection Policy) on BYOD (Bring Your Own Devices), I came across an issue on Android devices where on accessing Outlook for Android, the end user was being asked to 'Activate device administrator' as shown below. Having dealt with Exchange device mailbox policy in the past, I immediately knew what the issue was and thought of blogging about it to save others some time. If you navigate to Exchange admin portal > Mobile > Mobile device mailbox policy , then you should see a policy that is present in every tenant by default and set as optional . However, in case your users see the prompt to Activate device administrator, then chances are that either you have a separate custom policy created and assigned OR the default policy is modified requiring an encrypted device instead of being optional. As it was in my case. So what is happening here? One can use mobile device mailbox policies to mana...

If you manage and protect corporate data on end user devices, then you may have come across situations where enterprise applications may need to be given admin's consent before the policies can be applied. Through this blog, I will be demonstrating a simple admin approval workflow that you can implement in your organizational tenant to allow the use of your Azure AD identity and manage the access permissions against your enterprise apps to protect corporate data when being used by various services. For all intend and purposes, I will be using Intune App Protection Policies as an example when a user tries to access corporate data through Adobe Acrobat Reader on their BYOD. Let's start by configuring User consent settings As of writing this blog, currently there are 3 options available for controlling User consent as shown below. Microsoft recommends to allow user consent for verified publishers, but in my opinion, to ensure complete control of such requests, it is best to only a...