#Modern Workplace

  When it comes to managing third party browser extensions for macOS, there is no easy way. While Intune has the settings added for Google Chrome in settings catalog for Windows, the same is missing for macOS. Now that organizations are using a mixture of OS platforms between Windows and macOS, it is becoming increasingly important to have consistency in management of enterprise devices. Until such time, administrators will have to find ways to configure such settings in a supported manner. Luckily in case of macOS, one can configure .plist and\or .mobileconfig files to manage most of the settings if note all. In this blog, I will quickly demonstrate how to block Google Chrome extension and display a custom message to the end user. I am using Google Drive as an example. First we need to identify the extension ID and the easiest way is to access https://chromewebstore.google.com/ and search for the application. In this case we are searching for Google Drive. The search result w...

Starting with version 111 of Google Chrome, organizations can leverage conditional access policies natively using  CloudAPAuthEnabled . Before this release, Conditional access policies were only supported on Google Chrome by using additional extensions like Windows Accounts and Office Online . If you want to know more about the use of these extensions, then you can read all about it over here . Let's see the new policy involving  CloudAPAuthEnabled in a little detail and how can organization configure it using enterprise device management solutions. CloudAPAuthEnabled   is a setting that can be configured using the policy  Configures automatic user sign-in for accounts backed by a Microsoft® cloud identity provider .  By setting this policy to 1 (Enabled), users who sign into their computer with an account backed by a Microsoft cloud identity provider or who have added a work or school account to Microsoft Windows, can be signed into web properties using that ...

Earlier this year in January, I posted a blog on how to Enable Safe Browsing in Google Chrome in Windows devices using Intune . Now it is time to extend the same security policy to mobile devices. While there are many security features that can be enabled for Google Chrome, the prime focus for this blog will be Safe browsing. I will not go into too much detail about Safe browsing and why Enhanced protection should be enabled as I have already covered the details in the earlier blog post . However, when it comes to mobile devices and iOS in particular, it is not as straight forward as it is for Android. Let's see how the setting can be configured using in Intune. Enabling Enhanced Safe Browsing mode in Android 1. In Microsoft Intune admin center , go to Apps > App configuration policies 2. Click on Add and select Managed Devices. 3. Provide a name and select platform as Android Enterprise. 4. In the Profile type, you can select the profile of your choice, or All profile types. In...

  Network protection utilizes functions in SmartScreen to block phishing activities from malicious command and control sites. When an end user attempts to visit a website in an environment in which network protection is enabled, a toast notification may be presented based on the reputation of the URL. What if you don't want to give the user the ability to circumvent the blocked action at all? This is where the challenge lies, but luckily there is a way. First, let's look at the scenarios under which NP operates. 1. The URL has a known good reputation - In this case the user is permitted access without obstruction, and there's no toast notification presented on the endpoint. In effect, the domain or URL is set to Allowed. 2. The URL has an unknown or uncertain reputation - The user's access is blocked, but with the ability to circumvent (unblock) the block. In effect, the domain or url is set to Audit. The user will have access to the site for 24 hours; at which point th...

  While working with Google Chrome admx policies, a feature called  Safe Browsing  caught my attention. After doing some research I decided to blog my thoughts on it and how it can be enabled using Intune. What is Safe Browsing? Safe Browsing helps in protecting against phishing, social engineering, malware, unwanted software, malicious ads, intrusive ads, and abusive websites or extensions. Chrome contacts Google's servers periodically or real-time (depending on the protection level) to download the most recent Safe Browsing list of unsafe sites and is stored locally in the system. Chrome checks the URL of each site visited or file that is downloaded against this local list.  When Chrome starts, and on each update of the Safe Browsing list, Chrome scans extensions installed in the browser against the Safe Browsing list. If an extension on the list is found, Chrome will disable the extension. Different levels of Protection are -  Enhanced protection (Recomm...