#Modern Workplace

While attempting to upgrade my Surface device to 25H2 in my tenant, I constantly encountered issues. The error in the default Windows Update report was not really helpful. The error just indicated that the installation was being cancelled by the user and that it needed attention. Which is quite bizarre, because I had the device kept switched on and connected to the internet for a long period of time so the error didn't make sense to me. I started investigating this and realized that I needed more information to get to the bottom of the error. That is when I realized that I hadn't configured the collection of the Windows diagnostic or telemetry data correctly. While this is not a necessity, nonetheless highly recommended. Here is why.. Windows telemetry helps in improving security and compatibility, identifying and troubleshooting issues, monitoring device performance and reliability through collection of specific data points. These are classified across - Service-based data fro...

When it comes to configuring Microsoft Edge Enterprise sync, it Is really a no brainer. Not only it allows a seamless browsing experience across multiple supported devices to saved information like bookmarks, browsing history, saved passwords, and other settings on any device where you sign in with the same account, it also enables Single Sign On (SSO) into Microsoft 365 web apps and sessions supporting conditional access policies in the process. So how do you configure it in the modern workplace, especially for cloud native devices? Here are the steps - Enabling Edge enterprise sync using Intune 1. Sign-in to the Microsoft Intune admin center 2. Browse to Devices –> Configuration 3. Click Create Profile 4. Select Platform as Windows 10 and later 5. Select Profile type as Settings catalog 6. Provide a Name and hit next. 7. Click on Add settings. 8. Configure the following - 9. Assign to a device or user group as normal.  With the above configuration in place, you may run into sy...

The background.. Just a while back, Merill Fernando  (Product Manager at Microsoft) shared a post on LinkedIn about disabling SSPR for admin accounts. This was based off the recommendation on Maester  that  "Administrators with sensitive roles should use phishing-resistant authentication methods only and therefore not able to reset their password using SSPR." Now, with phishing-resistant authentication enabled, one may argue that there shouldn't be a need to disable SSPR for administrators, however, in my honest opinion it is still a good idea to disable SSPR for administrators as this will also align with both least privilege and zero trust model. But first, we are going to cover what all is involved in configuring Phishing resistant MFA. Enabling Phishing resistant MFA for Windows devices which uses Windows Hello for Business is pretty much an out of box functionality, but what about Apple devices like Macbooks that run on macOS? Let's find out.. Platform credentia...

Every now and then I come across customers seeking advice on managing macOS devices. The most common ask is around keeping them patched and secured which usually tops the list of the requirements. When users install their own updates (instead of admins managing the updates), it can disrupt user productivity and business tasks. Lately, Intune has made huge strides in managing macOS devices as part of cross platform management in general. There are built-in policies in Intune that one can use to manage device updates, configure when devices are updated, and review the device update status. Currently, there are mainly two ways to manage software updates for macOS using Intune - 1. DDM settings - Recommended on macOS 14.0 and newer devices, DDM is a new way to manage settings allowing installation of a specific update by an enforced deadline. The independent nature of DDM provides an improved user experience, as the device handles the entire software update lifecycle. It prompts users that...