#Modern Workplace

Microsoft keeps the security baselines up to date in general with each new versions coming out. Be it Windows OS 10\11, Windows Server OS 2022, Microsoft 365 Apps or Edge. Edge security baseline for v112 was recently released and I wanted to roll this out in my tenant using Intune. This blog covers the details on the setup. If you are using still using GPOs, then you can easily import the security baseline templates and assign them. In Intune, Microsoft had introduced Security baseline profiles to allow rolling out the security baselines out of the box. However, despite being a cloud managed feature, the baselines have not been updated in a long time. However, as of 31st March 2023, in a blog post comment, Microsoft have indicated that the security baselines may now finally be getting updated in Intune. More details can be found in this  link . This is fantastic news and long awaited in my opinion. However, if you don't want to wait until the security baselines are updated in Intu...

Recently, I had published a blog on enforcing MFA using Conditional Access policy for Windows 365 Cloud PCs . Now, in an effort to further improve the security of Cloud PCs, I am now covering the process of enforcing compliance for Microsoft Defender for Endpoint with Conditional Access, based on risk levels for Windows 365 Cloud PCs. Why enforce compliance for MDE in the first place? Short answer is - Why not? Not so short answer is that if you are licensed for MDE and have your endpoints onboarded in MDE and managed for MDE policies using Intune, then you can apply device compliance policies and use Conditional Access to identify threats. Once in place, these policies can help in identifying non-compliant devices which in turn can help in setting restrictions around access of corporate resources. Until the device risk level has fallen under the allowed level in the compliance policy, the restrictions will continue to stay in place. Let's look at the steps for putting the configur...

Windows 365 Cloud PC is the next generation of cloud computing which takes virtualization of the PC to a whole new level. PC-as-a-service or SaaS as Microsoft puts it, is a highly available, optimized, and scalable virtual machine providing end users with a rich Windows desktop experience. It is hosted in the Windows 365 service and is accessible from anywhere, on any device. Windows 365 service uses the following: 1. Microsoft Endpoint Manager to manage the Cloud PCs. 2. Azure Active Directory (Azure AD) for identity and access control. (HAADJ is also supported) 3. Azure Virtual Desktop for remote connectivity. 4. [Optional] Create Azure network connections, which are links between the Cloud PCs and an on-premises resources. In this blog we will cover details around creating AAD dynamic groups, AAD conditional access policy to enforce MFA and provisioning of a Windows 365 Cloud PC with AAD identity using Intune. Configuring Windows 365 Cloud PC in Intune Cloud PCs are created and assi...