#Modern Workplace

The background.. Just a while back, Merill Fernando  (Product Manager at Microsoft) shared a post on LinkedIn about disabling SSPR for admin accounts. This was based off the recommendation on Maester  that  "Administrators with sensitive roles should use phishing-resistant authentication methods only and therefore not able to reset their password using SSPR." Now, with phishing-resistant authentication enabled, one may argue that there shouldn't be a need to disable SSPR for administrators, however, in my honest opinion it is still a good idea to disable SSPR for administrators as this will also align with both least privilege and zero trust model. But first, we are going to cover what all is involved in configuring Phishing resistant MFA. Enabling Phishing resistant MFA for Windows devices which uses Windows Hello for Business is pretty much an out of box functionality, but what about Apple devices like Macbooks that run on macOS? Let's find out.. Platform credentia...

I have recently been testing and  familiarizing myself with Microsoft Single-sign on (SSO) extensible configuration for websites and apps on macOS. While the feature is still in preview, it has immense potential and has already proved to be a worthy edition in the management of Apple devices in general. While exploring the configuration, I felt the need to configure Microsoft 365 apps, particularly Microsoft OneDrive. In this blog, I will cover the configuration required to setup and manage Microsoft OneDrive on macOS devices using Intune. Intune Configuration Part 1 - As the first step, I will encourage to configure the SSO extension on the macOS devices to make the sign-in as seamless as possible. If you are interested in knowing how to go about this, then I recently blogged about  Reduce app sign-in prompts with SSO on macOS using settings catalog in Intune   which covers the steps and details. Part 2 - As the second step, Microsoft OneDrive app needs to be installed...

  The Microsoft Enterprise SSO plug-in provides single sign-on (SSO) to apps and websites that use Microsoft Entra ID for authentication, including Microsoft 365. This plug-in uses the Apple single sign-on app extension framework and it reduces the number of authentication prompts users get when using devices managed by Intune. I recently blogged about configuring SSO plug-in for iOS devices and wanted to cover a part of the SSO configuration for reducing Microsoft Entra ID sign-in prompts on a macOS, with a focus on Microsoft 365 apps using Intune. My test device is already enrolled, installed with Company Portal app and I manually changed its ownership to Corporate. What are the pre-requisites? - The device is managed by Intune. - macOS 10.15 and newer - The Microsoft Company Portal app must be installed and configured on the device. Intune Configuration There are multiple configurations needed for this to work - a. Extensible Single Sign-on (SSO) settings catalog 1. Sign-in to...