Azure Active Directory

October 16, 2018 By PC Portal

Microsoft named a 2018 Gartner Peer Insights Customers’ Choice for Access Management

Howdy folks,

Every day, everyone in the Microsoft Identity Division comes to work focused on helping you, our customers, make your employees, partners, and customers more productive and to make it easier for you to securely manage access to your enterprise resources.

So, I was pretty excited to learn that Microsoft was recently recognized as a 2018 Gartner Peer Insights Customers’ Choice for Access Management, Worldwide.

In the announcement, Gartner explained, “The Gartner Peer Insights Customers’ Choice is a recognition of vendors in this market by verified end-user professionals, taking into account both the number of reviews and the overall user ratings.” To ensure fair evaluation, Gartner maintains rigorous criteria for recognizing vendors with a high customer satisfaction rate.

Receiving this recognition is incredibly energizing. It’s a strong validation that we’re making a positive impact for our customers and that they value the innovations we added to Azure Active Directory (Azure AD) this year.

To receive this recognition, a vendor must have a minimum of 50 published reviews with an average overall rating of 4.2 stars or higher.

Here are few quotes from the reviews our customers wrote for us:

“Azure AD is fast becoming the single solution to most of our identity and access problems.”
—Enterprise Security Architect in the Transportation Industry. Read full review.

“Azure Active Directory is making great strides to become a highly available and ubiquitous directory service.”
—Chief Technology Officer in the Services Industry. Read full review.

“[Microsoft] has been a great partner in our implementing an identity solution [that] met the needs of our multiple agencies and provided us with a roadmap to continue to move forward with SSO and integration of our legacy and newly developed application. We were also able to set a standard for our SaaS application authentication and access.”
—Director of Technology in the Government Industry. Read full review.

Why and how you simplify IT with Microsoft 365

During this past week at Microsoft Ignite, it was an honor to spend time sitting with customers, listening to them explain what’s working and what’s not, and learning more about where they need our help.

In my session on Monday, I showed 75 minutes worth of examples of how we’ve applied a new philosophy to the way we build tools and services for IT pros. We refer to this approach to architecture, development, and end-user experience in Microsoft 365 as being “Integrated for Simplicity.” Our goal with this integrated simplicity is to make it as easy as possible for our customers to shift to a modern desktop and make their modern workplace a reality.

As part of my session on Monday, we made a series of announcements that align with this approach:

The shift to a modern desktop is an extension of what many organizations are already doing or are planning to do in the near future. There are many ways to start this process; for example, many tools and processes you’re using right now—like ConfigMgr and Active Directory—can easily be cloud-connected. Doing this not only reduces complexity—it also harnesses the power of Microsoft’s cloud-driven intelligence.

Modern desktop puts the power of the cloud in the hands of both end users and IT

The makeup of a modern desktop is simple: Windows 10 with Office 365 ProPlus—which are built in and driven by the cloud so that their scale, compute, automation, intelligence, and flexibility can simplify your IT. Supporting your end users with the Office ProPlus apps is a fundamental component of a modern desktop. These are the only apps with an artificial intelligence (AI) that can do the hard work of security while simultaneously improving and beautifying documents and presentations.

If you didn’t watch my session live, you can check it out in this recorded media stream. At the end of the session, I share three ways you can start using that cloud intelligence right now—and you can do these three things in minutes, not days.

1. Cloud-connect what you have today

A powerful way to begin cloud-connecting your existing infrastructure is to link your on-premises Active Directory with Azure Active Directory (Azure AD). This process is simple and it adds significant flexibility, security, and mobility to your organization’s identity.

I also strongly encourage you to cloud-connect ConfigMgr with Intune. The process takes #Just4Clicks and, once enabled, reaps immediate rewards including superior visibility into device health, as well as access to actions such as remote wipe and security features like conditional access.

For more information, you can watch the #Just4Clicks video on our Microsoft Cloud channel.

You can also get your files up into the cloud with OneDrive Known Folder Move. This simple process immediately gives you protection from ransomware, and it improves real-time collaboration.

Find more information in our Tech Community blog, Migrate Your Files to OneDrive Easily with Known Folder Move.

2. Gain superior visibility and control

One of the many announcements we made at Ignite was the work we’ve done to merge 20+ separate web consoles into a single point of entry called the Microsoft 365 admin center. This consolidation is a part of our focus on integrated simplicity, and it features seven specialist workspaces for security, compliance, device management, and more.

I encourage you to check out the preview at admin.microsoft.com

Another simple action with big benefits is enabling conditional access so that you can better understand how corporate data is being accessed by personal devices. Configuring conditional access is easy and it dramatically increases your security posture while also reducing the risk of both intentional and accidental data leakage.

Learn more about how to enable conditional access.

In addition to support for Win32 app deployment in Intune, we also announced Intune security baselines. These baselines are pre-configured (but still customizable!) and published every month. I strongly encourage everyone using Intune to enable these as soon as possible.

More information is available in Using security baselines in your organization.

3. Shift to a modern desktop

For years, engineers at Microsoft have dreamed of building a service that learns from the millions of devices, billions of authentications, and trillions of signals in the Microsoft Cloud—and then applies that information to the estates of our customers in real-time. Desktop Analytics is the realization of that dream.

Desktop Analytics is one of the most powerful tools we have ever created—and it is custom built to give IT teams the insight and information they need to deploy, manage, and service apps and devices.

Desktop Analytics offers a tightly integrated, end-to-end solution that automates the mountain of work required to validate the compliance of your hardware, drivers, applications (both 3rd party and your own internally developed), as well as the Office add-ins. This doesn’t just eliminate hundreds of hours of work for IT teams, it wipes out thousands of hours otherwise spent on manual compliance checks which have chronically stolen your bandwidth at a time when you could be pursuing strategic projects that make a lasting impact on the way your company operates.

Desktop Analytics is currently in private preview (public preview will be announced soon), but you don’t need to wait to use it: The Windows Analytics service (which is part of Desktop Analytics) is available to use right now. I think you’ll be really surprised by how much Windows Analytics will simplify and improve your ability to manage devices and apps, as well as simplify the task of upgrading to Windows 10.

More information is available in Windows Analytics Overview: Device Health, Update Compliance, Upgrade Readiness.

I also want to highlight how simple and valuable it is to shift from Office perpetual to Office 365 ProPlus with the Office Customization Tool in ConfigMgr. This is proof of how easy it now is for your on-premises infrastructure and the cloud to work together to reduce the complexity of what would otherwise be arduous manual tasks—e.g., migrating from MSI deployments of Office perpetual editions in favor of Office 365 ProPlus Click-to-Run.

Only the Office ProPlus apps offer the AI required for these scenarios.

More information is available in Overview of the Office Customization Tool for Click-To-Run.

As you plan for the future of your organization, prioritize finishing Windows 10 upgrades before January 2020. Both Windows 7 and Office 2010 will reach the end of extended support in 2020, and based on our data, we can see that there are now more devices in the enterprise running Windows 10 than any other previous version of Windows.

If your Windows 10 deployment hasn’t also reached the halfway mark yet, now is a great time to reach out to our FastTrack team for help with upgrades, migrations, and (as of Ignite) application compatibility as part of the newly announced Desktop App Assure program.

More information is available in Helping customers shift to a modern desktop.

Make the shift today

I started Monday’s session talking about the past instead of the future.

This look backwards focused on the little-known story of John Napier. In the early 1600s, Napier was an eccentric inventor and treasure hunter who never left his home without a wooden box of spiders in his pocket or a black rooster he considered magical. From this very unlikely source came a project 20 years and 10 million calculations in the making.

In 1614, he published a 147-page book that ushered in the technical underpinnings of the modern world. With no advanced notice or fanfare, he introduced the concept of logarithms and how to use them.

Once logarithmic tables were available, the sciences and engineering professions surged. Almost overnight, a world full of equations that could not be solved by hand within the time limits of a normal lifespan could be unraveled in minutes. This made the world a dramatically simpler place, and the sciences surged with this new, user-friendly computational technology.

Logarithmic calculations offered the means for accurate measures of planetary orbits, which led to interstellar cartography, which led to satellites and moon landings. Trade routes could now be measured and planned across oceans instead of counties. Engineers could now build things bigger, safer, and stronger—which led to industrialization, internal combustion, and skyscrapers. In very short order mobility leapt from carts, to steam engines, to intercontinental flight, and human productivity took flight by moving from hand tools, to electricity, to the cloud.

I believe we’re at another pivotal moment in history. All hyperbole aside, I see the volume and quality of the new tools demonstrated at Ignite as a huge opportunity for IT. Not only do these tools work with and expand upon the elements you already have within your infrastructure, but they put the power of the cloud in the hands of every one of your end users. The integrated simplicity and functionality of what has been built for IT pros allows you to cloud-connect the work you are doing and use cloud-based intelligence to transform your organization.

Please evaluate and investigate all of our announcements—and don’t hesitate to share your feedback. I appreciate your partnership and I am grateful for the incredible work you do every day.

The post Why and how you simplify IT with Microsoft 365 appeared first on Microsoft 365 Blog.

September 25, 2018 By PC Portal

Start using Microsoft 365 to accelerate modern compliance

Today’s post was written by Rudra Mitra, Partner Director of Microsoft 365 Security and Compliance.

With more than 200 updates from 750 regulatory bodies a day, keeping up to date with all the changes is a tremendous challenge. As privacy regulations, like the General Data Protection Regulations (GDPR), continue to evolve, compliance requirements can seem complex to understand and meet. However, when you store your data in the Microsoft Cloud, achieving compliance becomes a shared responsibility between you and Microsoft. Take the National Institute of Standards and Technology (NIST) 800-53 security control framework as an example—Microsoft helps you take care of 79 percent of the 1,021 controls, and you can focus your efforts on the remaining 21 percent. Additionally, Microsoft provides you with a broad set of security and compliance solutions to more seamlessly implement your controls.

In addition to a number of investments made over the last year to support GDPR compliance and the privacy rights of individuals, we hear from you that organizations need more built-in capabilities to proactively achieve modern compliance. Therefore, we are working diligently to bring more artificial intelligence (AI) powered, user-centered, and integrated compliance solutions into Microsoft 365. Today, we’re announcing new and expanded capabilities that support your organization’s compliance journey.

Assess and manage your compliance for GDPR and more

Conducting ongoing risk assessments of your information management systems is a crucial activity to help your organization understand the effectiveness of security, compliance, and privacy controls; recognize the risks; and make appropriate plans to remediate when needed.

We expanded Compliance Manager to offer 12 assessments, including security control frameworks, such as NIST CSF and CSA CCM, and regulated industry standards like FFIEC and FedRAMP. These assessments can help you proactively enhance your data protection controls and meet compliance obligations. Learn more about this update in our Tech Community blog.

Harness intelligence to protect and govern your most important data

To ensure effective protection and governance around your most important data, you should implement intelligent solutions and processes to automatically discover, classify, label, and monitor this data—no matter where it lives or travels.

The unified labeling experience in Microsoft 365, now generally available, provides organizations with a more integrated and consistent approach to creating, configuring, and automatically applying comprehensive policies to protect and govern data across devices, apps, cloud services, and on-premises locations. This new approach gives customers a single destination to create and configure data sensitivity labels for both Azure Information Protection and Office 365, so you can set up sensitivity and retention labels and policies in the same place. These labels can be used to enforce policy across our information protection services—for example, Windows Information Protection will be able to understand the presence of a data sensitivity label in a document and apply policy to protect that data on the device.

The unified labeling experience is complemented by user experiences built into Office apps and Windows—no plug-ins or add-ons required. This native labeling is now available in public preview for Office apps on Mac, iOS, and Android—giving customers a labeling experience they are familiar with if they are already using the Azure Information Protection client on Windows. We also support a growing ecosystem of third-party apps and security solutions. Starting in October, you will be able to preview the ability to open protected PDF files directly within Adobe Acrobat on Windows.

Additionally, our Information Protection SDK is now generally available, making it easy for ISVs and third-parties to build labeling and protection experiences into their apps and services. Learn more about all these new updates that help you meet both your security and compliance needs at our Tech Community.

In addition to the new unified labeling experience, we have several updates to Microsoft 365 data governance capabilities. First, you can now auto-apply a label to Exchange Online content and to files associated with a specific content type in SharePoint Online, such as tax documents or human resources information. Once you map a content type to a retention label with an auto-classification query, you can auto-apply retention and deletion policies to all files with that content type. This new capability enables you to align labels to your existing information architecture and governance policies.

We also made it easier for you to configure complex record retention schedules for your departments, locations, and categories with the new file plan capability, now available in public preview. The file plan capability allows you to import or export the retention plan as a template and bulk edit labels, providing a more robust way to manage your record retention policies.

Finally, long-term audit log availability is now coming to public preview for Microsoft 365 and Office 365 E5 subscribers. This is an important update for organizations that need long-term access to audit logs for regulatory or security purposes. The audit log availability has now increased from 90 days to one year.

Learn more about all of these data governance updates at the Tech Community blog.

Enforce zero-standing access to your sensitive data

For organizations looking to protect and control their data, governing privileged access can reduce the risk of data compromise and help meet compliance obligations regarding access to sensitive data. Built on the principle of no standing access, where admins do not have access by default, we are announcing the general availability of privileged access management in Office 365. This feature enables organizations to govern privileged access by requiring admins to go through an approval process and gain temporary permissions to perform high-risk tasks like a journal rule, which is a task that can expose and exfiltrate data by copying messages to an external shadow mailbox. Once an admin elevates permissions to execute the high-risk task, it can be automatically or manually be approved before access is granted—either way all activities are logged and auditable.

Privileged access management is available in the Microsoft 365 Admin Center, and organizations can now also manage Customer Lockbox requests and Data Access requests from Azure Managed Apps from a single management pane for privileged access to your Microsoft 365 data. Read more details on the Tech Community blog.

Proactively safeguard your sensitive emails with insights

We’re also sharing a few new enhancements in Office 365 Message Encryption that enable organizations to more seamlessly collaborate on and proactively protect their sensitive emails. First, to further enable collaboration for consumer recipients, Office 365 Message Encryption now offers organizations the option to control whether attachments should be encrypted for the encrypt-only template, so that recipients can have full permissions to share the attachment with anyone—this feature is generally available today.

To help IT admins proactively protect and control sensitive emails, organizations can monitor encrypted messages by viewing reports on encrypted messages. The new reporting dashboard in public preview provides granular details such as message ID, along with sender and recipient information. IT admins can use the insights to proactively adjust and apply policies to sensitive emails. To learn more about these capabilities and more, read the Tech Community blog for details.

Streamline compliance investigations process with enhanced Search & Tagging capabilities

Litigation and regulatory demands, like GDPR, are requiring organizations to be more efficient at discovering information in a timely manner. Organizations also have a responsibility to support internal investigations such as corporate fraud, discrimination, work rule violation, and other misconduct.

To further streamline the process of identifying relevant data, the new Search & Tagging feature in Advanced eDiscovery, now generally available, enables you to find the most relevant information within an existing eDiscovery case, using keywords, metadata, and analytics capabilities like Themes and Relevance Score. Additionally, you can preview and organize the data using case-specific tags, which can help you save time and cost when reviewing documents. Learn more about Search & Tagging.

Address global data residency needs with Multi-Geo Capabilities

Increasingly, governments around the world are enacting laws that mandate data residency for cloud data. Global companies are often challenged with digitally transforming with the cloud and staying in compliance with their data residency requirements.

Multi-Geo Capabilities in Office 365 can help address these concerns and make it easy for companies to meet their global data residency needs and empower every employee with a modern productivity experience. Earlier this year, we launched Multi-Geo Capabilities for Exchange Online and OneDrive, giving you controls over the country/region where each employee’s mailbox content and files are stored at-rest.

In 2019, we’re rolling out Multi-Geo Capabilities in SharePoint Online and Office 365 Groups, letting you control the country/region of SharePoint Online Team Sites and Office 365 Group content such as files, associated SharePoint Sites, and group mailboxes. Learn more about Multi-Geo Capabilities.

Learn more about the Microsoft 365 Compliance solutions

Our investment in data privacy and compliance is beyond the GDPR, and we want to help you make compliance a less burdensome process, so you can focus on your core work, to empower employees to achieve more. You can find more resources below to learn more about the compliance solutions Microsoft 365 provides.

The post Start using Microsoft 365 to accelerate modern compliance appeared first on Microsoft 365 Blog.

September 24, 2018 By PC Portal

Microsoft 365 adds modern desktop on Azure

Today, we are announcing Windows Virtual Desktop, the best virtualized Windows and Office experience delivered on Azure. Windows Virtual Desktop is the only cloud-based service that delivers a multi-user Windows 10 experience, optimized for Office 365 ProPlus, and includes free Windows 7 Extended Security Updates. With Windows Virtual Desktop, you can deploy and scale Windows and Office on Azure in minutes, with built-in security and compliance.

For many companies, the specific needs of their business require a virtualized desktop experience. The reasons for virtualization vary. For example, for regulated industries like financial services and healthcare, a virtualized desktop experience ensures compliance regulations are met and access to sensitive data is securely managed. For mobile workforces and Firstline Workers, desktop virtualization makes managing and provisioning access to corporate data and apps easier. It also gives IT options in supporting scenarios such as giving access to specific apps to certain employees.

Introducing the Windows Virtual Desktop

While desktop virtualization helps in many business scenarios, it has historically been complex and expensive to deploy and manage. To solve some of these complexities, we have developed Windows Virtual Desktop with both IT and the user in mind.

Windows Virtual Desktop includes the following benefits:

The only service to enable a multi-user Windows 10 experience, including compatibility with Microsoft Store and existing Windows line-of-business apps while delivering cost advantages previously only possible with server-based virtualization.
The best service to virtualize Office 365 ProPlus running in multi-user virtual scenarios. Microsoft Office is the most virtualized app used, and we are committed to deliver the best possible virtual experience. In the months ahead, we will have more to share on our investments in the Office 365 virtualized experience for the Windows Virtual Desktop service.
The only service to provide Windows 7 virtual desktop with free Extended Security Updates, giving you more options to support legacy apps while you transition to Windows 10.
The most scalable service to deploy and manage Windows virtual machines, using Azure for compute, storage, rich diagnostics, advanced networking, connection brokering, and gateway. You no longer need to host, install, configure, and manage these components yourself—so you can deploy and scale in minutes.
The most flexible service allowing you to virtualize both desktops and apps, meaning you can choose between providing your users the entire desktop experience or delivering only specific apps. When you deliver virtual apps to a Windows 10 endpoint, they are integrated seamlessly into the user experience.
Deeply integrated with the security and management of Microsoft 365. The Microsoft 365 conditional access, data loss prevention, and integrated management are natively built in—providing the most secure and simplest solution for protecting and managing all your apps and data.

Windows Virtual Desktop ecosystem

Windows Virtual Desktop is a comprehensive virtualization solution. However, we recognize that there is a need for different capabilities to serve our broad set of customers. To accommodate this need, we have built Windows Virtual Desktop as a platform that can be easily extended and enriched by partners in the following ways:

We will have many partners that extend the service through the Azure marketplace and are already working with leading partners, including Citrix, CloudJumper, FSLogix, Lakeside Software, Liquidware, People Tech Group, and ThinPrint.
The extensive network of Microsoft Cloud Solution Providers will be able to offer Windows Virtual Desktop to their customers and offer additional value around the service.
We are also working with partners such as Citrix to deeply integrate and build upon the Windows Virtual Desktop capabilities.

We will have more to share on our ecosystem approach in the near future.

Access to Windows Virtual Desktop

We’re excited to offer this service to Windows 10 Enterprise and Windows 10 Education customers. Once you sign up for Windows Virtual Desktop, you only need to set up or use an existing Azure subscription to quickly deploy and manage your virtual desktops and apps. The only additional cost to you is for the storage and compute consumption from the virtual machines themselves, which will live in your Azure subscription. You will be able to take advantage of any of your existing Azure compute commitments, including Azure Virtual Machine Reserved Instances (RI).

We are working hard to put the finishing touches on a public preview, which will be available later this year. If you would like to participate in the public preview, you can register your interest now. In the meantime, please visit the Windows Virtual Desktop website to learn more, or contact your Microsoft account team or Microsoft partner.

The post Microsoft 365 adds modern desktop on Azure appeared first on Microsoft 365 Blog.

August 29, 2018 By PC Portal

The role of standards in accelerating innovation

Howdy folks,

Today I’m going to blog about something a bit different: the important role identity open standards play in accelerating innovation. If you’re an identity geek or an open standards geek, or just interested in understanding where we believe the future of identity is headed, I think you’ll find it interesting.

At Microsoft, we firmly believe that open identity standards accelerate innovation. Some of you might think this is an oxymoron. Let me explain why it isn’t.

By building upon widely implemented industry standards, innovators are free to focus on the innovative aspects of their work, letting existing standards do the heavy lifting for the needs of their projects that standards already address. The potential for use of cryptographic and digital identity standards in decentralized systems illustrates this point.

Microsoft is deeply engaged with a ton of innovative members of the identity community, and we’re all working together to design and prototype an open standards–based approach to decentralized public key–based identity systems. Needless to say, we are VERY excited by the potential here.

We love what’s happening and the way innovators are coming together to enable new digital identity possibilities. All of us want these possibilities to achieve their promise as quickly as possible. Integrating and maintaining interoperability with existing identity management systems—all based on standards—will be key to accelerating this process.

Standards play a huge role in enabling innovation in decentralized public key–based identity systems. By using widely adopted industry cryptographic and data representation standards as an agreed framework, innovators in this space can achieve laser focus on the unique value that they’re adding. Furthermore, use of standards, where applicable, will facilitate faster adoption as decentralized public key–based systems move from prototypes to production systems.

To make things concrete, we believe that use of the following standards will accelerate innovation when building decentralized identity systems:

JWK [RFC 7517] is a widely deployed representation of cryptographic keys.
JWS [RFC 7515] is a simple, flexible representation of digital signatures.
JWE [RFC 7516] is a no-nonsense JSON-based representation encrypted content.
JWA [RFC 7518] defines an initial set of algorithms for use with all the above.
JWT [RFC 7519] is a simple, powerful, widely deployed representation of claims (including that JWT is often used for representing verified claims).
CBOR [RFC 7049] defines a compact binary data representation, which can be used as an alternative to JSON [RFC 8259] when size is at a premium.
COSE [RFC 8152] is the CBOR equivalent of JWK, JWS, JWE, and JWA.
CWT [RFC 8392] is the CBOR equivalent of JWT, providing a binary claims representation.
W3C Web Authentication and FIDO Client to Authenticator Protocol (CTAP) employ the building blocks above for public key–based authentication.

Great standards not only solve current use cases but enable solving new ones. The JOSE [RFC 7515-7518] and JWT [RFC 7519] standards and their binary equivalents explicitly enable innovation while still using the standards. How is this possible?

While JWA [RFC 7518] defined how to a set of commonly used cryptographic algorithms with JWS, JWE, and JWK, it also established the IANA JOSE Algorithms registry to enable additional algorithms to be used for new use cases, without having to revise the JOSE standards. For instance, RFC 8037 defined how to use new elliptic curves with JWS, JWE, and JWK. Microsoft is currently working with decentralized systems implementers on registering the secp256k1 algorithm for use with JWS and COSE. And when new cryptographic algorithms are invented, new identifiers can and will be registered for them in the IANA JOSE Algorithms registry.

Microsoft is building a proof of concept for decentralized identities based on these robust industry standards. We’d like to invite others to join us using this approach. Together we can dramatically accelerate innovation and rapid adoption using this approach.

We’re excited to see what we’ll achieve together!

Best regards,

Alex Simons (Twitter: @Alex_A_Simons)

Corporate Vice President of Program Management

Microsoft Identity Division

The post The role of standards in accelerating innovation appeared first on Microsoft 365 Blog.