In a recent LinkedIn post, I provided 4 suggestions as to how organisations can secure their remote workers, a thing I’m sure most would agree is of paramount importance under the circumstances.
Of the 4 suggestions, I have already written blog posts that look in more detail at Azure Information Protection, Conditional Access and more recently, Multi Factor Authentication. That leaves me with just Endpoint Manager to cover.
What is Endpoint Manager and why is it important right now…
Given what has happened over the last 12 months, with workforce mobility being put into practice on a larger-than-ever scale, device management has jumped to the forefront of many of our thoughts. Well, mobile device management (and device management generally) is where Microsoft’s Endpoint Manager comes in, and in this blog I will look to shed some light on how it works.
To start us off, here is an overview of the purpose of Endpoint Manager in Microsoft’s own words:
“by connecting to the cloud, you gain scale, security and intelligence to better manage your company’s devices and apps… while delivering a better end user experience.”
That’s great, but I need more detail…
A Microsoft product you might have heard of or even used to some extent is Intune. In more recent times, you might have heard Endpoint Manager and Intune used interchangeably, or at least in the same context. Well, there’s good reason for that, because Endpoint Manager is a Microsoft cloud product that has incorporated the functionality of Intune and Config Manager, as well a couple of other products you may or may not have heard of (which I will touch on shortly).
To understand why Microsoft have done this, we need to look at what Config Manager and Intune are responsible for in the first place:
Config Manager allows IT decision makers within an organisation to centrally manage devices on their network (such as laptops and servers), thus enabling a centralised rollout of software, updates, apps and operating systems.
Intune is Microsoft’s fully cloud-based mobile device management and mobile application management tool, allowing IT decision makers all the same functionality as Config Manager, only its direct cloud access allows for more nuanced policy options that are available as part of the Microsoft 365 suite.
The reason Microsoft have brought the two under the Endpoint Manager umbrella is to meet organisations at whatever point they’re at in their IT journey. A lot of organisations may have already written their policies and created their imaging in Config Manager and are therefore not ready (or wanting) to move to connecting everything to the cloud (Intune). Endpoint Manager therefore allows IT decision makers the simultaneously manage their current Config Manager, as well as adding any devices directly to Intune where necessary.
How does this Connection work…
IT decision makers can cloud-enable their Configuration Manager so that it can integrate with your Azure AD and Intune. Doing also gives you access to some of the more powerful features available in the Microsoft 365 suite, such as Conditional Access (which I have covered in a previous blog post).
It is at this point that it is necessary for me to introduce Co-management. Co-management is one of the main ways that organisations attach their existing Configuration Manager to the Microsoft 365 cloud. Co-manager is a product that is designed to simultaneously manage your Windows 10 devices with both Configuration Manager and Intune, giving you the power to choose which policy/app workloads should be managed by which product. The End Point Manager admin centre is the place where you can see which devices are managed by either Intune or Config Manager, and is also the centralised location through which all of your policy and device management can be carried out.
What kind of things can be done using Endpoint Manager…
Now that the high-level concept of Endpoint Manager is in place, I thought it would be good for me to give you some ideas of how Circle Cloud have used the product to improve the ways in which I customers manage their devices.
- Microsoft AutoPilot
Onboarding new computers for existing and new employees can be time consuming if not done correctly. In a cloud environment where people expect to work remotely, it seems old fashioned to have to setup a computer for each person manually, or attend the office to have an image applied to a machine. Windows Autopilot allows the automation of building new computers to your organisation’s specification directly over the internet. Here is an example of what Circle Cloud have used this tool for when supporting our customers:
- Automatically sets up a user’s computer over the internet, including connecting the device to your Microsoft 365 or Active Directory domain
- Ensure new starters are onboarded efficiently
- Automatically install software that is appropriate for the specific user upon setup
- Configure Office, Outlook and Teams for the user upon first logon
- Microsoft Intune
Once your organisation’s devices are enrolled in Intune, they receive your rules and settings using the central policies that you’ve created. At a time when increased employee mobility brings new security challenges, it’s important to ensure that we have control over mobile devices through which company information is accessed.
When creating a device compliance policy for your organisation, you can define the security standards a device must meet before being able to install Outlook, Office and Teams such as:
- Device must be encrypted
- Device must have a pin code set (meeting complexity requirements)
- Device must change pin code on a specified time interval (e.g. six months)
- Device cannot be jail broken or rooted
- Device must have a screen lock applied after ‘x’ amount of minutes, preventing a lost device being picked up and left open for somebody to view and extract information.
Intune also give you the ability to wipe the device or specific Office applications of company data either when a device is lost, or an employee leaves the business.
Final Remarks…
Hopefully this blog post has given you an idea of what Microsoft Endpoint Manager is, as well as what it is designed to achieve. At a time when it is important for our workforces to be mobile, it is equally important that we find new ways of meeting the security challenges posed by new ways of working. Cloud-based management of our end user devices give us so many options as to how we can maintain robust security measures, without compromising on the mobility our workforces require to function.
If you would like to speak to one of our team about Microsoft Endpoint Manager, please get in touch!
What Next?
Click Here to see a recent webinar recording where we covered Endpoint Manager in more detail.
If you're interested in finding out howEndpoint Manager fits into Circle Cloud's Managed Service Plans, Click Here.
