Now we're going to talk about Endpoint Manager both on mobile devices and we’ll come onto windows devices with what challenges it helps us tackle around mobile devices and those windows devices. From a security perspective our challenges with mobile devices were indeed to ensure company devices meet company standards. We need to make sure if we want every device to be encrypted, to have a pin code on the device, how do we ensure the device meets those standards. The second one is how do we allow people to access company data from personal devices which obviously has advantages from a flexibility perspective but the challenge is we don’t have the same level of control as company devices. The person who owns that device probably won’t want you to be able to configure it, but you still have the concern of how do we secure company data.
So, the policies we suggest you put in place. The first one you should put in place is compliance and configuration policies for iOS and Android company owned devices. So the compliance device is your standard, so all iOS devices may need a pin code and can’t be jailbroken for example. That would be your compliance standard and any divide enrolled in your organisation would be reviewed against those standards so you can see which meet the standards which don't. Then you've also got the configuration policies where you can push the policies. For example, you can configure a device to lock the screen on a device after it's been idle for three minutes to make sure no one can pick it up and access data on the device. These are real world examples the policies include in the document. The other sort of policy we recommend is around the second challenge which is to implement the MAM policies for BYOD devices and we’ll go ahead and have a quick look at those in the portal. They allow us to control app level if you've got people using personal devices. They might download Word or Outlook on their device, and without controlling their device we can have control over those apps so we can enforce pin codes on the apps themselves, or stop people copying and pasting data, that sort of stuff, without invading privacy and controlling devices that aren’t the business’.
So a couple of quick demos of how these look in the portal. First of all, how a compliance policy looks like here, if you have a look on the screen you can see a iOS compliance policy here and we just get a bit of an idea of what this looks like in the Endpoint Manager and what the settings are. For example, we can see here we won’t allow jailbroken devices, we’ll block simple passwords, all passwords must be alphanumeric and at least 6 characters in length and the password will expire after 60 days. This is where you go to configure those in Endpoint Manager, there’s a lot more settings in here you can utilise.
Your security standard for mobile devices will be different for different organisations but again our sort of policy gives you good guidelines you can use and implement a strategy that’s right for your business. Again, all the details are there so you could literally look at the policy in the document and configure it in the portal to get to this point.
The next part is the architecture policy. This can be used on company devices and BYOD so personal devices. They’re useful because they let you control the application itself. If we take a look in here in the Endpoint Manager portal, we take a look at the architecture policies. We’ll actually have a look at some of the settings, so if we go to data protection what we can see in here is for example we’re not going to allow our apps to be backed up to iTunes or iCloud because if somebody leaves we don’t have access to those backups so we don't have access to the company data in there. We allow users to only save copies of documents to certain services so we only allow them to save in OneDrive basically so if they get an email with an attachment we won't allow them to save it to their phone for example. So, you can see there we can also restrict copy and paste for these apps so there’s a setting here. We can restrict cut copy and paste between other apps which will prevent people copying data from work apps into personal apps in order to help you protect company information.
This is sort of the access requirements for these apps so if someone has Outlook on their device we can request a pin to access it as there’s no guarantee people have a pin on their device. So what you want is if it's a personal device you can make sure if the device got stolen they couldn't just get into the device without a pin and then open one of the apps. So you can actually say even on a personal device they must have a pin or biometric fingerprint or Face ID. It just means the business can control what they should be controlling instead of the whole device. Again, these policies are all specified in the document.
So, now we’ve got Windows devices. So, first of all it’s what policies we recommend you put in place using this technology. We recommend compliance for windows devices to say this is our security standard, the device must have this version of windows and that black devices will be compared to that policy. The second thing you can do is not just review a safe compliance, you can actually use Endpoint Manager to configure bitlocker to be configured on the devices and we’ll show you where that is. The third one is using Endpoint Manager to manage OneDrive so what you can do is push a policy on all devices. Basically, we would for example, prevent personal account syncing, restrict tenant access so they can only add one OneDrive account on their laptop.It means they can’t add accounts for other organisations. ANother policy to put in place is to force the OneDrive client to silently move the norm folders it provided the user with a bit of back up.
So just going to show you the portal again, so compliance policies, options for Windows devices. This is our security standard. It requires a certain version of the operating system right down to patch level. It requires a password on the device and for it to be encrypted. It requires antivirus. We don't want it in our tenant if it has a nasty viru.
The second part was the Endpoint security policy to not just read the devices security posture but to actually push settings to the device and in this case push out bitlocker to enable bitlocker on the devices. So, in the Endpoint security section on the left you cango in and go to encryption settings and get all of your bitlocker settings in here that you want to push to a device because exactly what type of encryption level you want to use and they’ll do a group policy in here and the benefit is that whether on the network on not this is the policy on the device.
