Episode 372 – Microsoft Intune (Part Deux) – App

March 14, 2024

Episode Transcript

Welcome to Episode 372 of the Microsoft Cloud IT Pro Podcast, where we’ll be discussing more of Microsoft Intune, one of the most powerful tools for managing your organization’s devices, apps, and endpoint security. In this episode, we continue our discussion on the three pillars of Intune – Devices, Apps, and Endpoint Security – with Apps. We’ll cover App protection policies, touch on the management experience, how MDM and MAM come into play, and how App protection policies protect your corporate data.

Like what you hear and want to support the show? Check out our membership options.

Show Notes

About the sponsors

Intelligink utilizes their skill and passion for the Microsoft cloud to empower their customers with the freedom to focus on their core business. They partner with them to implement and administer their cloud technology deployments and solutions. Visit Intelligink.com for more info.

See full episode transcriptTranscript is autogenerated by AI

1 00:00:03,365 --> 00:00:05,935 - Welcome to episode 372 2 00:00:05,935 --> 00:00:08,255 of the Microsoft Cloud IT Pro podcast 3 00:00:08,855 --> 00:00:11,255 recorded live on March 8th, 2024. 4 00:00:11,645 --> 00:00:14,015 This is a show about Microsoft 365 5 00:00:14,015 --> 00:00:16,175 and Azure from the perspective of it pros 6 00:00:16,175 --> 00:00:19,135 and end users where we'll discuss a topic or recent news 7 00:00:19,155 --> 00:00:20,495 and how it relates to you. 8 00:00:20,865 --> 00:00:23,975 Today we'll be continuing our discussion on Microsoft 9 00:00:24,035 --> 00:00:25,815 Intune, one of the most powerful tools 10 00:00:25,955 --> 00:00:28,815 for managing your organization's devices, apps, 11 00:00:28,835 --> 00:00:29,935 and endpoint security. 12 00:00:30,315 --> 00:00:33,175 In this episode, we'll be focusing on the app pillar 13 00:00:33,175 --> 00:00:35,375 of Intune, which includes app protection, 14 00:00:35,755 --> 00:00:37,415 app configuration, and office apps. 15 00:00:37,665 --> 00:00:39,335 We'll explore the many tools 16 00:00:39,335 --> 00:00:41,535 and features available to help you manage 17 00:00:41,595 --> 00:00:44,335 and secure the apps your organization uses. 18 00:00:44,685 --> 00:00:47,775 Join us as we dive deeper into app capabilities 19 00:00:47,915 --> 00:00:49,255 of Microsoft Intune. 20 00:00:51,655 --> 00:00:52,935 I should like script this out 21 00:00:52,935 --> 00:00:54,695 so I don't have to hit two buttons. You 22 00:00:54,695 --> 00:00:56,695 - Should automate yourself out of a job, 23 00:00:57,035 --> 00:01:00,095 - Not the way my day went today with a automation . 24 00:01:01,365 --> 00:01:04,015 - Yeah, you having some automation woes at work? 25 00:01:04,375 --> 00:01:06,335 I, I'm gonna get you into it just so you rant a little bit. 26 00:01:06,485 --> 00:01:08,575 - Okay. You're gonna get me into it. One quick one. 27 00:01:08,635 --> 00:01:11,455 We do not need to spend time figuring out why this happened 28 00:01:11,455 --> 00:01:12,535 because I don't know why it happened. 29 00:01:12,735 --> 00:01:14,495 I just turned everything back on. 30 00:01:14,495 --> 00:01:15,655 After I turned it all off, 31 00:01:15,775 --> 00:01:18,055 I essentially rebooted the cloud and it worked. 32 00:01:18,875 --> 00:01:20,375 So I had a client call me the other day 33 00:01:20,375 --> 00:01:22,015 and like the SharePoint list was getting, 34 00:01:22,415 --> 00:01:24,735 I have an automation that runs daily from A CSV 35 00:01:24,735 --> 00:01:25,815 to update a SharePoint list. 36 00:01:26,145 --> 00:01:28,095 Short story email gets sent to mailbox 37 00:01:28,775 --> 00:01:30,535 CSV gets picked up by Logic apps. 38 00:01:31,025 --> 00:01:34,575 Logic apps or the email tells logic apps 39 00:01:34,575 --> 00:01:35,895 to go fire off a runbook, 40 00:01:36,265 --> 00:01:39,775 which essentially grabs the CSV outta blob storage, 41 00:01:40,125 --> 00:01:41,775 runs a PowerShell script against it 42 00:01:41,775 --> 00:01:42,975 to update a SharePoint list. 43 00:01:43,245 --> 00:01:46,935 It's a daily process. My Logic app is literally three steps. 44 00:01:47,315 --> 00:01:50,175 New email, copy the attachment to blob storage, 45 00:01:50,835 --> 00:01:52,335 run a runbook done. 46 00:01:52,605 --> 00:01:53,735 They call me yesterday 47 00:01:53,735 --> 00:01:55,415 and they're like, we're getting all kinds 48 00:01:55,415 --> 00:01:59,135 of duplicate things in this SharePoint list 49 00:01:59,715 --> 00:02:02,655 and we just killed the Logic app 50 00:02:03,115 --> 00:02:04,615 and we don't know what's going on. 51 00:02:04,805 --> 00:02:06,575 It's like, okay, I've been dealing 52 00:02:06,575 --> 00:02:07,895 with issues like this all week, so 53 00:02:08,475 --> 00:02:10,055 why not another one today? 54 00:02:10,055 --> 00:02:11,415 I went in and looked at it, 55 00:02:11,755 --> 00:02:13,495 the logic cap worked as it should have. 56 00:02:13,785 --> 00:02:17,055 Email came. I saw where it triggered, I saw where it went 57 00:02:17,055 --> 00:02:18,735 and added the file to Blob Storage 58 00:02:19,075 --> 00:02:21,815 and I saw where it triggered the runbook only it ran 59 00:02:21,835 --> 00:02:22,975 for longer than it should have. 60 00:02:22,975 --> 00:02:25,095 When it triggered the runbook, it was like it normally the 61 00:02:25,095 --> 00:02:27,495 nor Runbook normally runs for like 45, 50 minutes. 62 00:02:27,995 --> 00:02:30,175 It had been running for two hours and 15 minutes. 63 00:02:30,725 --> 00:02:33,495 Okay, maybe my PowerShell script took longer to run. 64 00:02:33,895 --> 00:02:37,335 I went and looked at Azure Automation, a single go run, 65 00:02:37,335 --> 00:02:41,055 an Azure automation Runbook created like 50 66 00:02:41,315 --> 00:02:43,615 or 75 jobs 67 00:02:44,035 --> 00:02:46,215 of running this one PowerShell script running this one 68 00:02:46,215 --> 00:02:49,255 Runbook a single action to Logic Apps. 69 00:02:49,255 --> 00:02:51,735 Somehow told it to run the runbook 75 times 70 00:02:52,395 --> 00:02:54,695 and it wasn't even running it properly 71 00:02:54,695 --> 00:02:56,495 because the PowerShell script wasn't 72 00:02:56,495 --> 00:02:57,815 doing what it was supposed to. 73 00:02:57,845 --> 00:03:00,125 Thus creating all these duplicate items in the SharePoint 74 00:03:00,125 --> 00:03:02,405 list, we shut it all down, canceled everything, 75 00:03:02,405 --> 00:03:04,365 turned it all back on today and sent an email 76 00:03:04,385 --> 00:03:05,445 and everything's working fine. 77 00:03:05,545 --> 00:03:08,925 - Sounds like a good Logic app gone bad. I don't know. 78 00:03:08,925 --> 00:03:11,005 Yeah, also sounds like a little bit 79 00:03:11,005 --> 00:03:13,885 of a complex process you've instituted there. 80 00:03:14,185 --> 00:03:16,725 So can I, can I ask you some probing questions? Sure. 81 00:03:16,875 --> 00:03:19,845 Well can the client uploading the CSV upload 82 00:03:19,845 --> 00:03:20,965 it directly to Blob Storage? 83 00:03:21,275 --> 00:03:23,405 - Potentially it comes from, 84 00:03:24,125 --> 00:03:25,885 I could go into the whole depth of the solution. 85 00:03:25,915 --> 00:03:27,045 It's an automated email 86 00:03:27,155 --> 00:03:28,805 that comes daily from another service. 87 00:03:29,425 --> 00:03:32,885 So there's another third party application they have 88 00:03:32,915 --> 00:03:34,085 that runs, it's 89 00:03:34,085 --> 00:03:35,365 - Like an EDI kind of thing. 90 00:03:35,715 --> 00:03:39,485 - Yeah. Ish. And it like sends the CSV from this system 91 00:03:39,745 --> 00:03:44,725 to this set email address that triggers the Logic app. 92 00:03:44,905 --> 00:03:47,285 - One of the thoughts that went through my head is 93 00:03:47,825 --> 00:03:51,325 if you can send it directly to storage, either via Blob 94 00:03:51,345 --> 00:03:54,165 or maybe like if it is an EDI ISH thing, most support 95 00:03:54,885 --> 00:03:57,485 P just SFTP, that thing straight in there 96 00:03:57,945 --> 00:04:01,125 and then leverage event grade events to go 97 00:04:01,125 --> 00:04:02,285 and kick off that stuff. 98 00:04:02,285 --> 00:04:04,525 Right? Like simplify the process like kick. 99 00:04:04,925 --> 00:04:06,645 'cause if the, if the mailbox is only there 100 00:04:06,665 --> 00:04:08,885 for automation purposes, it's just overhead, right? 101 00:04:08,885 --> 00:04:09,965 It just kind of sits in the middle 102 00:04:10,655 --> 00:04:11,765 short circuit the mailbox. 103 00:04:12,435 --> 00:04:13,645 Yeah. I don't know that it, I 104 00:04:13,645 --> 00:04:15,205 - Don't know that it fixes my issue though. 105 00:04:15,305 --> 00:04:17,805 - It doesn't fix your underlying issue with Logic Apps. 106 00:04:17,915 --> 00:04:19,525 Like whatever Logic Apps did and 107 00:04:19,545 --> 00:04:20,845 and went wrong there it was, 108 00:04:20,985 --> 00:04:22,925 but it could fix your issue with Logic Apps 109 00:04:23,205 --> 00:04:27,085 'cause you could have a, an event that kicks off something 110 00:04:27,085 --> 00:04:28,325 that's maybe not a Logic app 111 00:04:28,785 --> 00:04:31,005 and drive things through that way. Yeah, 112 00:04:31,205 --> 00:04:32,205 - I don't know. 113 00:04:32,205 --> 00:04:33,245 It was just kind of bizarre. 114 00:04:33,425 --> 00:04:35,645 - It sounds like, like when you described it it's like wow 115 00:04:35,645 --> 00:04:36,725 that's a lot of moving pieces 116 00:04:37,505 --> 00:04:39,485 so it it's maybe worth one of those things. 117 00:04:39,715 --> 00:04:41,925 Investing in simplification, getting 118 00:04:41,945 --> 00:04:43,085 - Rid of one of them. Do 119 00:04:43,085 --> 00:04:45,125 - Some like self-op optimization 120 00:04:45,265 --> 00:04:46,645 and kind of tech debt removal. 121 00:04:46,875 --> 00:04:48,805 - Yeah, I could we have 122 00:04:48,805 --> 00:04:49,805 - Backup in the chat too. 123 00:04:50,235 --> 00:04:52,445 Like you you got folks telling you it's a bad idea. Yes. 124 00:04:52,445 --> 00:04:53,765 Get rid of the mailbox. I know this is your first 125 00:04:53,765 --> 00:04:55,045 inclination for many things. 126 00:04:55,285 --> 00:04:56,845 it's going in a mailbox. 127 00:04:57,195 --> 00:04:58,645 - Yeah. I'd have to see like 128 00:04:58,645 --> 00:05:02,525 what the options even are from this other system to export 129 00:05:02,525 --> 00:05:04,405 that CS V or how it can, 130 00:05:04,655 --> 00:05:07,005 where it could go, what they could do with it. Yeah, 131 00:05:07,185 --> 00:05:09,525 - If there's something that's generating a CSV, 132 00:05:09,525 --> 00:05:10,805 it's probably worth investigating 133 00:05:10,865 --> 00:05:12,805 and seeing how that can be simplified. 134 00:05:13,475 --> 00:05:17,525 Conceivably there's a world where it might be easier for you 135 00:05:17,585 --> 00:05:20,565 to like stand up a proxy service in the middle, right? 136 00:05:20,565 --> 00:05:22,365 Like and that doesn't need to be too complex 137 00:05:22,465 --> 00:05:23,645 or anything like that, right? 138 00:05:23,675 --> 00:05:25,605 That can kind of broker that 139 00:05:26,125 --> 00:05:27,965 communication back to SharePoint for 140 00:05:27,965 --> 00:05:28,965 - You. 141 00:05:28,965 --> 00:05:30,205 Other thing we've talked about it, 142 00:05:30,255 --> 00:05:31,685 we've just never implemented it. 143 00:05:31,795 --> 00:05:34,325 That would short circuit even more of it is 144 00:05:35,005 --> 00:05:37,885 I believe this third party service also has an API 145 00:05:38,075 --> 00:05:41,445 that we could in theory call with like an Azure function 146 00:05:41,445 --> 00:05:44,165 or just have the PowerShell script call the API directly 147 00:05:44,545 --> 00:05:47,845 and query the API and copy the data to the SharePoint list 148 00:05:48,025 --> 00:05:50,165 and just have a PowerShell script 149 00:05:50,425 --> 00:05:52,005 and then it simplifies it even more. 150 00:05:52,265 --> 00:05:55,885 But it's time and money to go recreate a process 151 00:05:56,075 --> 00:05:58,645 that was working fine up until it didn't. 152 00:05:58,945 --> 00:06:00,685 It was one of those classic cases too 153 00:06:00,685 --> 00:06:02,085 where like automation is great 154 00:06:02,145 --> 00:06:04,045 for the last year, year and a half. 155 00:06:04,645 --> 00:06:06,565 Absolutely no complaints. It's been running flawlessly 156 00:06:06,585 --> 00:06:08,765 and then for whatever reason automation blows up 157 00:06:09,065 --> 00:06:12,245 and it just creates a mess because it's automated 158 00:06:12,265 --> 00:06:13,965 and you just expect it to work. I 159 00:06:13,965 --> 00:06:16,965 - Would also be worried about some underlying thing changing 160 00:06:17,075 --> 00:06:19,005 like in the logic apps connector, 161 00:06:19,395 --> 00:06:21,285 like the whole mailbox flow, right? 162 00:06:21,285 --> 00:06:26,125 Like given the stuff between exchange and their API surface 163 00:06:26,345 --> 00:06:28,725 and they're always moving things around these days, 164 00:06:29,385 --> 00:06:30,885 you're also taking a dependency on 165 00:06:30,885 --> 00:06:33,605 that Logic apps connector which is ultimately like built 166 00:06:33,625 --> 00:06:34,805 by another team, right? 167 00:06:34,825 --> 00:06:36,405 So at some point they probably come in 168 00:06:36,405 --> 00:06:37,685 and they go, Ooh, we're just gonna 169 00:06:37,685 --> 00:06:38,805 change functionality today. 170 00:06:39,275 --> 00:06:40,805 Then you break on the other side. 171 00:06:40,875 --> 00:06:42,445 - Yeah and that breaks not a big deal. 172 00:06:42,445 --> 00:06:44,925 You just go figure out why the mailbox isn't there. 173 00:06:44,985 --> 00:06:47,165 And that actually happened yesterday 174 00:06:47,425 --> 00:06:49,525 to like the connection to the mailbox dropped. 175 00:06:49,545 --> 00:06:51,765 We just went in and reconnected. Reconnected it 176 00:06:52,125 --> 00:06:53,125 - TLDR. 177 00:06:53,125 --> 00:06:55,845 You like the pain that you're gonna continue to 178 00:06:56,785 --> 00:06:58,085 to live with it? 179 00:06:58,305 --> 00:07:00,365 - No, I wanna go do it with the API. 180 00:07:00,635 --> 00:07:01,805 That would be the ideal goal 181 00:07:01,945 --> 00:07:04,085 and the ideal thing is that Logic Apps doesn't go 182 00:07:04,085 --> 00:07:06,725 and create 75 instances of a runbook. There you go. 183 00:07:06,725 --> 00:07:09,205 - It's, it's time to write a statement of work 184 00:07:09,665 --> 00:07:11,125 and go, go get some money, 185 00:07:11,315 --> 00:07:12,485 - Some type of error checking 186 00:07:12,785 --> 00:07:14,765 for an error I never thought I'd have to check for 187 00:07:14,905 --> 00:07:15,905 - It happens. 188 00:07:15,905 --> 00:07:18,405 It's, it's another from the trenches thing for us. 189 00:07:18,635 --> 00:07:21,605 - Okay, so Pirate wants me to get the mailbox forward it 190 00:07:21,605 --> 00:07:25,045 to a team channel and then I go call an instance of copilot 191 00:07:25,045 --> 00:07:27,285 and have copilot ask copilot 192 00:07:27,285 --> 00:07:31,885 and teams with a prompt that says go get the CSV file 193 00:07:31,905 --> 00:07:33,045 and process it this way 194 00:07:33,145 --> 00:07:34,965 and go do this and that and all of that. 195 00:07:35,265 --> 00:07:36,845 Ha get copilot in. There 196 00:07:36,845 --> 00:07:37,845 - You go. 197 00:07:37,845 --> 00:07:38,445 It can be AI driven. 198 00:07:38,765 --> 00:07:40,685 - I was playing with that in Excel today 199 00:07:40,865 --> 00:07:43,285 but that's another episode we should get into our real topic 200 00:07:43,415 --> 00:07:45,485 since we promised part do 201 00:07:45,795 --> 00:07:46,795 - Real topic. 202 00:07:46,795 --> 00:07:49,285 Yes. So just to play things back, 203 00:07:49,385 --> 00:07:54,125 the last episode we talked started talking about the 204 00:07:54,815 --> 00:07:57,605 suite of products that comprise 205 00:07:58,885 --> 00:08:03,245 Microsoft Intune and kind of how that composes together. 206 00:08:03,385 --> 00:08:07,485 So we started our conversation framing out Intune. 207 00:08:07,995 --> 00:08:10,125 I'll say again, I still really like the way you think about 208 00:08:10,125 --> 00:08:13,365 it as kind of three pillars across devices, apps 209 00:08:13,585 --> 00:08:14,605 and point security. 210 00:08:15,265 --> 00:08:16,285 And it turns out 211 00:08:16,285 --> 00:08:18,205 that our initial conversation only 212 00:08:18,265 --> 00:08:19,485 let us get through devices. 213 00:08:19,865 --> 00:08:21,325 So we still have two more pillars to get through. 214 00:08:21,325 --> 00:08:24,805 We've gotta get through apps and endpoint security. 215 00:08:25,785 --> 00:08:27,845 So you know, go back and listen to part one 216 00:08:27,845 --> 00:08:31,165 where we covered devices, how you can enroll them, 217 00:08:31,555 --> 00:08:34,325 onboard them, a kind of high level overview 218 00:08:34,345 --> 00:08:35,645 of configuration options 219 00:08:35,645 --> 00:08:36,925 that are available, things like that. 220 00:08:37,305 --> 00:08:40,125 And then we've got the continuation of things here. 221 00:08:40,145 --> 00:08:41,565 So let's see how far we get today. 222 00:08:42,105 --> 00:08:45,045 And let's start with our second pillar 223 00:08:45,825 --> 00:08:47,645 of applications. 224 00:08:47,945 --> 00:08:49,005 How does that sound? Well 225 00:08:49,005 --> 00:08:52,445 - The applications sounds like a plan 226 00:08:52,825 --> 00:08:55,365 and I didn't put up, I should have started with another tab. 227 00:08:55,535 --> 00:08:57,325 We'll get to app protection policies. 228 00:08:57,465 --> 00:08:59,405 We are sharing the screen for those of you. 229 00:08:59,785 --> 00:09:01,565 If I ever can find the time 230 00:09:01,565 --> 00:09:03,845 and if the cloud stops breaking, I will try to get some 231 00:09:03,845 --> 00:09:05,005 of these up on YouTube too 232 00:09:05,075 --> 00:09:07,205 because that's ultimately been my goal. 233 00:09:07,505 --> 00:09:11,965 But applications. So I like applications in Intune. 234 00:09:12,275 --> 00:09:14,645 This is, I would say there's a couple 235 00:09:14,645 --> 00:09:15,805 different facets to it. 236 00:09:15,945 --> 00:09:18,725 One of it maybe kind of drifts into security a little bit. 237 00:09:18,825 --> 00:09:20,325 One of it kind of drifts into devices. 238 00:09:21,265 --> 00:09:23,885 But one of the things I've been doing a lot 239 00:09:23,955 --> 00:09:26,165 with lately when it comes to apps 240 00:09:26,225 --> 00:09:28,725 and Intune is actually the deployment 241 00:09:28,905 --> 00:09:32,565 of applications in using Intune to 242 00:09:33,275 --> 00:09:37,805 publish applications installers for various, 243 00:09:38,195 --> 00:09:40,405 various applications so people can install 'em. 244 00:09:40,425 --> 00:09:43,845 So I think last episode when we talked about some 245 00:09:43,845 --> 00:09:46,725 of the devices, we talked about autopilot 246 00:09:47,385 --> 00:09:49,725 and Intune when it came to imaging devices. 247 00:09:49,865 --> 00:09:53,445 And this is what I've seen a lot of is companies wanting 248 00:09:53,545 --> 00:09:57,165 to get away from the, let me get a device, 249 00:09:57,345 --> 00:09:59,845 let me go install my own custom image on it 250 00:09:59,865 --> 00:10:01,325 and then I have to box it up again 251 00:10:01,385 --> 00:10:02,765 and then maybe send it to a user. 252 00:10:02,975 --> 00:10:04,405 Especially with all the remote work. 253 00:10:04,745 --> 00:10:08,165 So they've been saying, well what can I do with autopilot 254 00:10:08,545 --> 00:10:13,285 and Intune to lessen this overhead? 255 00:10:13,285 --> 00:10:16,365 And I've had some people, I don't know if we mentioned this 256 00:10:16,365 --> 00:10:19,845 or not, I've had some people come in they kind of think 257 00:10:19,845 --> 00:10:23,685 of like, oh autopilot is now my remote imaging tool . 258 00:10:23,865 --> 00:10:26,845 And I'm like, not really. 259 00:10:27,105 --> 00:10:28,445 And this is going back a little bit 260 00:10:28,445 --> 00:10:30,565 to devices really in a nutshell, 261 00:10:30,785 --> 00:10:35,445 all autopilot does is it says this device belongs 262 00:10:35,445 --> 00:10:37,125 to my organization and 263 00:10:37,125 --> 00:10:39,605 therefore you need to use an organization ID on it. 264 00:10:39,785 --> 00:10:42,605 At its core that's about auto all autopilot does, 265 00:10:42,605 --> 00:10:46,965 there's a few things in like the profiles in terms of with 266 00:10:46,965 --> 00:10:49,245 that organization device, are you a standard user? 267 00:10:49,465 --> 00:10:51,805 Are you an admin? And then some of the out 268 00:10:51,805 --> 00:10:55,685 of the box setup scenarios like maybe hide the EULA 269 00:10:56,145 --> 00:10:59,325 or take default keyboard settings, some of that. 270 00:10:59,505 --> 00:11:01,365 But really autopilot doesn't have much. 271 00:11:01,465 --> 00:11:03,645 And then from there it gets into Intune. 272 00:11:03,705 --> 00:11:08,205 So autopilot is this device belongs to my organization 273 00:11:08,305 --> 00:11:10,845 and you're going to log in with an organization id, 274 00:11:10,865 --> 00:11:12,525 you're not gonna use a local id, 275 00:11:12,705 --> 00:11:15,165 you're not gonna go create an MSA account. 276 00:11:15,465 --> 00:11:17,925 You are going to use your organization ID 277 00:11:17,945 --> 00:11:18,965 to sign into the device 278 00:11:19,305 --> 00:11:20,525 and you're gonna be a standard user, 279 00:11:20,525 --> 00:11:21,645 you're gonna be an administrator. 280 00:11:22,555 --> 00:11:24,605 Typically when you have an imaging scenario, 281 00:11:24,605 --> 00:11:26,405 you have a bunch of applications pre-installed. 282 00:11:27,025 --> 00:11:28,965 Now that part of the 283 00:11:29,585 --> 00:11:32,805 new device onboarding moves into this application pillar 284 00:11:32,825 --> 00:11:35,045 of Intune where you can go in 285 00:11:35,225 --> 00:11:36,885 and start creating these applications. 286 00:11:36,885 --> 00:11:38,845 Whether it's Adobe Creative Cloud 287 00:11:38,905 --> 00:11:42,245 or Adobe Reader, I know it's Microsoft, it's Google Chrome, 288 00:11:42,955 --> 00:11:46,645 it's Spotify, it's Citrix, it's 289 00:11:47,515 --> 00:11:49,085 your office applications. 290 00:11:49,825 --> 00:11:52,445 Any of those applications that maybe you install, 291 00:11:53,105 --> 00:11:55,205 you can now go package up 292 00:11:55,545 --> 00:11:58,445 and actually upload that install package 293 00:11:58,505 --> 00:12:01,885 or that Intune package into your applications and Intune 294 00:12:02,225 --> 00:12:05,205 and now go in and start assigning them to users 295 00:12:05,905 --> 00:12:06,925 or to devices. 296 00:12:07,545 --> 00:12:12,165 So in some cases I've had like maybe it's an MSP 297 00:12:12,745 --> 00:12:15,245 app for remoting into devices 298 00:12:15,425 --> 00:12:18,645 or it's like a fresh service discovery, some type of agent 299 00:12:18,645 --> 00:12:19,765 that you use for something 300 00:12:19,865 --> 00:12:23,565 and you're like, this really isn't a user application. 301 00:12:23,595 --> 00:12:25,525 It's really more of a device application. 302 00:12:25,535 --> 00:12:28,485 Every device that's onboarded should have this application 303 00:12:29,445 --> 00:12:31,565 regardless of who the user is. 304 00:12:31,945 --> 00:12:33,965 So you can assign applications to devices, 305 00:12:34,785 --> 00:12:38,485 you can assign them to users and then as users log in 306 00:12:38,585 --> 00:12:41,605 or as devices are onboarded, these applications 307 00:12:41,605 --> 00:12:44,365 that are required can be pushed down to those devices. 308 00:12:44,825 --> 00:12:47,725 So it, it's not the image in the sense that it's 309 00:12:48,415 --> 00:12:50,285 let's bundle all this together in image. 310 00:12:50,395 --> 00:12:52,925 It's this device is forced into my organization, 311 00:12:52,995 --> 00:12:54,205 it's forced into this user 312 00:12:54,585 --> 00:12:56,685 and once that user logs into that device, 313 00:12:56,865 --> 00:12:58,645 I'm gonna force all these applications down 314 00:12:58,905 --> 00:13:00,725 and install them on their device. It's 315 00:13:00,725 --> 00:13:03,085 - A little bit of, I mean it's the layering that you used 316 00:13:03,085 --> 00:13:05,205 to do in the past with maybe like a golden image. 317 00:13:05,345 --> 00:13:07,005 Yep. Your desktop deployment 318 00:13:07,465 --> 00:13:10,445 and the difference being, hey, I might go out 319 00:13:10,445 --> 00:13:13,485 and say I'm taking like a Windows client device, right? 320 00:13:13,485 --> 00:13:15,925 And I'm, I'm gonna go ahead, I'm gonna install my 321 00:13:15,925 --> 00:13:17,525 applications on it and then like you said, 322 00:13:17,525 --> 00:13:20,525 I'm gonna take it back through sealing that image, you know, 323 00:13:20,525 --> 00:13:22,485 and, and run it back to the out of box experience. 324 00:13:22,515 --> 00:13:23,725 Like whatever you need to do 325 00:13:23,785 --> 00:13:25,485 to assists prep it and get it going. 326 00:13:25,865 --> 00:13:28,405 The layering approach, like it can be a little bit slower 327 00:13:28,725 --> 00:13:29,765 'cause it's not all baked in. 328 00:13:29,905 --> 00:13:33,005 Yes. But the nice thing is like you get the dynamicism 329 00:13:33,305 --> 00:13:35,365 of a policy driven approach 330 00:13:36,065 --> 00:13:38,485 to application deployment, which is kind of cool. 331 00:13:38,585 --> 00:13:40,365 So at the end of the day, like like you said, 332 00:13:40,365 --> 00:13:42,845 you can take an organizational set of policies 333 00:13:42,905 --> 00:13:46,445 for things like devices could be like IOT devices 334 00:13:46,975 --> 00:13:48,125 multi os, right? 335 00:13:48,125 --> 00:13:51,765 Like like all and package that up and make it policy driven. 336 00:13:51,945 --> 00:13:54,765 So users in this security group maybe get this set 337 00:13:54,765 --> 00:13:57,965 of applications, users in this security group get this other 338 00:13:57,985 --> 00:13:59,405 set, everybody gets this thing. 339 00:13:59,655 --> 00:14:00,805 Which is really kind of cool 340 00:14:00,805 --> 00:14:04,165 because you get away from managing images 341 00:14:04,545 --> 00:14:06,405 and you're effectively managing access 342 00:14:06,405 --> 00:14:08,845 to applications maybe kinda like on the identity side 343 00:14:08,845 --> 00:14:10,965 where like you can be really locked down 344 00:14:11,425 --> 00:14:13,045 or you can leverage things like, 345 00:14:13,045 --> 00:14:14,765 like you can do MDM on your device 346 00:14:15,065 --> 00:14:16,805 or you can do mam like what's the most 347 00:14:16,805 --> 00:14:17,885 important thing to manage? 348 00:14:17,945 --> 00:14:20,125 Is the most important thing to manage the device itself 349 00:14:20,265 --> 00:14:23,685 or is the important thing to manage the, you know, 350 00:14:23,685 --> 00:14:25,965 the application and access to the application. 351 00:14:26,515 --> 00:14:29,845 Usually it's the latter. 352 00:14:29,915 --> 00:14:31,365 Like you wanna manage the application 353 00:14:31,365 --> 00:14:33,405 and access to the applic and access to it, right? 354 00:14:33,595 --> 00:14:35,325 Like, and make that flow more seamless. 355 00:14:35,915 --> 00:14:39,285 I'll tell you like if you're stuck in the kind of mentality 356 00:14:39,585 --> 00:14:42,285 of hey we still need to do the golden image thing 357 00:14:42,285 --> 00:14:44,565 and that's how we deploy and you know, 358 00:14:44,585 --> 00:14:48,205 we come down from our centralized repository of images 359 00:14:48,585 --> 00:14:50,085 and we bootstrap internally 360 00:14:50,985 --> 00:14:53,565 and that's, you know, how we do everything. 361 00:14:53,635 --> 00:14:56,285 Like you're maybe missing out a little bit on, on like 362 00:14:56,355 --> 00:14:59,365 that world and that dynamicism and, and just to cover it. 363 00:14:59,365 --> 00:15:01,845 So there's a question in the chat about app protection 364 00:15:02,165 --> 00:15:06,325 policies and are those App v, app V is app virtualization, 365 00:15:06,455 --> 00:15:09,685 which is different 'cause you're actually going 366 00:15:09,945 --> 00:15:12,605 and in this case like you're pushing an application like 367 00:15:12,605 --> 00:15:14,965 let's take, well let's do a whole bunch of applications. 368 00:15:14,965 --> 00:15:17,005 Let's let's imagine like office. Alright 369 00:15:17,025 --> 00:15:18,245 - So are we gonna go into this? 370 00:15:18,315 --> 00:15:20,045 Yeah. Are we done with the app deployment? 371 00:15:20,145 --> 00:15:22,205 All right, so app protection policies are the next 372 00:15:22,205 --> 00:15:23,485 thing that we're gonna dive into. 373 00:15:23,765 --> 00:15:25,765 I just, I I wanted to make sure. Okay. It's your show. 374 00:15:25,785 --> 00:15:27,885 No it's not, it's your show. Okay, keep going. 375 00:15:28,155 --> 00:15:29,565 Nope, we're done with app installment. 376 00:15:29,595 --> 00:15:31,125 Okay, so app protection policies 377 00:15:31,605 --> 00:15:33,845 'cause yes, this was a question in the chat now they're 378 00:15:34,005 --> 00:15:35,165 apologizing for derailing us. 379 00:15:35,615 --> 00:15:38,485 Don't apologize. It is way too easy to derail us 380 00:15:38,665 --> 00:15:40,725 to apologize about derailing us . 381 00:15:40,875 --> 00:15:42,605 Okay, so app protection policies Scott, 382 00:15:42,905 --> 00:15:44,725 so once you've deployed these applications, 383 00:15:45,095 --> 00:15:46,965 let's say you've deployed these applications 384 00:15:47,025 --> 00:15:49,485 and they're on devices or users have installed applications, 385 00:15:49,485 --> 00:15:50,725 what are app protection policies? 386 00:15:50,725 --> 00:15:54,805 - You're the Intune expert. I told you this was your show. 387 00:15:55,075 --> 00:15:56,445 - Nope. You started down this path 388 00:15:56,465 --> 00:15:57,525 so you get to continue it. 389 00:15:57,525 --> 00:15:58,445 Oh my gosh because you know what, 390 00:15:58,445 --> 00:15:59,525 they're just as much as me. 391 00:15:59,765 --> 00:16:01,165 'cause I think you actually introduced them 392 00:16:01,165 --> 00:16:04,445 to me like six years ago or seven years ago. I have 393 00:16:04,445 --> 00:16:06,125 - A lot of gray hair, I can't remember back that far. 394 00:16:06,905 --> 00:16:10,925 So I, I mean protection policies are, you know, 395 00:16:10,965 --> 00:16:13,405 I think at a high level they, they're just that they're, 396 00:16:13,555 --> 00:16:17,725 they are policies that are applied to applications. 397 00:16:18,325 --> 00:16:22,085 I think about them primarily as data protection policies, 398 00:16:22,235 --> 00:16:24,245 like remove the word app protection 399 00:16:24,245 --> 00:16:26,045 and really think about like data protection 400 00:16:26,045 --> 00:16:28,685 but within context of the operational controls 401 00:16:29,195 --> 00:16:31,805 that are available within an application. 402 00:16:32,225 --> 00:16:34,605 So let's say back to the office example, 403 00:16:34,695 --> 00:16:38,525 let's say you either deploy office to your end users 404 00:16:39,185 --> 00:16:42,285 or your end users do the BYOD thing 405 00:16:42,465 --> 00:16:44,525 and they bring office along the way. 406 00:16:45,035 --> 00:16:48,365 What you want to do is you wanna say like regardless of 407 00:16:48,365 --> 00:16:51,045 how this came in, whether it came from one of my images, 408 00:16:51,225 --> 00:16:52,485 it came from one of my deployments 409 00:16:52,745 --> 00:16:56,925 or it came from a user who just happened to go to office.com 410 00:16:56,925 --> 00:16:58,405 and download office like as one 411 00:16:58,405 --> 00:16:59,485 of their installs through there. 412 00:17:00,065 --> 00:17:03,605 The most important thing is probably protecting the data. 413 00:17:04,265 --> 00:17:07,005 And so the cool thing here is you kind of, again you, 414 00:17:07,025 --> 00:17:12,005 you go from MDM device management to mam you're, you're back 415 00:17:12,005 --> 00:17:14,765 to application management to a certain degree. 416 00:17:14,785 --> 00:17:16,245 So sometimes you wanna layer both of these. 417 00:17:16,245 --> 00:17:18,365 Sometimes you wanna do one and not the other. 418 00:17:18,945 --> 00:17:21,125 But the nice thing is effectively you're, 419 00:17:21,125 --> 00:17:25,485 you're pushing policy downstream to based on the user 420 00:17:25,795 --> 00:17:30,005 that is accessing the application, enforce this set 421 00:17:30,005 --> 00:17:31,365 of policies on top of it. 422 00:17:31,665 --> 00:17:33,765 So that can be a little bit limiting in some situations 423 00:17:33,765 --> 00:17:36,605 because maybe the application itself 424 00:17:37,355 --> 00:17:40,005 doesn't support a particular policy that you need 425 00:17:40,005 --> 00:17:41,725 for data protection or things like that. 426 00:17:41,985 --> 00:17:43,685 And that's when you go down the MDM route, right? 427 00:17:43,685 --> 00:17:45,645 Like you actually enroll the whole device and 428 00:17:45,645 --> 00:17:47,485 and maybe do some other things on top of it. 429 00:17:48,025 --> 00:17:50,745 But I think it's always best to kind of start from a, 430 00:17:51,095 --> 00:17:55,785 from kind of a mish perspective versus the MDM thing. 431 00:17:55,805 --> 00:17:59,865 So like I'll give you a sense like where I am at Microsoft, 432 00:17:59,865 --> 00:18:03,385 like we do a multi-layered approach where you can get 433 00:18:03,385 --> 00:18:05,385 to some things without being M DMed 434 00:18:05,805 --> 00:18:08,225 and there's a set of applications 435 00:18:08,525 --> 00:18:10,945 and things that I can do where I'm in one world 436 00:18:11,485 --> 00:18:13,465 and then if I want to go to like the next click stop, 437 00:18:13,465 --> 00:18:15,665 like let me say I want 438 00:18:15,685 --> 00:18:18,465 to open a Word doc on an internal SharePoint site 439 00:18:18,845 --> 00:18:22,105 that's gonna require me to have a lockdown version of Word, 440 00:18:22,105 --> 00:18:24,065 which means my device needs to be MD MD 441 00:18:24,525 --> 00:18:26,865 but if I don't want MDM my device, my employer 442 00:18:27,375 --> 00:18:29,065 also offers me virtual desktops. 443 00:18:29,285 --> 00:18:33,425 So I can go to a virtual desktop which is protected 444 00:18:33,445 --> 00:18:36,505 by a policy that lets me in through identity 445 00:18:36,505 --> 00:18:38,305 and like conditional access and things like that. 446 00:18:38,565 --> 00:18:39,985 And then I can just get to office from there. 447 00:18:40,085 --> 00:18:42,705 And then I don't need to MDM my device in any way. 448 00:18:43,255 --> 00:18:45,505 They are this nice flexible way 449 00:18:46,045 --> 00:18:50,145 to have additional operational controls on top 450 00:18:50,145 --> 00:18:53,025 of applications that are deployed in your environment 451 00:18:53,645 --> 00:18:55,945 and make data protection policy driven. 452 00:18:56,075 --> 00:18:57,865 Which is kind of cool when you think about it. 453 00:18:58,045 --> 00:19:00,225 And it's not just office stuff that you can protect either, 454 00:19:00,275 --> 00:19:02,025 which makes it even better. 455 00:19:05,845 --> 00:19:07,465 - Do you feel overwhelmed by trying 456 00:19:07,465 --> 00:19:09,745 to manage your Office 365 environment? 457 00:19:09,885 --> 00:19:11,625 Are you facing unexpected issues 458 00:19:11,655 --> 00:19:13,505 that disrupt your company's productivity? 459 00:19:13,535 --> 00:19:16,305 Intelligent is here to help much like you take your car 460 00:19:16,305 --> 00:19:18,705 to the mechanic that has specialized knowledge on how 461 00:19:18,705 --> 00:19:21,745 to best keep your car running Intelligent helps you 462 00:19:21,825 --> 00:19:23,505 with your Microsoft cloud environment 463 00:19:23,505 --> 00:19:25,105 because that's their expertise. 464 00:19:25,255 --> 00:19:26,545 Intelligent keeps up 465 00:19:26,545 --> 00:19:28,625 with the latest updates in the Microsoft cloud 466 00:19:28,625 --> 00:19:30,065 to help keep your business running 467 00:19:30,425 --> 00:19:31,585 smoothly and ahead of the curve. 468 00:19:31,655 --> 00:19:33,545 Whether you are a small organization 469 00:19:33,545 --> 00:19:35,825 with just a few users up to an organization 470 00:19:35,825 --> 00:19:39,065 of several thousand employees they want to partner with you 471 00:19:39,125 --> 00:19:42,745 to implement and administer your Microsoft Cloud technology, 472 00:19:43,315 --> 00:19:46,705 visit them at intelligent.com/podcast. 473 00:19:47,205 --> 00:19:51,625 That's I-N-T-E-L-L-I-G-I-N 474 00:19:51,705 --> 00:19:55,265 k.com/podcast for more information 475 00:19:55,285 --> 00:19:56,745 or to schedule a 30 minute call 476 00:19:56,745 --> 00:19:57,985 to get started with them today. 477 00:19:59,185 --> 00:20:01,785 Remember intelligent focuses on the Microsoft cloud 478 00:20:01,925 --> 00:20:03,745 so you can focus on your business. 479 00:20:05,965 --> 00:20:07,145 That's why these are my favorite. 480 00:20:07,245 --> 00:20:09,465 We were talking a little bit too even in the chat about 481 00:20:10,235 --> 00:20:13,185 especially like you said the BYOD scenario where 482 00:20:13,725 --> 00:20:15,945 the way I always think of it is that like puts in, 483 00:20:16,425 --> 00:20:18,385 I can't remember if this is exactly what you said, 484 00:20:18,385 --> 00:20:19,585 but it puts that container 485 00:20:19,585 --> 00:20:22,425 around your corporate data in an application 486 00:20:22,755 --> 00:20:25,105 where like Outlook and you gave the example of Word 487 00:20:25,285 --> 00:20:29,225 and some of those where that typical MDM scenario, 488 00:20:30,045 --> 00:20:31,745 you are giving that employer 489 00:20:31,885 --> 00:20:33,425 or whoever M DMed your device, 490 00:20:33,535 --> 00:20:34,825 full control of your device, right? 491 00:20:34,825 --> 00:20:36,225 They can do stuff with your camera, 492 00:20:36,225 --> 00:20:37,865 they can do remote wipes, they can do all of 493 00:20:37,865 --> 00:20:40,505 that App protection policies only gives them access 494 00:20:40,685 --> 00:20:44,105 to affect the corporate data in the application. 495 00:20:44,205 --> 00:20:47,750 So your example of I think Outlook where let's say I went 496 00:20:47,750 --> 00:20:49,685 and added my Gmail account into Outlook 497 00:20:49,685 --> 00:20:53,205 or I added my MSA, my personal email into Outlook 498 00:20:53,585 --> 00:20:57,365 and I also added my company email into Outlook. 499 00:20:57,865 --> 00:21:00,725 It only lets my company access or wipe 500 00:21:00,865 --> 00:21:03,165 or control that data within an Outlook 501 00:21:03,165 --> 00:21:06,885 that's in my company account, not my personal account. 502 00:21:07,425 --> 00:21:10,605 So they can do things like I pulled it up here, some 503 00:21:10,605 --> 00:21:12,245 of the examples of requiring a pin 504 00:21:12,345 --> 00:21:14,805 or a fingerprint to access corporate email. 505 00:21:14,905 --> 00:21:16,005 So I can open up Outlook, 506 00:21:16,125 --> 00:21:18,165 I can go browse my personal email all day long. 507 00:21:18,505 --> 00:21:20,925 As soon as I jump over to my corporate email, it's going 508 00:21:20,925 --> 00:21:25,525 to force me to enter a pin or do some type of fingerprint 509 00:21:25,665 --> 00:21:26,805 or face id. 510 00:21:27,145 --> 00:21:29,165 If I wanna protect data from being copied, 511 00:21:29,525 --> 00:21:33,125 I can say again personal email, I can copy and paste data in 512 00:21:33,125 --> 00:21:34,365 and out of it all day I want to 513 00:21:34,665 --> 00:21:36,925 but my corporate email, you can't copy an email 514 00:21:37,025 --> 00:21:39,565 and paste it into a text message or copy an email 515 00:21:39,565 --> 00:21:42,245 and post it into the notes application on your phone. 516 00:21:42,675 --> 00:21:44,565 That corporate data stays within 517 00:21:44,565 --> 00:21:46,605 that corporate bubble within 518 00:21:46,635 --> 00:21:48,125 that application on your device. 519 00:21:48,865 --> 00:21:52,565 And you can put a whole bunch of different policies 520 00:21:52,945 --> 00:21:54,565 and restrictions around it. 521 00:21:54,785 --> 00:21:57,525 But also if a user leaves you can say 522 00:21:58,035 --> 00:21:59,045 it's their personal device. 523 00:21:59,165 --> 00:22:01,805 I feel really bad if I deleted all your family pictures 524 00:22:01,805 --> 00:22:03,925 Scott, because IM DMed your device. 525 00:22:03,925 --> 00:22:05,925 Mm-hmm and you ran away with it 526 00:22:05,925 --> 00:22:09,205 and I had to do a remote wipe with ma'am. 527 00:22:09,285 --> 00:22:11,445 I can say okay Scott, you ran away at your device. 528 00:22:11,465 --> 00:22:12,685 You can keep all your pictures 529 00:22:12,945 --> 00:22:14,885 but I'm gonna completely remove all 530 00:22:14,885 --> 00:22:16,965 that corporate data from those applications on your device. 531 00:22:17,115 --> 00:22:19,285 Yeah it gives a great middle ground, 532 00:22:19,715 --> 00:22:20,805 - It's a little bit different. 533 00:22:21,305 --> 00:22:23,445 It does take you kind of being open 534 00:22:23,745 --> 00:22:26,125 to a new way to do things. 535 00:22:26,125 --> 00:22:28,245 Particularly if you're coming from that world 536 00:22:28,345 --> 00:22:31,205 of everything's super locked down by default. 537 00:22:31,205 --> 00:22:32,925 Like you do kind of have to take a step back 538 00:22:32,925 --> 00:22:35,245 and maybe think about like hey what's the goal 539 00:22:35,425 --> 00:22:37,605 or the end state that I wanna be in? 540 00:22:37,905 --> 00:22:39,725 So I am a huge fan 541 00:22:39,725 --> 00:22:42,405 of ma m like I think like you should really come from the 542 00:22:42,605 --> 00:22:45,525 approach of ma m first and not MDM first. 543 00:22:45,955 --> 00:22:48,565 Like convince me that we do need 544 00:22:48,565 --> 00:22:51,685 to do MDM rather than let's do MDM by default 545 00:22:52,035 --> 00:22:54,965 because like every time you do this 546 00:22:54,965 --> 00:22:57,965 and you go down this path, like usually is the data 547 00:22:57,965 --> 00:22:59,605 that's the most important thing to protect. 548 00:22:59,865 --> 00:23:01,325 The more locked down you make things, 549 00:23:01,465 --> 00:23:03,205 the harder it is for your users. 550 00:23:03,785 --> 00:23:04,965 And there there's a series 551 00:23:04,985 --> 00:23:06,565 of trade-offs that come with that, right? 552 00:23:06,565 --> 00:23:09,645 Like you're introducing not only friction maybe in accessing 553 00:23:09,645 --> 00:23:12,725 and working with the data, you're also introducing a bunch 554 00:23:12,725 --> 00:23:14,805 of ancillary processes on the side. 555 00:23:14,875 --> 00:23:18,485 Like if you make it harder to log in 556 00:23:18,705 --> 00:23:21,285 to access your data and SharePoint and pull that up 557 00:23:21,285 --> 00:23:24,885 and word on your desktop, that's probably additional load 558 00:23:25,275 --> 00:23:28,125 that you're putting on things like your help desk 559 00:23:28,225 --> 00:23:29,845 and your support organizations. 560 00:23:30,085 --> 00:23:31,965 'cause there's gonna be more questions from your 561 00:23:31,975 --> 00:23:33,125 users in those areas. 562 00:23:33,665 --> 00:23:36,725 So great you protected the data and the device 563 00:23:36,865 --> 00:23:38,765 but if you didn't need to go to that path, 564 00:23:38,985 --> 00:23:40,445 all you're doing is costing yourself 565 00:23:40,445 --> 00:23:41,605 more money in other places. 566 00:23:42,155 --> 00:23:44,605 It's an interesting kind of TCO exercise 567 00:23:44,745 --> 00:23:46,125 to come back and think through. 568 00:23:46,155 --> 00:23:47,205 Yeah to a certain degree. 569 00:23:47,205 --> 00:23:49,445 Like it, it does, it depends on the devices like you 570 00:23:49,445 --> 00:23:51,885 mentioned like the containerization and things like that. 571 00:23:51,985 --> 00:23:53,885 Or I guess the segmentation 572 00:23:53,885 --> 00:23:55,205 of data is the way I would put it. 573 00:23:55,205 --> 00:23:58,165 Like there's a big difference between like a work profile 574 00:23:58,185 --> 00:23:59,485 and an Android device and the way 575 00:23:59,485 --> 00:24:03,165 that segments versus the way like an app protection policy 576 00:24:03,505 --> 00:24:08,165 for for say like Outlook on iOS works versus office 577 00:24:08,385 --> 00:24:10,565 or Outlook on a Windows device, right? 578 00:24:10,595 --> 00:24:13,085 They're all very different in the operational controls 579 00:24:13,085 --> 00:24:16,525 that are available to them and how they behave. 580 00:24:16,665 --> 00:24:18,525 And that's okay. Like I think you can get through that 581 00:24:18,725 --> 00:24:21,445 'cause you're, you're probably gonna have multiple OSS 582 00:24:21,465 --> 00:24:22,885 and multiple flavors 583 00:24:22,885 --> 00:24:25,965 of the same application across OSS and things like that. 584 00:24:26,585 --> 00:24:28,725 But it definitely is kind of like a consideration 585 00:24:28,725 --> 00:24:30,965 for you like how that segmentation containerization 586 00:24:30,965 --> 00:24:34,805 of data occurs and how that manifests 587 00:24:34,825 --> 00:24:36,165 for users at the end of the day. 588 00:24:36,225 --> 00:24:38,005 But I think like, like I said, 589 00:24:38,005 --> 00:24:41,485 if you can do the the the managed thing first you're making 590 00:24:42,115 --> 00:24:43,445 your users' lives easier. 591 00:24:43,575 --> 00:24:46,405 Which selfishly if you're like an admin who has 592 00:24:46,405 --> 00:24:48,365 to support this stuff or you're on the help desk side 593 00:24:48,365 --> 00:24:49,965 or anything like that, it also makes 594 00:24:49,965 --> 00:24:51,085 your life easier, right? 595 00:24:51,105 --> 00:24:52,285 And the easier your life is 596 00:24:52,285 --> 00:24:55,365 that typically means reduce cost better cogs like 597 00:24:55,635 --> 00:24:56,925 that, that's not a bad thing. Yep. 598 00:24:57,065 --> 00:24:58,885 - And I would say even from the admin perspective, 599 00:24:58,905 --> 00:25:01,605 it makes your life easier in terms of 600 00:25:02,435 --> 00:25:05,045 that initial enrollment onboarding of devices. 601 00:25:05,275 --> 00:25:07,045 Like you go the full MDM route 602 00:25:07,045 --> 00:25:10,805 and you start dealing with the Google management, 603 00:25:12,325 --> 00:25:13,405 whatever the work management, 604 00:25:13,845 --> 00:25:16,725 whatever their work management thing is, now you deal 605 00:25:16,725 --> 00:25:19,685 with the Apple management side of things, you have 606 00:25:19,685 --> 00:25:22,445 to start dealing with certificates from these different 607 00:25:22,445 --> 00:25:26,125 vendors and there's a lot more setup 608 00:25:26,505 --> 00:25:29,245 and certificates that can expire on you. 609 00:25:29,425 --> 00:25:32,325 Not that anybody ever has certificates expire on 'em 610 00:25:33,065 --> 00:25:34,085 - Now it was just DNS. 611 00:25:34,395 --> 00:25:35,405 It's never a certificates 612 00:25:35,595 --> 00:25:38,205 - That can affect the MDM process 613 00:25:38,825 --> 00:25:42,365 versus the application management for me feels it's, 614 00:25:42,365 --> 00:25:46,085 there's a lot less from the administrative side in terms of 615 00:25:46,085 --> 00:25:47,565 what you're managing, how you set 616 00:25:47,565 --> 00:25:48,605 it up, how you configure it. 617 00:25:48,665 --> 00:25:50,965 So I'm with you, I'll go into a lot of companies, 618 00:25:50,965 --> 00:25:52,525 they'll be like yeah we wanna manage the devices. 619 00:25:52,545 --> 00:25:53,965 And I'm like, so have you heard 620 00:25:54,655 --> 00:25:57,205 about app protection policies and how these work? 621 00:25:57,265 --> 00:26:00,325 And they're like whoa, that's awesome. We don't need an MDM. 622 00:26:00,385 --> 00:26:02,965 We can just do app protection policies 623 00:26:02,985 --> 00:26:04,845 and protect all the data and all the apps 624 00:26:05,025 --> 00:26:07,765 and segment it out and go that route. 625 00:26:07,985 --> 00:26:10,445 So I think it is, everybody's heard 626 00:26:10,445 --> 00:26:13,645 of mobile device management, everybody's been doing it for 627 00:26:13,645 --> 00:26:15,805 so long, whether it's been through Intune 628 00:26:16,265 --> 00:26:18,405 or whether it's been through some 629 00:26:18,405 --> 00:26:20,485 of the other third parties, the airplay 630 00:26:20,705 --> 00:26:23,285 or whatever some of the other ones are, 631 00:26:23,285 --> 00:26:27,125 they all have their own that not a lot of people have heard 632 00:26:27,125 --> 00:26:29,405 of or fully understand what these app protection policies 633 00:26:29,405 --> 00:26:30,725 are And yeah I am. 634 00:26:31,145 --> 00:26:32,245 I'm a huge fan of them. 635 00:26:32,395 --> 00:26:34,325 - When you mentioned that maybe not a lot 636 00:26:34,325 --> 00:26:35,525 of folks have heard what these are, 637 00:26:36,165 --> 00:26:37,645 I bet they have heard about them, 638 00:26:38,315 --> 00:26:41,405 they just don't maybe know that 639 00:26:41,555 --> 00:26:43,645 - Realize - We're talking about the same thing. 640 00:26:44,025 --> 00:26:46,925 So you mentioned management experience, maybe we should kind 641 00:26:46,925 --> 00:26:49,485 of touch on that a little bit because you know you do have 642 00:26:49,685 --> 00:26:52,525 multiple oss, you do have multiple flavors 643 00:26:52,525 --> 00:26:54,285 of applications, things like that. 644 00:26:54,985 --> 00:26:56,205 One of the things that's kind 645 00:26:56,205 --> 00:26:59,005 of maybe disappointed me I been a friction point 646 00:26:59,105 --> 00:27:03,645 for me in this space is that sometimes the admin experience 647 00:27:03,665 --> 00:27:07,485 for this is bifurcated and it's kind of split up, right? 648 00:27:07,485 --> 00:27:10,725 Like so for something like managing office, 649 00:27:10,945 --> 00:27:13,245 you might be doing cloud policies in one part 650 00:27:13,245 --> 00:27:15,645 of the admin center for something for managing OneDrive. 651 00:27:15,905 --> 00:27:17,005 You might be over in like the 652 00:27:17,005 --> 00:27:18,405 OneDrive admin center like what? 653 00:27:18,405 --> 00:27:20,405 Like admin.onedrive.com 654 00:27:21,025 --> 00:27:22,885 for managing this other thing over here. 655 00:27:23,185 --> 00:27:27,325 You might be inside of another part of the Intune suite. 656 00:27:27,825 --> 00:27:29,725 So the, it starts to get a little bit weird 657 00:27:29,965 --> 00:27:33,965 'cause we start to kind of fall into the oh isn't a 658 00:27:33,965 --> 00:27:35,205 product, it's a suite . 659 00:27:35,345 --> 00:27:37,965 Yes. And now because it's, it's not 660 00:27:38,805 --> 00:27:42,125 cohesive across these admin experiences for a application 661 00:27:42,125 --> 00:27:44,925 of policy in different flavors, 662 00:27:45,265 --> 00:27:48,085 it can be a little bit difficult to get to that way. 663 00:27:48,605 --> 00:27:50,925 I will say like if you can get there, 664 00:27:51,485 --> 00:27:53,765 I really do believe like at the end of the day, 665 00:27:53,835 --> 00:27:56,925 like the ROI is there like you know somewhat flippantly like 666 00:27:56,925 --> 00:27:58,245 the juice is worth the squeeze. 667 00:27:58,825 --> 00:28:00,845 You can make it happen because a lot 668 00:28:00,845 --> 00:28:03,605 of this too is like you kind of set it up once 669 00:28:03,745 --> 00:28:05,045 and then you just, you're done, right? 670 00:28:05,045 --> 00:28:06,365 Like you, you really don't come back 671 00:28:06,365 --> 00:28:07,925 and reconfigure office too often. 672 00:28:08,625 --> 00:28:12,565 So once you get all those policies set up, cool, you know, 673 00:28:12,565 --> 00:28:14,165 we're ready to go think about it like 674 00:28:14,165 --> 00:28:15,885 how many times do you come back, coming back 675 00:28:15,905 --> 00:28:17,605 and reconfiguring OneDrive, 676 00:28:18,185 --> 00:28:19,445 how many times are you gonna come back 677 00:28:19,445 --> 00:28:22,165 and reconfigure the way Outlook behaves on mobile devices? 678 00:28:22,755 --> 00:28:24,405 Like you gotta go through the pain once 679 00:28:24,905 --> 00:28:26,885 and hopefully, you know, 680 00:28:26,885 --> 00:28:29,005 like I said there there is ROI down the road there. 681 00:28:29,185 --> 00:28:30,885 - As long as nothing changes stuff 682 00:28:30,885 --> 00:28:31,885 - Is gonna change. 683 00:28:31,945 --> 00:28:33,925 But I think that makes it easier too, right? 684 00:28:33,925 --> 00:28:37,325 In the world of the, the old days of you know, 685 00:28:37,425 --> 00:28:41,445 hey let's layer all our applications into a quote unquote 686 00:28:41,545 --> 00:28:42,685 golden image, right? 687 00:28:42,745 --> 00:28:44,405 And, and deploy that out to our devices. 688 00:28:45,035 --> 00:28:47,565 Like you know when you wanted to update an application on 689 00:28:47,565 --> 00:28:50,725 that you either had some form of slipstreaming that you had 690 00:28:50,725 --> 00:28:53,005 to do or you were going back 691 00:28:53,305 --> 00:28:57,245 and you were effectively deploying that thing again, right? 692 00:28:57,885 --> 00:28:59,765 Updating the application, installing the next version, 693 00:29:00,165 --> 00:29:03,405 resealing it like that never worked like not as well 694 00:29:03,405 --> 00:29:05,125 as it was supposed to in my experience. 695 00:29:05,245 --> 00:29:06,605 I used to hate doing that stuff, right? 696 00:29:06,625 --> 00:29:08,965 It was effectively like rebuild from scratch every time. 697 00:29:09,785 --> 00:29:12,845 So yeah, you gotta go to different places maybe like it's, 698 00:29:12,875 --> 00:29:14,565 it's different in how you interact with it. 699 00:29:14,885 --> 00:29:16,645 I would argue even for like the segmentation 700 00:29:16,645 --> 00:29:17,685 and the admin experience, 701 00:29:17,685 --> 00:29:19,405 it's still easier at the end of the day. 702 00:29:19,965 --> 00:29:21,845 'cause now rather than going in back 703 00:29:21,845 --> 00:29:24,525 and redoing a whole image and redeploying and 704 00:29:24,525 --> 00:29:27,085 and figuring out how to get that stuff out to users 705 00:29:27,905 --> 00:29:30,445 on the desktop side and, and what does that look like 706 00:29:30,465 --> 00:29:32,445 and how do you do either app streaming 707 00:29:32,465 --> 00:29:35,045 or app installation updates with like you just go 708 00:29:35,065 --> 00:29:37,445 and figure out the policy and then and and then you're done. 709 00:29:37,835 --> 00:29:39,365 It's far simpler. I 710 00:29:39,365 --> 00:29:40,365 - Would agree with that too. 711 00:29:40,365 --> 00:29:42,965 Like from a, I don't even know 712 00:29:42,965 --> 00:29:44,805 that I wanna call it a segmentation, 713 00:29:44,905 --> 00:29:47,285 but from like you said the whole layering approach 714 00:29:47,345 --> 00:29:50,285 and the whole almost like an a la carte type approach, 715 00:29:50,825 --> 00:29:54,365 you can make changes to small portions of it. 716 00:29:54,585 --> 00:29:57,885 Change a single app, deploy an update to a single app, 717 00:29:57,885 --> 00:30:01,845 make a slight tweak to a configuration without going through 718 00:30:01,905 --> 00:30:03,485 and redeploying everything. 719 00:30:03,885 --> 00:30:05,685 I would even say a lot of these 720 00:30:05,945 --> 00:30:09,565 and I don't know where, so configuration policies kind 721 00:30:09,565 --> 00:30:11,725 of falls into devices, kind of falls into apps, kind 722 00:30:11,725 --> 00:30:12,805 of falls into endpoint security. 723 00:30:12,805 --> 00:30:14,565 Those kind of span all of them, even from 724 00:30:14,565 --> 00:30:17,965 that aspect like the configuration policies 725 00:30:18,005 --> 00:30:21,685 that Microsoft has in place now are getting pretty close 726 00:30:21,785 --> 00:30:24,165 to being on par with what you could do with GPOs. 727 00:30:24,865 --> 00:30:27,685 Let me tell you from a GPO perspective, I go into some 728 00:30:27,685 --> 00:30:29,965 of these organizations and look at their GPOs 729 00:30:29,985 --> 00:30:33,365 of like we have these all these GPOs way up at the top level 730 00:30:33,365 --> 00:30:35,925 and then we have GPOs down layer all the way down layers 731 00:30:35,945 --> 00:30:37,325 and layers of GPOs 732 00:30:37,425 --> 00:30:40,125 and it's like by the time you get down here you have like 733 00:30:40,125 --> 00:30:41,725 500 GPOs applying 734 00:30:41,785 --> 00:30:44,085 but you don't know which o use they're inheriting from. 735 00:30:44,085 --> 00:30:47,285 And all of this, I think the app confi 736 00:30:47,305 --> 00:30:49,885 or not the app, it is app configuration policies, 737 00:30:49,885 --> 00:30:52,765 device configuration policies, all of those configuration. 738 00:30:53,165 --> 00:30:55,245 I will say you can absolutely still end up 739 00:30:55,245 --> 00:30:57,365 with 500 policies layered. 740 00:30:57,645 --> 00:30:59,485 I have seen organizations that have 30 741 00:30:59,545 --> 00:31:01,725 or 40 layered not 500 yet. 742 00:31:01,845 --> 00:31:03,125 I actually don't know there may be a limit 743 00:31:03,425 --> 00:31:06,405 but it feels a lot easier to me because it's all flat. 744 00:31:06,555 --> 00:31:09,885 It's like here's all of our policies all in a nice list 745 00:31:10,425 --> 00:31:13,045 and now instead of all this weird inheritance, 746 00:31:13,415 --> 00:31:16,045 these just apply to a user or to a group 747 00:31:16,465 --> 00:31:18,845 or to all your devices where it's, I need 748 00:31:18,845 --> 00:31:20,645 to go test a new policy 749 00:31:21,225 --> 00:31:22,445 and I don't, 750 00:31:22,455 --> 00:31:24,245 maybe I just wanna push it out to three devices. 751 00:31:24,425 --> 00:31:26,005 Now I'm not figuring out, okay, 752 00:31:26,005 --> 00:31:28,645 where in my OU structure can I put these three devices 753 00:31:28,985 --> 00:31:31,045 so they'll only get these settings, not these, 754 00:31:31,395 --> 00:31:33,685 it's just let's go into a configuration policy 755 00:31:33,745 --> 00:31:35,045 and assign it to those three devices. 756 00:31:35,195 --> 00:31:36,965 Yeah, I think that segmentation, 757 00:31:36,965 --> 00:31:40,765 that layering in intune across policies, 758 00:31:40,765 --> 00:31:43,645 across application deployment, across some 759 00:31:43,645 --> 00:31:46,365 of the device security, it just, it's a different way 760 00:31:46,365 --> 00:31:48,285 of thinking about it but I think once you wrap your head 761 00:31:48,285 --> 00:31:52,245 around it, it's a lot simpler way to organize it. 762 00:31:52,585 --> 00:31:55,245 And I also have found, Scott, you mentioned 763 00:31:55,795 --> 00:31:57,165 like going different places 764 00:31:57,425 --> 00:31:59,325 to set up different policies and all of that. 765 00:31:59,845 --> 00:32:02,405 I feel like Microsoft is trying to improve on that 766 00:32:02,475 --> 00:32:03,485 because more 767 00:32:03,505 --> 00:32:06,685 and more I have noticed the, 768 00:32:07,485 --> 00:32:09,645 I call it almost like the iframe approach 769 00:32:09,935 --> 00:32:13,165 where if you go into like app configuration policies 770 00:32:13,165 --> 00:32:14,245 and go set up a policy, 771 00:32:14,995 --> 00:32:17,685 it's really just giving you maybe a little different ui, 772 00:32:17,705 --> 00:32:20,925 but at the end of the day it's still setting up a 773 00:32:21,125 --> 00:32:22,125 configuration policy and 774 00:32:22,125 --> 00:32:25,205 that same policies shows up if you go look at like all your 775 00:32:25,485 --> 00:32:28,965 configuration policies where maybe there's five 776 00:32:28,965 --> 00:32:31,045 or six different places you can configure them, 777 00:32:31,425 --> 00:32:36,405 but it's just all looking back to the same central spot. 778 00:32:36,785 --> 00:32:39,005 And I noticed that earlier, I can't remember, 779 00:32:39,005 --> 00:32:41,525 remember if it was this way with security before where, 780 00:32:41,865 --> 00:32:43,765 and this may be a bridge into security, I'd go 781 00:32:43,765 --> 00:32:46,125 to endpoint security and set up a BitLocker 782 00:32:46,345 --> 00:32:47,725 or disc encryption policy 783 00:32:48,025 --> 00:32:50,405 and it's really giving me the same UI as if I go 784 00:32:50,405 --> 00:32:52,565 to the devices and set up a configuration policy 785 00:32:52,985 --> 00:32:54,365 and go select BitLocker, 786 00:32:54,625 --> 00:32:58,125 it ends up all being two different ways to get 787 00:32:58,185 --> 00:33:00,085 to the same thing or set up the same thing. 788 00:33:00,405 --> 00:33:02,645 - I think they're better at it today than they used to be. 789 00:33:02,915 --> 00:33:04,925 Like you go through the admin experiences, 790 00:33:05,665 --> 00:33:08,205 but there's still the potential for disconnect there 791 00:33:08,505 --> 00:33:10,645 as just there is, hey like I'll, I'll go 792 00:33:10,645 --> 00:33:11,845 to OneDrive as an example again, right? 793 00:33:11,935 --> 00:33:15,765 Admin dot OneDrive can be a slightly different experience 794 00:33:15,915 --> 00:33:19,165 than you see over in Intune itself. 795 00:33:19,315 --> 00:33:21,005 Like hey, when you're going to like the Intune 796 00:33:21,055 --> 00:33:22,325 admin center and things like that. 797 00:33:23,065 --> 00:33:24,965 So you, you have to be mindful of like 798 00:33:25,015 --> 00:33:26,485 where you're working in the stack 799 00:33:26,905 --> 00:33:29,245 and how that composes for you, right? 800 00:33:29,245 --> 00:33:31,165 Like but I, I think that's all stuff 801 00:33:31,165 --> 00:33:33,245 that can be figured out, right? 802 00:33:33,245 --> 00:33:34,645 Like it's not the end of the day , 803 00:33:35,075 --> 00:33:38,365 it's not hard at at the end of the day to think 804 00:33:38,365 --> 00:33:39,405 through some of this stuff. 805 00:33:40,205 --> 00:33:43,885 I also think it's worth like if you're an organization maybe 806 00:33:43,915 --> 00:33:47,885 that you know is imaging exclusive for deployment, 807 00:33:47,995 --> 00:33:52,085 your GPO exclusive things like that, taking a step back 808 00:33:52,185 --> 00:33:55,085 and doing a little bit of like the rationalization exercise. 809 00:33:55,115 --> 00:33:56,965 Like hey, what's our North star 810 00:33:56,985 --> 00:33:59,765 and where do we really want to be for some of these things? 811 00:34:00,115 --> 00:34:03,685 Because I think the easy answer is yeah, 812 00:34:03,695 --> 00:34:05,245 let's do the GPO thing, right? 813 00:34:05,245 --> 00:34:06,285 And we'll figure it out later. 814 00:34:06,305 --> 00:34:07,845 We don't know what we don't know today. 815 00:34:08,345 --> 00:34:11,325 And I think that gets you into a little bit 816 00:34:11,445 --> 00:34:14,325 of trouble too if you're not thinking about the, 817 00:34:14,705 --> 00:34:16,605 not only the applications that are deployed, 818 00:34:16,665 --> 00:34:18,765 but again the data that's deployed about 819 00:34:19,105 --> 00:34:20,165 that's deployed with them. 820 00:34:20,355 --> 00:34:21,765 Like how is the data accessed? 821 00:34:21,765 --> 00:34:23,285 How is the data used and what does that look like? 822 00:34:23,515 --> 00:34:25,525 It's kind of an eye-opening experience if you've never gone 823 00:34:25,525 --> 00:34:27,445 through and rationalized it within your organization. 824 00:34:27,885 --> 00:34:30,565 I always found it to be an interesting thing to go through 825 00:34:30,745 --> 00:34:34,045 and, and even use like that opportunity to talk about 826 00:34:34,425 --> 00:34:39,205 how we protect data as a way to leverage other parts 827 00:34:39,225 --> 00:34:40,285 of the stack, right? 828 00:34:40,285 --> 00:34:43,085 Like, like there's all these intertwined things between DLP 829 00:34:43,185 --> 00:34:46,045 and sensitivity labels, app protection policies 830 00:34:46,045 --> 00:34:47,605 and all the things that come together 831 00:34:48,065 --> 00:34:49,285 and when you put 'em all together, 832 00:34:49,395 --> 00:34:51,925 like you do really get kind of a cohesive 833 00:34:52,495 --> 00:34:54,445 experience from from the user side, 834 00:34:54,815 --> 00:34:57,325 which arguably like the most important thing, 835 00:34:57,325 --> 00:34:59,365 like the easier you make security for your users, 836 00:34:59,715 --> 00:35:02,085 like I said, like the less burden it is on everybody else in 837 00:35:02,085 --> 00:35:04,085 your organization and it means they'll actually use it 838 00:35:04,085 --> 00:35:05,725 and won't try and subvert the process. 839 00:35:06,425 --> 00:35:08,245 - Yes, absolutely. 840 00:35:08,665 --> 00:35:11,445 So should we try to tackle, should we keep this to two, 841 00:35:11,445 --> 00:35:13,205 should we jump into security for a little bit 842 00:35:13,205 --> 00:35:14,445 before we wrap it up today 843 00:35:14,675 --> 00:35:15,675 - Real quick I guess. 844 00:35:15,675 --> 00:35:18,525 Okay. I mentioned the multi OS thing. 845 00:35:19,105 --> 00:35:22,085 So you know you have protection policies today, 846 00:35:22,155 --> 00:35:25,725 like there's a whole set of overarching maybe like global 847 00:35:26,065 --> 00:35:29,485 or like more generalized settings that are available to you 848 00:35:30,105 --> 00:35:33,725 across things like Windows devices and, 849 00:35:33,725 --> 00:35:35,005 and kind of common apps there. 850 00:35:35,595 --> 00:35:40,245 Android and iOS is also available to you 851 00:35:40,745 --> 00:35:42,165 and it's one that I haven't played with, 852 00:35:42,205 --> 00:35:44,445 I don't know if you've had a chance to play with them, 853 00:35:44,585 --> 00:35:47,445 but conditional, conditional launch policies 854 00:35:48,185 --> 00:35:49,925 is another thing that you run into 855 00:35:50,625 --> 00:35:53,325 and can be another that you area 856 00:35:53,325 --> 00:35:55,285 that you kinda play around with. 857 00:35:55,545 --> 00:35:57,645 And then, and then you've got various like conditional 858 00:35:57,645 --> 00:36:00,085 launch policies across, you know, windows 859 00:36:00,385 --> 00:36:01,765 and iOS and things like that. 860 00:36:01,985 --> 00:36:06,045 So for example, like a conditional policy might be, I need, 861 00:36:06,305 --> 00:36:07,725 you can't launch this app 862 00:36:07,865 --> 00:36:09,445 unless you're on this version of Windows. 863 00:36:10,065 --> 00:36:12,765 So even though you don't manage the device, you can dictate 864 00:36:12,795 --> 00:36:14,525 that hey the app can't launch, 865 00:36:14,525 --> 00:36:16,725 like you can't launch Outlook basically until you get 866 00:36:16,725 --> 00:36:17,925 to this point release of Windows 867 00:36:18,785 --> 00:36:21,725 or you know, this particular patch so 868 00:36:21,725 --> 00:36:23,485 that you're protected from the things that we want, 869 00:36:23,485 --> 00:36:24,805 we want you to be protected from. 870 00:36:25,105 --> 00:36:26,965 So you can get to all that stuff like you 871 00:36:26,965 --> 00:36:28,125 mentioned without GPOs. 872 00:36:28,125 --> 00:36:30,325 And I think without the, the complexity of GPOs 873 00:36:30,325 --> 00:36:32,765 and the layering other things that, 874 00:36:32,885 --> 00:36:34,885 that come in there like are there trade-offs? 875 00:36:35,145 --> 00:36:36,845 Yes. Do you have to go out 876 00:36:36,845 --> 00:36:39,205 and like figure out like are the trade-offs worth it also? 877 00:36:39,225 --> 00:36:42,205 Yes. I would argue that it's worth spending the time to do 878 00:36:42,205 --> 00:36:44,925 that rather than just diving straight into GPOs 879 00:36:44,985 --> 00:36:47,245 or kind of like the legacy I'll, I'll, 880 00:36:47,245 --> 00:36:49,405 I'll call it the legacy way to do things. Yeah, 881 00:36:49,525 --> 00:36:52,045 - I have not played with conditional launch yet. 882 00:36:52,105 --> 00:36:53,365 The other one I wanna play 883 00:36:53,365 --> 00:36:57,165 with since we're talking about secured apps is this I think 884 00:36:57,185 --> 00:37:01,205 is technically an intra feature, 885 00:37:01,785 --> 00:37:05,805 but the secure tunneling between your corporate apps 886 00:37:05,985 --> 00:37:09,925 and Office 365 where you can now set up those policies 887 00:37:09,925 --> 00:37:12,525 that say yeah, if you're gonna open up Outlook, 888 00:37:13,025 --> 00:37:15,805 if you are opening up Outlook on a mobile device, you have 889 00:37:15,805 --> 00:37:17,165 to have it over like a, 890 00:37:17,165 --> 00:37:21,005 essentially it's encrypted VPN tunnel directly 891 00:37:21,115 --> 00:37:22,605 between that app. 892 00:37:22,755 --> 00:37:24,365 Well not directly, you're still going over the internet, 893 00:37:24,365 --> 00:37:26,725 but be that encrypted tunnel between that application 894 00:37:26,785 --> 00:37:28,045 and Office 365. 895 00:37:28,425 --> 00:37:29,925 But I think that's more of a conditional, 896 00:37:30,405 --> 00:37:31,925 I can't remember if it's conditional access 897 00:37:31,945 --> 00:37:35,005 or if it's those other, there were those new enterra. 898 00:37:35,155 --> 00:37:38,765 Yeah, Enterra. SSE is what Pirate is saying in the chat 899 00:37:38,795 --> 00:37:40,125 that came out at the same time 900 00:37:40,185 --> 00:37:43,085 as Enterra was renamed to Enterra. 901 00:37:43,865 --> 00:37:45,685 - As Enterra was renamed Enterra 902 00:37:45,865 --> 00:37:47,645 - As Azure ID was renamed to intra, 903 00:37:47,805 --> 00:37:49,805 I guess would be the proper way to phrase it. Yeah, 904 00:37:49,925 --> 00:37:51,165 - I was giving a talk the other day 905 00:37:51,165 --> 00:37:53,405 and I always like to say the artist formerly known 906 00:37:53,665 --> 00:37:55,725 as Azure ad when I talk about intra 907 00:37:56,065 --> 00:37:57,685 and I don't see people get my joke at all, 908 00:37:57,785 --> 00:37:58,925 but I'm gonna keep going with it. 909 00:37:59,145 --> 00:38:01,405 - You should keep going with that one. Absolutely. Let's 910 00:38:01,405 --> 00:38:03,085 - Talk, you wanna, you, you think we 911 00:38:03,085 --> 00:38:04,245 can do endpoint security? 912 00:38:04,565 --> 00:38:06,765 I think we, it's up to you. It's your show. What 913 00:38:06,765 --> 00:38:07,765 - Is it already, man? 914 00:38:07,915 --> 00:38:10,045 Time flies when we're having fun. Time 915 00:38:10,135 --> 00:38:11,245 - Flies when you're talking. 916 00:38:11,425 --> 00:38:14,165 App protection policies said no one ever . 917 00:38:14,425 --> 00:38:16,765 - Let me look. What do we have in endpoint security? 918 00:38:17,015 --> 00:38:18,285 - Let's see, we're gonna have all the 919 00:38:18,285 --> 00:38:20,765 encryption stuff you talked about. Lockers, 920 00:38:20,765 --> 00:38:21,885 - Encryption, firewall. 921 00:38:22,625 --> 00:38:24,485 - Yep. Yeah, all all stuff. 922 00:38:24,525 --> 00:38:26,205 - I, I don't, I don't know. 923 00:38:26,615 --> 00:38:28,285 Let's wait with security, let's wait. 924 00:38:28,725 --> 00:38:30,965 I feel like if we dive into security, we're gonna end up 925 00:38:31,075 --> 00:38:33,885 with like an hour and 15 minute show or something. 926 00:38:33,995 --> 00:38:37,205 - Part three I have manifested the reality that you wanted 927 00:38:37,355 --> 00:38:40,365 with the way I posted about this on social media. 928 00:38:40,545 --> 00:38:43,445 So all right, perfect. So this will wrap up part two 929 00:38:44,305 --> 00:38:47,405 and we will get back 930 00:38:47,835 --> 00:38:49,725 with part three next time. 931 00:38:49,905 --> 00:38:52,445 - And point DLP. Ooh, there's a topic too. 932 00:38:52,745 --> 00:38:54,205 Hey Pirate, you want to come on and talk? 933 00:38:54,225 --> 00:38:55,365 We should have Pirate as a guest. 934 00:38:55,395 --> 00:38:56,685 Yeah, that's a cool feature. 935 00:38:57,005 --> 00:38:58,725 I have not done a ton of time with it, 936 00:38:58,725 --> 00:38:59,885 but I am familiar with it. 937 00:39:00,025 --> 00:39:02,365 But yes, before we go down another rabbit hole, 938 00:39:02,555 --> 00:39:05,805 part three part try part, what is it? Part Tray. 939 00:39:06,025 --> 00:39:07,245 - I'm not good at French. Well 940 00:39:07,265 --> 00:39:08,765 - You started down French. 941 00:39:08,785 --> 00:39:10,805 You better be able to finish French. Do 942 00:39:11,455 --> 00:39:12,765 - Dunes. No, do do 943 00:39:13,325 --> 00:39:14,325 - Trey. 944 00:39:14,325 --> 00:39:16,325 It's got, yeah, Trey, I think maybe some. 945 00:39:16,445 --> 00:39:18,125 I should ask my sister-in-law. . 946 00:39:18,465 --> 00:39:19,845 She knows French . 947 00:39:19,845 --> 00:39:24,165 Alright, well that Scott, go and enjoy your weekend. 948 00:39:25,005 --> 00:39:27,805 I am off to Seattle on Sunday morning. 949 00:39:28,145 --> 00:39:30,205 - All right. MVP summit coming your way. 950 00:39:30,425 --> 00:39:32,445 All right, someday we'll talk about that too. But 951 00:39:32,585 --> 00:39:34,445 - Yes, I will give you all the recaps 952 00:39:34,445 --> 00:39:36,125 that I'm allowed to when I get back. Perfect. 953 00:39:36,505 --> 00:39:38,565 - As always, I'll be short up. Thank you. Thank you. 954 00:39:38,625 --> 00:39:41,725 We will chat again. Well you and I'll chat again week. We'll 955 00:39:41,725 --> 00:39:42,965 - Chat again soon. But yeah, 956 00:39:42,965 --> 00:39:43,925 - For everybody else we'll chat 957 00:39:43,925 --> 00:39:44,965 again in two weeks. All right, 958 00:39:44,965 --> 00:39:45,885 - Thanks Scott. No 959 00:39:45,885 --> 00:39:46,885 - Thanks. 960 00:39:48,825 --> 00:39:50,085 - If you enjoyed the podcast, 961 00:39:50,585 --> 00:39:52,645 go leave us a five star rating in iTunes. 962 00:39:52,865 --> 00:39:54,205 It helps to get the word out 963 00:39:54,225 --> 00:39:57,725 so more it pros can learn about Office 365 and Azure. 964 00:39:58,465 --> 00:40:01,045 If you have any questions you want us to address on the show 965 00:40:01,145 --> 00:40:03,485 or feedback about the show, feel free 966 00:40:03,485 --> 00:40:06,605 to reach out via our website, Twitter, or Facebook. 967 00:40:06,905 --> 00:40:09,125 Thanks again for listening and have a great day.

Digital Dispatch Podcast Podcast Artwork Image

Microsoft Cloud IT Pro Podcast

Ben Stegink, Scott Hoag

On the MS Cloud IT Pro Podcast, Scott and Ben discuss the Microsoft Cloud with a focus on IT Pros. They'll discuss the latest in Microsoft 365 and Office 365 News, Azure news and talk about their experiences with managing the Microsoft Cloud as well as interview industry experts on various cloud technology. They'll cover things such as SharePoint, Exchange, Microsoft Teams, PowerShell, Azure, Azure AD, Security, Networking, Storage, and the many other technologies and products that have made their way into the Microsoft 365 suite and Azure. To stay up-to-date on the latest in Microsoft Cloud news and gain some valuable knowledge as you deploy it within your own organization, make sure to tune in every week! Find out more at msclouditpropodcast.com.

Contact Show