Understanding the fundamentals of a product is the most important thing for a successful deployment. Keeping your resources secure while leveraging other services within the Microsoft 365 product suite is what you will learn about in this chapter.

In this chapter, we'll go through the following topics:

• Microsoft 365 services
• Azure Virtual Desktop and Windows 365
• Windows 10 and Windows 11

Microsoft 365 includes many services that you might use in your day job, whether as an IT professional or a non-technical user. The services help you to become more productive by simplifying tasks that would require a lot of work in on-premises environments. A great example would be the shift we've made from Exchange Server to Exchange Online.

What do the services achieve?

In this introductory section of the book, we will briefly explain the Microsoft 365 core services and features that are relevant to the subject of this book, just to get a good baseline understanding of the differences between the various services. You'll also learn about the purpose and benefits of each service.

Microsoft Endpoint Manager

Microsoft Endpoint Manager (MEM) is the consolidation of Microsoft Intune and Microsoft Endpoint Configuration Manager (MECM). It provides one holistic management experience while adding new functionality and intelligent actions without any complex migration or disruption of productivity.

It provides a number of assets to aid your transition to modern management while also increasing customers' security and helping them move to the cloud. MEM now also includes management capabilities for different endpoints:

Figure 1.1 – MEM – service portfolio

MEM helps you manage physical and virtual desktops, laptops, tablets, and other mobile devices, including iOS, Android, and macOS devices.

MEM uses Azure Active Directory (Azure AD) as the primary identity and directory store. It replaces the traditional Active Directory, includes hybrid identity capabilities, and can also integrate with local management infrastructures such as Configuration Manager via Kerberos.

Intune is extremely helpful for devices that are beyond the management scope of Group Policy, such as mobile phones, devices that are not Active Directory Domain Services (AD DS) domain members, or Windows 10 devices that are joined to Azure AD:

Figure 1.2 – MEM – management console

With MEM, you can achieve the following:

• Let your organization's employees use their personal physical and virtual e ndpoint devices to access organizational data (commonly known as bring your own device (BYOD)).
• Manage organization-owned phones.
• Control access to Microsoft 365 from unmanaged devices, such as public kiosks and mobile devices.
• Help ensure that devices and apps that do connect to corporate data comply with security policies.

For example, when a user attempts to open one of their line-of-business (LOB) apps on their phone or Windows 10 endpoint, Microsoft 365 checks with Azure AD to authenticate the user and verify whether that user can access the data from that app on that device. The granting of access depends on the following:

• Conditional Access policies defined within Azure AD
• Whether the app on that device complies with app configuration and data protection policies (Intune will confirm this for Azure AD)

If the device and app are both compliant with all policies, Azure AD notifies Microsoft 365 that the data can be accessed.

Azure Virtual Desktop

Azure Virtual Desktop, or AVD for short, is a Microsoft-managed platform-as-a-service offering on top of the Microsoft Azure cloud. Unlike traditional virtual desktop infrastructure (VDI) deployments, all the infrastructure services, such as brokering, web access, load balancing, management, and monitoring, are all set up for you as part of a control plane offering.

Windows 365 Cloud PC

A new way of experiencing Windows, on any device – that's the best way to describe the new Microsoft cloud service Windows 365 Cloud PC. Microsoft's vision is to have people use Windows 365 the same way as they would manage a physical endpoint but with the flexibility of the cloud.

Windows 365 is everything you need if you are looking for a simple way of running your Windows desktops in the cloud. You can decrease the costs and complexity of your environment by deploying and managing virtual endpoints in MEM; no additional VDI expertise or resources are needed. More about this will be explained later in this chapter.

AVD and Windows 365 Cloud PC – shared responsibility model 1

As with many cloud services, there is a shared set of security responsibilities. You have control and flexibility, and with that comes responsibility. If you are adopting Windows 365 Cloud PC, it's important to understand that while some components come already secured for your environment, there are other areas where you will need to configure things to fit your organization's security needs:

Table 1.1 – Shared responsibility model 1

AVD and Windows 365 Cloud PC – shared responsibility model 2

The following table is an extension of the previous one, but it goes a bit deeper in terms of the differences in management experience:

Table 1.2 – Shared responsibility model 2

Windows 10 Enterprise

Windows 10 Enterprise is one of the primary components of your Microsoft 365 subscription. Windows 10 meets the needs of large and midsize organizations, providing users and organizations with the tools, services, and support to enhance their personal and organizational productivity.

Windows 10 also supports collaboration through Microsoft 365 apps, Microsoft Teams, Microsoft Whiteboard, and OneNote.

Windows 10 helps improve productivity by providing faster, safer ways to get work done across all your users' devices. Users can find apps, settings, documents, and messages by using enterprise search and Cortana, and use Timeline to see a chronological view of their activities and documents. Windows 10 has hardware options ranging from Surface Hub to the new always-connected PCs. These options support users wherever they need or prefer to work. Users can move from one device to another with Continue on PC in Microsoft Edge or take notes directly on a web page with Microsoft Ink. Windows 10 also comes with a robust set of accessibility features, such as a narrator, word prediction, and eye control.

Windows 10 includes tools to help you customize device setup, manage all your devices, and control corporate identities, data, and apps on personal devices without impacting personal data. Maximize security and productivity by staying current with Windows 10. The way to update Windows has changed completely. Major upgrades that previously happened every few years have now changed to updates that happen twice a year. Windows-as-a-Service, the model for Windows 10, provides the flexibility and control needed to manage and distribute updates using your current method or by using Microsoft's infrastructure.

Windows 10 protects, detects, and automatically responds to the most advanced malware and hacking threats, while protecting user identities, devices, and your organization's information. Windows 10 investigates threats as they evolve and automates remediation to make response times faster, thanks to Intelligent Security Graph (which uses security intelligence, machine learning, and behavioral analytics). These security solutions are built in and provide you with full security life cycle management for endpoint protection (EPP) and endpoint detection and response (EDR).

It also integrates with other Microsoft 365 services, which cover even the most complex multi-platform environments:

• Threat protection: Windows 10 threat protection includes next-generation malware and hacking defense to help protect against threats, including zero-day attacks. It provides a hardened platform that can help prevent encounters, isolate threats, and prevent the execution of malicious apps and content. Windows 10 can detect and respond to the most advanced threats and automatically remediate them.
• Identity access: Windows 10 protects user identities against pass-the-hash and pass-the-ticket attacks by helping you move to a world without passwords. Windows Hello is a biometric authentication tool that strengthens authentication and helps guard against potential spoofing.
• Information Protection: Windows 10 makes it easy to protect data – whether that data is at rest or in use. Windows Information Protection helps protect sensitive information against leaks. When you combine Windows 10 with Azure Information Protection and Microsoft 365, you get a sophisticated solution that meets the highest requirements for data loss prevention with minimal input.

Windows 11 Enterprise

Windows 11 is the next evolutionary phase of Windows; it is the most significant update to the Windows operating system since Windows 10. It offers a lot of innovations focused on enhancing end user productivity in a fresh experience that is flexible and fluid. Windows 11 is designed to support today's hybrid work environment and is intended to be the most secure, reliable, connected, and performant Windows operating system ever.

Windows 11 is built on the same foundation as Windows 10, so the investments you have made in tools for update and device management are carried forward.

Windows 11 is Zero Trust ready and secure by design, with new built-in security technologies that will add protection from the chip to the cloud, while enabling productivity and new experiences. Key security features such as encryption, hardware-based isolation, and malware prevention are turned on by default. Going passwordless has also been made easier by simplifying the steps to deploy Windows Hello for Business.

To address the need for hybrid working in the market right now, location shouldn't matter. Addressing the new how, when, and where we work demands simplicity and security changes in the Windows operating system as well as the delivery of Windows in a simpler way – from the cloud with Windows 365:

Figure 1.3 – Windows 11

You can have a highly secure and consistent experience for users, with all the necessary IT controls, that delivers updates in a non-disruptive way, combined with a new, modern look and feel – that's the best way to describe what Windows 10 offers in a nutshell.

We will explain more about Windows 11 in Chapter 6, Windows Deployment and Management.

Productivity Score

The journey to digital transformation is supported by Productivity Score, which provides insights into how your organization uses Microsoft 365 and the technology experiences that support it. Your organization's score reflects the effectiveness of your people's work and technology and can be compared to benchmarks from organizations similar in size to yours.

Productivity Score provides the following:

• Metrics to help you see where you are on your digital transformation journey
• Insights about your data to help you identify opportunities to improve productivity and satisfaction in your organization
• Actions you can take to help your organization use Microsoft 365 products efficiently

The following Productivity Score screenshot shows you the level of insights you get based on scoring metrics in the Microsoft 365 admin portal:

Figure 1.4 – Productivity Score

Your Productivity Score is based on the combined scores of your people and technology experiences categories. Each category is weighted equally, with a total of 100 points. The highest possible Productivity Score is 800.

Endpoint Analytics

Endpoint Analytics is a service that is used to ensure the consistent performance of your MEM deployment and is part of Productivity Score. Everything that is collected comes from measurements of how your business is working. For example, Endpoint Analytics gives you insights into the boot time of your physical device, logon duration, and application startup time.

The insights enable IT admins to reduce support costs by adding capabilities to proactively solve issues in their environment. This can all happen automatically without any involvement of the IT admin:

Figure 1.5 – Endpoint Analytics

Your end-to-end experience can be dramatically improved by Endpoint Analytics and the benefits it brings. Another huge benefit is that all service costs are included; unlike the case with Azure Monitor, there is no need to pay for storage retention!

Desktop Analytics

Desktop Analytics is an important part of the full MEM service; it is cloud-based and integrates with Configuration Manager. The service also provides different levels of insights and intelligence for IT administrators to make proactive decisions about the update readiness of your Windows 10 endpoints. The service combines data from your business with data aggregated from millions of devices connected to Microsoft cloud services.

Here is a list of the different benefits of Desktop Analytics with Configuration Manager:

• Create an inventory of apps running in your organization.
• Assess app compatibility with the latest Windows 10 feature updates.
• Identify compatibility issues and receive mitigation suggestions based on cloud-enabled data insights.
• Create pilot groups that represent the entire application and driver estate across a minimal set of devices.
• Deploy Windows 10 to pilot and production-managed devices.

Here is an example screenshot of how security and feature updates come together in a single, unified experience in Desktop Analytics:

Figure 1.6 – Desktop Analytics – management console

Now that we have talked about all the different enhancements to monitor and analyze your endpoints, we're going to talk about the different Microsoft 365 services that you can use within your physical and cloud-managed desktops.

Microsoft 365 Apps (for Enterprise)

Microsoft 365 Apps for Enterprise includes the Microsoft productivity suite of applications, such as Word, Excel, PowerPoint, Outlook, and Teams, for both Windows and Mac devices. Microsoft 365 Apps isn't a web-based version of Office – instead, it's a full version of Office that your users install and run on their devices. You can use the Office applications that come with Microsoft 365 Apps with the on-premises or online versions of Exchange, SharePoint, or Skype for Business.

You can install Microsoft 365 Apps from a network share or directly from the internet. After it's installed, you don't have to be connected to the internet to use it. However, you'll need to connect at least once every 30 days to ensure that your license is still active.

Microsoft 365 Apps is updated either monthly or semi-annually with new features, security updates, and other quality updates from Microsoft. You can choose which frequency works best for your organization by selecting specific update channels.

Microsoft 365 Apps has a few benefits over Office Professional Plus 2019, such as support for air-gapped devices and device-based activation, and organizations interested in Office 2019 should contact Microsoft for more information.

OneDrive for Business (part of Microsoft 365 Apps)

Microsoft OneDrive is an enterprise file sharing service that allows you to easily store and securely access your files from all your physical, virtual, and mobile devices. You can work together with people from any location, regardless of whether they're inside or outside your organization, while also exploiting comprehensive security capabilities to, for example, only allow data sharing based on several security baseline conditions. All your data in OneDrive is protected through advanced encryption while in transit and at rest in data centers.

OneDrive enhances collaboration capabilities within Microsoft 365 apps by connecting you to your personal and shared files in Microsoft 365. With OneDrive on the web, desktop, or mobile, you can access all your personal files and any files shared with you by other people or teams, including files from Microsoft Teams and SharePoint.

Another great feature is OneDrive cloud backup – also known as OneDrive folder backup (previously Known Folder Move). This service automatically syncs your Desktop, Documents, and Pictures folders on your physical or virtual endpoints to your OneDrive cloud storage. Your files and folders stay protected and are available from any device!

Microsoft Teams

Microsoft Teams is a unified communications collaboration tool that brings different services together to modernize the way you work with colleagues and external businesses. Teams allows you to implement a chat-based workspace as part of your Windows 10 physical and virtual PCs but also as a mobile app on various platforms, which helps you stay up to date both in the office and on the go.

Teams keeps your team in sync by sharing OneDrive and SharePoint documents, insights, and status updates while being able to manage important projects and easily locate people – from anywhere and on any device!

With Microsoft Teams, you can do the following:

• Communicate through chat, meetings, and calls: Host audio, video, and web conferences, and chat with anyone inside or outside of your organization.
• Collaborate with integrated Microsoft 365 apps: Teams makes teamwork easy by allowing users to co-author and share files with popular Microsoft 365 apps – from Microsoft Word to Microsoft Power BI.
• Customize your workplace and achieve more: Using Teams, you can integrate apps from Microsoft and third-party partner services to meet your organization's unique needs.
• Connect across devices: Teams and Teams devices work well together for intelligent meeting and calling experiences. Find the right devices for your needs and bring your best ideas to life.

Microsoft Edge

Microsoft Edge has been around for a while as the next modern iteration of Internet Explorer, first released in 2015. After 5 years, a new version of Edge was released, built on top of the open source software project Chromium. This uses the same core engine as the Google Chrome browser.

Microsoft Edge has proven to be very fast. Its alignment with other Microsoft services such as MEM to set policies, as well as the cross-platform support for the app to sync data such as personal history and favorites settings, has been well received. This has resulted in Edge being the default browser for Windows 10 to date.

Microsoft Edge is available on Windows, macOS, iOS, Android, and Linux. You can choose what device you want to use with the same native Edge experience across different platforms.

Universal Print

You might remember the following workflow – or still do it to this day: spin up a Windows Server environment, add the print server role, and start adding your printers and designated drivers to the server. Not very modern or efficient, is it? Universal Print offers the same, and more, features while also eliminating the need for on-premises infrastructure. It enables you to manage printers directly through a centralized portal in Microsoft Azure. Say goodbye to installing (and maintaining) printer drivers on devices and/or golden images. As a bonus, everything works with Azure AD. This means that users can use the same set of credentials they use for other Microsoft services, whether they log on to a physical desktop or a virtual desktop running in the cloud.

Microsoft Defender for Endpoint (formerly MDATP)

Microsoft Defender for Endpoint is the enterprise version of Microsoft Defender which is standard enabled in Windows 10 Enterprise and Windows 11 Enterprise. It's a cloud security platform designed to help enterprise networks prevent, detect, investigate, and respond to advanced threats.

The service is integrated end to end into the MEM console and therefore aligns easily with other compliance and security settings and roles as part of your security baselines.

One of the great features of integrating Defender within MEM is that after your organization onboards a device using the configuration package, you will never have to do it again. All your physical and/or cloud PC will be secured out of the box:

Figure 1.7 – Defender for Endpoint – management console

The Defender for Endpoint configuration process in Intune is very simple and is something we will explain in more detail later in the book.

Exchange Online

Exchange Online is a messaging and collaboration platform for your email, calendar, contact info, and tasks. You can access all of this with Microsoft Outlook, Outlook on the web, or Outlook Mobile. You can access Exchange Online on most devices, including Android, iOS, and Windows 10 devices.

SharePoint Online

SharePoint Online is the cloud evolution of Microsoft SharePoint Server. It helps you create team- or communication-focused sites for efficient collaboration and communication. Internal users with an appropriate Microsoft 365 or SharePoint Online license can use SharePoint Online. They can share files or folders with others inside or outside the organization. Sharing outside the organization can be controlled by site administrators.

With SharePoint Online, users can do the following:

• Build sites, pages, document libraries, and lists.
• Add web parts to customize their pages.
• Share important visuals, news, and updates with a team.
• Search and discover sites, files, people, and news from across their organization.
• Manage their business processes with flows, forms, and lists.
• Sync and store their files in the cloud so anyone can securely work with them.
• Catch up on news on the go with the SharePoint mobile app.

In this chapter, you learned about all the different Microsoft 365 services you might use in your day job or as part of your journey to using MEM to simplify the management overhead of your environment.

This chapter mainly intended to provide context for the later chapters in the book; we are now switching gears and taking you on the journey of unified endpoint management with MEM.

1. What are the main benefits of using MEM?
   1. MEM ensures that an organization no longer needs credentials to access and share company data.
   2. MEM prevents remote devices and apps from accessing an organization's resources.
   3. MEM helps keep an organization's cloud and on-premises devices, apps, and data secure.
2. What are the main differences between Windows 365 Cloud PC and AVD?
   1. Windows 365 Cloud PC is designed for simplicity and AVD for flexibility.
   2. Windows 365 Cloud PC has a fixed-price cost model and AVD is consumption-based.

1. (A)
2. (A)

If you want to learn more about MEM after reading this chapter, please use the following free online resources:

• MEM fundamentals: https://docs.microsoft.com/en-us/learn/paths/endpoint-manager-fundamentals/
• Introduction to MEM: https://docs.microsoft.com/en-us/learn/modules/intro-to-endpoint-manager/