Watermarking

In this section, we will explore the concept of watermarking as a means to safeguard sensitive information from being captured on client endpoints. Similar to screen capture protection, watermarking involves the inclusion of QR code watermarks within the Cloud PC desktop. These QR codes contain unique connection IDs, allowing IT administrators to trace Cloud PC sessions. The process of enabling watermarking involves configuring it on the Cloud PC and ensuring compliance by the client endpoints.

Figure 6.64 – Screenshot of the Cloud PC desktop when watermarking is enabled

To configure watermarking, follow these steps:

1. Go to Microsoft Intune admin center | Devices | Configuration Profiles.
2. Create a configuration profile by setting Platform as Windows 10 and later and Profile type as Templates, then select Administrative templates.
3. On the Configuration settings tab, navigate to Computer Configuration | Windows Components...

RDP device redirection

Redirecting things such as local drives from the physical device to the Cloud PC can help the end user to easily transfer local files between the devices. Generally, there is nothing wrong with allowing the redirection of local drives or other local resources such as the clipboard. The important thing is to be aware of it and understand the impact it can have. If you want to use Windows 365 to create a secure and closed platform for users and potential external partners, you might want the documents and files to stay within the environment and not allow users to move files between the two devices.

Note

You will find a full list of all supported RDP redirection settings here: https://learn.microsoft.com/windows-365/enterprise/manage-rdp-device-redirections.

All the settings that can be redirected to a Cloud PC can be managed with a configuration profile within Microsoft Intune. We covered how to create a configuration profile in Chapter 4. When creating...

Microsoft Defender for Endpoint

Securing Cloud PC devices is as important as physical devices. Defender for Endpoint helps to detect, prevent, investigate, and respond to threats against your organization’s endpoints. The built-in intelligence can help stop an attack before it gets out of control. If your organization is using other security products from Microsoft 365, all solutions can collaborate and help create a complete picture of a potential incident.

Enabling Defender for Endpoint in Intune

Getting your Cloud PC devices onboarded into Microsoft Defender for Endpoint is quite simple. The first step is to ensure the service connection to Microsoft Intune is enabled:

1. Start by going to https://security.microsoft.com and then to Settings | Endpoints | Advanced features. From here, set Microsoft Intune connection as On.

Figure 6.66 – Screen capture protection setting in Microsoft Intune admin center

2. After the connection...

Security baselines

Security baselines are preconfigured groups of Windows settings that help you apply the security settings that are recommended by the relevant security teams. The baselines you deploy can be customized to enforce only the settings and values required by you. There are multiple security-related settings in Windows, as well as for Microsoft Edge for your endpoints. Another great asset is the option to do versioning and filtering based on different operating systems or scenarios that have to be stricter.

You no longer have to use GPOs to ensure the security settings on your endpoints – just create a security baseline profile and you’re all set.

Windows 365 delivers its own branded set of security baselines that include different best practices that are optimized for Cloud PC virtualized scenarios. We highly recommend customers use these as they come from experience from real-world implementations. You can use these policies to lower the risk while...

Summary

In the chapter, you’ve learned everything about enabling users to access their Cloud PCs from any device in a secure way as well as optimizations available to deliver premium experiences. We went deep into the new modern user experiences that you get when choosing Windows 365 that are different than any other virtualization solution on the market. We hope you enjoyed it!

In the next chapter, you will learn how to analyze, monitor, and troubleshoot Cloud PCs.

Questions

Answer the following questions to test your knowledge from this chapter:

1. How can you enable Conditional Access for users when connecting to Cloud PCs?
2. What is the easiest way to secure your Cloud PCs?
3. How can you enable screen capture protection and watermarking for Cloud PCs?

Further reading

Please take advantage of the following resources to learn more about the topics covered in this chapter:

• Conditional Access in Azure AD: https://learn.microsoft.com/azure/active-directory/conditional-access/overview
• Windows security baselines guide: https://learn.microsoft.com/windows/security/operating-system-security/device-management/windows-security-configuration-framework/windows-security-baselines
• Windows LAPS overview: https://learn.microsoft.com/windows-server/identity/laps/laps-overview

Watermarking

In this section, we will explore the concept of watermarking as a means to safeguard sensitive information from being captured on client endpoints. Similar to screen capture protection, watermarking involves the inclusion of QR code watermarks within the Cloud PC desktop. These QR codes contain unique connection IDs, allowing IT administrators to trace Cloud PC sessions. The process of enabling watermarking involves configuring it on the Cloud PC and ensuring compliance by the client endpoints.

Figure 6.64 – Screenshot of the Cloud PC desktop when watermarking is enabled

To configure watermarking, follow these steps:

1. Go to Microsoft Intune admin center | Devices | Configuration Profiles.
2. Create a configuration profile by setting Platform as Windows 10 and later and Profile type as Templates, then select Administrative templates.
3. On the Configuration settings tab, navigate to Computer Configuration | Windows Components...

Redirecting local devices

Redirecting things such as local drives from the physical device to the Cloud PC can help the end user to easily transfer local files between the devices. Generally, there is nothing wrong with allowing the redirection of local drives or other local resources such as the clipboard. The important thing is to be aware of it and understand the impact it can have. If you want to use Windows 365 to create a secure and closed platform for users and potential external partners, you might want the documents and files to stay within the environment and not allow users to move files between the two devices.

Note

You will find a full list of all supported RDP redirection settings here: https://learn.microsoft.com/windows-365/enterprise/manage-rdp-device-redirections.

All the settings that can be redirected to a Cloud PC can be managed with a configuration profile within Microsoft Intune. We covered how to create a configuration profile in Chapter 4. When creating...

Microsoft Defender for Endpoint

Securing Cloud PC devices is as important as physical devices. Defender for Endpoint helps to detect, prevent, investigate, and respond to threats against your organization’s endpoints. The built-in intelligence can help stop an attack before it gets out of control. If your organization is using other security products from Microsoft 365, all solutions can collaborate and help create a complete picture of a potential incident.

Enabling Defender for Endpoint in Intune

Getting your Cloud PC devices onboarded into Microsoft Defender for Endpoint is quite simple. The first step is to ensure the service connection to Microsoft Intune is enabled:

1. Start by going to https://security.microsoft.com and then to Settings | Endpoints | Advanced features. From here, set Microsoft Intune connection as On.

Figure 6.66 – Screen capture protection setting in Microsoft Intune admin center

2. After the connection...

Security baselines

Security baselines are preconfigured groups of Windows settings that help you apply the security settings that are recommended by the relevant security teams. The baselines you deploy can be customized to enforce only the settings and values required by you. There are multiple security-related settings in Windows, as well as for Microsoft Edge for your endpoints. Another great asset is the option to do versioning and filtering based on different operating systems or scenarios that have to be stricter.

You no longer have to use GPOs to ensure the security settings on your endpoints – just create a security baseline profile and you’re all set.

Windows 365 delivers its own branded set of security baselines that include different best practices that are optimized for Cloud PC virtualized scenarios. We highly recommend customers use these as they come from experience from real-world implementations. You can use these policies to lower the risk while...

Summary

In the chapter, you’ve learned everything about enabling users to access their Cloud PCs from any device in a secure way as well as optimizations available to deliver premium experiences. We went deep into the new modern user experiences that you get when choosing Windows 365 that are different than any other virtualization solution on the market. We hope you enjoyed it!

In the next chapter, you will learn how to analyze, monitor, and troubleshoot Cloud PCs.

Questions

Answer the following questions to test your knowledge from this chapter:

1. How can you enable Conditional Access for users when connecting to Cloud PCs?
2. What is the easiest way to secure your Cloud PCs?
3. How can you enable screen capture protection and watermarking for Cloud PCs?

Further reading

Please take advantage of the following resources to learn more about the topics covered in this chapter:

• Conditional Access in Azure AD: https://learn.microsoft.com/azure/active-directory/conditional-access/overview
• Windows security baselines guide: https://learn.microsoft.com/windows/security/operating-system-security/device-management/windows-security-configuration-framework/windows-security-baselines
• Windows LAPS overview: https://learn.microsoft.com/windows-server/identity/laps/laps-overview