As you work towards onboarding your organization to Co-Management, a significant hurdle for some teams is getting Current. For Co-Management, Windows 10 1709 (released in January 2018) is required. Your organization may be in the process of planning or implementing this update, and, once you are updated and Auto Enrollment is configured, your clients will be automatically enrolled to Co-Management. The great news is that upgrading Windows 10 is enabled by default! In most cases, upgrade problems are related to AAD tenant configurations that have not been updated. To learn how to update these configurations, check out this documentation. If, at any point in the process, you need assistance with your Windows 10 upgrade, just use the "request assistance" option at: Microsoft.com/en-us/FastTrack/

If your environment currently has Windows 10 devices locally domain joined, you will need to Hybrid Azure AD join your devices before you can enable Co-Management in ConfigMgr. Hybrid Azure AD joining your devices is a process that automatically registers your on-premises domain-joined devices with Azure AD. For more context on this process, check out the Introduction to device management in Azure Active Directory, as well as this documentation about How to plan your Hybrid Azure AD join.

Unwrapping a new PC is incredibly exciting, but we've all felt a bit of dread when thinking about how long it will take it get all our settings and apps just right so that we can start being productive. Co-Management solves this device provisioning problem with Windows Autopilot. Whether you are looking to set up and pre-configure new Windows 10 devices, or reset, repurpose and recover existing devices – Autopilot provides a simplified experience for both IT and the end user. Autopilot also reduces the time, resources, and complexity associated with deploying, managing, and retiring/recycling devices. And, while all this is going on, the experience for your end users is streamlined and easy right out of the box. Windows Autopilot supports multiple scenarios, all of which are maximized with Co-Management: Your end users can drive their own new-device deployments into either Active Directory (Hybrid Azure AD Join) or Azure Active Directory.You can set up self-deploying new device deployments into Azure Active Directory, for shared devices and kiosks.With Windows Autopilot for existing devices, you can use ConfigMgr to migrate an existing device from Windows 7 and Active Directory into Windows 10 and Azure Active Directory.For detailed info on how to enroll Windows devices in Intune using Autopilot, check out this detailed documentation.

There's no simpler way to say it than this: In the cloud, Identity is the new control plane. This fundamental principal of security and management means that securely connecting users to applications and resources (no matter where they exist or how they are used) is what will set apart world-class organizations. This huge shift in how we approach IT is embodied by Azure AD. Azure AD allows you to seamlessly link your users, devices, and applications – across both cloud and on-premises environments. Bringing your devices to Azure AD enables you to take advantage of Azure AD's full potential to better improve productivity for your users and security for your resources. Having devices in Azure AD is the foundation for both Co-Management and device-based conditional access. When you have Windows 10 deployed, Azure AD provides two options for corporate-owned devices to suit your organization's varied needs: Azure AD Join and Hybrid Azure AD Join.

The health of our network is directly connected to the health of the devices moving in and out of it. Intune has the unique ability to talk to unhealthy clients and act as a watch dog for your organization, even when a client is not on your corporate network. When you use Co-Management to combine this power with ConfigMgr's ability to report back 98% of known healthy clients, you can detect, assess, and provide great visibility across all clients, in real time. Intune also adds the support needed for compliance upgrades across all connected clients. Getting started with this feature is simple – to borrow a very famous advertising slogan, here are the three steps: Use Windows 10 1709 (or later) and enable Co-Management.Use ConfigMgr 1806 (or later).There is no step 3. To begin using these features, you do not need to move any workload over to Intune. In upcoming release we'll add additional functionality into CCMeval, the identification of potentially unhealthy machines (in both ConfigMgr and Intune) will get even easier.

IT must be able to ensure that every device they manage is reachable – no matter where it is – whenever it connects. IT must also provide each device and device user with everything needed to stay productive while protecting the apps and data being used. With the device actions supported by Intune, these critical functions can be solved (as the name implies) remotely. Why you need it: Remote device actions give IT unparalleled management controls on the device without interfering with personal data. These remote device actions allow IT to delete company data on lost or stolen devices, rename a device, restart a device, review device inventory, and remote control into a device. This is an important and simple way to protect corporate data stored on these devices – whether it is in e-mail or OneDrive. Additional real-time actions include restarting a device, wiping out pre-installed OEM apps with the a fresh start reboot, and performing a factory reset on any Windows 10 device. To learn how to remote control a Windows 10 device via the third party program TeamViewer, use this documentation.

Simply put, Conditional Access is EMS flexing its might. Surprisingly often, regular uses of ConfigMgr overlook how much they can use Conditional Access (CA) and take advantage of the simple, cloud-attached benefits. CA is a perpetual-motion machine which ensures that corporate resources are only accessed by trusted users on trusted devices using trusted apps. It has been built from scratch in the cloud and, whether you're managing devices with Intune or extending your ConfigMgr deployment with Co-Management, it works the same way. With Co-Management, Intune evaluates every device in your network to determine how trustworthy it is – and it does this in two key ways: Intune ensures a device or app is managed and securely configured based on any way you choose to set your organization's compliance policies (g. make sure all devices have encryption enabled and are not jailbroken). This is a pre-security breach, configuration-based evaluation.For Co-Managed devices, ConfigMgr also does configuration-based evaluation such as required updates or apps compliance – and Intune combines this evaluation along with its own assessment.Intune detects active security incidents on a device thanks to the intelligent security of Windows Defender Advanced Threat Protection and other mobile threat defense providers. These partners perform ongoing behavioral analysis on a devices to detect active incidents and pass this information to Intune for real-time compliance evaluation. This is a post-security breach, incident-based evaluation. You can listen to Brad Anderson discuss CA in depth (with live demos!) in this section of his keynote at Ignite 2018.

In this episode of the Endpoint Zone with Brad Anderson you'll hear from Microsoft's Chief Information Security Officer, Bret Arsenault, about how Microsoft protects it's employees mobile devices.

To learn more about Desktop App Assure: https://aka.ms/DesktopAppAssure To request assistance with your apps today: https://aka.ms/DesktopAppAssureRequest

Coming up in this episode of the Endpoint Zone with Brad Anderson Brad talks to the CEO of JAMF software, Dean Hager. Brad and Dean discuss the JAMF Casper integration with Microsoft Intune and Microsoft 3365 [01:00] Some context on JAMF [03:40] "We're Apple guys" [07:40] Whiteboarding ow JAMF and Conditional Access work together [10:45] Demo [17:00] Insight into where the JAMF / Microsoft partnership is going next