Відео

That’s you hybrid policy at work. This is not a Microsoft best practice

When you change a computer you'd enroll that computer under your Entra ID account in Windows Hello for Business and create a new passkey for that device. If you want to provide support for users that forgot their computers at home, then you'd have a spare that you can let them log into with their password, or login to a co-worker's company computer. Passwords will still always work. Enrolling a computer in Windows Hello for Business is not mandatory. If they forgot their password, you'd have self-service password reset (SSPR) configured in Entra ID. Or, you can allow them to chew up your time with a tedious manual admin password reset. Windows Hello for Business is part of Entra ID and does not work out of the box and it needs to be configured. And, an IT manager has to be open to learn new modern security skills. This requires taking training courses, practicing on a demo M365 tenant to get hand-on experience outside of your production tenant, and ideally certifying on this technology. By doing this, an IT manager will learn how these systems are meant to be configured and how to make them work smoothly and securely. Is the process of re-skilling easy? No. Is it rewarding? For sure. It's also more interesting IT work. There will always be these "what if this or that" scenarios that come up. Once you know the tech well, the answers will come to you quickly and confidently. If you don't have the opportunity to reskill, then find a Microsoft cloud partner. It doesn't have to be Xerillion, but find one that can help you get ramped up quickly.

Passkeys don't move with your Entra ID account from computer to computer. Each computer will have it's own unique passkey generated when you enroll the device into Windows Hello for Business.

@@Xerillion well, the passkey is stored in authenticator on my phone. I was expecting to be offered a QR code. Seems to happen some computers and not others.

Passwordless there as well. I have an iPhone. I don't enter a password to login to it, or my M365 mobile apps that run on it.

No. Another device would need to establish it's own session/token.

Hi! When going to full passwordless sign-in with a properly configured M365 tenant, password changes should be very rare. I bet I have done it once in the past 3 years and it was a very odd situation where I was on a cruise ship wifi and trying to login to my laptop for the first time in 6 months. As an IT manager you can get out of the business of doing tedious user password resets. This is what SSPR (self service password reset) with Entra ID (Azure AD) is for. We configure this as part of our standard M365 tenant setup. And in our practice, getting as many tedious things off the plate of IT managers is an ongoing refinement process. And as I mention in the video, it's really tough on internal IT managers to learn on these new systems, understand what is important, what isn't, while maintaining the existing system. Anyway, SSPR enablement/configuration, and politely pushing back on users (within reason) when they ask you to manually reset is the way to go. IT admin manual password resets should be very very rare.

@@Xerillion Hi and thanks for reply. SSRP is of course something to teach users better. A problem that I notice is also that when users have PIN codes, they think that the PIN code is their password and do not understand the difference, and that also creates problems when they really need their password. For example, when they have to enroll a phone or computer. Is there a way to enroll new devices without a password? Maybe to approve it on their current device?

I see. you explained that it will only work on the machine where Windows hello is enrolled

Thanks for commenting @andrewenglish3810. I mean it. And I get your point. I feel there is more missed by having multiple un-integrated, or loosely integrated 3rd party IT security and management servers to to deal with. Also, Microsoft uses these same security products. They are a $3T company. I say if it is good enough for them, it's good enough for most of us. Also, as a company that only integrates these systems, we just don't have issues and IT overall is very peaceful. That being said, IT managers need to train, certify and get years of experiencing properly integrating these system, which is tough for internal IT managers to do and I'm epithetic to that issue. Again, totally respect your point. And thanks for taking a moment to comment.

Arent they effectively the same? Entra ID is a name change afterall

Thanks @BrianTrela...I love you to man. ❤

Thanks @twangt! And, yes, we do...about 98% of the time. There are some cases where Azure Virtual Desktop makes sense though at this point, rare.

Thanks @tanbirprodhan888! Sure, you can purchase the Microsoft 365 E5 Security Add-on. It does require you have at least one M365 E5 license though...which usually is good to give to the IT manager.

Yes

Yes to both. I suppose there is always going to be a chance that a desktop application won't work, though we haven't run into one yet in our cloud practice with clients.

Business Premium has a 1.5TB email archive included. Part of the work of these integrations is to advise the client and configure a policy that automatically moves emails from the live mailbox to archive. In the case where someone must have a live 100GB mailbox (rare) we can add on an Exchange Online Plan 1 license which is still less expensive than M365 E3, and still a better value. In cases where someone needs 300+ licenses, M365BP premium isn't an option unless they want to mix Business with Enterprise licenses...something I wouldn't recommend.

You would have to add a plan 2 to get 100GB

@@iansylvester1164 Yep, your right. I stand corrected, and that is what we do. Plan 2. I mistyped.

No prob. But that would carry the cost up

@@iansylvester1164 That is true though still cheaper than M365 E3, but even if it was higher, the amount of users we need to apply this add-on is rare when you integrate the 1.5TB archive. I'd estimate for every 30 integration projects we do, which would amount to a total of around 1,000 end-users, I doubt it is even 10. And to make M365 E3 apples to apples with M365 BP, you need to also put add-ons to M365 E3 raising it's cost. That being said, if M365 E3 isn't your thing, all good.

Hi Peter, I don't know if VNC was blocked by the Cloud PC.

No, it isn't.

Thanks @kaplangolfer!

Just a quick question. I just wanted your input on whether users of Microsoft Office 365 (E3) as well as Windows 365, should be "backing up" their Office 365 data (like OneDrive). I understand about the multiple "Recycle Bins" that are in place (plus the 7-year retention policy) but in terms of a backup process outside of Office 365, I was just wondering which product or 3rd party (if any) you would recommend or if it is not necessary. Thank you for your time!!!

You can take an existing Windows 10 or 11 Pro company computers as-is...manage it with Intune. If Windows 10, manage the upgrade automatically through Intune. Refurbished computers purchased with Windows 11 Pro managed with Intune. Super easy. No overhead. The thing is this...if an IT manager doesn't want to do it, they will find a way not to. If they want to make it happen, they will find a way. Going doing the path I describe in the video would be for an IT manager that is all-in with, and excited about, Microsoft cloud services. If they aren't, that's cool too.

Thanks @RealDeal! Yes, it's possible to migrate from Google and Slack for files. I don't know about Slack chat data. Interesting question though, and I'll put that one in the back of my mind.

Thanks Rob! :)

We anticipate by March - June 2024 based on the progress of things at the enterprise level, which is why SMB's need to get AI READY now. They wouldn't just drop in CoPilot with out getting their security modernized, and shared files fully integrated, and even then, not without getting their users and IT admins trained...thus the theme of this video. Microsoft isn't moving away from file sync on Windows File Explorer..they added a shortcut as you spoke, which is OK, but that shortcut feature isn't replacement for anything. In fact, they are doubling down on sync, in that Windows 365 Cloud PC's, their virtual desktop solution, will be able to work offline and sync.

@@Xerillion Microsoft now recommends using Shortcuts in their documentation as "the more versatile option". Also, they are prepping the Onedrive PWA, OneDrive web app and, Teams to handle offline files. It sounds like they are moving away from Sync.

If that is your interpretation, that's cool. I mean it. What I like to see is IT pro's who keep an eye on the changes and formulate their own opinions of the future. This is what companies pay us to do...to have a vision. When I speak to new prospective clients, often I tell them, "Imagine you **weren't** hiring my company as a 3rd party, imagine you were hiring me (Wayne Chapin) as your internal IT manager, and you asked me: 'Wayne, if you come to work as the IT manger for our company, what direction would you take our IT system?' I'd then give my my take on shared files inside Microsoft 365." Now, in your case, you'd do the same...which cool. And, I'll go a step further...I really enjoy getting into conversations about where things are headed with IT pro's like yourself, though it's much more beneficial to do it live, versus chat. Which for 2024, I'm trying to figure out a way to get a live engaged conversation going with some of you guys. But again, not in chat. And not be just going live in UA-cam while you guys message me in chat. I'd really like a peer-based video meeting. That's hopefully something I can figure out for 2024. All that said, thanks for engaging Mike. 👍