AMA: Powerful Apple device management with Intune

Thank you for the reply! Transcripted answer from the video: "Yeah, that's a great question and a very insightful one. I have three things to say about this, the first one being that today, the way we think of our Mac use cases, it is built as a single managed user device. So, all the scenarios that we build in, including Platform SSO that we are releasing, it's currently aimed at those types of scenarios. Now, that doesn't mean that we don't support multiple-user scenarios. You could still enroll a device without device affinity and have multiple users sign in. But as soon as you start putting down certificates that access resources on the device, we need to be able to really validate who the user is and that we are providing the right set of certificates to the right user. In terms of validating that, we made some design choices where, in the early days of supporting our resource access scenarios using certificates, that currently means that we deliver the kind of verification we need. We can only verify that this is the device that it's meant for, but not so much who the user is, which resulted in us making this choice. Now, we have been hearing this feedback from a lot of you that there is a business case and a need for providing the right certificate in the user Keychain because that also has an end-user impact for... It's a much better user experience for having to select that certificate. And we are working through that feedback to make sure that we can still meet the needs of security that we have while supporting that scenario. Now, to that end, and about multiple user devices, the good news is with... ANDY: I think we lost Arnab again. TYLER: It looks like we lost Arnab again. ANDY: So, to finish Arnab's point there, so yes, V2 of Platform SSO that Apple announced at WWDC does support multiple accounts. And so, as we roll out V1 support, we'll be adding V2. I don't have the specific timelines there, but I'm sure Arnab can share it. But it is something we need to support. And then, just going back to the user cert thing, we know this is an issue. I want people to know that. We know we need to fix this. As Arnab mentioned, there was a security reason, initially, why we went the route we went, but we also hear you loud and clear, and we need to make a change, and we're evaluating what our options are to both meet the one security issue we had while also looking at the input that you've all provided us. At the end of the day, we don't want to block you in. So we want you to adopt and you be able to utilize Intune as your management option. And so, we will absolutely be looking and providing some updates, hopefully sooner rather than later, on what our plan is on user certs. TYLER: Absolutely. It's a great question on security, and thank you for bringing that up and for providing the updates. I appreciate the mental synchronization there between Arnab and Andy. Thank you, Andy, for jumping in on that."

Thanks for the reply! Transcripted answer from the video: "Well, I think what you'll see, we have a preview coming up for what's called the "awake config" command. We already have it on iOS. I mean, that's the starting point. So that will allow that policy, and I know Apple now allows apps, and we'll be looking at scripts, as well, to happen before the user exits the Setup Assistant, right? So that's the baseline. Additionally, we're revamping all of ADE. So we're migrating the profiles over to what we're calling "EC V2," or Enrollment Configuration V2, which is similar to our Settings catalog, so all this data-driven UI so we'll be able to build much more faster feature sets. And one of them is to create more control over what different profiles and apps get installed during that window. And so, definitely you'll see more and more of that in the next year about controlling what goes first, what's on there. I think it's going to be critical not just for what you're choosing but what we are putting on you. So, whether it's Platform SSO or even the Authenticator app, you know, we need to have those on the device for part of our enrollment. And so we want to make sure those are there first to enable. And so, yeah, we definitely acknowledge there's some more granular controls we need to add, and the first part of that will be the Awake Config feature set coming out this fall."