AMA: Windows security and best practices

Andrew_Beard
Copper Contributor
Jun 04, 2024
Hi - I am interested in deploying the cloud PKI infrastructure for Intune to a customer who uses cloud only Windows devices but wishes to authenticate their Wi-Fi and VPN using certificates from the computers and users. https://learn.microsoft.com/en-us/mem/intune/protect/microsoft-cloud-pki-deployment The VPN accesses a few servers in an AzureAD DS or in a legacy AD lifted to run on Azure cloud machines. They have no legacy Certificate Authority and as a small company of between 20 and 50 users and client workstations, cannot afford third party solutions for RADIUS which are all the instructions I find when searching the web for practical step by step implementation instructions like this from Oliver Kieselbach: https://oliverkieselbach.com/2024/03/04/how-to-configure-cloud-pki-certificate-based-wifi-with-intune/ My issue when reading through the Microsoft learning documentation I find that it wants another separate PKI or CA service is needed (or a certificate from the third party Radius service?) - I thought that was they whole point of the Cloud PKI service - not to have to have another one? "When connecting to a relying party such as a Wi-Fi access point or VPN server, an SSL/TLS connection is first established by the managed Intune device when attempting to connect. Microsoft Cloud PKI doesn't provide these TLS/SSL certificates. You must obtain these certificates through another PKI or CA service." From: https://learn.microsoft.com/en-us/mem/intune/protect/microsoft-cloud-pki-deployment#ensure-chain-of-trust Can you help me with this as I don't understand why the cloud PKI alone would not be sufficient to provide the Root and intermediate root certs exported and uploaded to the VPN gateway/firewall and the network access point controllers for Wi-Fi when combined perhaps with the Microsoft cloud NPS extension service, but then again that also needs an on prem AD with Radius server and presumably a CA server? https://learn.microsoft.com/en-us/entra/architecture/auth-radius I am happy to use SAML and SSO in Entra for the VPN which may negate the requirement for RADIUS and NPS, but how would that work for Wi-Fi? Is that also possible?
- Jason_Sandys
  Microsoft
  Jun 05, 2024
  Hi Andrew. The crux of the limitation here is that the current Cloud PKI offering in Intune is for issuing certs to managed devices only. VPNs and WAPs typically require their own SSL/TLS cert to establish the secure connection with the client but since these are not Intune manageable devices, Cloud PKI cannot be used to issue certs to them. Note that a service side cert is required to established the secure channel -- a client-side cert cannot be used for this. We are aware of these types of scenarios (there are others) but they were not part of the initial scope for the solution; they are something we've discussed investigating but there's nothing to share about this today.
Char_Cheesman
Community Manager
Jun 05, 2024
Welcome to the AMA: Windows security and best practices. Let's get started! Post your questions in the Comments. We'll be answering questions in the live stream and in chat.
lexcyn
Steel Contributor
Jun 05, 2024
It would be really nice if in the Intune built in compliance settings we had a Windows Hello for Business setting natively so we could ensure users have it registered since our business requires it to be registered (we are currently relying on custom compliance scripts that are a bit wonky)
- Jason_Sandys
  Microsoft
  Jun 06, 2024
  Thank you for the feedback. There are aspirations for this but nothing to share at this time. An alternate approach here is to remove the password credential provider from the Windows login screen ensuring that users can only use WHfB to sign in: https://techcommunity.microsoft.com/t5/windows-it-pro-blog/windows-passwordless-experience-expands/ba-p/3962005
  - lexcyn
    Steel Contributor
    Jun 07, 2024
    Thanks! This would be something that we'd look at a bit farther along in the future since we are not quite there to support a true password less environment yet 🙂
RuanITCJ
Brass Contributor
Jun 05, 2024
We remove Quick Assist from our devices because there are no policies that provide us with security and control over who can send or receive requests. Will there be any policies coming for Enterprises to control Quick Assist?
- Jason_Sandys
  Microsoft
  Jun 05, 2024
  I don't know of anything specific planned for Quick Assist itself as central management requires a management tool like Intune and thus this is the entire purpose of Remote Help in Intune.
  - RuanITCJ
    Brass Contributor
    Jun 05, 2024
    The problem with Remote Help in Intune is that it requires an additional license. Not sure why it's not included as part of the normal Intune license.
- Char_Cheesman
  Community Manager
  Jun 05, 2024
  Thanks for participating in today's session of AMA: Windows security and best practices! For reference, the panel covered your question at 20:10.
SimonHalpin
Copper Contributor
Jun 05, 2024
We are looking at using Security BaseLines in Intune and move away from the CIS hardening policy we currently apply via GPO as part of our migration away from GPO'S. Is there an already documented process that can easily identify each setting in security baseline and where they map against CIS policy?
- Joe_Lurie
  Microsoft
  Jun 05, 2024
  SimonHalpin There is no one to one mapping between Security Baselines and CIS Benchmarks. See FAQ here: Learn about Intune security baselines for Windows devices | Microsoft Learn
  - SimonHalpin
    Copper Contributor
    Jun 05, 2024
    OK, my scenario is I need to justify to our IT security team why I believe Intune Baselines would be better for us as an organistion over the CIS policy. My main reason is to get away from GPO and eventyually move devices to Entra joined rather than hybrid. When we scan a machine witht the CIS SAT checker tool , the CIS policies make it 64% compliant where as a security baseline only built machine is 43% compliant. Now, I did try to explain that the CIS tool is marking its own homework so it wasnt a fair comparison but I need to show that baselines will secure us better and make it easier to make changes moving forward
- Jason_Sandys
  Microsoft
  Jun 05, 2024
  Hi Simon. I'm not sure if I follow the intent here. If you are moving away from CIS, why do you need to have a mapping between the Windows security baseline and CIS? Ultimately, to answer the question though, no, CIS is the product of a third-party and thus we don't provide any direct collateral or guidance on how to use or implement it. Our recommendation and guidance is that the Windows security baseline is sufficient to begin your journey for locking down Windows.
rb-qcm
Copper Contributor
Jun 05, 2024
Can you give a quick description of how Lighthouse can also be used not only to manage Office 365, but to also create new user accounts in On-prem hybrid environments and sync to Azure using Automation through Azure Arc?
mohaa98
Brass Contributor
Jun 05, 2024
Is there a way to deploy a standard M365 Update channel to clients via Intune but also permit users to change to a different channel if they choose? (We have the monthly channel set in the App deployment via Intune and set in M365 Admin channel) Are there any security concerns with permitting users to choose a different update channel?
- NateNielsen
  Microsoft
  Jun 05, 2024
  Hi Jonathan, users are unable to change to a different update channel. Only an IT administrator can control what updates from a specific channel get pushed down to an end user device.
  - mohaa98
    Brass Contributor
    Jun 05, 2024
    Are you able to target a subset of users via a separate app deployment with Intune to use a different channel or is your tenant locked to one channel due to the setting in the M365 admin center?
Saxe1234
Occasional Reader
Jun 05, 2024
How about Microsoft Recall? We have Citrix Farm and we offer SSH/RDP access for Windows clients which are not under our control. And we dont like the idea that Windows is automating in taking screenshots even if they are stored locally (for now).

From which apps will be screenshots taken? Only Microsoft owned apps or anyone?
- Char_Cheesman
  Community Manager
  Jun 05, 2024
  Thanks for participating in today's session of AMA: Windows security and best practices! For reference, the panel covered your question at 29:40.
bdoknack
Brass Contributor
Jun 05, 2024
What is the roadmap for Defender and ARM and feature parity with x64 processors?
- Joe_Lurie
  Microsoft
  Jun 05, 2024
  bdoknack Thanks for the question. We can't really give roadmap info here, but generally speaking, we are looking throughout the Intune admin center to any place where Arm management does not have feature parity to x64, and looking to add that parity. Keep an eye on the https://aka.ms.IntuneInDev and https://aka.ms/IntuneNew pages for features under development or newly released.
- Char_Cheesman
  Community Manager
  Jun 05, 2024
  Thanks for participating in today's session of AMA: Windows security and best practices! For reference, the panel covered your question at 26:50.
Kevin1575
Occasional Reader
Jun 05, 2024
When will Config Refresh be GA?
- Jason_Sandys
  Microsoft
  Jun 05, 2024
  Kevin Sheehan addressed this on camera a few minutes ago (somewhere around the 18 minute mark). It's already GA today but requires the 5D update (May out of band quality update which will be rolled into the June monthly cumulative update). To my knowledge, there is a blog in coordination that will discuss this as well.
- Joe_Lurie
  Microsoft
  Jun 05, 2024
  Kevin1575 When we GA a new feature from a preview status, that GA date is based on quality, not on the calendar. Today we do not have a GA date to share. Please keep an eye on the https://aka.ms/IntuneNew page for any updates to Config Refresh.
- Char_Cheesman
  Community Manager
  Jun 05, 2024
  Thanks for participating in today's session of AMA: Windows security and best practices! For reference, the panel covered your question at 32:40.

Event banner

Event details

Location

Date and Time