User Profile
Dave_Backman
Former Employee
Joined 7 years ago
User Widgets
Recent Discussions
Driving business continuity with OS updates
As I travel the globe to share best practices around Windows 10 servicing with IT professionals, our partners, and internal technical teams, I acquire new insights that inform and fine-tune my next discussions with Microsoft customers large and small. Today, as I was working from home as a result of our company’s recommendations during the current public health situation, I started to reflect on a scenario that to date we haven’t published guidance around: operating system (OS) servicing and business continuity. And, while the current global challenges have prompted me to write on this topic, the things I’m going to talk about today are certainly applicable for any situation in which a company may need to embrace extended remote work scenarios. So first, what do I mean by combining an OS servicing discussion with the concept of business continuity? Simply put, business continuity ensures that, for any given business, despite some type of significant disruption, mission critical operations for the organization can continue functioning at a basic level. This interim approach to operations ensures a company will survive as a viable entity until the disruption is remediated. As our Corporate Vice President Jared Spataro recently shared, Microsoft is embracing its social responsibility and desire to protect public health by enacting a level of business continuity for our company’s employees to work from home. This also means that my ability and effectiveness to work from home equates to a healthy, secure, and patched Windows 10 device. Certainly, my personal home device meets that criteria because I am a Microsoft customer and receive my security patches via Windows Update from the Windows Servicing and Delivery team on a regular basis. But does that device have everything on it that allows me to connect in a secure manner and remain seamlessly productive across corporate resources? The answer for me would be “probably,” but that might not be the case for our developers and other mission critical personnel that require a heightened level of security and access. So what about my Microsoft owned and managed device that’s capable of getting me to 100% of what I need on the corporate network? Is our IT team responsible for my device, able to see it and keep it compliant, especially with the latest security updates? Talking generally about security compliance in the context of business continuity, an unpatched machine on the Internet can be exposed to some malicious vulnerability, which could impact a user’s ability to connect to the corporate network and do their job from home. Multiply that threat across tens of thousands of employees also working from home and you have a scenario that could impact any well-developed business continuity plan by eliminating the ability for employees to safely and productively connect remotely on any given day. Fortunately, for Microsoft and our employees, our IT team has embraced the cloud and modern management such that they see my device on the open Internet and effectively service and patch my Windows 10 work machine. Leveraging modern management, they ensure that I will remain secure, productive and most importantly, compliant with our security policies. By leveraging Azure Active Directory (Azure AD), Microsoft Endpoint Manager (formerly Intune), and the policies in Windows Update for Business, the team can manage my machine business as usual, even in a zero-day scenario when a patch needs to be expediated. Our IT team, Core Services Engineering & Operations (CSEO), recently published a detailed guide on how they have embraced modern management and the move to the cloud. The key benefit of cloud management for any IT administrator is that the user does not have to be connected to the corporate network. If the user and device are connected to the Internet, the solution remains seamless. This capability all but eliminates a scenario of an exploit impacting large numbers of employees in a work-from-home scenario in order to support our current business continuity strategy. Is your organization in the position to support Windows 10 servicing and patching remotely in order to support a business continuity approach from home while keeping devices safe, compliant, and productive? While many organizations do have this type of capability, there’s a possibility of device health issues that might adversely impact patch compliance effectiveness, or might challenge on-premises deployment management solutions remotely as an administrator. With safe and secure aspects of business continuity addressed, how do we then address productivity? Simply put, in a very similar, cloud-based approach. For me, it’s just as important to keep my Office ecosystem up to date based on the corporate standard update cadence via the cloud update service. This keeps your users satisfied, up-to-date, and using the latest features and capabilities. Overnight, my world as well as that of my global peers switched from mostly in-person meetings to a new world where collaboration via the Office tools is the new norm. All of a sudden, Microsoft Teams became the center of my work universe so its ability to be reliable and scalable is critical to my success of staying connected, informed and collaborative with my remote peers. The ability to convert all those meetings from in-person to remote, and do so with confidence, ensured that critical work can still get done in this new remote norm. Further, scaling from an average of over one million Teams meetings and calls a month based on current usage, to a significant exponential bump, is also critical. In keeping users productive with corporate managed devices, how does the modern managed approach support remote workers in the event of a hardware failure? Fortunately for us, CSEO has not only embraced modern management, but also Windows Autopilot for the deployment of new hardware beginning back in January. In a business continuity scenario where a remote worker may experience a device failure, the user can now order a new device and have that device shipped directly from the OEM by following a few simple steps, and once received, they can be back up and productive in 5 to 10 minutes. Again, this detail is spelled out in the CSEO guide I referenced above. At the end of the day, if your IT team can move to embrace cloud-based and modern management practices, you can rapidly support an efficient business continuity approach that solves many of the traditional challenges IT has traditionally faced during times where large populations of users are required to work remotely. The capabilities offered today can help you more easily manage support solutions and capabilities that are designed to scale and provide continuity over both near and long-term requirements. For more information, check out some of these great pages dedicated to Windows 10 servicing: Windows as a service gateway Microsoft Intune Deploying Office 2019 for IT Pros Windows Autopilot Microsoft Teams Configuring Windows Update for Business Real-world practices to optimize Windows 10 update deploymentsReimagining IT to support the hybrid workforce
As I sit here in my home office, now three months into Washington’s statewide shelter in place order, I have reflected on my experiences working remotely during this time and how successfully I have adapted to this new normal. I have landed on a good routine, baked in ample breaks to get away from my laptop, and ensured that I map out my priorities towards a good work-life balance. My typical Windows 10 and servicing talking points have also evolved from espousing the virtues of Windows 10, the better together story, and why currency is so important for keeping clients patched and up to date to a discussion that now weaves in business continuity as a theme throughout the servicing journey. At the forefront of these discussions is the digital transformation journey of our enterprise customers, and how they are embracing modern and cloud management in order to successfully manage their endpoints to support remote worker scenarios. At the heart of these scenarios is the desire to keep users safe, secure, and productive while delivering a great user experience. Accomplishing this requires infrastructure optimization, scaling to match the endpoint population, and selecting the right tools (cloud-based) to minimize user and device impact. In order to bind the four pillars of supporting remote work with a solid user experience, infrastructure readiness, global deployment scale, and modern management, organizations need to overlay a basic business continuity framework. For Microsoft, that framework is as simple as respond/react, recover, and, in Satya’s new vernacular, reimagine. In this case, as IT professionals, we need to reimagine how we will embrace the new normal of a hybrid workforce. The challenge of the IT professional going forward is grappling with how to effectively service and support a hybrid workforce as quarantine restrictions are lifted, which, by most indications, will involve a percentage of the workforce returning to work while others remain remote, two very disparate scenarios from an IT perspective. Ideally, you can leverage a single management plane with a simplified estate, leveraging native operating system (OS) capabilities to deliver a consistent and seamless experience while providing the best user experience, regardless of scenario. A more common scenario, however, is one where an on-premises experience keeps users compliant, patched, and current while the remote user experience lags behind from a patching and currency perspective. Consider the experience and user impact should a remote user pop into the office for a meeting with a device that is six months out of date. That user connects to the network and is quickly burdened with a plethora of updates that may take them "offline" for a period of time. Parity across on-premises and remote work approaches, therefore, become paramount to your success with hybrid workforce scenarios. Regardless of the approach you take, it's important to simplify the toolsets, potentially down to a single management pane, including the tools necessary to effectively manage endpoints. This includes drivers and firmware, quality updates, OS feature updates, managing/protecting data at rest or in transit, and allowing efficient access to Office, productivity tools, and updates. It also includes hands-off hardware provisioning for remote workers and even internals, security, and compliance, as well as the deployment of line of business (LOB) and other applications. In short, it will require reimagining the enterprise, and architecting IT for digitally transforming the future. Certainly, for many of you, this will be a journey, while others have already embraced digital transformation and are much closer to the reimagination of IT. Internally at Microsoft, we were fortunate that our own internal IT organization had been piloting a full digital transformation in partnership with the product groups in order to achieve a solution that effectively addresses all the challenges of a hybrid workforce. Following a successful pilot, they implemented their hybrid workforce strategy this past January as an approach to managing the entire device estate. Phase 1: Respond/react Like other organizations that have fully transitioned to modern and cloud management, the first phase, or the respond phase, of Microsoft IT's approach to the need to immediately support a remote workforce in the face of COVID-19 was painless. Senior leadership sent out the mandate for the entire workforce to work remotely, document and grab whatever hardware they needed to setup a comfortable home office, and conduct business as usual through virtual collaboration tools like Microsoft Teams. For more traditional on-premises IT organizations, the respond phase included scrambling to purchase laptops and other hardware in order to support the remote work scenarios at a time where it was extremely difficult to do so due to silicon and hardware shortages. Phase 2: Rebuild For phase two, or rebuild, for Microsoft and others that had transitioned to cloud-based management practices, it was a matter of tweaking VPN capacity to match the remote workforce, and making any necessary modifications to VPN traffic to ensure internet friendly traffic like OS updates, M365 traffic and even browsing went directly to the internet versus traversing the VPN concentrators and the corporate networks. On the other end of the spectrum, for those with more traditional IT approaches, they were scrambling to first figure out how to remotely manage all these new remote devices, and then to accept a level of risk on the endpoints versus accepting additional risk on the corporate perimeters. Phase 3: Reimagine For our own reimagine phase, which will begin in low risk locations relatively unaffected by the global health crisis, Microsoft's leadership will begin turning the dial to allow a small percentage of essential workers to return to their respective offices. In short, by relying on Azure AD and leveraging our own security stack, Endpoint Manager, Microsoft Intune, Windows Update for Business, Windows Autopilot, a Zero Trust network, and VPN split tunneling, our IT department is primed to embrace the hybrid workforce. As a former IT professional myself, I highly recommend that organizations that have yet to move beyond the rebuild phase to invest time and effort start planning for a hybrid workforce when things start to slowly return to this new normal. The new normal will require more traditional IT organizations to address not only the technical implications associated with modern and cloud-based management, but also the cultural aspects of the transition. Legacy IT thinking, traditional security postures, service management maturity, change management, agility, and a willingness to embrace the cloud are all aspects to be assessed and addressed in order to position any organization for the new normal. Key considerations and factors to address Whether it is an on-premises or remote worker endpoint, the goal is to keep users safe, secure, and productive with minimal user impact. To achieve that goal, any IT organization needs an efficient and regular rhythm for applying drivers and firmware; deploying quality updates and OS feature updates; managing/protecting data at rest and in transit; allowing efficient access to Office, productivity tools, and updates; hands-off provisioning of hardware for remote workers and even internals; prioritizing security and compliance; and managing LOB and other application deployments. Here are a few great blogs and resources to leverage during those strategic discussions on how best to position an IT organization for the future: Transitioning to modern access architecture with Zero Trust Optimize Office 365 connectivity for remote users using VPN split tunneling Enhancing VPN performance at Microsoft Managing Patch Tuesday with Configuration Manager in a remote work world Leverage Microsoft Endpoint Manager as that Single Pane for Management Autopilot to Provision Endpoint Device without IT Intervention Build a Modern Data Platform Enforce Endpoint Security & Compliance Optimize Delivery of Windows 10 Feature Updates Optimizing Windows 10 Update Adoption Optimize Windows monthly update deployment for remote devicesReimagining IT to support the hybrid workforce: five months later
As I sit here in my home office, eight months into this new normal…wait, check that, that’s how I started the first in this series of blogs on Reimaging IT to support the hybrid workforce…five months ago. I have to admit that, as remote work scenarios have evolved over time, it would be a disservice if I didn’t discuss how things have evolved when it comes to supporting a hybrid workforce, or even my own remote work situation. Like many of you, I thought my remote work situation was temporary. I set up a makeshift office in my bonus room, which is now a permanent fixture. I thought I had a good work-life balance that included plans to get off the laptop periodically, but it just wasn’t enough. After five months of working from home, it was also evident that I was getting a little too sedentary, which caused some back issues. Fast forward to today. I now have a standing desk, something which I recently discovered, thanks to a team all-hands meeting, is a hot topic of discussion and has become the norm for many. I’m forcing myself to get outside on a more regular basis. I’ve also turned my dining room into a recording studio for the various presentations and sessions I deliver on a regular basis. In my first blog, I outlined Microsoft's internal business continuity framework, with its first two phases focused on “react” and “recover.” Based on customer engagements and conversations over the last three months, I can see that many organizations are starting to enter the final phase of the framework, or what we call “re-imagining IT.” I’ve received a lot of requests from customers to help address specific pain points, around patching and updating Windows, for example. From a timing perspective, I believe our first virtual Microsoft Ignite was a factor in organizations starting the process of moving into that final phase given all the announcements and discussions around embracing the hybrid workforce of the future. While Microsoft Ignite was a fantastic forum for new announcements, and there were many, each session was very solution-centric. I didn’t see anything pulling together a holistic and strategic discussion on supporting the hybrid workforce. With that in mind, my focus here will be on pulling together that holistic vision alongside recent announcements and new resources. Below you will find a high-level architectural view of how I see IT re-imagined and progress on the move towards cloud and modern management to support the hybrid workforce, which is what we’re doing today here at Microsoft. As a recap, whether it is an on-premises or remote worker endpoint, the goal is to keep devices in your organization safe, secure, and productive with minimal user impact. To achieve that goal, IT organizations need: Efficiency and regular rhythm when applying drivers and firmware Rhythm when deploying quality updates and OS feature updates Management and protection protocols when protecting data at rest and in transit Efficiency when access to Office, productivity tools, and updates Hands-off provisioning of hardware for remote workers and even internals Securing browser access by using the new Microsoft Edge Prioritization of security and compliance Management of line-of-business (LOB) and other applications, including secure connectivity for mobile iOS and Android devices The foundation and success of this cloud and modern approach hinges on a zero-trust network and split tunnel capability to direct mission critical business traffic via VPN, all while pushing all other non-essential traffic directly to the internet, including Office and Windows updates coming from the Microsoft infrastructure, network, and CDNs. A recent blog on the Microsoft 365 Connectivity principles does a great job in outlining this recommended approach of managing the split tunnel concepts while the zero trust model and assessment tool can assist companies in adopting the concept. Certainly securing devices is at the core, but it’s also inclusive of securing and protecting the users identities. Hot off the presses from Ignite, we also announced the Microsoft Tunnel Gateway, which closes the gap around secure LOB connectivity from your iOS and Android devices. While addressing the security topic, check out the latest release of the Digital Defense Report, which outlines the latest threat intelligence and guidance, with a special section dedicated to securing the remote worker and endpoints. With security architecture in place, it covers the need to protect your company’s IP and data while in transit and at rest, assuming Microsoft Defender for Endpoint and a hearty DLP are in place on the end point. As the Defense Report calls out, it’s important to realize that as company data is being stored off premises, a heightened awareness on endpoints is critical. I also recommend leveraging the security baselines that get published with every Windows 10 update and other solution releases to ensure that as they’re deployed, your policies either remain active or are incremental with the new feature and capabilities. Further, leverage the Microsoft Compliance Manager to ensure security and compliance requirements are met within SLAs across the application portfolio. By leveraging Update Compliance, it also gives you insights into our safeguard holds to assist you in place to minimizing user impacts to devices that may experience compatibility issues which may elicit an update failure. The other benefit of deploying split tunnel VPN for Windows is that it provides you flexibility of leveraging a number of different update solutions, whether it be Windows Update, Microsoft Intune, Windows Update for Business or a combination of solutions that meet your needs and requirements. Split tunnel VPN for Office also offers the same benefits as Windows and still allows for some configuration flexibility to meet your requirements. In addition, by leveraging Windows Update to manage Edge browser updates, you can also bypass the corporate VPN and push those updates directly to the internet as well. Making the move to the cloud Now that we’ve discussed the foundation of a rock solid security approach, and one that can minimize bandwidth impacts on a corporate VPN solution, let’s look deeper at a model of modern and cloud management capabilities that allows everything to be managed on a remote endpoint. A good reference model would be our own internal IT approach to endpoint management, as shown here: Internally, it starts with the Microsoft Endpoint Manager solution. Microsoft Endpoint Manager brings that concept of a single pane of management glass to life. Not only does it fully integrate with your on-prem deployment of configuration manager so you can continue to leverage it to manage on-prem devices if you so choose, it also fully integrates with Intune for remote worker endpoint scenarios. Further, while it provides management capabilities, it also becomes that all important dashboard to help drive compliance, as well as provide you endpoint data that allow you to make data-driven decisions around improving device productivity via endpoint analytics, device health and upgrade readiness via Desktop Analytics, and more. With Microsoft Endpoint Manager, you can then start managing remote worker scenario’s and endpoints via Intune as long as the devices are Azure AD joined. In our scenario, we manage the device policies via Intune but leverage Windows Update for Business to manage the actual deployments of Windows 10 feature updates and quality updates, with all still managed via Microsoft Endpoint Manager. This configuration keeps all the update traffic internet-centric, and pulls the content directly from the Microsoft Content Delivery Network (CDNs), thus eliminating impact on any corporate VPN solution. As a side note, the feature updates do not include the Windows 10 optional content such as features on demand (FODs), language packs (LPs) or the local experience packs (LXPs). In order to address that capability, a great post on Acquiring optional content was recently published that includes a highly comprehensive guide and how-to. The overall goal of this process is to ensure compliance, keep users and their devices secure and productive as possible. This requires setting up Windows Update for Business and optimizing updates in order to achieve the stated goals during any deployment to the remote worker. In the near future, we should be seeing more improvements in the ability to better support and deployments with greater granularity. This defined approach is great for supporting existing endpoints that are part of the estate. What it doesn’t do is address one of the biggest challenges of managing and supporting the hybrid workforce: the hands-off provisioning and deployment of newly purchased devices. Having said that, the foundation of supporting Windows Autopilot is already in place via Microsoft Endpoint Manager, Intune and Azure AD. Windows Autopilot is exactly how we here at Microsoft address hands-off provisioning for newly purchased devices. Devices are purchased and shipped directly to end users, who can connect to the internet, log into the machine and be fully functioning in roughly 10 minutes with out any intervention from IT. Certainly, having a light device footprint and primarily pushing down GPOs improves the user experience, so the balance becomes a decision on how many applications you may or may not want to include as part of the process. More apps mean more data to be pushed, and the greater the impact to getting the users into productive state. This segues into the application deployment discussion and challenge of how you can deploy LOB applications and manage updates to your applications. In many ways it boils down to approach: you can use a push or end user pull model. The push model is certainly one that’s supported by the aforementioned architecture, anchoring on Intune as the deployment mechanism. At the enterprise SKU level, Intune supports a broad array of supported application packaging technologies that organizations can package up and push to remote worker endpoints efficiently with the new MSIX packaging format being the recommended approach based on its flexibility. Given Intune is capable of supporting Android and iOS devices, in conjunction with MSIX, you can also deploy LOB to mobile devices. If you layer in the previously mentioned Microsoft Tunnel Gateway solution, you can also provide secure mobile connectivity to those LOB applications. For the pull model, organizations have a number of options for users to pull applications including the Store for Business, a company supported portal that is externally facing. From my perspective, I would consider avoiding application deployment in the remote worker scenario, and instead leverage Windows Virtual Desktop as the most secure, robust and scalable approach that provides LOB application owners 100% control of delivery and support of applications in Windows Virtual Desktop including secure delivery, protecting data at rest and in transit. Optimizing delivery mechanisms With the technology foundation and architecture discussion under our belts, there is one final topic of supporting the hybrid workforce which is probably the most important: optimization of the deployment of Windows updates. This goes beyond the technology necessary to drive deployment success, and instead covers other critical pieces of information you need to consider in the process. The first piece is to understand the best practices and considerations for the Microsoft-recommended policy considerations feature set over feature set. These are all outlined in the Windows 10 Update Baseline, which, like the security baselines, represents a set of tools and guidelines that assist you in making important policy decisions to ensure deployments are optimized to their fullest. Next, ensuring the tools and guidelines for optimizing both feature updates and quality updates will ensure efficient delivery of the bits, minimize bandwidth impact and provide the greatest level of user experience. It is also important for any one in the position of deploying Windows updates, that you are fully educated on any issues Microsoft has surfaced during our normal course of business in servicing more than one billion devices worldwide via the Windows 10 release notes. Finally, leverage the Video Hub for technical deep dives on all of the aforementioned tech by leveraging the filters on your solution area of interest. Conclusion In closing, I hope this helps tie all of our solutions and services together into a cohesive storyline that provides you with that longer term, more strategic, and holistic picture of what it takes to “re-imagine IT” support for the hybrid workforce. At the end of the day, it’s all about embracing digital transformation in order to go towards cloud and modern management. This is not a technology discussion given that I believe this post shows that the technology is viable, but instead a cultural paradigm shift for many organizations with the current situation serving as a forcing function. Use the time to explore new opportunities in your estate that unlock new ways of servicing your remote endpoints and drive change in your organization that embrace service management maturity for the hybrid workforce, as it appears to be the new normal moving forward.Re: Autopilot
Hey Phyllis... Great question and its been identified as a gap and to add to Steves content. I am meeting with our lab team next week to get a hands on lab and content created that will eventually be posted on the M365 Lab site. In the mean time, we do have a YouTube video posted at aka.ms/MEMPlaylist. Check it out...Re: Driver Management: What does Microsoft recommend?
EricOhlin was just looking through the CSEO (MS IT) Windows 10 deployment deck and do not see any references to their approach to managing this age old challenge for most IT Pro's. Let me reach out to them and get you the answer to how we manage these internally. Stay tuned!Updated for 20H2: Windows 10 gets better with every release
With each release, Windows 10 improves from a security, productivity, and manageability perspective. But the underlying message, and what makes it all possible, is the agility and unbelievable engineering innovation that simplifies the servicing process for the IT Pro. Delivering on my promise to make it a habit to share the better together slides with each release, the version attached to this post covers IT innovations through Windows 10, version 20H2--and the end of service (EOS) date for each feature set so you don't get too close to hitting EOS for any of the devices in your estate. Stay tuned for the next update!Servicing Windows: A resource guide
During my visits with customers, I'm often asked, "Where do I find more information on [XYZ]?" and my follow-up emails often contain the same group of links when it comes to resources about Windows as as service and managing feature or monthly updates. As a result, I thought I'd make a quick post listing those resources: Windows as a service "home" page What is Desktop Analytics? Desktop Deployment Center Overview of Windows Autopilot Application compatibility in the Windows ecosystem Microsoft Connected Cache Windows 10 update history Desktop App Assure overview Windows Insider Program for Business FastTrack for Microsoft 365 Modern Desktop Assessment (for partners or those working to migrate to, and help customers stay current with, Windows 10) And, for those who want to hear and learn about servicing concepts and practices directly from the engineers and product experts, I'd recommend the following sessions from Microsoft Ignite 2019 in Orlando--all of which are available on demand: Keeping 600 million devices protected, productive, and healthy (Carlos Picoto) Demystifying Windows 10 Dynamic Update (Steve DiAcetis) Understanding and deploying Windows 10, version 1909 (Vivek Singh Gaur) Accelerate app testing against new Windows builds (Rahul Gupta) Strategic and tactical considerations for ring-based Windows deployments (John Wilcox, Sean McLaren_ Transforming update management with cloud controls (Jesse McGatha) Solving Windows 10 feature updates in a multilingual environment (Sudhagar Thirumoolan) How to manage Windows 7 Extended Security Updates (ESUs) for on-premises and cloud environments (Michael Raschko) Provide a great end user update experience by utilizing update management policies (Aria Carley) Make the Windows update experience smooth and seamless (Suma SaganeGowda) Ask the experts: Modern deployment & device management (Thomas Trombley)
