Force users to "entra register" their devices
Hi, is it possible to force user to register their devices when they log in with their company account to any other device than company owned? I tested on my private smarthphone. Logged in as normal user with company account and my device did not show up in entra as "Microsoft Entra registered" Any ideas? Thanks
Compliance licenses at tenant level
Hi, We are a small organization of about 200 employees, and we have following requirements. DLP policies configuration at Exchange, OneDrive, SharePoint BYOD security Users should not be able to send files outside the org And so on as we evaluate We already have M365 Business Premium. However, after researching we figured out that M365 Business premium will alone not solve our requirements. May be compliance license will. We want to apply security policies at tenant level in our organization but definitely do not want every user to get licenses as this will be expensive for us and there is no requirement at all for our users. The question is, Is there a way to solve the above scenario?Splitting a 365 Tenancy?
Hi, So the situation is that a company has two branches, one local (to me) and the other overseas. Currently all the IT is based around a single Microsoft 365 Tenancy (with third party extensions for DMARC and email spam/phishing protection) administered from the overseas branch. This is reportedly leading to some issues, the two branches have different security requirements (the local branch can afford to be more open with regards to BYOD for example), having to go through the overseas admins for almost every change is inconvenient, and also importantly some data should be compartmentalized (notably there is local information that ideally should not be visible to anybody in the overseas department, including the admins). So having been asked to look into options, and being quite new to the inner workings of 365, after some investigation it seems prima facia that a solution might be to split the tenancy into two, moving the local office members into the new tenancy which would be controlled by a local admin, and then connecting the two possibly with a multi-tenant organization. Obviously everyone would need to keep the same email addresses. So, what I would like to check is 1) Is this possible? 2) Is this a sensible solution to the problem? 3) (Assuming the first answer is "yes" and the second at least a "maybe") any pointers to how to do it and any things to watch out for? Any help/suggestions would be greatly appreciated.
Self Service Reset password (SSPR)
Hi I have an odd situation with random users. When SSPR is enabled for them, they cannot login email on their iPhone corporate Intune device, is pushing the login to conditional access trusted locations blocked. Email works just fine with SSPR disabled. Anyone experience something similar.SSPR at the windows sign-in screen by creating a device policy in Intune
Hi We are gradually deploying SSPR at the windows sign-in screen by creating a device policy in Intune. Option B mentioned in this article is to deploy a registry. My question is, does the registry get deployed with the Intune device policy? Because I have the registry below and I did not add it. HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\AzureADAccount "AllowPasswordReset"=dword:00000001Deploy Sophos userspecific VPN-configurations
Is there a way to deploy with one app in intune for each user a specific Sophos SSL VPN Configuration. Each configuration is in the users OneDrive und needs to be copied in C:\Program Files (x86)\Sophos\Sophos SSL VPN Client\config. The users have no admin rights and can't write in C:\Program Files (x86)\Sophos\Sophos SSL VPN Client\config.
