2. Today’s challenges Data Users Apps Devices
The explosion of devices is eroding the standards-based approach to corporate IT.
Devices
Data
Users need to be productive while maintaining compliance and reducing risk.
Users expect to be able to work in any location and have access to all their work resources.
Users
Deploying and managing applications across platforms is difficult.
Apps

3. Management. Access. Protection.
People-centric IT
Users
Devices
Apps
Data
Enable your end users
Allow users to work on the devices of their choice and provide consistent access to corporate resources.
Unify your environment
Deliver a unified application and device management on- premises and in the cloud.
Protect your data
Help protect corporate information and manage risk.
Management. Access. Protection.

4. Access and Information Protection
Unify your environment
Common identity to access resources on-premises and in the cloud √
Empower users
Protect your data
Centralize corporate information for compliance and data protection
Policy-based access control to applications and data
Simplified registration and enrollment for BYO devices
Automatically connect to internal resources when needed
Access to company resources is consistent across devices

5. Empower users Challenges Solutions
Users want to use the device of their choice and have access to both their personal and work- related applications, data, and resources.
Users want an easy way to be able to access their corporate applications from anywhere.
IT departments want to empower users to work this way, but they also need to control access to sensitive information and remain in compliance with regulatory policies.
Users can register their devices, which makes them known to IT, who can then use device authentication as part of providing access to corporate resources.
Users can enroll their devices, which provides them with the company portal for consistent access to applications and data, and to manage their devices.
IT can publish access to corporate resources with conditional access based on the user’s identity, the device they are using, and their location.

6. Enabling IT to empower users
Users can enroll devices for access to the Company Portal for easy access to corporate applications
IT can publish Desktop Virtualization (VDI) for access to centralized resources
RDS Gateway
VDI
Session host
Users can work from anywhere on their device with access to their corporate resources.
Web Application Proxy
IT can publish access to resources with the Web Application Proxy based on device awareness and the users identity
Web Apps
Files
LOB Apps
Remote Access
IT can provide seamless corporate access with DirectAccess and automatic VPN connections.
Active Directory
Users can register devices for single sign-on and access to corporate data with Workplace Join

7. Registering and Enrolling Devices
Users can enroll devices which configure the device for management with Windows Intune. The user can then use the Company Portal for easy access to corporate applications
Data from Windows Intune is sync with Configuration Manager which provides unified management across both on- premises and in the cloud
Active Authentication
Active Directory
ADFS
Users can register BYO devices for single sign- on and access to corporate data with Workplace Join. As part of this, a certificate is installed on the device
Web Application Proxy
IT can publish access to corporate resources with the Web Application Proxy based on device awareness and the users identity. Multi-factor authentication can be used through Windows Azure Active Authentication.
As part of the registration process, a new device object is created in Active Directory, establishing a link between the user and their device

8. Demo
Workplace Join

9. Publish access to resources with the Web Application Proxy
AD Integrated
Developers can leverage Windows Azure Mobile Services to integrate and enhance their apps
Other cloud based apps and identity stores
Mobile Services
Published applications
Restful OAuth apps
Office Forms Based Access
Claims & Kerberos web apps
Use conditional access for granular control over how and where the application can be accessed
Active Directory
ADFS
Devices
Apps & Data
Web Application Proxy
Reverse proxy pass through
e.g. NTLM & Basic based apps
Users can access corporate applications and data wherever they are
Active Directory provides the central repository of user identity as well as the device registration information
Active Directory
IT can use the Web Application Proxy to authenticate users and devices with multi-factor authentication

10. Demo
Web Application Proxy

11. Make corporate data available to users with Work Folders
Active Directory discoverability provides users Work Folders location
IT can configure a File Server to provide Work Folder sync shares for each user to store data that syncs to their devices, including integration with Rights Management
IT can selectively wipe the corporate data from Windows 8.1 clients
Active Directory
Reverse Proxy
Devices
Apps & Data
File Services
Web Application Proxy
Domain joined devices
Access Policy
Users can sync their work data to their devices.
Users can register their devices to be able to sync data when IT enforces conditional access
IT can publish access directly through a reverse proxy, or conditional access can be enforced via device registration through the Web Application Proxy

12. Demo
Work Folders

13. Effective working with Remote Access
An automatic VPN connection provides automated starting of the VPN when a user launches an application that requires access to corporate resources.
Web Apps
Session host
LOB Apps
Files
VDI
Cannot originate admin connection from intranet
VPN
Traditional VPNs are user- initiated and provide on- demand connectivity to corporate resources.
Firewall
Can originate admin connection from intranet
With DirectAccess, a users PC is automatically connected whenever an Internet connection is present.
DirectAccess
Connection to
intranet is always active

14. Unify your environment Challenges Solutions
Providing users with a common identity when they are accessing resources that are located both on- premises in a corporate environment, and in cloud-based platforms.
Managing multiple identities and keeping the information in sync across environments is a drain on IT resources.
Users have a single sign-on experience when accessing all resources, regardless of location.
Users and IT can leverage their common identity for access to external resources through federation.
IT can consistently manage identities across on- premises and cloud-based identity domains.

15. Expanded domain join capabilities
Not Joined
Workplace Joined
Domain Joined
User provided devices are “unknown” and IT has no control. Partial access may be provided to corporate information.
Registered devices are “known” and device authentication allows IT to provide conditional access to corporate information
Domain joined computers are under the full control of IT and can be provided with complete access to corporate information
Browser session single sign-on
Seamless 2-Factor Auth
for web apps
Enterprise apps single sign-on
Desktop Single Sign-On

16. Active Directory for the cloud
Leverage cloud platforms to run Windows Server Active Directory and Active Directory Federation Services to reduce infrastructure on-premises.
Files
LOB Apps
Web Apps
Infrastructure Services
Developers can integrate applications for single sign-on across on-premises and cloud-based applications.
Manage Active Directory using Windows PowerShell, use the improved deployment experience and leverage the Active Directory Administrative Center for centralized management
Active Directory
Activate clients running Office on at least Windows 8 or Windows Server automatically using existing Active Directory infrastructure.
Run Active Directory at scale with support for virtualization and rapid deployment through domain controller cloning.

17. Managing cloud identities
3rd party services
Apps in Azure
Developers can build applications that leverage the common identity model
Active Directory
Web Apps
LOB Apps
Files
Users get access through accounts in Windows Azure Active Directory to Windows Azure, Office 365 and 3rd party applications
DirSync
Active Directory
ADFS
Users are more productive by having a single sign-on to all their resources
IT can use Active Directory Federation Services to connect with Windows Azure for a consistent cloud based identity.
IT can provide users with a common identity across on- premises or cloud-based services leveraging Windows Server Active Directory and Windows Azure Active Directory
Dirsync keeps user attributes in sync across directories.

18. Increasing the value in Active Directory Federation Services
SaaS Apps
Organizations can connect to SaaS applications running in Windows Azure, Office 365 and 3rd party providers
Enhancements to ADFS include simplified deployment and management
ADFS
Active Directory
Organizations can federate with partners and other organizations for seamless access to shared resources
Resources in other businesses or identity realms
ADFS
Firewall
Web Application Proxy
(includes ADFS Proxy)
Published applications
Restful OAuth apps
Office Forms Based Access
Claims & Kerberos web apps
Conditional access with multi- factor authentication is provided on a per-application basis, leveraging user identity, device registration & network location
Users can register their devices to gain access to corporate data and apps and single sign-on through device authentication

19. Demo
ADFS

20. Corporate identity management
Users can reset their passwords via Windows logon, significantly reducing help desk burden and costs.
Active Directory
Manage the complete life cycle of certificates and smart cards through integration with Active Directory.
Sync users identity across directories, including Active Directory, Oracle, SQL Server, IBM DS, and LDAP.
Self-service group and distribution list management, including dynamic membership calculation in these groups and distribution lists, is based on the user’s attributes.
Allow users to manage their identity with an easy to use portal, tightly integrated with Office.

21. User provisioning, de-provisioning, and role updates
Active Directory
Automate the process of on-boarding new users
Real-time de-provisioning from all systems to prevent unauthorized access and information leakage
LDA P
Certificate Management
Automatically synchronize all user information to different directories across the enterprise
Built-in workflow for identity management

22. Protect your data √ Challenges Solutions
As users bring their own devices in to use for work, they will also want to access sensitive information and have access to this information locally on the device.
A significant amount of corporate data can only be found locally on user devices.
IT needs to be able to secure, classify, and protect data based on the content it contains, not just where it resides, including maintaining regulatory compliance.
Users can work on the device of their choice and be able to access all their resources, regardless of location or device.
IT can enforce a set of central access and audit polices, and be able to protect sensitive information based on the content of the documents.
IT can centrally audit and report on information access.

23. Policy based access to corporate information
IT can provide a secure and familiar solution for users to access sensitive corporate data from anywhere with VDI and RemoteApp technologies.
Centralized Data
Desktop Virtualizatio n
RDS Gateway
Distributed Data
Devices
LOB Apps
Web Apps
Session
host
Files
VDI
Access
Policy
Users can access corporate data regardless of device or location with Work Folders for data sync and desktop virtualization for centralized applications.
IT can publish resources using the web application proxy and create business-driven access policies with multi-factor authentication based on the content being accessed.
IT can audit user access to information based on central audit policies.

24. Protecting information with multi-factor authentication
Active Authentication
1. Users attempts to login or perform an action that is subject to MFA
2. When the user authenticates, the application or service performs a MFA call
3. The user must respond to the challenge, which can be configured as a txt, a phone call or using a mobile app
4. The response is returned to the app which then allows the user to proceed
Devices
Apps & Data
Application authentication
e.g. Active Directory, Radius, LDAP, SQL, Custom apps
ADFS
5. IT can configure the type and frequency of the MFA that the user must respond to
User

25. Demo
Windows Azure Active Authentication (PhoneFactor) Dependent on network connectivity 

26. Protect data with Dynamic Access Control
File Services
Active Directory
Automatically identify and classify data based on content. Classification applies as files are created or modified.
File classification, access policies and automated Rights Management works against client distributed data through Work Folders.
Centrally manage access control and audit polices from Windows Server Active Directory.
Integration with Active Directory Rights Management Services provides automated encryption of documents.
Central access and audit policies can be applied across multiple file servers, with near real- time classification and processing of new and modified documents.

27. Demo
Dynamic Access Control

28. Recap: Access and Information Protection
Unify your environment
Common identity to access resources on-premises and in the cloud √
Empower users
Protect your data
Centralize corporate information for compliance and data protection
Policy-based access control to applications and data
Simplified registration and enrollment for BYO devices
Automatically connect to internal resources when needed
Access to company resources is consistent across devices

29. Related content Breakout Sessions
WCA-B204
Active Directory Enables User Productivity and IT Risk Management Strategies Across a Variety of Devices
WCA-B214
Windows Server Work Folders overview – my corporate data on all my devices
WCA-B332
Windows Server Work Folders – a deep dive into the new Windows Server data sync solution
WCA-B333
Enable work from anywhere without losing sleep: remote access with the Web Application Proxy and VPN solutions
WCA-B334
Secure anywhere access to corporate resources such as Windows Server Work Folders using ADFS
Hands on lab
Active Directory Deployment and Management Enhancements
Using Dynamic Access Control to Automatically and Centrally Secure Data
Introduction to DirectAccess in Windows Server 2012
Windows Server 2012 R2 Work Folders
Access & Information Protection Booth

30. © 2018 Microsoft Corporation. All rights reserved
© 2018 Microsoft Corporation. All rights reserved. Microsoft, Windows and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

31. 更多免费PPT模板，请关注蜜蜂演示