Windows Store \ Microsoft Account?

[gshaw]

Another one of those little problems I wonder if there's a better way around but can't see one at present...

 

We've ordered in a couple of Dell Venue Pro 11 tablets for staff use, not joined to a domain at present. We want the staff to be able to install Windows Store apps as they need, said staff are also on Office 365 for email etc.

 

As it stands the only method I can see for each person is:

 

- set up a Microsoft (i.e. personal) account with their work email address

- set up either local or linked Microsoft account on the device

 

If I don't either set up the Microsoft account or give instructions how to do so the staff won't be able to use the Windows Store. Not sure if this changes once machines are domained, can anyone confirm?

 

One day I hope MS will sort out this authentication mess they have with the two separate systems and enable Office 365 accounts to be used with the Store, wouldn't that just make so much more sense?!

Edited April 2, 2014 by gshaw

[AngryTechnician]

Everything you have said is 100% correct and does not change when the machine is domain-joined.

 

I'm certain that that full logon using Azure AD (which is the backend of O365) will come to Windows eventually, but I'd wager we're a few years off before it happens.

Edited April 2, 2014 by AngryTechnician

[gshaw]

What would be really powerful would be to have the Store as an Azure service so basically it'd be another 365 app e.g. https://store.yourdomain.ac.uk - at which point the organisation would have full control of what appears, for example a choice of...

 

- approved apps only

- pre-purchased apps via site license, click and download as required + free apps

- full access to everything purchases need to be approved by organisation's Store admin before money is taken or set pre-paid limit e.g. £20 per user.

 

I know MS are pushing InTune MDM as a way to manage some of this but would be nice to allow users to access the Store experience and breadth of choice whilst still giving admins a way to push out key apps and avoid runaway purchasing.

[disk]

You can join them to your domain and associate Microsoft Accounts to Domain Accounts. This allows you to maintain control over them while still allowing them to access the Windows Store. I haven't looked into automating this process, but I imagine there is a way (powershell?). To do it manually you go to PC Settings -> Accounts -> Your Account -> Connect to a Microsoft account.

[gshaw]

I'm guessing the creation of those accounts is still manual though or does it auto-create them on demand? What controls do you get with GPOs, is it a case of "block access to Store" or something more granular? Just getting a dev network with 2012 R2 up at the moment but haven't had chance to join any Win8.1 devices to it yet...

[AngryTechnician]

I haven't looked into automating this process, but I imagine there is a way (powershell?).

There isn't. Accounts have to be created manually and linked to the domain account manually.

 

What controls do you get with GPOs, is it a case of "block access to Store" or something more granular?

You can block the store entirely (easy to implement) or you can whitelist/blacklist individual apps that can be installed using AppLocker (more complicated). Both approaches can be applied on a per-user basis.

[psydii]

Is there a good place to learn this stuff? Once upon a time there were the resource kits, but now it just seems to be variable quality blogs in technet?

[gshaw]

Is there a good place to learn this stuff? Once upon a time there were the resource kits, but now it just seems to be variable quality blogs in technet?

 

Seems these days we're often on our own and it's those who are willing \ able to play around and come up with viable solutions based on vague notes on TechNet that prove the most valuable. Still amazed Microsoft didn't have a simple fix on its site for a Windows Store bug I found after 20 minutes trying to set up one of our Surface RT's a few months back. Definitely need to up their game on that front and spend less on the pointless forum reps that just parrot irrelevant "answers" and ask you to "submit your feedback for future releases"

[william_tropico]

 

GPO option thst might work although not tired it myself yet

 

This policy setting lets you control whether Microsoft accounts are optional for Windows Store apps that require an account to sign in. This policy only affects Windows Store apps that support it.

 

If you enable this policy setting, Windows Store apps that typically require a Microsoft account to sign in will allow users to sign in with an enterprise account instead.

 

If you disable or do not configure this policy setting, users will need to sign in with a Microsoft account.

 

Computer Configuration > Admin Templates > Windows Components > App runtime > Allow Microsoft accounts to be optional

 

Thank you,

Will

[gshaw]

Next question is what counts as an "enterprise account" - is that an AD username or Office 365 one?

 

Edit: looks like that setting only covers a couple of built-in apps, Store still needs the Microsoft Account

 

http://exchange2010admin.blogspot.co.uk/2013/10/windows-81-remove-requirement-for.html

Edited May 20, 2014 by gshaw

[william_tropico]

I would assume it is Office 365 account.

 

On Domain computers / laptops we have disabled the store because of this. We have a 1:1 device scheme for post 16 students so they each have a surface rt and trying to explain that their school email account needs to be 'converted' to a MS account / separate MS account does feel like wasted time! (and Windows store behind a proxy is another issue )

 

I do agree with what is said about using office365 for store downloads. can only hope it is soon