Enterprise State Roaming for Windows 10

[Arthur]

Cloud-based roaming profiles!

 

https://blogs.technet.microsoft.com/ad/2016/02/04/more-azure-ad-and-windows-10-goodness-enterprise-state-roaming-public-preview

 

More Azure AD and Windows 10 goodness: Enterprise State Roaming public preview!

I’ve been looking forward to this post for some time now. Those of you who saw our blog series on enterprise functionality in Windows 10 last year would have read that we were working on building an enterprise compliant service to sync OS settings across Azure AD joined Windows 10 devices. Well it’s finally here! Today we are announcing the public preview of Enterprise State Roaming for Windows 10.

 

As you’re probably aware, ‘settings sync‘ has existed since Windows 8 and 8.1. It allows consumers to sync OS settings and Universal Windows Platform application data across all their personal Windows devices. It uses a personal Microsoft Account and a consumer OneDrive folder in the cloud to achieve this. Enterprise State Roaming – or ‘OS State Roaming’ as we referred to it in the Bringing the cloud to enterprise desktops series of blog posts, well before it had a real name – brings the exact same user experience to enterprise users!

 

The big difference between Enterprise State Roaming and settings sync lies under the hood. As much as the settings sync feature is well loved by consumers, it does not meet many enterprise customers’ needs. IT admins want to retain control of corporate data, even when an employee leaves the company. Enterprises users also want to separate work and personal data on their devices. They don’t want their corporate Wi-Fi passwords syncing to the cloud along with their favorite game’s high score. Enterprise State Roaming in Windows 10 solves these problems for corporate owned devices because data is roamed using Azure AD identities and is backed by storage in the Azure cloud.

 

Enterprise State Roaming enables a number of benefits for enterprise customers. Among them are:

 

• Separation of corporate and consumer data – No mixing of enterprise data in a consumer cloud account or consumer data in an enterprise cloud account.
  
• Enhanced security – All the data is automatically encrypted before leaving the user’s Windows 10 device by using Azure Rights Management (Azure RMS), and data stays encrypted at rest in the cloud. All content stays encrypted at rest in the cloud, except for the namespaces, like settings names and Windows app names. By the way, you don’t need a separate paid Azure RMS subscription to use this service. Microsoft provides free limited use Azure RMS service restricted for Enterprise State Roaming use.
  
• Better management – More control and visibility over who syncs settings in your organization and on what devices.
  
• Geographic location of data in the cloud – Data will be stored in an Azure region based on the country associated with the Azure AD directory. We understand it is important to some of our enterprise customers to ensure data stays within their geographic boundaries due to the compliance reasons.
  

Please note at the time of this public preview, this service is available in US and Europe regions only. We do plan to roll service out globally in the near future.

 

What do I need to deploy Enterprise State Roaming?

All you need to deploy Enterprise State Roaming in your organization is the following:

 

• An Azure Active Directory Premium subscription. Enterprise State Roaming requires an Azure Active Directory Premium subscription. At the time of GA, users will require to have premium licenses assigned to use this service.
  
• Windows 10 (Version 1511, Build 10586 or greater). Devices must either be
  
  • Azure AD joined
    or
    
  • AD Domain Joined with automatic registration to Azure AD
    

So, what account is really being used for roaming?

In Windows 8 and Windows 8.1, roaming always happens through a connected Microsoft Account via the consumer OneDrive cloud – even on corporate owned Domain Joined devices. This is still possible today for organizations and users who are willing to allow personal accounts on corporate owned devices. However, the advent of Azure AD Join in Windows 10 gives us the capability to drive cloud services using work or school accounts – even on Domain Joined machines. With Enterprise State Roaming, OS settings use this account to authenticate to the Enterprise State Roaming service back-end (which in turn uses Azure storage) to roam data between devices.

 

A personal Microsoft Account can still be added to an Azure AD joined Windows 10 machine as a secondary account – allowing personal apps and data to be used on the device. In this configuration however it is important to note that:

 

• The OS settings always roam with the primary account
  
• App state data roams based on the identity of app acquisition
  

Note that multiple identity support for roaming is not yet available in current builds of Windows 10. So, if you log into a corporate owned device with your enterprise credentials, the OS settings and the state of Windows apps acquired using enterprise account will roam using Azure AD account. The state of the Windows apps acquired using your secondary personal Microsoft Account will not roam. Similarly, if you log into a personally owned device with a Microsoft account, the OS settings and the state of the Windows apps acquired using that Microsoft account will roam via the consumer OneDrive cloud, but the state of the Windows apps acquired using enterprise account will not roam.

[Michael]

Be interesting to see how this performs in reality, if you consider 'true' roaming over a 3G/4G connection. My immediate thoughts are this is great, but the infrastructure in the UK is severely lacking.

[gshaw]

An Azure Active Directory Premium subscription

 

Immediately rules it out for education customers at current pricing

[Arthur]

Immediately rules it out for education customers at current pricing

I agree. For my school it would cost just under £58,000 per year which unfortunately makes it a complete non-starter.

[3s-gtech]

Can Direct Access achieve some of this?