| Access control challenge | -Windows 10 Mobile solutions | -
|---|---|
Organizations frequently use passwords to authenticate users and provide access to business applications or the corporate network, because more trustworthy authentication alternatives are too complex and costly to deploy. |
-Windows Hello provides biometrics to identify the user and unlock the device that closely integrates with Microsoft Passport to identify, authenticate, and authorize users to access the corporate network or applications from their Windows 10 Mobile device with supporting biometric hardware. |
-
When an organization uses smart cards, it must purchase a smart card reader, smart cards, and smart card management software. These solutions are complex and costly to implement; they also tend to delay mobile productivity. |
-Windows Hello with Microsoft Passport enables a simple and cost-effective MFA deployment across the organization, enhancing the business’ security stance. |
-
Mobile device users must enter their password on a touch keyboard. Entering complex passwords in this way is error prone and less efficient than a keyboard. |
-Windows Hello helps enable iris scan, fingerprint, and facial recognition-based authentication for devices that have biometric sensors. These biometric identification options are more convenient and more efficient than password-based logon. |
-
Users dislike the need to enter long, complex passwords to log on to corporate services, especially passwords that must change frequently. This frustration often leads to password reuse, passwords written on notepads, and weak password composition. |
-Microsoft Passport allows users to sign in once and gain access to corporate resources without having to re-enter complex passwords. Authentication credentials are bound to the device through a built-in Trusted Platform Module (TPM) and cannot be removed. |
-
| Area name | -Policy name | -Description | -
|---|---|---|
Cryptography |
-Allow FIPS Algorithm Policy |
-Enable or disable the FIPS policy. A restart is needed to enforce this policy. The default value is disabled. |
-
BitLocker |
-Encryption Method |
-Configures the BitLocker Drive Encryption Method and cipher strength. The default value is AES-CBC 128-bit. If the device cannot use the value specified, it will use another one. |
-
Cryptography |
-TLS Cipher Suite |
-This policy contains a list of the cryptographic cipher algorithms allowed for Secure Sockets Layer connections. |
-
| Threat | -Windows 10 Mobile mitigation | +Windows 10 Mobile mitigation |
|---|---|---|
An app infects other apps or the operating system with malware. |
-All Windows 10 Mobile apps run inside an AppContainer that isolates them from all other processes and sensitive operating system components. Apps cannot access any resources outside their AppContainer. |
+All Windows 10 Mobile apps run inside an AppContainer that isolates them from all other processes and sensitive operating system components. Apps cannot access any resources outside their AppContainer. |
An unauthorized app or malware attempts to start on the device. |
-All Windows 10 Mobile apps must come from Windows Store or Windows Store for Business. Device Guard enforces administrative policies to select exactly which apps are allowed to run. |
+All Windows 10 Mobile apps must come from Windows Store or Windows Store for Business. Device Guard enforces administrative policies to select exactly which apps are allowed to run. |
User-level malware exploits a vulnerability in the system or an application and owns the device. |
@@ -291,249 +206,164 @@ Table 3. Threats and Windows 10 Mobile mitigations
| - | Personal devices | -Corporate devices | +Personal devices | +Corporate devices | |
| Ownership | -User | +Ownership | +Employee | Organization | |
| Primary use | -Personal | -Work | +Device Innitialization + +In the Out-of-the-Box Experience (OOBE), the first time the employee starts the device, they are requested to add a cloud identity to the device. | +The primary identity on the device is a personal identity. Personal devices are initiated with a Microsoft Account (MSA), which uses a personal email address. | +The primary identity on the device is an organizational identity. Corporate devices are initialized with an organizational account (account@corporatedomain.ext). +Initialization of a device with a corporate account is unique to Windows 10. No other mobile platform currently offers this capability. The default option is to use an Azure Active Directory organizational identity. +Skipping the account setup in OOBE will result in the creation of a local account. The only option to add a cloud account later is to add an MSA, putting this device into a personal device deployment scenario. To start over, the device will have to be reset. + |
| Deployment | -The primary identity on the device is a personal identity. A Microsoft account is the default option for Windows 10 Mobile. | -The primary identity on the device is an organizational identity. An Azure AD account is the default option for Windows 10 Mobile. | +Device Enrollment + +Enrolling devices in an MDM system helps control and protect corporate data while keeping workers productive. | +Device enrollment can be initiated by employees. They can add an Azure account as a secondary account to the Windows 10 Mobile device. Provided the MDM system is registered with your Azure AD, the device is automatically enrolled in the MDM system when the user adds an Azure AD account as a secondary account (MSA+AAD+MDM). If your organization does not have Azure AD, the employee’s device will automatically be enrolled into your organization’s MDM system (MSA+MDM). +MDM enrollment can also be initiated with a provisioning package. This option enables IT to offer easy-to-use self-service enrollment of personal devices. Provisioning is currently only supported for MDM-only enrollment (MSA+MDM). + | +The user initiates MDM enrollment by joining the device to the Azure AD instance of their organization. The device is automatically enrolled in the MDM system when the device registers in Azure AD. This requires your MDM system to be registered with your Azure AD (AAD+MDM). |
| - | Personal identity | -Corporate identity | +Personal identity | +Work identity | |
| First account on the device | -Microsoft account | +First account on the device | +Microsoft Account | Azure AD account | |
| Device sign-in | -Users cannot sign in to devices with Azure AD credentials, even if they add the credentials after initial activation with a Microsoft account. | -Users can unlock devices with an Azure AD account. Organizations can block the addition of a personal identity. | +Ease of enrollment | +Employees use their Microsoft Account to activate the device. Then, they use their Azure AD account (organizational identity) to register the device in Azure AD and enroll it with the company’s MDM solution (MSA+AAD+MDM). | +Employees use their Azure AD account to register the device in Azure AD and automatically enroll it with the organization’s MDM solution (AAD+MDM – requires Azure AD Premium). |
| User settings and data roaming across devices | -User and app settings roam across devices activated with the same personal identity over personal OneDrive. | -Windows 10 Mobile currently does not support users and app settings roaming over the enterprise cloud. It can block the roaming of personal cloud settings. | +Credential management | +Employees sign in to the device with Microsoft Account credentials. +Users cannot sign in to devices with Azure AD credentials, even if they add the credentials after initial activation with a Microsoft account. + | +Employees sign in to the device with Azure AD credentials. +IT can block the addition of a personal identity, such as an MSA or Google Account. IT controls all devices access policies, without limitations. + |
| Ability to block the use of a personal identity on the device | +|||||
| Ability to block the use of a personal identity on the device | No | Yes | |||
| Level of control | -Organization can apply most* restrictive policies to devices, but they cannot remove the Microsoft account from them. Device users can reclaim full control over their devices by un-enrolling them from the organization’s MDM solution. -
-Note
-
-* MDM functionality on personal devices might be limited in the future. -
-
- |
-Organizations are free to apply the restrictive policies to devices that policy standards and compliance regulations require and prevent the user from un-enrolling the device from the enterprise. | +User settings and data roaming across multiple Windows devices | +User and app settings roam across all devices activated with the same personal identity through OneDrive. | +If the device is activated with an MSA, then adds an Azure AD account, user an app settings roam. If you add your MSA to an Azure AD- joined device, this will not be the case. Microsoft is investigating Enterprise roaming for a future release. | +
| Level of control | +Organizations can apply most of the available restrictive policies to devices and disable the Microsoft account. You can prevent users from reclaiming full control over their devices by unenrolling them from the organization’s MDM solution or resetting the device. Legal limitations may apply. For more information, contact your legal department. | +Organizations are free to apply any restrictive policies to devices to bring them in line with corporate standards and compliance regulations. They can also prevent the user from unenrolling the device from the enterprise. | +|||
| Information Protection | +You can apply policies to help protect and contain corporate apps and data on the devices and prevent intellectual property leaks, but still provide employees with full control over personal activities like downloading and installing apps and games. | +Companies can block personal use of devices. Using organizational identities to initialize devices gives organizations complete control over devices and allows them to prevent personalization. | +|||
| App purchases | +Employees can purchase and install apps from the Store using a personal credit card. | +Employees can install apps from your Store for Business. Employees cannot install or purchase app from the Store without the addition of an MSA. |
| Setting | -Description | -|||
|---|---|---|---|---|
| Device Password Enabled | -Specifies whether users are required to use a device lock password -
-Note
-
-
-
-
- |
+Branch | +Version | +Release Date |
| Allow Simple Device Password | -Whether users can use a simple password (for example, 1111 or 1234) | +Current Branch | +1511 | +November 2015 |
| Alphanumeric Device Password Required | -Whether users need to use an alphanumeric password When configured, Windows prompts the user with a full device keyboard to enter a complex password. When not configured, the user will be able to enter a numeric PIN on the keyboard. | +Current Branch for Business | +1511 | +March 2016 |
| Min Device Password Complex Characters | -The number of password element types (in other words, uppercase letters, lowercase letters, numbers, or punctuation) required to create strong passwords | -|||
| Device Password Expiration | -The number of days before a password expires (Biometric data does not expire.) | -|||
| Device Password History | -The number of passwords Windows 10 Mobile remembers in the password history (Users cannot reuse passwords in the history to create new passwords.) | -|||
| Min Device Password Length | -The minimum number of characters required to create new passwords | -|||
| Max Inactivity Time Device Lock | -The number of minutes of inactivity before devices are locked and require a password to unlock | -|||
| Allow Idle Return Without Password | -Whether users are required to re-authenticate when their devices return from a sleep state, before the inactivity time was reached | -|||
| Max Device Password Failed Attempts | -The number of authentication failures allowed before a device is wiped (A value of zero disables device wipe functionality.) | -|||
| Screen Timeout While Locked | -The number of minutes before the lock screen times out (This policy influences the device’s power management.) | -|||
| Allow Screen Timeout While Locked User Configuration | -Whether users can manually configure screen timeout while the device is on the lock screen (Windows 10 Mobile ignores the Screen Timeout While Locked setting if you disable this setting.) | +Current Branch | +1607 | +July 2016 |
| Setting | -Description | -||||||
|---|---|---|---|---|---|---|---|
| SSID | -The case-sensitive name of the Wi-Fi network (service set identifier [SSID]) | +Network connection | +Description | +Auto Scan | +Auto Download | +Auto Install | +Auto Restart |
| Security type | -The type of security the Wi-Fi network uses; can be one of the following authentication types:
-
|
+Wi-Fi | +Device is connected to a personal or corporate Wi-Fi network (no data charges) | +Yes | +Yes/td> + | Yes | +Yes – outside of Active Hours (forced restart after 7 days if user postpones restart) |
| Authentication encryption | -The type of encryption the authentication uses; can be one of the following encryption methods:
-
|
+Cellular | +Device is only connected to a cellular network (standard data charges apply) | +Will skip a daily scan if scan was successfully completed in the last 5 days | +Will only occur if update package is small and does not exceed the mobile operator data limit or the user clicks “download now”. | +Yes, if the user clicked “download now” | +Idem |
| Extensible Authentication Protocol Transport Layer Security (EAP-TLS) | -WPA-Enterprise 802.11 and WPA2-Enterprise 802.11 security types can use EAP-TLS with certificates for authentication | -||||||
| Protected Extensible Authentication Protocol with Microsoft Challenge Handshake Authentication Protocol version 2 (PEAP-MSCHAPv2) | -WPA-Enterprise 802.11 and WPA2-Enterprise 802.11 security types can use PEAP-MSCHAPv2 with a user name and password for authentication | -||||||
| Shared key | -WPA-Personal 802.11 and WPA2-Personal 802.11 security types can use a shared key for authentication. | -||||||
| Proxy | -The configuration of any network proxy that the Wi-Fi connection requires (To specify the proxy server, use its fully qualified domain name [FQDN], Internet Protocol version 4 [IPv4] address, IP version 6 [IPv6] address, or IPvFuture address.) | -||||||
| Disable Internet connectivity checks | -Whether the Wi-Fi connection should check for Internet connectivity | -||||||
| Proxy auto-configuration URL | -A URL that specifies the proxy auto-configuration file | -||||||
| Enable Web Proxy Auto-Discovery Protocol (WPAD) | -Specifies whether WPAD is enabled | +Cellular -- Roaming | +Device is only connected to a cellular network and roaming charges apply | +No | +No | +No | +Idem |
| Settings | -Configuration | -|||||
|---|---|---|---|---|---|---|
| Proxy name | -The unique name of the proxy connection | +Servicing option | +Availability of new features for installation | +Minimum length of servicing lifetime | +Key benefits | +Supported editions |
| Proxy ID | -The unique identifier for the proxy connection | +Windows Insider Builds | +As appropriate during development cycle, released to Windows Insiders only | +Variable, until the next Insider build is released to Windows Insiders | +Allows Insiders to test new feature and application compatibility before a Feature Update is released/td> + | Mobile |
| Name | -The user-friendly name of the proxy connection | +Current Branch (CB) | +Immediately after the Feature Update is published to Windows Update by Microsoft | +Microsoft typically releases two Feature Updates per 12-month period (approximately every four months, though it can potentially be longer) | +Makes new features available to users as soon as possible | +Mobile & Mobile Enterprise |
| Server address | -The address of the proxy server, which can be the server FQDN or IP address | -|||||
| IP address type | -The IP address type that identifies the proxy server, which can be one of the following values:
-
|
-|||||
| Proxy connection type | -The proxy connection type, which can be one of the following values:
-
|
-|||||
| Ports | -The port information for the proxy connection; includes the following settings:
-
|
-|||||
| Configuration reference | -The connection reference information for the proxy connection. The corporation determines the information in this optional setting. | +Current Branch for Business (CBB) | +A minimum of four months after the corresponding Feature Update is first published to Windows Update by Microsoft | +A minimum of four months, though it potentially can be longerNo | +Provides additional time to test new feature before deployment | +Mobile Enterprise only |
| Setting | -Description | -|||
|---|---|---|---|---|
| Native VPN protocol profile | -The configuration information when the VPN uses native Windows 10 Mobile VPN protocols (such as IKEv2, PPTP, or L2TP); includes the following settings: -
|
+Activity (Policy) | +Version 1511 settings | +Version 1607 settings |
| VPN plugin profile | -Windows Store–based VPN plug-ins for the VPN connection; includes the following settings:
-
|
+Subscribe device to CBB, to defer Feature Updates | +RequireDeferUpgrade + +Defers Feature Update until next CBB release. Device will receive quality updates from Current Branch for Business (CBB). +Defers feature update for minimum of 4 months after Current Branch was release. | +BranchReadinessLevel + +Defers Feature Update until next CBB release. Device will receive quality updates from Current Branch for Business (CBB). +Defers feature update for minimum of 4 months after Current Branch was release. |
| Defer Updates | +DeferUpdatePeriod + +Defer Quality Updates for 4 weeks or 28 days | +DeferQualityUpdatePeriodInDays + +Defer Feature and Quality Updates for up to 30 days. | ||
| Approve Updates | +RequireUpdateApproval + + | +RequireUpdateApproval + + | ||
| Always on connection | -Whether the VPN connects at user sign-in and stays connected until the user manually disconnects the VPN connection. | -|||
| App trigger list | -A list of apps that automatically initiate the VPN connection. Each app trigger in the list includes the following settings:
-
|
-|||
| DNS suffixes | -A comma-separated list of DNS suffixes for the VPN connection. Any DNS suffixes in this list are automatically added to Suffix Search List. | -|||
| LockDown VPN profile | -Whether this VPN connection is a LockDown profile. A LockDown VPN profile has the following characteristics:
-
You must delete a LockDown VPN profile before you can add, remove, or connect other VPN profiles. |
-|||
| Name Resolution Policy Table rules | -A list of Name Resolution Policy Table rules for the VPN connection. Each rule in the list includes the following settings:
-
|
-|||
| Proxy | -Any post connection proxy support required for the VPN connection; includes the following settings:
-
|
-|||
| Remember credentials | -Whether the VPN connection caches credentials. | -|||
| Route list | -A list of routes to add to the routing table for the VPN connection. Each route in the list includes the following settings:
-
|
-|||
| Traffic filter list | -A list of traffic rules that define the traffic that can be sent through the VPN connection. Each rule in the list includes the following settings:
-
|
-|||
| Trusted network detection | -A comma-separated list of trusted networks that causes the VPN not to connect when the intranet is directly accessible. | +Pause Update rollout once an approved update is being deployed, pausing the rollout of the update. | +PauseDeferrals + +Pause Feature Updates for up to 35 days | +PauseQualityUpdates + +Pause Feature Updates for up to 35 days |
| Setting | -Description | -
|---|---|
| APN name | -The APN name | -
| IP connection type | -The IP connection type; set to one of the following values:
-
|
-
| LTE attached | -Whether the APN should be attached as part of an LTE Attach | -
| APN class ID | -The globally unique identifier that defines the APN class to the modem | -
| APN authentication type | -The APN authentication type; set to one of the following values:
-
|
-
| User name | -The user account when users select Password Authentication Protocol (PAP), CHAP, or MSCHAPv2 authentication in APN authentication type | -
| Password | -The password for the user account specified in User name | -
| Integrated circuit card ID | -The integrated circuit card ID associated with the cellular connection profile | -
| Setting | -Description | -
|---|---|
| Allow Storage Card | -Whether users can use storage cards for device storage (This setting does not prevent programmatic access to the storage cards.) | -
| Require Device Encryption | -Whether internal storage is encrypted (When a device is encrypted, you cannot use a policy to turn encryption off.) | -
| Encryption method | -Specifies the BitLocker drive encryption method and cipher strength; can be one of the following values:
-
|
-
| Allow Federal Information Processing Standard (FIPS) algorithm policy | -Whether the device allows or disallows the FIPS algorithm policy | -
| SSL cipher suites | -Specifies a list of the allowed cryptographic cipher algorithms for SSL connections | -
| Restrict app data to the system volume | -Specifies whether app data is restricted to the system drive | -
| Restrict apps to the system volume | -Specifies whether apps are restricted to the system drive | -
| Setting | -Description | -
|---|---|
| Allow automatic update | -The automatic update behavior for scanning, downloading, and installing updates; the behavior can be one of the following:
-
|
-
| Allow non Microsoft signed update | -Whether automatic updates will accept updates that entities other than Microsoft have signed | -
| Allow update service | -Whether devices can obtain updates from Windows Update, WSUS, or Windows Store | -
| Monthly security updates deferred | -Whether monthly updates (for example, security patches) are deferred (You can defer updates up to 4 weeks.) | -
| Nonsecurity upgrades deferred | -Whether nonsecurity upgrades are deferred (You can defer upgrades up to 4 weeks.) | -
| Pause update deferrals | -Whether the device should skip an update cycle (This setting is valid only when you configure devices to defer updates or upgrades.) | -
| Require update approval | -Whether approval is required before updates can be installed on devices (If approval is required, any updates that have an End User License Agreement [EULA] are automatically accepted on the user’s behalf.) | -
| Schedule install time | -The scheduled time at which updates are installed | -
| Scheduled install day | -The schedule of days on which updates are installed | -
| Update deferral period | -How long updates should be deferred | -
| Update service URL | -The name of a WSUS server from which to download updates instead of Windows Update | -
| Upgrade deferral period | -How long Windows 10 Mobile upgrades should be deferred | -
| Setting | -Description | -
|---|---|
| Approved updates | -A list of approved updates. Each update in the list includes the Approved Time setting, which specifies the update approval time. Any approved updates automatically accept EULAs on behalf of users. | -
| Failed updates | -A list of updates that failed during installation. Each update in the list includes the following settings:
-
|
-
| Installed updates | -A list of updates that are installed on the device. | -
| Installable updates | -A list of updates that are available for installation. Each update in the list includes the following settings:
-
|
-
| Pending reboot updates | -A list of updates that require a restart to complete update installation. Each update in the last has the Installed Time setting enabled, which specifies installation time for the update. | -
| Last successful scan time | -The last time a successful update scan was completed. | -
| Defer upgrade | -Whether the upgrade is deferred until the next update cycle. | -