Licensing, Security & Management: Making Microsoft 365 Defender and Intune Work Together with Videsh Chavan

Welcome back to the M665FM podcast. Today we are tackling a problem almost every Microsoft 365 organization you've been doing in context. You bought the licenses but you actually using what you paid for. Microsoft 365 license can become complicated very quickly. Organization build stage, Microsoft 365, E3, E5, E7, business premium, security add-ons, Intune capabilities, Defender, products, and identity features, but chance, letting those license into a current security and device management architecture and the knowledge challenge, and that's where we go today in this conversation. My guest is Windesh Shavan, head of AUC engineering and identity at PerkkingAlmer. Windesh brings 18 years of experience across end-user computing device management, Microsoft 365, identity and security. He has built a let enterprise scale MC65 device management and identity security program and was recognized with the next, what, the next tunnel, CIO award for 2015. His central argument is straightforward. Organization should treat licensing and management identity security as separate decision. They need to work together. So today we are going to explore how organization can align Microsoft licensing, Microsoft Intune, and Microsoft Defender to raise security gaps, control costs, and create an only five endpoint entity, when they come to the NS65 podcast. Hey, thank you. Thanks, Michael. Thanks for inviting and having just on this. Looking forward for this session. And as you have nicely described about the oral experience, yeah, hopefully this will be helpful for someone somewhere and keep bringing on the overall experience. Yeah, so it would be good to start with. Really excited. Yeah, Windesh before we get into the licensing and security, let's start with you. You spent around 18 years working in endpoint computing. What did you see look like when you started? Yeah, that's a good question. And if I go back like when I started my journey somewhere around 2008, okay, at that point of time, like we didn't had specifically into sort of competing as a concert. Or let's say we didn't had digital work with as a concert. So it was more like desktop engineering, or we were just trying to involve or like evolve more into the desktop engineering code concepts, more of most of the tools that we have with the UC or digital workplace. It was like quite legal C1, like maybe for SCCM, SCCM was like market leader at that point of time. And then everyone were looking at SCCM as one of the management tools. But the way it has been evolved now, it has been pretty much shaped into a digital era. And now UC or the digital workplace is a core area of the IT, where we are managing the device management, we are working on the cloud management, deployment, and everything all together. So that we are making our end result experience quite good. Right, so this is how I can see, like how it has been developed from like typical managing the fleet of the stops, like hardware part and now moving from the hardware to more like a cloud PCs or virtual devices. And then we move over all dependency from the physical devices. What are their particular moments when traditional end-pile management start becoming more on end-pile from your perspective? So I think the way Microsoft have introduced tool or feature called Intune, right, I can see that as a turning point here, like how the devices management has been improved drastically. And how we are able to really use the overall M-thestifies in tune as a suit to manage our devices all together. Like earlier, we had SICM, but I think SICM was more like managing the physical devices, less virtual devices, and mostly it was like a bit time consuming, the way the APIs were discovered, the way the task were delivered. So there were less APIs that were actually involved, but the way Intune has been developed, it is directly working with Graph APIs, which is quite quick. And the way the devices are sinking back the way devices are managed, it is pretty much easy to any administrator who is able to learn about the Intune and their able to manage. Like in SICM, I know you need a typical 10 or 12 years of experience just to start with as an architecture. But here I think given the Intune, it is quite easy to navigate, it is quite easy to manage and the way Microsoft to do it, I think it is easy for any of the administrator to handle the overall architect management of the devices. Yeah, awesome. So let's just define what endpoint actually means today. I say 10 years ago, people primarily thought about, to cooperate with those PCs, what's an enterprise endpoint in 2000? 26. So yeah, like we have two cases, mostly one is physical devices. We still need some physical devices, but most of the teams are now moving from physical devices to the cloud devices. Now from cloud devices to more like cloud desktop devices. So we had like the phase goes like this, like it started with physical devices, then we moved to virtual devices, like we wanted to have some dependency on physicals and onto to remove that dependency by utilizing some cloud devices. But now the way it has been evolved, now we should go as a desktop as a service. Right, it's most like a dust that everyone should go or we should try to adopt a desktop as a service where we are going to windows 365 to start with like again, you deny Microsoft tool, like it is pretty much again effortless the way you just plug any of the thing. Maybe things are devices, right? And then you should be able to use it just with your normal own device. You don't need any, you know, high configuration device to use this set of devices already. So that is anyway cutting down the overall cost and the device management cost that is involved, like and the way we are evolving now into the windows pieces, the desktop, cloud pieces, you will see like the connectivity, the end user experience and the way we are interacting with the applications, it is much better. Yeah, that's interesting. So we have Fauley R, windows 55, but I like to stay a little bit more actually at the hardware part, our windows, macOS, iOS, Android and Linux. Now, effectively, part of the same management problem. Yes, so with Intu1, right, I think we have that very much wide acceptance of the given devices. It's not only like you are able to enroll or you're able to manage the windows devices, you are also able to match some of the immersive devices, right? Like maybe windows, macOS of HoloLens, for example, MetaQuest devices, like them, it's like some of the devices which are able to enroll and it comes as part of the AOSP configuration, like Android Open Source Project. So you would be able to also configure those devices, which was a bit problematic while we had other legacy tools in our environment. Okay, and what's your perspective on the I think it's its upcoming especially at Corona at personally owned devices? Sorry, there was a bit network pledge. Yeah, what did you think about personal owned devices? I think with Corona, a lot of people start working with their own devices. Definitely, the way in the Corona era, right, we adopted the work from home, like most of the companies and the way we started to look and do effortlessly, we can provide the work from home opportunities. Our end result without coming to office, of course, then, this one, you're getting all the time on mute, yeah, sorry, it was a bit domestic. Yeah, so what I'm saying, like with the BYUOD stuff, right, we were able to actually bring out the policy, we were able to see like how effortlessly we can plug into devices and make end result life easy. It's not also about asking the existing users to use this service, it was also a bit challenge to onboard the users, like how the onboarding would work, like normally onboarding was done earlier, someone would come to the office, they would collect the laptop and then the local IT team would configure, but the way Corona has said, it has been changed. Like now users are getting the devices shipped to their home, with Windows Autopilot as one of the major key components where we configure it as a wrapper, and then user is able to configure their devices on their own. So I think it's pretty much modernized as compared to what we had and also the overall imaging time that we had before Corona era. I think that has been really been decreased, like earlier, I know if you need to manage or if you need to image a device, right, it would take somewhere around two or three us, but now it's not more than 20 minutes. Right, which one? Yeah. Okay. And then now we'll a little bit join the area of Cloud PCs, we talk about Windows 365 or AVD. Do the traditional idea of a corporate network still matter? Yes, the reason is like there are some of the applications, which are like quite dependent on the on-premises and those are legacy applications. Like when we do the application migrations, right, let's say when we move from Windows 10 to 11, and we wanted to move most of our devices to AVD or the Cloud PCs, we weren't able to do that at a scale for like let's say, a car getting 95% or 100% the reason is there are too many legacy applications and those legacy applications are sitting there from years. Like maybe someone have built those applications, he have left the organization probably vendor have delivered, they are no more working with us. And then probably the IT managing those applications, they are not aware about those application at all and they're sitting there from years. So we cannot really move them and those are also tied to the some of the on-premises applications or the configurations where we need to be hosted them on the on-premises. So I think that is one of the biggest challenges like when we wanted to see like why we want to have that physical infrastructure in place. Yeah, we have, I think, yeah, with Corona, we have this homework and accurate trend is the location. So if user can work from anywhere, where does the security boundary actually exist? Like when you say about the users, right, the security bond that I say like it's mostly related to the MFA part, right? So I think that's one of the security area where everyone would be having a boundary. And the way nowadays like everything is connected to internet, right? And we do not need something like a physical access in some cases. Any person who is connected on the internet, they can easily access our resources, given they are able to proceed with the security, authentication or like configurations, they pass the security configuration and they're able to access. So I think that is one of the thing which is still there and that is something it would be there. And I guess that is also beneficial because we have to protect our resources. And of course having any of the ATAX or any of the threats, it is good to have that. Yeah, and this is identity become the new perimeter or will you say identity plus device health is a real perimeter? Yes, like nowadays the focus is more on the identity. The reason like why? Because again, it is like hurt of any of the IT environment. Everything goes from there, right? Like without identity, you won't be able to create users, you won't be able to create or manage the groups, you're not able to manage the connectors, applications, everything. So everything is tied with the identity. So if you're able to manage your identity properly, having all the security controls, the guard rails, everything in place, then I think identity is one of the areas where you need to focus it. Like let's say for example, if someone is doing assessment of the identity, the first thing that comes to my mind is identity, like how much secure we are from the identity perspective, the security score that adopts it is having a huge advantage for the identity as well because it is having like conditional policies, everything, right? Groups, users, groups, then how the people are connected, how people are utilizing that is, so says how the applications are actually connected to each other. So everything is coming from identity all together. And yeah, let's get into someone, everybody loves to talk about Microsoft licensing. Why is Microsoft licensing so difficult to understand for organizations? So maybe what we can do, we can focus on the problem here. Okay, so the problem is like licenses licensing, it is always treated as procurement. It's not architecture, okay? Like sometimes you see licenses are bought without nothing, I don't know, okay? Those are purchased without knowing exactly like what are the capabilities, they unlock, then there are some tools operating in silos, right? Like maybe there are some of the, let's say for example, into your defend, their identity policies, those are on the very end independently, instead of having a one connected system, right? So those are operating in silos here. And then third is mostly like the reactive security position, like team, discover gap after an incident rather than designing controls, around what's already licensed, right? So that's again one of the reactive security posters that we have. So if you say like this is how I would take as a problem, right? The core idea I do today should be like quick licensing into a defender or everything as a one connected system, rather than having three separate line items. Okay, once you have this connected as a one system, then like let's say we have a practical framework as well, like how we wanted to go with the typical five step practical framework. Let's say you want to see how you want to go from a disconnected tools to one unified step. So the first point here would be like we need to do the licensing audit and the capability mapping. Second is identify the first baseline. Third is have in tune as an enforcement layer, okay? Then defend us the detection and response layer and fifth is of course continuous cost to coverage to be. So this is pretty much important and this is how I would take a five step practical framework to you know get a one unified strategy which is missing I guess in some of the organizations that I have seen and this would be really helpful for someone who wanted to build that one unified strategy. And then before because of this we have seen like licensing cost has been huge, okay? We discovered when we do the overall Microsoft 365 through or licensing review and then it's already late, right? We cannot do much over there. So I think that's that's what I would I would say is just from the licensing perspective, like how it would be useful like when we see it as overall one connected system. But if you say like what would be the typical key database from this particular particular framework then I think like again licensing is nothing like not a procurement but it's more like an architecture decision, right? So that's something we need to be very much sure. And identity again this is the foundation in to a defender they are both built on it like we know how to work upon it and in most of the cases you know organization is not really really exploring all the features that has been added to those particular add-ons, okay? Sometimes it is just purchased and we are not utilizing or leveraging any of those features or probably a best classic example. So we have defender as part of our maybe M35E file license and then we also have Sentinel one or CrowdStrike as our idea. So if you wanted to go with that then why we have the licensing on e5? We should be on e3, right? Why we are paying licenses for both of the tools, where the both of the tools have the same functionality. I know there could be some specific use cases but I think that can be in a time they are closed out by doing a close review like what was net and what is not net. But overall this is the typical situation that I have seen for most of the organizations. Yeah. Yeah. Yeah. I think a little bit is the biggest challenge to understand what the company own all the licenses or is this understanding what you need. So as I said like the first thing that I would see like we need to inventory what all are assigned then versus active licenses then we need to map each tire like let's say e3 versus e5 defender p1 versus p2 right the Internet defender features that is unlocking unlocking itself then we need to flag the shelter paid for features like who is nobody is using it. So that will help us with the initial licensing audit and capability mapping then the second boss is like of course identifying the first baseline. Like here we should make conditional access and identity protection as the foundation not enough to talk of course then enforcing fish resistant MFA risk-based signing policies which is coming as part of the M file licenses it is something like not everyone is using like just in the past Microsoft have forcefully started now to push the fishing resistant MFA and until that point of name none of the organizations were using it right so that's why I can say like how the licensing has been discovered and how we are really leveraging all the tools because in some cases you know some of the organizations has started to go and check with Microsoft hey are we really licensed with this feature is this something that is coming into our licensing coverage right so this is something you can do when you know like you treat licensing as architecture and not as a procurement solution okay and then of course every device and app policy it should be like key of identity signals when we do the identity first baseline right and then ensuring like the tools that we have like into a defender those are like in fourth layer right those are built on the maybe the one that we discussed like corporate versus BIOD like segmenting the policy by ownership because of course not one size fits all yeah correct and then of course up in the end point security baseline ASR rules there are multiple features like how we wanted to really to this but yeah there should be an uh uh a quarterly check as well if you wanted to see how we are going with the cost of coverage review like maybe do a quarterly check uh see if you are a license for maybe identify gaps just to maybe a tie or maybe waste from onions add-ons and then maybe a simple score card like like how much is the licenses percentage policy coverage and then open gaps so I think this is how we would really work on this licensing one what's wrong with uh simply saying okay well buy SE7 and then we have everything right so that's that's that's the problem right like uh as we know with e7 uh we have this AI capability okay we have all the features but the question remains again unanswered are we really utilizing all the features are we really having any of these such huge cases where we need all the e7 features or components as part of the e7 licenses because e7 licensing is like a hefty price for organization right so when we are doing that we should see the overall forecast we should also review what all our uh use cases and how would typically this fit into our environment because I've seen this uh quite uh blindly like some organizations they would say like no no that is e7 it means it is covering something so we should go with that but then no one really looks from the architecture point of view like e7 really needed for organization if if we needed do we have the supporting use cases for it okay and when we do the use cases we should thoroughly check each and every business when it because in some cases it might be possible like there are some of the use cases which are having e7 feature component so we can buy specifically e7 license for those which are rather than purchasing for all the uses and making a default we can have those uh mixed licensing okay or I know like from Microsoft perspective they are giving uh you know uh challenge for these compliance from the compliance perspective there is a mixed licensing but I think from the organization benefit right it is a really good to pay how do you really license the overall strategy right and then how do you architect the overall strategy with respect to the licensing and then how we are really utilizing it I think the Microsoft compliance is just one thing like we need to if you if you are sure like you know what has been used how it is been used and if you are able to map the respective licenses to the respect users I don't think that could be any way problem yeah um I think there are some some interesting architectural questions here a lot of companies uh three licensing as yeah procurement the first thing is who should own Microsoft license in decision i.e security, pro presuming finance enterprise architecture so that's an organization wide question it's not like something only i'd be able to decide like also or not the security team as well so you need to connect with each and every team okay that we have we need to understand the typical use case of the business team use case of the internal IT team or use case of the customer as well right who are utilizing our infrastructure because this is how it is connected to each other and once we know like what is our typical use case how many uh users we need for top typical licenses or how many uh features we need to utilize when we wanted to go with the procurement decision so that's where the licensing architecture will place a important role because you know what you have added it you know what has been typically licensed you know what is the typical usage you know your users that's also important and the this is where the big decisions comes altogether and then I think when you work with everyone altogether you better understand your environment rather than asking one team to go ahead and do the decision um uh should should organizations main and tame uh capability map the showing exactly which Microsoft features they are painful uh so you mean like uh is that something organization should know or they should be able to figure it out yeah do do do i i don't know i think mapping it that's a really sensible show shall say doing this or yes yes that's what I said like if you want to do right as I said like at the moment the problem is three of the aspects by the first is like licensing or bought without mapping entitlement okay let's say for e3 e5 and there are some add-ons which are purchased without knowing exactly like what are the capabilities and how they unlock those capabilities this is a much one of the major points that second is again there are some tools which are already operating in silos right like for example there is defender there are identity policies there is purview right this are some of the features that or the add-ons that are already configured independently instead of one connected system so this is the second problem that we have and then third is again these reactive security questions like let's say there is a security team they are saying and uh now complaining like hey no no we are able to see like there is no maybe three policies there is no entice spam and then we want to cover it so what we do like we have this reactive security question and then team this course like there is a gap uh after any incidents rather than we had as part of the designing controls right so this is pretty much needed and then how often short license be reviewed daily weekly monthly yearly quarterly uh so like maybe as I said so it is really depends like how you wanted to do this altogether right like if you ask me so normally what I would do like I run a quarterly check okay like if you are using licenses right using the right licenses then identify the gaps okay maybe uh justify if there is a tie-up rate or that has any waste from unused add-ons right and then third is like maybe just drop a single uh simple square cut like how many license are used policy coverage and then open gaps what are the open gaps so the quarterly check is something like I would recommend for everyone yeah um before we go to ensuing um uh I think about your framework for for deciding keep it upgraded downgrade or remove it can you a little bit explain here uh yeah so as I said like there is a typical five step practical framework okay which I would really apply in any of your organization so first is like licensing or detain capability mapping okay this is one of the major things that we need to do and I know like most of the time is spent on this particular topic because this is the base right and this is where we identify the first baseline like we know now what are our users what is the typical first baseline and from there uh we should be able to map the actual capabilities uh looking at the first baseline now after that we need to ensure like in tune is our enforcement layer so everything should go via into okay as a first step so that it is our enforcement layer and if you wanted to move with the defender again uh defender is only acting as a detection and response layer okay and then you also have defender configured everything from in tune like let's say for ASR policies uh any of the security related policies right maybe baseline everything should go from in tune so that's why we say in tune as the enforcement layer defend the detection address per layer and then there should be the fifth one which is like continuous course to cover is a view like this is something you do as part of your continuous job or continuous review so that you know your environment much better and then you are able to identify the typical gaps or the overall licenses that you have in your environment and yeah now that's the governance with into into in um if someone still thinks of in tune as Microsoft mobile device management product what they are missing they are missing as I said they're missing done of things and that's why I wanted to say again like we should treat in tune as the enforcement layer for every configuration every settings every apps management anything right because in tune is again connected with each of every features that we have with Microsoft 365 and this is where you should act in tune as an enforcement layer and we should not fit into as only MDM solution right now with the features and the upgrades that are being delivered by in tune right it is pretty much one of the you know favorite tools for any of the administrator to manage the man device plates not only device plates but also you know you are managing managing the security posture you are managing the mobile devices that you are also managing the OEM updates everything right like patch management application management so all these features are now coming to engine which which makes in tune a better product as compared to what we have in the market and um what is the first workloads you normally move into in tune so yeah the first and most was like we moved the patch management okay this was one of the things that we wanted to get rid of from the ssm because the way in tune has the windows auto patch right we wanted to really utilize this as the feature because it is it is something like it is a bit less pinned or let's say a bit effective as compared to ssm then if you ask about the second thing it is the application management okay anyway like we could not move initially everything because there were some dependencies on the ssm but yeah for most of the cases like application deployment application management we were able to do that third is also about the devices management right like provisioning thing like windows auto pilot this is one of the major ideas I think which we really liked about the in tune because we started to deliver the cloud giant devices from in tune right in ssm or other blega city devices also we environment when it to be dependent on the on on devices but now it is something like when it to go with the cloud devices okay um what did you think about organizations do organizations create too many policies into in tune or is to less or what the typical mistakes um yeah like it should be organized type and that's what I can say if you want to have in tune policies it should be organized and it is very well connected with each and every other feature or component that we use in our environment right so when we design a policy we should see like which all areas are being covered and rather than making number of policies altogether try to make it like a baseline right like let's say for a security baseline if you have different policies different if you have maybe windows devices policies different maybe grow age all like browser specific policies so if you have different different policies right managing and maintaining is a bit problem so I would prefer like rather not having different policies n number of policies it is all time to look with the security baselines which has been almost like um introduced by Microsoft like it has been released by and we have a typical version updated from the Microsoft like what are the typical service baseline or the security baseline that needs to be there so I think someone should go and build those policies which is a better way to approach yeah and I think another interesting topping is provisioning and device provisioning and it says yeah I think change dramatically there then we talk about a tool when this auto pilot what problem do windows auto pilot actually solve yeah as I said like the important thing is with the windows auto pilot it is drastically reducing the overall imaging time okay the way image was done in the past it was taking somewhere around 3 years okay just to maybe starting from 1.5 or 3 years depending on upon the network again but yeah that was a typical time the imaging time that we had in the past but now it has been drastically reduced like let's say having the provisioning policies in place windows auto pilot you just copy devices and then with the auto pilot your device is provisioned okay it could be used for a vision device provision but normally it should not take more than 20 minutes 15 to 20 minutes is barely the time that we see with the windows auto pilot and that is where it auto pilot is helping all the organizations and the second motion but the thing where you they're just described earlier was related to Corona era right so windows auto pilot has came as one of the Savior for the IT team where they wanted to build the devices at the customer right now the user end okay without giving much of knowledge or let's say without having much of efforts from the iD side they are just you know connecting with the OEM they are getting in the windows auto pilot hooked to their environment they are able to you know add devices to the auto pilot and then the user is able to build the devices on their own which was quite missing earlier before Corona era right if you need to do that I know like you need to have some expertise you need to have that network connectivity that was one of the again dependency right but now it has been changed all together so the transition to the corporate device image is it's that yeah that's what I can say okay okay um i think a little bit about this idea again an organization realistic ship laptops directly from the supply at you and employee without Emma touched it yes that's what the windows auto pilot makes your life better like normally every organization has a tie up with the OEMs right and then we give we give normally a tenant access to them so that they can add those devices when they're ship from factory to end users so we don't need to do anything like as soon as the devices are added to our tenant the provision policies are attached to it and the way those are configured it's like like mostly like a zero touch right like user's need to unpack then you need to connect to internet and then then you to use their login email address password and that's it just wait for 10 or 10 minutes and your system is built all together um i see where i think in tune it's it started as i say as as device configuration tool now it's it's an amazing or a really important part of of the security architecture what why is this happen regarding what yeah yeah in tune is this isn't just about configurable devices anymore how does it become a part of the security architecture right so as i say like we have this defender which is also tied with in tune and since in tune would be more like a enforcement layer for any of the policies configurations it could be security configurations it could be security baseline it could be any aspect of the security right so you have this all of the configuration policies that can be managed all together within in tune so you don't need to navigate all together to each and every portal you can do those all of the security configurations right away from into itself so that's why i think this is one of the biggest area that we can see as an improvement and the way it is attached to all the security systems is also really making it much better in the security posture right we improve the overall security posture so at the moment like let's say if i want to deploy any of the anti-war as policies i can do it from in tune if i want to do any of the it's the scalar policies right which is i can security i can do it from in tune like in tune is most like a management tool now where you can build any of the security policies just by creating the policies or importing the any of the adm templates that is available within the tools and you should be able to manage the overall policies so i think that's how it has been really improved overall as compared to what we had in the past. You have also bring defender to the architecture when someone says Microsoft defender that actually in entry family of products how do you explain the ecosystem? See defender is really big shark that's what i can say like it should be pretty much aware about all the protection layers that defender is providing and then you should be able to unlock all the features that defender is providing like as i said like when we did our licensing migration right we discovered like there are many features that are being not used as part of the defender and then there are some of the features which were over utilized as well right and then we need to be compliant from the Microsoft site like no no this is something we cannot use for e3 users probably we need to use it only for the e5 users because those functionality or those license components are not really provided as part of the service plan which has been provided by e3 or e5 licenses so let's say from the defender right you have your Microsoft defender right as the anti-ware stool it works as a anti-ware stool it works as a defender for endpoint okay managing your endpoints it could be having like plan one plan two where you were really utilizing your defender capabilities okay like maybe from the security perspective from blocking from researching from developing or let's say also from this category you put face right so there is also something you can use it within the defender so these are the typical you know configurations or difficult layers that you have within the defender but unless and until you don't know you won't be able to unlock these features so you need to have that defender portion looked thoroughly thoroughly and then understand like what is the defender offering and what are the capabilities and how we can do a lot those who that's built a scenario a managed up top start behaving as a specifically defender detects a firm thing what is next in the major Microsoft environment so yeah so there could be multiple scenarios right like when we say my defender is detecting something so we have a typical let's say a ticket that has been created as part of the defender portal right like as for the detection and response so the security team is normal response equal if in case we see in the behavior which is you know having a threat altogether so that has been flat using the defender as part of the detection and response framework that we have where every ticket is been standardized every ticket has been really looked upon from the security team they block the devices if in case they feel like now this is a real security and there could be also some false alarm so we need to really see what is the actual impact what is the behavior where it is blocking what all models are been blocked and then how it has been really moved forward as part of the detection and this one strategy that we have within defender so could we essentially create a loop detect, evaluate, restrict, remake and then store okay what will you say from your perspective how many organizations actually implement the complete loop? I can like for every organization there is a different environment or behavior like how they treat the defender in some cases they might have don't they don't have the feature itself or the components itself some of them have eliminated and some of them have a full skill so whenever we have a full skill I'm pretty much sure they are using this feature but I cannot in a full way where it is explored where you do the overall discovery you do the overall detection at response and I think if you ask me like the recommendation is to use defender for detection and response and then you have your security team actual looking into those detections that we have from defender right that is a major yeah yeah my Microsoft talks extensively about zero trust but yeah the term can become very abstract what does zero trust actually mean to you operationally? see zero trust means again same thing like we should not allow anything which is outside our environment and if it has been allowed then we should have a proper security guard to it which would go and scrutinize to eat an over security aspect and only once it is been authenticate allowed right and then you have the proper necessary security tools, your confirmation security measures in place only then the device is allowed to an environment so I think that's where it comes as a zero trust like we won't be able to trust any of the outsiders without you go through any of the security mechanisms that we have in place. what is zero trust exactly is it's a Microsoft product, a service, a framework, how will you describe it? sorry it went for a minute okay yeah no so if you ask me like how we would really describe zero trust it says more like maybe modern cyber security strategy okay that's something we have as part of the modern modernization strategy so it is fundamentally you know changing like how organization approves the overall security so it just typically built on the principle of like never trusting anything on anyone or default like as I said never trusting any of the external things and then continuously verifying like there is a typical security pushchers, ability mechanism for every accessor request that has been given for us right so again this is typically based on our three core principles like maybe verification of identity then application context and then of course like enforcement of least rule age right like how we are doing that least rule age within our environment so yeah that's that's how I think we look with the zero trust again that's not something like it's a product it's more like a mindset that we have and this is something like we take care as part of the design like when we are thinking about a security aspect and then they should be implemented across an organization not only for specific maybe organized specific business, financial something so it should be more like an organization level adopted strategy that comes as part of the security and there are typical comprehensive frameworks that that has been there like how we really implement zero trust and nowadays like we have AI right that is also something evolving into this category like how we really include like AI driven attacks and then how we are connected all together so I think yeah this is how I would really say like how this zero trust is coming or it's more like a mindset rather than a product yeah yeah yeah we can't have 2006 2026 Microsoft con yeah conversion without talking about about AI I think where do you see AI changing endpoint management actually yeah the way AI has now evolved right it you have used it the way the way how it has been done for the AI right adapting the endpoints it should be now more like focused on the IT operations like the IT ops like how we wanted to have the AI enabled IT ops all together like let's say you have a prediction mechanism you have then a prior to mechanism all together that you can enable using AI right let's say maybe for example next thing is a good tool like for my experience where we were using it in the past for AI capabilities and then it was giving us a good feature like it was able to product what is happening with the endpoints it was also practically fix the issues okay using some of the data that we have as part of the telemetry okay so this is how I would say like how the AI is helping the endpoints when we wanted to work because earlier the problem was like let's say there is a user he's complaining like there is some issue now we come to know only when he's complaining but we never know before he had some issues right so this is where AI is helping like it will predict us looking at the logs looking at the given telemetry like how the device is able to work what is the typical desktop how the device is operating what is the typical health and then what are the typical issues that user had right it could be possible like user is having a biosodica as for maybe last couple of weeks okay he's not reporting in the issues but it just not like his devices in a good condition it could be possible like his device health status is quite bad or the desktop is quite not in a good shape so this is where AI is helping us to give that productive information and then we can practically fix those issues rather than user coming to us to fix the issues we would be going to them and then helping this practically so I think this is what it helps. It helps but it cannot handle the endpoint management. It helps I can say like totally we cannot be relying on the AI but yeah at least you can left ship some of your L1 strategies or L1 task to AI I think this is where I would see AI fade into it most of the capabilities that they offer like we really cannot be dependent for everything on AI so if you say you wanted to inject AI into your IT labs then I think this is where I can see the opportunity where we are adding this as a one task. I think architecture really really big and I like to make it more practical so imagine a global enterprise was 50,000 employees been also at Mac IOS and Android, Windows 365, Android the regulatory, existing SCCM infrastructure, thousands of applications, employee work globally, contractors, bring your own device, e3, e5, e7, licensing, multi third party security tools. The CIO says we want modern managed stronger security, lower lives and cost. Where did you start? Again for me I think if I would go right I would go with the discovery procedure altogether okay that's what I said like if you want to define like what is the license strategy we need to do the licensing audit altogether and then we need to also have the capability map in we need to know our environment better I think that's where I'm coming from so if you want to have everything you need to know your use case and then you need to know what is there in future like let's say you need to also predict some of the things you should not be only dependent on what is current like in some cases let's say you have a security poster you need to improve your security poster but if you do not have that now as part of the designing architecture mind then you will lose that functionality when you want to have it in future right in in some cases we see like this is a bit missed decision from the architect or the licensing thing who do that and then later on they discover like that is a gap right so just to overcome you need to do that altogether and as I said for any licensing thing or any confusions what we need to do we need to have that audit we need to know our environment better and we need to map those specific use cases so that you know where we would be utilizing or leveraging all these tools or features like as I said for the BYOD concept as well you need to know what all your users are because BYOD again it is not accepted by each and every region like if you are working in a global company it's something like you cannot have this adoption in every company or any every organization or every location within your global company right so there might be some limitations so you need to also know like what are those limitations what are the typical use cases and how we wanted to avoid that. Awesome I think a little bit about the how we can go I can say how do we prevent the transformation from disrupting these thousands of employees. Distruption right like how we can avoid a disruption for the thousands of lives again like the discussion could be anything right like it's not like it is only licensing it could be anything the discussion is something where you are not actively monitoring your services you are not actively monitoring your deliveries okay most of the time like what we say in a typical you know environment if you someone is working in most of the cases the disruption is like when you are not following the typical standard procedures or typical standard architect designs right if you are not able to renew this with your peers if you are not able to handle it properly if you are not able to really implement as per the canvas then there is a possibility of having a disruption in year future right but something I would say like we should avoid altogether so that we are able to minimize the disruption okay wherever necessary of course we cannot really stop the disruption altogether but at least you can minimize by having the good reviews good decisions having the good high level level document you know everything is documented everything is a good and then everything is implemented as well we can't hold okay yeah that's it's cool so yeah thank you first for this I have a quick fire round so I give a short question and you give give a short answer okay Windows Windows or Mac OS Windows cloud native or hybrid hybrid compliance policy or conventional like this conditional axis one in tune feature more organization should use use tight yeah auto wallet most underestimated endpoint security risk business units like roaming users one technology in EUC you are most excited about modernizing the digital workplace and how we really adapt and connect to the cloud stops and then of course working with the AI adoption all together okay and finish the sentence the endpoint of the future will I sorry vote endpoint finish the sentence the endpoint of the future will no okay yeah so thank you for for the interview who shall I invite next and what a question should I ask yeah probably any of the MVP so any of the let's say the community masters where they are typically implying the overall end user experience so it could be someone who is you know working all together into the Windows as a core concept and then also implementing the air related strategies I think that's one I would say best you go with yeah so in this yeah what's that out from this conversation it's how closely connected these areas all have become Microsoft licensing isn't a simple pursuer man problem in tune isn't a simple device management but the defender isn't a simple anti-rear and identity isn't a simple user name in possible words yeah together they create an architecture where identity device health security signals accessible is licensing you buy all influence each other um yeah so this was really cool so so thank you for staying here with me for all the listeners the info are all on the MC 60 part of the podcast page from Bindersh you think the links and yeah thank you so much for staying here with me thanks thanks we'll go thanks everyone thanks everyone listening you have looking forward thanks yeah thank you have a nice day bye