MS InTune MAM question
Discussion
My company delivers Teams through Citrix and it's not a marvellous experience - it's very laggy. Teams works very well on my phone but as I have a high spec PC with big screens and a high spec camera, I'd rather use that.
When I use Teams natively installed on my PC for my personal calls (my version of Teams vs the work version through Citrix), it's great (operationally) but I'm told I cannot connect to my corp Teams this way.
InTune provides for a MAM policy on our phones and iPads, rather than a MDM policy that would take over complete ownership of the device. I'm told it can't do the same on PCs or Macs. If I wanted InTune to completely take over, I can elect to enroll the PC for a MDM policy but I don't want that. I'd like a MAM policy just like the way it works on my phone.
Any experts that can confirm I what I want is possible please?
When I use Teams natively installed on my PC for my personal calls (my version of Teams vs the work version through Citrix), it's great (operationally) but I'm told I cannot connect to my corp Teams this way.
InTune provides for a MAM policy on our phones and iPads, rather than a MDM policy that would take over complete ownership of the device. I'm told it can't do the same on PCs or Macs. If I wanted InTune to completely take over, I can elect to enroll the PC for a MDM policy but I don't want that. I'd like a MAM policy just like the way it works on my phone.
Any experts that can confirm I what I want is possible please?
What your work is telling you unfortunately seems true in the context you describe. So, what you want isn't directly possible given the way it sounds like your work IT is set up.
The MAM policy that you have accepted on your phone would give them a certain level of 'trust' of your phone. It probable/possible that it allows them to enforce certain security policies (like requiring a screen lock) and might allow them to do a remote wipe and so on. Given that modern Android/Apple phones tend not to be riddled with malware and viruses, they probably consider this sufficient.
A Windows PC is a whole other kettle of fish; it's quite plausible that your PC could have all sorts of malicious things on it. So, they want full management of the whole thing for them to feel they can 'trust' it.
FWIW, I think they are probably being overly onerous about the control, and there are better, more modern ways to 'secure' an IT system which allow the flexibility you are after. But that doesn't help you much!
An option for you might be to run another copy of Windows within a virtual machine on your computer using something like https://www.virtualbox.org/ And you can enrol that computer in your work MDM without it affecting your 'real' personal Windows machine.
Another thought, on the off chance that you have a Samsung phone, Samsung Dex can allow your phone to essentially behave like a PC. You can connect a monitor/mouse/keyboard and use it like a computer. https://www.samsung.com/uk/apps/samsung-dex/
The MAM policy that you have accepted on your phone would give them a certain level of 'trust' of your phone. It probable/possible that it allows them to enforce certain security policies (like requiring a screen lock) and might allow them to do a remote wipe and so on. Given that modern Android/Apple phones tend not to be riddled with malware and viruses, they probably consider this sufficient.
A Windows PC is a whole other kettle of fish; it's quite plausible that your PC could have all sorts of malicious things on it. So, they want full management of the whole thing for them to feel they can 'trust' it.
FWIW, I think they are probably being overly onerous about the control, and there are better, more modern ways to 'secure' an IT system which allow the flexibility you are after. But that doesn't help you much!
An option for you might be to run another copy of Windows within a virtual machine on your computer using something like https://www.virtualbox.org/ And you can enrol that computer in your work MDM without it affecting your 'real' personal Windows machine.
Another thought, on the off chance that you have a Samsung phone, Samsung Dex can allow your phone to essentially behave like a PC. You can connect a monitor/mouse/keyboard and use it like a computer. https://www.samsung.com/uk/apps/samsung-dex/
Thanks. The MAM policy we have for our phones only allows for containerisation of the MS apps and not any further restrictions or control over the phone.
They already explained to me that this isn't possible for the PC but I just wondered if that was a convenient way of saying "we haven't got around to looking into this yet" but thanks for confirming what they said. It's a shame.
I didn't really want another virtual Windows on the machine. I have multiple screens so I wanted to have the normal Citrix environment on one, Teams native on my PC on another, and so on. To be honest, if Teams would just work better on the Citrix environment, I'd accept that but it's just not good.
Oh well, maybe Citrix or MS will sort this out one day. Thanks again.
They already explained to me that this isn't possible for the PC but I just wondered if that was a convenient way of saying "we haven't got around to looking into this yet" but thanks for confirming what they said. It's a shame.
I didn't really want another virtual Windows on the machine. I have multiple screens so I wanted to have the normal Citrix environment on one, Teams native on my PC on another, and so on. To be honest, if Teams would just work better on the Citrix environment, I'd accept that but it's just not good.
Oh well, maybe Citrix or MS will sort this out one day. Thanks again.
Gassing Station | Computers, Gadgets & Stuff | Top of Page | What's New | My Stuff