This message was deleted.

If we do as MS recommends, and AAD join our machines, do we then need to worry about UEM?

@Kasper Johansen we are thinking the same thing as we go azure do we need any uem

Well from my point of view it will be difficult to have UEM with AAD joined devices. You can configure FSLogix Profile Container, to retain what ever configurations the user does in case of a Windows 10 reset

@Cory Zaner and @Kasper Johansen for your customer, does having a Profile Container mean that you're managing the user session? What about context awareness, managing things like security, printers, drive-mappings 🤮, odbc, mandatory signatures, performance features like cpu clamping for those nasty legacy apps, diagnostics, custom file and folder actions for those legacy apps that need to have different settings for every department but need to work with just one app. etc. (just wondering). If you need more than just a roaming profile, sorry FSLogix, then I'd go for Ivanti IWC (most features, integrates with FSLogix, has best support ever), Ivanti UWM (less features, more flexible, has it's own VHDx solution, you scripters will like it).

@Dennis van Dam I agree with you on everything, when we talk about managed domain joined machines. But with AAD joined machines, there is no ties to the on-prem domain, there is no easy way of pushing out network drives, networks printers etc. On top of that, IMO, that doesn't really matter. To me an AAD joined machine is a standalone computer, which should never be on the domain network. Sure it can access an isolated network or a guest network, from there the user will be able to access the domain joined machines, via either Citrix or some other remoting technology. And to clarify, when I say AAD joined, it's pure AAD joined, not AAD hybrid-joined.

My brain was still with my customer where they delivered AAD machines and after 5000 of them were in the field they noticed that (for them) hybrid was needed. So yeah for AAD only expensive thin clients there might not be a need of any management, agree.

I think some folks were thinking 100% azure joined with vpn.

AAD with VPN to your infrastructure does that make sense from a security stand?

Longed Lived GPP.

VPN needs to die. Do whatever you can to kill VPNs

Good stuff, will pass this over to the team. I think the justification for vpn is 2fa enrollment and our devices will be preloaded from Dell/hp and auto enrolled in intune. But you bring up some good points, we don’t want just anyone getting on our network.

@Aaron Parker I agree with you regarding VPN. What are your arguments for getting rid of VPN? I still find my self talking to "classic" network guys, where VPN is almost always a must to do just about anything

@Kasper Johansen never trust endpoints. Who knows what's on them

I know 🙂