-
-
Notifications
You must be signed in to change notification settings - Fork 82
win365 readme
The baseline has been designed for, and tested on the following:
- Windows 11 Enterprise 23H2 Gallery Image
- W365 Provisioning Policy configuration:
- License Type - Enterprise
- Join Type - Microsoft Entra Joined
- Network - Microsoft Hosted Network
- Use Microsoft Entra single sign-on - Yes
- Cloud-Only or Hybrid Identity with Entra ID as IdP
- MFA configured via Conditional Access
- User is not an Administrator
- M365 Business Premium or M365 E5/A5, or M365 E3/A3 + MDE P1/P2
OR:- Entra ID P1 or P2
- Office 365 E3/E5, A3/A5 or F3
- Intune P1
- Defender for Business or Endpoint P1/P2
- An appropriate Windows 365 Enterprise SKU
Access to the W365 host has been tested using the Windows App via a client also running the Windows OIB.
Note
The Windows 365 OIB is designed to work as an addition to the Windows OIB. It is recommended to assign the W365 host all Windows OIB policies with the exception of:
- BitLocker
- Device Health Compliance Policy
The above can be achieved using group assignments or Intune filters.
Warning
The Windows 365 OIB is not designed to protect corporate data if accessed via a non-corporate device.
Please reference Importing the Baseline for information.
Primary information regarding adherence to security frameworks can be found in the main README.
The Windows 365 OIB has been created with the following Microsoft documentation as guidance:
- https://learn.microsoft.com/en-us/windows-365/enterprise/configure-single-sign-on
- https://learn.microsoft.com/en-us/windows-365/enterprise/security-guidelines
- https://learn.microsoft.com/en-us/windows-365/enterprise/manage-rdp-device-redirections
- https://learn.microsoft.com/en-us/windows-365/enterprise/rdp-shortpath-public-networks
- Connectivity configuration
- Resource redirection including restricting clipboard transfer from server to client
- W365-specific Device Health Compliance policy
All policies are Settings Catalog and will show in Devices>Configuration Profiles.
For a complete list of settings, please consult SETTINGSOUTPUT.