AI-powered IT support with Moveworks in Microsoft Teams: now on AppSource

by Contributed | Dec 10, 2020 | Technology

This article is contributed. See the original author and article here.

Microsoft Teams is excited to announce that AppSource now includes Moveworks, the world-leader in AI-powered IT support.

Moveworks is a conversational AI chatbot that allows employees to resolve their tech issues directly in Teams, instantly and autonomously, with no involvement from your IT team. Unlike conventional chatbots, Moveworks leverages advanced natural language understanding, or NLU, to determine exactly what employees are requesting—no matter how they phrase those requests.

“By helping to quickly resolve employees’ IT issues within Microsoft Teams, Moveworks allows companies to work faster. And in a world that now relies on technology to collaborate, it’s never been more critical to provide real-time, location-agnostic tech help.”

— Mike Ammerlaan, Director, Microsoft 365 Ecosystem, Microsoft

Behind the scenes, Moveworks takes action and retrieves knowledge by integrating with other enterprise systems, such as Active Directory, SharePoint, and Microsoft 365. These deep integrations enable the Moveworks bot to deliver end-to-end resolution for a wide range of IT issues:

• Provisioning and deprovisioning software licenses


• Unlocking accounts and resetting passwords


• Creating and editing distribution lists


• Serving up answers to troubleshooting questions


• Ordering devices and accessories for the home office


• …And much more.

Before Moveworks became available on AppSource, fully deploying the bot still took just eight weeks. But by downloading Moveworks at the click of a button, you can shrink that time-to-value even further—thanks to these added capabilities:

• Rapidly roll out the bot to your workforce


• Access the latest Moveworks features on Teams faster


• Build your custom bot avatar, alongside Moveworks’ design team


• Easily contact Moveworks Support for rapid assistance

For enterprise Teams customers like Equinix, Moveworks has significantly enhanced the Teams platform in two distinct ways. First, Moveworks allows Equinix employees already using Teams to fix their tech problems—from accessing software to editing email lists to unlocking accounts—via quick, painless conversations with the AI chatbot. And second, Moveworks intercepts IT issues submitted through other channels and then resolves those issues on Teams, bringing new users to the platform.

You can read Equinix’s success story here.

Reimagining your virtual workplace
Particularly in this new normal of remote work, the ability to remain productive anywhere and anytime defines successful employees. But without a physical office or access to in-person help, these employees often don’t know where to find critical resources.

With Microsoft Teams, however, every key team member, workflow, and file is consolidated in a single place. And by adding Moveworks to Teams, getting IT support is just as simple.

“Microsoft Teams is a powerful platform, and Moveworks makes it even more valuable. It’s a symbiotic relationship.”

— Greg Ogle, VP of Global IT Infrastructure, Equinix

Aisera and Microsoft Teams streamline service desk support driving employee productivity

by Contributed | Dec 10, 2020 | Technology

This article is contributed. See the original author and article here.

Today’s urgent need to optimize and transform service desk support across internal departments such as IT, HR, and Sales has led to a dynamic new partnership between Microsoft Teams and Aisera’s AI Service Desk. The agile technologies of Conversational AI, NLU, Cognitive Search, Unsupervised NLP, and Conversational RPA combined with Teams’ ability for employees to connect and collaborate seamlessly, underscores the growing trend of work from anywhere.

Service desks were previously unable to meet the demands of offering a five-star employee experience—bogged down by manual processes, lack of self-service and automation, and long waits to resolve support requests. Previously, employees had to wait an average of three days to get their internal IT or HR issues resolved, as support desks were stretched thin and unable to meet business Service-Level Agreements (SLAs). This problem was amplified during the pandemic, leaving many internal support organizations unprepared.

Aisera’s AI Service Desk, integrated with Microsoft Teams, takes advantage of cutting-edge AI collaboration technology and dramatically improves employee support experience. Now, employees are freed from long wait times that once characterized the service desk. Aisera on Teams provides instant resolutions of employee requests, thus making employees more productive.

Auto-resolve support requests in seconds, not days
With the growing emergence of Teams as a preferred channel for employee communication, Aisera’s integration fits perfectly into IT service desk environments for ITSM automation. Aisera serves as a go-to IT and HR channel for employees that don’t force users to log into service desk environments and portals. Here, using AI, their requests are auto-resolved in seconds.

Building the ultimate support hub
The convenient central interface created by unifying Aisera with Teams has propelled employee productivity to unprecedented levels. Aisera’s agility in resolving issues is founded on a virtual assistant using Conversational AI, NLU, Cognitive Search, Unsupervised NLP, and Conversational RPA in a scalable, cloud-native AI technology platform. Moreover, Aisera’s conversational RPA technology acts as the AI-driven workflow automation engine, which enables MS Teams with automation for user workflows and tasks.

Employees can leverage pre-built integrations to Microsoft products from Active Directory, Office 365, SharePoint, Knowledge Bases, Dynamics 365, and leading ticketing systems, including Service Now, JIRA Service Desk, and BMC.

Teams adoption rates soar with Aisera’s Conversational AI
The ability of MS Teams integration to transform self-service has been instrumental in automating internal services and boosting service desk productivity. Customers have reported an increase in user engagement, with proactive notifications and a substantial decrease in tickets created through Teams via AI-powered auto-resolution. The results? Employee satisfaction has improved by 70 percent, agent productivity has doubled—and average resolution rates improved by 90 percent in many cases—a significant key performance indicator of Service Desk efficiency.

Staying resilient with continuous learning

by Contributed | Dec 10, 2020 | Technology

This article is contributed. See the original author and article here.

Resilience is a theme that has emerged from all over the world as we find ways to cope, learn, and grow through these unusual times. We have good news for people who would like to start a career or who already work in technology: Research shows that the pandemic has accelerated digitization to the tune of a projected 149 million new jobs in tech by 2025.¹

In-demand tech jobs by 2025:

• 98M new jobs projected in software development


• 23M in cloud and data roles


• 20M in data analysis, machine learning, and AI


• 6M in cyber security


• 1M in privacy and trust

In contrast, since 2008 employer-paid training has declined steadily.² So how can you keep up with the training and certifications you need to grow into these high-demand roles? This is an encouraging opportunity to take charge of your own career growth through available training resources. Recently, we launched an initiative to help people worldwide acquire the digital skills needed in a COVID-19 economy.

It’s the right time to get skilled

Where are you in your career stage? Maybe you’re happily employed and the pandemic has not significantly impacted your career path. If so, this is a good opportunity to keep your skills relevant with training or explorations in new areas to ensure you’re current. Maybe you’re actively looking for a new role. Do you need to strengthen skills to be a prime candidate? Perhaps you’re a recent graduate and want to build specific skills for a role you’re interested in. Or maybe you’re growing in your career and want to take the next steps to become an expert in your field. Wherever you are in your current career stage, using this time of change to improve your skills can help you stay ahead.

Get role-based tech training

We’ve been building a portfolio of technical role-based training and certifications designed to help you stay current and be future-ready. Role-based training focuses on department objectives rather than product knowledge. For example, training and certification for a cloud administrator covers a broad set of products including data management and analytics, system properties and provisioning rules, VMs and even resource management, just to name a few. This helps provide a valuable set of skills to be successful in a job role, and in turn, makes you valuable as an employee or partner.

Learn in the style that fits best

Everyone learns differently. To meet people where they are, Microsoft Learn provides a range of learning modalities, often combined to create a personalized experience. This method empowers you to grow in a way that fits you best:

• Self-paced learning on Microsoft Learn helps build practical jobs skills with free, step-by-step, bite-sized tutorials and modules. Learning paths offer interactive coding environments right in the browser.


• Training events provide unique upskilling experiences, combining presentations with demonstrations, discussions, and hands-on workshops virtually and/or in person.


• Instructor-led training with Learning Partners, using Microsoft Official Courses taught by Microsoft Certified Trainers, brings customized training plans and dedicated personal attention and support to quickly advance technical expertise.

Keep moving forward

Continuous learning is a key signal of resilience and staying ahead. Just as Microsoft training is aligned with roles, Microsoft Certifications are designed to validate that those in-demand talents exist. Microsoft Certification validates technical knowledge and the ability to demonstrate real-world skills, recognition that can help you aim for your next career step. Continue learning and growing, even during a pandemic. Explore Microsoft Learn to find your path forward.

Related post:

• Microsoft launches initiative to help 25 million people worldwide acquire the digital skills needed in a COVID-19 economy

¹ Microsoft Data Science, utilizing LinkedIn Data. Methodology and assumptions can be found in the white paper “Methodology: Digitization Capacity of the World Economy.”

² Council of Economic Advisers calculations of data from Census Bureau, Survey of Income and Program Participation. Microsoft CELA Data Science and Analytics.

HLS Security Monthly with Scott – Insider Risk Management Webcast 12-16

by Contributed | Dec 10, 2020 | Technology

This article is contributed. See the original author and article here.

  Join Microsoft’s Scott Murray and special guest Derek Peter for this month’s security webcast as they address Insider Risk Management. During this webcast they will present, and answer your questions, around the workings of Insider Risk Management within the Microsoft 365 Compliance stack.

• When: 12/16/2020 at 10am Central/11am Eastern


• Who: Microsoft’s Scott Murray and special guest Derek Peter


• Where: Microsoft Team Live Event online
  
  
  
  • Click here to grab the .ics calendar invite  
  
  
  • Click here to join the event directly 
  
  
  
  

Thanks for visiting – Michael Gannotti   LinkedIn | Twitter  

Michael Gannotti

No recompile, no redeploy, managing features flags in .NET Core, locally and with Azure

by Contributed | Dec 10, 2020 | Technology

This article is contributed. See the original author and article here.

Feature flags is a concept meaning that you switch features on and off via a flag. Why would you want to do that?

Here’s some good reasons:

• Early integration. Usually you work on a feature in a branch. The longer the feature takes to complete, the more trouble you will have with merging/rebasing, once you are done with the feature. Being able to integrate the feature into your main branch early means less of that kind of hassle. The effect of this is that you can ship a feature to production before it’s ready for public use. This type of deployment is also called dark deployment.


• A/B testing. A known pattern for trying out new, or changed features, is A/B testing. In A/B testing you want to answer a question, is A better than B. A represents one version of your app and B the other. To find this out, you create different versions of an app. Then you decide to filter your incoming user traffic so that different users ends up on different versions. You can then measure different things such as conversion rates, if you are an e-commerce, or maybe if more users click a certain button and more. One way you can use to create different versions of a site, is to ensure that different features are activated. On a website this can mean that different flags are set in localStorage, or you use parameters in the URL or it’s decided via data from the backend.


• Flighting. Flighting is a term that means that a certain percentage of users gets a new feature. It can be almost the same mechanisms at play as with A/B testing. Instead of trying to answer whether A is better than B, you try to deliver a new feature to a subset of users to see if they can use a feature without issue. If there’s an issue, you can always roll back.

 

References

• Why feature management


• Use an App Configuration store to add feature flags to ASP .NET Core


• Free Azure account

 

Using feature flags

Depending on if you are working on a mobile app, a webapp or some other type of software, how you implement feature flags might differ. The flow of how a feature flag is applied is roughly the same though:

1. Create the flag. Create the flag with suitable name and namespace and give it a value.


2. Evaluate the flags value. This means that somewhere there’s a line of code looking roughly like so:

   if (flag) {

      // render A, else B

   }

 

Code like that might be baked into a tag component, so you might not have to write it. (That’s just what it is in .NET Core)

1. Render different experiences. As a result of the previous bullet you end up doing something differently, either you render/don’t render a certain portion of a page. Or, you redirect from one route to another route and so on. The exact details of this process is up to you, but the steps are the same.

 

No recompile, No redeploy

 

Above is Jean Claude Van Damme in the movie, No retreat, no surrender. The only way to beat the bad guy (Van Damme) was by a superior technique, taught to a young fighter by the ghost of Bruce Lee. You might not have a ghost handy, but you can make sure that the way you manage your feature flags is done with a minimum of interruption – No recompile, no redeploy.

You can have the flag as a variable within your code. Depending on what it’s set to, the feature is either on or off. This has a weakness though, it forces you to change the code, recompile and redeploy it. That can work for you but oftentimes you want a different behavior, you want to be able to enable/disable flags with no compilation or redeploy. So how do you do that? You move the mechanism for managing the flags outside of your source code. There’s a couple of ways to do that, and we will explore both ways:

• 
  

  Configuration file. By specifying the flags and their value in a configuration file and have your app read from said file, you accomplish a decoupling of flag management and app.

  
  


• 
  

  Configuration service. A configuration service is a service endpoint, reachable by for example an HTTP request. Such a service can be placed in your companies network or in the cloud.

  
  

Let’s look at how you can implement feature flags in .NET Core next, with both the mentioned approaches.

 

Example usage, .NET Core App

It’s possible to work with feature flags locally by using a built-in functionality in ASP .NET Core that uses a JSON file appsettings.json. Using said JSON files you can define what flags you have and their values. Then you can rely on decorators and built-in tags in Razor to display differently depending on the value of the flags.

You’ll start by trying out the configuration file scenario first and then move to use the App Config store in Azure.

 

Create flags and configure your project to use them

1. Create an ASP .NET Core project with the following command:

   dotnet new mvc –no-https –output TestFeatureFlags

 

The command will create an MVC project in a sub directory TestFeatureFlags.

1. Navigate into your project:

   cd TestFeatureFlags

 

1. Add the following NuGet packages with the following command:

   dotnet add package Microsoft.Azure.AppConfiguration.AspNetCore

   dotnet add package Microsoft.FeatureManagement.AspNetCore

 

1. Locate Startup.cs and add the following using statement at the top:

   using Microsoft.FeatureManagement;

 

1. In the same file, locate ConfigureServices() method and add row:

   services.AddFeatureManagement();

 

1. By default .NET Core reads from a FeatureManagement section of the config file appsettings.jsoon. You can override that my specifying your own name like so in ConfigureService() method:

   services.AddFeatureManagement(options =>

   {

      options.UseConfiguration(Configuration.GetSection(“MyFeatureFlags”));

   });

 

It’s up to you if you want to do this change or not, we will however continue with the default, so we need to specify a FeatureManagement section in appsetting.json.

1. Open appsetting.json and add the following JSON configuration:

   “FeatureManagement”: {

     “FeatureA”: true,

     “Beta”: true,

     “FeatureB”: false,

     “FeatureC”: {

        “EnabledFor”: [

            {

                “Name”: “Percentage”,

                “Parameters”: {

                    “Value”: 50

                }

            }

        ]

     }

   }

 

Above, you introduce the features FeatureA, Beta, FeatureB and FeatureC. Note how FeatureC is nested.

 

Render the content

Next you will see how you can use the Razor tag feature and render a portion if the correct flag is enabled.

1. Locate the Index.cshtml file under Views/Home. At the top of the file add the following row:

   @addTagHelper *, Microsoft.FeatureManagement.AspNetCore

 

This line will let you use the feature tag.

1. In the same file, change the HTML content to this text:

   <div class=“text-center”>

    <h1 class=“display-4”>Welcome</h1>

    <p>Learn about <a href=“https://docs.microsoft.com/aspnet/core”>building Web apps with ASP.NET Core</a>.</p>

    <feature name=“Beta”>

      <div class=“nav-item”>

        <a class=“nav-link text-dark” asp-area=“” asp-controller=“Beta” asp-action=“Index”>Beta</a>

      </div>

    </feature>

   </div>

 

Note above the usage of the feature tag:

   <feature name=“Beta”>

      <div class=“nav-item”>

        <a class=“nav-link text-dark” asp-area=“” asp-controller=“Beta” asp-action=“Index”>Beta</a>

      </div>

    </feature>

 

What you are saying is, if the flag Beta is set to true, then render this portion. Consulting your appsettings.json you can see the flag Beta is true, so it should work. Let’s build and run our project next.

1. Run the following command to build and run your project:

   dotnet build && dotnet run

 

You see an output similar to the below:

   info: Microsoft.Hosting.Lifetime[0]

      Now listening on: http://localhost:5000

   info: Microsoft.Hosting.Lifetime[0]

      Application started. Press Ctrl+C to shut down.

 

1. Open a browser and navigate to http://localhost:5000. You should see the following:

 

1. Next, open up your appsetting.json and set the Beta flag to false, like so:

   “Beta”: true

 

Save the file and refresh the browser. You should now see the following:

 

Congrats, you’ve managed to set up feature flags locally and control its usage via appsetting.json file. However, if your app is deployed to a cloud service like Azure, it’s somewhat impractical to go into the deployment files, open up a file and save it. I mean you can, but it feels clumsy, or even worse, change the file locally and redeploy the whole thing, yikes !

A better approach is to rely on a configuration service. For Azure you can use something called Azure Config Store. Let’s leverage that service next.

 

Adding Azure Config Store

Before we add the cloud service the review the steps we are about to take:

• 
  

  Set up secrets storage. A good way of moving configuration and keys, during development, is to use the secrets storage. The secrets storage is tool that associates keys to a specific .NET Core project. Moving your app to the cloud though, you would need to use the App Configuration tab to place your secrets in or even better, Azure Key Vault.

  
  


• 
  

  Provision Azure Config Store. Provision the config store is straight forward. Here we will provision the store and add a feature flag that will mirror what we have in the appsettings.json.

  
  


• 
  

  Configure App to use Config Store. Finally we will configure our app to use the Config store. That’s done by pointing out the connection string of the config store and one code line of configuring.

  
  

Set up secrets storage

1. To set up the secrets storage, run the command dotnet user-secrets init:

   dotnet user-secrets init

 

You now have a new entry in your project file ending with .csproj, something similar to this:

   <UserSecretsId>9dcd0c7b-e32d-407d-aabd-d34c644ecaaf</UserSecretsId>

 

We will return to secrets management once we need to persist the connection string from our cloud resource.

 

Provision Azure Config Store

1. 
   

   To provision an Azure Config Store, head to portal.azure.com.

   
   


2. 
   

   Select Create a resource, from the top left menu.

   
   


3. 
   

   In the Search the Marketplace box, enter App Configuration and select Enter.

   
   


4. 
   

   Select App Configuration from the search results, and then select Create.

   
   


5. 
   

   On the Create App Configuration pane, enter the following settings:

   
   

 

1. Select Review + create to validate your settings.


2. Select Create

Get connection string

Once the resource has finished provisioning, head to the resource page.

1. 
   

   Select Settings > Access keys.

   
   


2. 
   

   Make a note of the primary read-only key connection string.

   
   

Create a feature flag

1. 
   

   Select Operations > Feature manager > Add.

   
   


2. 
   

   In the Add pane:

   
   
   
   
   1. check Enable feature flag
   
   
   2. For Feature flag name, enter Beta
   
   
   3. Select Apply, to create the feature flag
   
   
   
   

Configure App to use Config Store

1. In a terminal, in your project root, run dotnet user-secrets set”:

Ensure you replace “<your connection string>” with the connection string you made a note of in the Azure Portal.

   dotnet user-secrets set ConnectionStrings:AppConfig “<your_connection_string>”

 

This will set a secret in the secrets manager that you will be able to retrieve via code next.

1. Open the file Program.cs, locate the method CreateHostBuilder() and replace it with the following code:

   public static IHostBuilder CreateHostBuilder(string[] args) =>

    Host.CreateDefaultBuilder(args)

        .ConfigureWebHostDefaults(webBuilder =>

            webBuilder.ConfigureAppConfiguration(config =>

            {

                var settings = config.Build();

                var connection = settings.GetConnectionString(“AppConfig”);

                config.AddAzureAppConfiguration(options =>

                    options.Connect(connection).UseFeatureFlags());

            }).UseStartup<Startup>());

 

What you did was calling the ConfigureAppConfiguration() method on the webBuilder instance. It takes an Action delegate where you retrieve the AppConfig value from the section ConnectingStrings. Then you use the result string value and call AddAzureAppConfiguration() that connects to the Config store and instructs it to use feature flags. Next, let’s rebuild and run your app and see if it works :)

1. Run the app with this terminal command:

   dotnet build && dotnet run

 

You should now see your app rendered like this:

 

This time, the feature flag value is read from Azure instead of from appsettings.json

1. 
   

   Let’s uncheck the flag:

   
   
   
   
   1. Return back to the Azure portal and the App Config resource page:
   
   
   2. Select Operations > Feature manager
   
   
   3. Uncheck the checkbox for the Beta feature flag.
   
   
   4. Restart the app by running Ctrl-C followed by dotnet run.
   
   
   
   

This time, you should see the following image, with the Beta text gone.

 

Summary

First you learned about what feature flags are and in what scenarios they make sense to use. Then you learned some weird movie trivia about Van Damme, sorry ;) . After that you learned how to set up feature flag locally using the appsettings.json file. Finally, you learned how to use Azure App Config service and not only store your feature flags there but read their values from your app. Hopefully, this got you more interested in using the App Config service, cause there’s more to learn :)

Providing secure access to Desktop and Mobile Helpdesk admins using Role-Based Access Control in MEM

by Contributed | Dec 9, 2020 | Technology

This article is contributed. See the original author and article here.

By Pallavi Joshi – Program Manager | Microsoft Endpoint Manager – Intune

This article talks about using Role-based Access Control (RBAC) in Microsoft Intune to setup separate helpdesk roles for Desktop teams who manage Windows device estate and for Mobile teams who manage mobile device estate. RBAC in Intune helps you manage who has access to your organization’s resources and what they can do with those resources.

With the rise in remote working, an increasing number of organizations are now managing their employees’ mobile and Windows devices using Microsoft Endpoint Manager. This requires the helpdesk teams to work securely and productively to enable end users with their daily workings.

Many customers that we work with have dedicated teams for managing Windows and mobile devices. The helpdesk admins, part of Windows team, manage Windows devices only, but do not manage mobile devices, and vice-versa. By the end of this blog, you will be able to provide access to the relevant workloads to these helpdesk teams so they get a customized view of the devices they need to manage, and also prevent access to devices outside their scope.

Steps to configure RBAC for Windows and Mobile Device Helpdesk team:

1. Create Azure AD device groups for Windows and Mobile Devices


2. Create Azure AD user groups for Windows and Mobile Helpdesk Admins


3. Create scope tags and assign device groups


4. Create Windows helpdesk admin role and add assignments


5. Create Mobile helpdesk admin role and add assignments

Step 1 – Create Azure AD device groups for Windows and Mobile Devices

The first step to setup RBAC is to create separate Azure AD device groups based on device OS type.

As an example, I have created three Azure AD dynamic device groups based on the property deviceOSType – Android Devices, iOS Devices, and Windows Devices:

Android Dynamic membership rules

iOS Dynamic membership rules

Windows Dynamic membership rules

Step 2 – Create Azure AD user groups for Windows and Mobile Helpdesk Admin

The second step is two create two user groups, one for Windows Helpdesk Admins who manage Windows devices, and the other for Mobile Helpdesk Admins who manage mobile devices.

As an example, I have created two Azure AD user groups – Windows – Helpdesk Admins, Mobile – Helpdesk Admins and added helpdesk admins to each of these groups:

Azure AD group

Step 3 – Create scope tags and assign device groups

The third step is to create separate scope tags, one for each Operating System. The device groups created in step 1 need to be assigned to the respective scope tags.

As an example, I have created three scope tags – Apple, Android and Windows. I have assigned the Android Devices group to Android scope tag, and so on. This ensures that all the devices part of the

Android Devices group will automatically get the Android scope tag assigned to them. Similarly, devices part of Windows Devices group will automatically get the Windows scope tag assigned to them, and so on.

The scope tags would be used in future steps to control the visibility of devices and other workloads for Helpdesk Admins.

Helpdesk admin Scope tags

Step 4 – Create Windows helpdesk admin role and add assignments

The fourth step is to create a custom role for Windows helpdesk admin and provide the permissions required by the helpdesk admin.

As an example, I have created Windows Helpdesk role, given Read permissions for all the workloads, and Wipe and Sync Device permissions under Remote Tasks. You can update the permissions based on your requirements.

Windows Helpdesk permissions

Once the permissions are added and role is created, assignments need to be added to the role using the groups and scope tags created in the previous steps.

As an example, for the Windows Helpdesk role, I am adding Windows Assignment. The Members of this assignment are Windows – Helpdesk Admins created in Step 2, the Scope (Groups) has Windows Devices group created in Step 1 and Scope tags is defined as Windows created in Step 3.

Windows Helpdesk assignment properties

This ensures that users part of Windows – Helpdesk Admins group can assign policies, configurations and apps only to devices part of Windows Devices group, if they have permissions for the same. In this case, we have not provided assign permissions to helpdesk because we do not want them to be able to add or update assignments. This step also ensures that users who are part of Windows – Helpdesk Admins can view only the objects which have scope tag as Windows.

You can watch my Ignite session on Deep Dive into RBAC in Intune for deeper understanding on the topic.

Step 5 – Create Mobile helpdesk admin role and add assignments

The last step is to create a role for Mobile helpdesk admin and provide the permissions required by the helpdesk admin. The process is similar to Step 4, we just need to select different groups and permissions as per the requirements of mobile device team.

As an example, I have created Mobile Helpdesk role, given Read permissions for all the workloads, and Sync Device permissions under Remote Tasks. Based on my customer interactions, I have not given Wipe permission for this role for mobile helpdesk team. You can update the permissions as per your requirements.

Mobile Helpdesk properties

This document contains information about creating custom role in Microsoft Endpoint Manager.

Once the permissions are added and role is created, assignments need to be added to the role using the groups and scope tags created in the previous steps.

As an example, for the Mobile Helpdesk role, I am adding Android & iOS Assignment. The Members of this assignment are Mobile – Helpdesk Admins created in Step 2, the Scope (Groups) has Android Devices and iOS Devices group created in Step 1 and Scope tags is defined as Android and Apple created in Step 3.

Mobile Helpdesk assignment properties

This ensures that users part of Mobile – Helpdesk Admins group can assign policies, configurations and apps only to devices part of Android Devices and iOS Devices group, if they have permissions for the same. In this case, we have not provided assign permissions to helpdesk. This also ensures that users part of Mobile – Helpdesk Admins can view only the objects which have scope tag as Android and Apple.

Once the configuration is complete, you will notice that Windows Helpdesk Admins can view only Windows devices. They are unable to view mobile devices. They can sync and wipe Windows devices remotely. Similarly, Mobile Helpdesk Admins can view Android and iOS devices, sync these devices remotely, and are unable to view Windows devices.

Note – For the scenarios where a helpdesk admin is part of both Mobile Helpdesk and Windows Helpdesk roles, they will be able to perform specific actions on devices defined in the relevant role.

In the above example, if a helpdesk admin is part of both Windows – Helpdesk Admins and Mobile – Helpdesk Admins groups, then they will be able to view both Windows and mobile devices. They would be able to sync and wipe Windows devices as defined in Windows Helpdesk role, but only sync mobile devices as defined in Mobile Helpdesk role.

This configuration ensures that you have created a boundary for your Desktop and Mobile Device helpdesk team to operate in, thus providing strong security. You are also able to customize their view, so they see only relevant devices, thus ensuring their productivity. Also, the automatic scope tag assignment and role assignments ensure that no manual tasks are required, ensuring scalability of the solution across your departments.

We hope this helps you in setting up RBAC for your helpdesk teams in Microsoft Endpoint Manager and enables them to work effectively.

If you have any questions on this post, just let us know by commenting back You can also ask quick questions at @IntuneSuppTeam out on Twitter.