Windows 10 and Personally Owned Device Manageability

Windows 10 includes new features to help organizations manage aspects of personally owned PCs to help control how they interact with an organization’s resources, including Azure Active Directory (AAD) membership, mobile device management (MDM) enforcement, and OS upgrade management. The features can help secure corporate data on devices in organizations with bring-your-own-device (BYOD) policies and devices outside of the organizational network perimeter. However, these features may require specific editions of the OS and prerequisite software and services to ensure the organization’s policies are properly deployed.

Changing Definition of Device Management

Active Directory (AD) has served as the centerpiece of Windows management since Windows 2000, and it continues in Windows 10. All editions of Windows 10 with the exception of Windows Home continue to support traditional Windows AD domain join.

Securing and managing a device through traditional AD and Group Policy (GP) processes require that a device be joined to the domain and that deep hooks are set within the OS to enable organizational policy to be applied and enforced. For devices joined to a domain, AD enables identity and access management (IAM), including single sign-on for access to resources in the Windows domain, administrative password reset, and password policy enforcement. AD also enables central device configuration management and enforcement through GP. However, AD and GP were designed at a time when devices in the workplace were all owned by an organization, complete control of the device was permissible, and access to the organization’s network could be assumed.