Tag: Cyclone

Categories
Apple Security

Recap: Attending Jamf’s JNUC 25 in Denver, Colorado

I was fortunate to be in Denver, Colorado last week to attend Jamf’s annual JNUC event – this was the first time I have attended this event and I wanted to share a few thoughts below for others that did not attend.

As this blog is reasonably long here are some hyper links to the various sections if you want to jump around

Before getting into the content, I will share four photos from a short hike I did outside of Boulder in the foothills of The Rockies after the conference finished:

Top Takeaways

  • Meeting Jamf’s global execs and key leaders was very beneficial. From a partnership perspective this is helpful to establish the Cyclone brand and for us to be aligned with the vision from the key leaders.
  • Meeting other global Jamf partners and seeing where their business focus is was also illuminating. Whilst we share similar goals, how they have gone to market at times differs from our stratgegy in New Zealand so it was useful to have my thinking challenged in this space.
  • Jamf is a platform, not a point solution. From my days selling Microsoft 365 with Microsoft APAC, I know the value of being able to position a platform to a customer. Jamf are clearly very focused on expanding beyond being a premium MDM for Apple devices, and wrapping very capable security, IdP and education focused solutions around the core MDM offerings
  • Automation: a big push from Jamf for partners to automate deployment and management as much as possible to achieve scale and financial efficiencies to be competitive with solutions.
  • A continued energy directed towards MSP: new tools, better billing engines, faster quoting tools – much was unveiled to make life easier for MSP to transact and deliver Jamf solutions (a very welcome message from my perspective)

Keynotes

Opening Keynote

Commercial – State of the Union

Things that stood out from the Keynote to me included:

  • A big push for use of Jamf Blueprints – a smarter way to group and manage configuration profiles
    • 12 additional Declarations and 34 Configuration Profiiles released at the event
  • SSO in Jamf Account across the different Jamf consoles – faster switching
  • AI Assistant – big push e.g. using AI asisstant to search for redundacies or conflicts in deployed configuration profiles and to provide a remediation plan automatically.
  • A live demo of Compliance Benchmarks for CIS L1 and L2 as well as NIST standards – all deliverable via Jamf Blueprints
    • when new versions of macOS are released, the benchmarks can be updated automatically and the correct configurations flow to devices seamlessly
  • Very smart security via the macOS Telemetry Framework that Jamf Protect and Jamf Security Cloud can pick up on – Jamf Mac endpoint telemetry explained

Education – State of the Union

Things that stood out from the Keynote to me included:

  • A big push for enhanced value through Jamf managed Shared iPad mode
  • A live demo of Jamf School showing how Blueprints can work (coming in 2026)
  • A live demo of Platform SSO (PSSO) – easy to deploy, great for multi-user devices
    • It was clear that Jamf was not threatend by PSSO native integrations and the impact this may have on Jamf Connect. They actively encouraged customers and partners to migrate to PSSO
  • A live demo of Jamf School at Home
    • The use of the Jamf Parent app for managing iPads – I really liked this and the functionality was largely new to me.

Overall, the keynotes were mostly useful – there was some very good annoucements in the Commercial keynote and from the Education keynote I was particularly interested in the announcement of the acquistion of Identity Automation and how this can allow a seamless single sign on experience into apps such as Canva and Seesaw when deployed onto iPads managed in Shared iPad mode showing a clear time saving for students in a classroom by removing the need to sign into each app individually with a school email address and password.

Product Innovation

Unsurprisingly, Jamf used the JNUC platform to announce a lot of innovation and new products, some targeted at making the life of MSP easier (yay) other functionality was more for end customers to benefit from directly.

Michael Covington (VP Portfolio Strategy) shared some interesting insights to partners during the pre-event Global Partner Summit, including:

  • Endpoint teams are being asked to do more – some are being measured on how happy their end users are with their devices (clearly, this leans into Apple’s wider strategy of “Employee Choice”)
  • Customer tool consolidation is a big focus: not using separate consoles for different platforms and leveraging AI assistants wherever possible to accelerate routine tasks
  • Jamf view themselves as a platform company now – being a point solution (e.g. best in breed MDM) is not longer a viable solution. Jamf see their platform being:
    • Users (IdPm integration)
    • Endpoints (MDM, Security)
    • Applications (tailored tools for end users e.g. teachers/students/parents, and IT to manage endpoints)

I won’t go into all the partner tools that have been developed and made available but if you are a Jamf partner, check out the Partner Hub and look for the MSP Toolkit as a starting point.

One thing I did enjoy from multiple sessions at Jamf was the willingness of the presenters to do live demos. Most worked flawlessly, some hit a few delays and one didn’t work at all – but that’s the reality. I like to see tech companies backing themselves and their products and being confident to deliver live demos to large audiences.

Mike Vanderlinder (Senior Product Manager) shared some interesting insights into SMB and the focus that Jamf have on that segment (as do Apple themselves, interestingly):

  • 27% computers in SMB are Mac
  • 43% expect Mac use to increase
  • 36% SMB lack dedicated IT Support
  • 25,000+ Jamf existing SMB customers

There is a paradox in trying to serve the SMB segment: how to balance employee experience vs delivering a full feature set.

  • SMB Solutions: tend to be limited features to keep it simple to manage and quick to deliver
  • Enterprise Solutions: tend to be feature rich but more complex to deliver

To address this, Jamf are releasing new tools to reduce the initial provisioning friction, simplify integration setup and ease the learning curve making for a better end user experience overall.

Platform SSO: The Next Frontier

Adam Derrick (Jamf Solutions Engineer) presented this session to a packed audience.

This session demo’ed Simplified Setup, a feature that Apple announced with the launch of macOS 26 Tahoe (see here for technical deployment docs). There is a blog explaining this here and right now only Okta IdP supports this, but essentially it shifts the authentication into the OOBE stages rather than requiring a user to complete the authentication once they reach the active desktop. It makes for a very strong OOBE for the end user, but feels like it’s not quite fully polished yet given most IdP have not adopted it yet.

Jamf are keeping all their PSSO documentation updated here: www.jamf.it/psso

There was discussion around the different authentication methods available for PSSO:

  • Password Sync
  • Secure Enclave Key
  • Smart Card / Yubikey
  • Tap to login (new contactless authentication via iPhone/Apple Watch on macOS 26)

The general consensus still appears to be that using Secure Enclave is the way to go. This leverages Apple’s Secure Enclave to store hardware bound non-exportable authenticaatiotn keys and users authenticate using a key that never leaves the Mac’s hardware. Right now, this is only supported by Microsoft’s Entra ID.

Apple’s Authenticated Guest Mode also featured with full Jamf support – I can see a lot of value in this for computer labs, or retail / hospitality where users are needing to quickly sign in/out of a Mac

  • Login to Mac with account credentials from IdP
  • Sign in to apps and websites
  • User data is erased after logout
  • Auto advance to streamline process

Enterprise Security Standards in Action – Future of Identity Integrations with SSF and CAEP

This session had a number of presenters:

  • Matt Vlasach – VP of product Jamf
  • Mike Kiser Director of Strategy Sailpoint
  • Atul Tulshibagwale – CTO of Sgnl
  • Dan Hefley – Product Manager at Okta

This was a super interesting session for me as it was all new, but appeared very similar to what Microsoft have developed with their Conditional Access inside of Entra ID.

SSF = Shared Signals Framework

CAEP = Continuous Access Evaluation Framework

A good starting point to learn more is here: Shared Signals Framework and Continuous Access Evaluation Protocol, with the idea being that if you can source real time signals from multiple sources using a shared framework, you can make better decisions around device compliance and take appropriate actions as a result.

  • If this….
    • Account compromised
    • Endpoint infected
    • User account is disabled
    • Compliance level changes
  • Then that….
    • Restrict access
    • Revoke sessions
    • Stepup authentication
    • Wipe device

The working group collaboratively created the SSF framework (Shared Signals Working Group – OpenID Foundation) and Jamf have done significant work to embrace this: Shared Signals Framework and Continuous Access Evaluation Protocol

For organisations working in heavily regulated industries I can see the adoption of a solution based on SSF and CAEP as a natural progression to integrate robust device compliance with restrictions to corporate data.

Apple Platform Security

This session was mainly presented by Dan Flynn a security engineer from Apple and was excellent. His focus was very much showcasing the built in security functionality in macOS that MDM and security platforms can adopt. Matt Vlasach from Jamf then showcased how Jamf are leveraging this native “security by default” approach from Apple through their MDM and security products.

One feature that Matt did demonstrate was the ability to do “set and forget” OS updates inside of Jamf now. In other words, rather than needing to define a specific date when updates need to be applied by Apple’s Declarative Device Management (e.g. 30th November), you can now define the number of days post-update release to apply.

In other words, if Apple release an update on 30th November, you can configure an OS update policy to say “allow users to manually update at any point after the release, but use DDM to force it after 14 days” – by stating the number of days (instead of a specific date) then you don’t need to continually manually configure the policy when new updates are released.

This reduces the overhead of managing OS updates significantly.

eSIM Best Practices for iPhone and iPad: Setting the gold standard in mobile security for 2026 and beyond with zero touch global deployment

I was interested to learn more about eSIM management – this ession was presented by 1Global who are a Mobile Virtual Network Operation (MVNO) and had a strong influence of their commerical offerings. Nevertheless, there were some great learnings in this space and seeing the industry shift towards eSIM only.

From Planning To Impact: Implementing Shared iPad with Purpose in Jamf School

This session was presented by Michael Thomson (Jamf Sales Engineer) and was excellent.

I have always felt that Shared iPad was not a great name for the functionality that Apple is offering here (unique user profiles stored on a single iPad vs a standard iPad simply being shared amongst users).

Michael did share a PDF of his session slides which you can access here – this goes into good detail on how local storage on an iPad can be intelligently configured to support a great end user experience in the classroom.

Categories
General

The Perfect Storm: Lessons from critical outages at Microsoft and CrowdStrike in July 2024

A short note before this post starts: I’ve not been blogging recently due to a major knee injury sustained falling off my mountain bike over Easter 2024. This required two reconstructive surgeries and has restricted my time for blogging. I’m mostly over this now and plan to write blogs more regularly again. With that, on with the post!

In July 2024, CrowdStrike experienced a significant global outage that left many businesses unable to access critical security services. For several hours, their endpoint detection and response (EDR) tools were unavailable, sparking concerns about the impact of cybersecurity tool downtime on business continuity. This incident was further compounded by outages in Microsoft’s Azure data centres leading to more outages and confusion over the root causes of the problems being experienced by businesses globally. In both instances, these outages were not the result of a cyber attack but instead the consequence of software updates gone wrong. Given that a February 2023 report from IDC placed CrowdStrike at the number one spot when it comes to endpoint security, with a 17.7% market share and Microsoft’s own endpoint security solutions a close second with a 16.4%, these outages caused significant business disruption.

Understanding The Root Causes

As is often the case with critical outages, there was not one single cause, but instead a cascading effect of a combination of factors, including a software update error that propagated across CrowdStrike’s global infrastructure, compounded by issues with their cloud provider. Endpoint Detection and Response (EDR) platforms like CrowdStrike or Microsoft Defender do present security teams with a dilemma. Starting too late in the Windows boot sequence leaves them susceptible to missing detection of malware running at the lowest level of the Windows operating system, or being disabled by it. But being given boot priority is a privilege and not a right, and developers of Windows kernel drivers are required to uphold extremely high quality-assurance standards (this video from a former Microsoft Windows developer explains it well).

In this instance, the dependency on a single cloud provider which experienced failover protocols magnified the problem. This underscores the importance of both rigorous testing of updates in isolated environments and having diverse, redundant infrastructure to mitigate cloud-based risks. Similar causal issues affected Microsoft’s Azure outage: a misconfigured software update led to network routing issues and widespread unavailability of cloud services to customers. The extent of these networking issues, prevented or delayed the automated failover to redundant data centres, leaving services offline for an extended period.

Business Impacts For Affected Customers

The CrowdStrike outage, affecting only Windows devices, led to numerous challenging situations:

  • Device Outages: Windows devices crashed with Blue Screens of Death (BSOD) and required a manually intensive process to restore to operational usage
  • Disruption to Security Monitoring: Companies were left unable to detect potential threats on their networks in real time. For some, this created a dangerous blind spot, leaving them vulnerable to attacks during the outage period. Security operations centers (SOCs) relying on CrowdStrike tools had to operate without their primary line of defense.
  • Operational Downtime: Beyond the security implications, the outage had an operational impact. Without access to critical cybersecurity infrastructure, some organizations had to suspend or reduce operations, leading to potential financial losses. The dependence on third-party services without adequate contingency measures proved costly.

Companies depending on Azure for cloud computing, storage, and application hosting also faced significant challenges.

  • Interruption of Security Services and Related Tools: Some businesses using Azure for hosting security monitoring tools or third-party cybersecurity services  experienced an operational security gap. The inability to monitor network activity or respond to threats due to cloud downtime posed an additional layer of risk.
  • Disruption to Business-Critical Applications: Many organizations rely on Azure to host critical applications, from enterprise resource planning (ERP) systems to customer relationship management (CRM) platforms. The outage caused widespread disruption, with companies unable to access or run key business operations
  • Data Access and Storage Issues: Azure’s storage services, such as Azure Blob Storage, were also impacted. For organizations storing large volumes of data in the cloud, the inability to access or update this data during the outage caused operational delays and concerns over data integrity. In some cases, businesses were unable to retrieve time-sensitive information, disrupting decision-making and service delivery.

Lessons For Business Leaders

  • Build Redundancy into Critical Systems: Organizations should ensure that their key services have backup systems in place—whether by using multiple vendors, redundant cloud platforms, or hybrid cloud environments.
  • Develop (and test!) Strong Incident Response Plans: Businesses need a plan for when their critical cybersecurity tools go down. This includes backup solutions, alternative threat detection methods, and robust communication protocols to ensure that the security team can respond effectively even when primary systems are offline.
  • Vendor Accountability and Transparency: While businesses rely on vendors like CrowdStrike and Microsoft for critical functions, it’s important to demand transparency in service level agreements (SLAs) and contingency plans.
  • Multi-Cloud and Hybrid Cloud Strategies: One of the biggest lessons from the Azure outage is the need for organizations to diversify their cloud infrastructure. Relying solely on one provider can lead to significant downtime when outages occur. Adopting a multi-cloud or hybrid cloud approach—where critical workloads are distributed across multiple cloud providers or a mix of cloud and on-premise environments—can mitigate the impact of a single provider’s outage.
  • Prepare for Worst-Case Scenarios: Outages like the CrowdStrike and Azure incidents highlight the importance of contingency planning. Businesses should conduct regular risk assessments of their cloud dependencies, implement offline backups for critical data, and ensure that their internal teams are trained to handle extended cloud outages. This preparation can limit operational downtime and keep security and business operations running during disruptions.

No business is immune to these disruptions: in late August Cyclone (the company where I work) experienced a complete outage of internet connectivity in our Christchurch office after a misconfigured routing update between our ISP and fibre provider, causing a 12hr outage. Critical services that were hosted on-premise were failed over to Azure cloud instances as part of our redundancy and business continuity plan, ensuring staff around New Zealand could continue to work and support our customers. Whilst time intensive and costly to perform, having confidence in redundancy systems to ensure business continuity is critical in today’s technology reliant world.

Categories
General Microsoft365

Goodbye 2023 & Top 5 Posts Of The Year

2023 is nearly done and it has been quite the year for me!

I started the year with my longest ever bikepacking trip (at the time) and longest single day on a bike (192km), before returning to work at Microsoft and being made redundant in March – a first time experience for me. The silver lining was a chance to have a break from work for a couple of months, a 10 day bikepacking “redundancy ride” and then quickly into a new job. This afternoon I’m hopping on a flight to Glasgow, Scotland to spend three weeks in Europe with my daughter who has been studying there for the last four months.

I’ll share the Top 5 Blogs of 2023 below, but first a slightly more detailed recap of the year.

New Experiences – Bikepacking Far From Home

On Siberia Bridge, suspended high above a gorge north of Wellington

I started 2023 as I finished out 2022 – riding my bike ~100km/day and pitching my tent where I ended up. I’d had a custom bikepacking bike built in October and had tested it out before Christmas over 6 days of riding and camping. I resumed this in early January at the top of the South Island where I completed my longest ever day on a bike – 192km. I was really proud of this achievement and the whole ride is documented here:

Tour Aotearoa: 6 Days 5 Nights In Lower North Island – December 2022 (+ bonus 2 days in South Island!) – SamuelMcNeill.com

Having loved this so much, I followed it up with a weekend ride in early February:

West Coast Wilderness Trail – Bikepacking Adventure – February 2023 – SamuelMcNeill.com

Back To Work …. Then A Redundancy

Energised from an incredible break, I hit the ground running, only to learn in late February my role was being dis-established. It took about a month to play out, but I posted a reflection about the initial experience and feelings here:

Therefore, Send Not To Know For Whom The Bell Tolls, It Tolls For Thee – SamuelMcNeill.com

It was an unusual experience and one that I could not say I enjoyed, although I learnt a lot about myself and also my friends. A lot of men in particular went out of their way to connect with me, check in and make sure I was doing alright. Many shared their own redundancy experiences. It was humbling to see the care and willingness to support me from others who had insight into my experience.

I was very fortunate to receive a generous redundancy package from Microsoft and also receive a number of job offers, before accepting a role to join Cyclone as their Technology Strategist.

Silver Linings

Parking up at Lake Tekapo after a long bike from Geraldine

With some time on my hands and the seasons changing into deep Autumn (my favourite) we had a family holiday in the North Island before I embarked on my #RedundancyRide:

Redundancy Ride + Alps 2 Ocean – May 2023 – SamuelMcNeill.com

This was a time of pure joy, cathartic and healing after losing my job and a chance to reflect, process, unwind and reset. I met some interesting characters across ten days of cycling and camping and when I reached the end I desperately wished I could just keep going. I had agreed to a delayed start date with Cyclone but that was fast approaching and I could not put it off.

This was a special time in my life and I’m deeply grateful to my wife who encouraged me to get out and do this.

Back Working

I was straight into it at Cyclone and was loving visiting customers in person for a change after most of my work had been remote due to COVID19. I was fortunate to be able to head over to Melbourne to attend EduTech 2023, the largest EduTech conference in the southern hemisphere. I wrote up my reflections here:

Reflections on EduTechAU 2023 Day 1 – SamuelMcNeill.com

Over the first six months of my time at Cyclone I’ve continued to engage with Microsoft, this time as a partner, worked more closely than ever before with Apple which has been both fun and interesting to learn how they operate, and also partnered with key customers like the Ministry of Education. I’ve delivered webinars on modern management of devices, experimented with Virtual Labs in the Azure cloud as well as running my own Win11 CloudPC in a browser on my Mac, shared tips on securing cloud identities, securing your digital data estate, and some thoughts on digital citizenship and promoting best practice in IT teams.

Of course, with the emergence of generative AI this had to get a discussion as well, and I shared some best practice tips and considerations in relation to Microsoft Copilot in an Education context.

Suffice to say, I’m looking forward to getting to the airport, putting my feet up and winging my way to Europe to see my daughter. It’s been a crazy old year.

So with that, here are the top 5 most popular blog posts I wrote this year:

#1 Microsoft Copilot Considerations in Education

Microsoft Copilot Considerations In Education – SamuelMcNeill.com

This was only written in October 2023 but clearly tapped into the zeitgeist, garnering the top number of views for a blog post I wrote this year. I attempted to provide a quick overview of some of the considerations education customers would need to make before going ‘all in’ on Copilot, as well as explaining the various versions of Copilot.

UPDATE 15/12/23: Microsoft has announced this morning that Copilot for M365 will be available to education customers as of 1/1/24 – the same baseline requirements apply as Enterprise: minimum 300 seat count and $30/u/m pricing.

#2 Therefore, Send Not to Know For Whom The Bell Tolls, It Tolls For Thee

Therefore, Send Not To Know For Whom The Bell Tolls, It Tolls For Thee – SamuelMcNeill.com

Tapping into my love of literature, this quote from the famous John Donne poem was a reflection on my redundancy from Microsoft. I was humbled by the outpouring of support and job offers I received after finding myself unemployed.

#3 Extending Shared PC Mode with OneDrive Sync

Extending Shared PC Mode With OneDrive Sync – SamuelMcNeill.com

This was actually the first blog post I wrote in January 2023, not knowing I would be let go by Microsoft a couple of months later. Like many of my blogs, it was more technical in nature and designed to help busy IT administrators learn how to add value to student lab computers or other shared devices.

#4 Reflections on EduTechAU 2023 Day 1

Reflections on EduTechAU 2023 Day 1 – SamuelMcNeill.com

This was a reflection during my first overseas trip/conference since joining my new company, Cyclone. It was also the first major education conference I’d attended in over six years where I was merely a delegate, free to take in the sessions and not work a booth or be presenting myself. Unsurprisingly, it was AI heavy in themes and this post was a good recap of the first day.

#5 How To: Creating Local Users on Windows 11 Home and Windows 11 Pro During OOBE Startup

How To: Creating Local Users on Windows 11 Home & Windows 11 Pro During OOBE Startup – SamuelMcNeill.com

Another technical post, I wrote this one after working with the Ministry of Education to solve some issues around their Windows devices for Teacher Laptops. It was a bit topsy turvy re-engaging with the MoE who had been my customer for the first 3-4years of my time at Microsoft, and now I was supporting them again but for a different company. There are some really good tips in this one.

Bonus Post: Redundancy Ride + Alps 2 Ocean – May 2023

Redundancy Ride + Alps 2 Ocean – May 2023 – SamuelMcNeill.com

This actually came in as the 6th most viewed blog post of the year and was a visual and written record of my bike trip that I referred to as my #RedundancyRide at the time. Some cool photos and videos of the beautiful South Island of New Zealand.

That’s A Wrap

Closing out another year of life, work and blogging. Thanks for your support, the reading of the blog, the comments, the Tweets (or should that be “posts” on X now!).

I wish you and your family and friends a restful festive season ahead.

Categories
Microsoft365 Windows 11

Cloud Mobile Device Management Delivers For Schools & Partners

CGHSLogoThrough the use of cloud-first technologies and modern deployment methodologies Cyclone have supported Christchurch Girls’ High School through a significant device upgrade to Windows 10 over the Christmas 2017 break. This was achieved through using the full suite of services included in the Microsoft Schools Agreement with the Ministry of Education and driven greater efficiencies for Cyclone and reduced costs for Christchurch Girls‘ High School.

This week I caught up with Stefan van der Busse from Cyclone to learn more about the company’s latest school deployments and how their continued focus on cloud technologies is assisting them to deliver faster and more affordable system upgrades for their education customers. Stefan talked specifically about Christchurch Girls’ High School Te Kura o Hine Waiora (CGHS) and the upgrade from Windows 7 to Windows 10 over the Christmas 2017 holiday break.

When Cyclone first engaged with CGHS there was a very traditional network in place, with on-premise Active Directory and Group Policy managing the school owned Windows 7 fleet with no device management platform at all. Stefan’s goal was to increase the visibility of these devices both on and off the school network and therefore the plan was to move the school towards a cloud-first Modern Device Management (MDM) approach. The Microsoft technologies used in this deployment were:

Why Use Modern Cloud Deployment Technologies?

Historically, Cyclone have used reasonably custom deployments for each school they managed and had planned towards standardizing deployments to increase efficiencies and reduce costs for the schools. Over the Christmas 2017 break they had a number of school sites that were looking to upgrade from Windows 7 to Windows 10 and this presented the perfect opportunity to co-ordinate a hybrid-cloud approach to deployment across multiple sites.

CGHS alone had 60x staff laptops to be replaced in January (TELA), with a further 200x desktop machines around the school between January and April and 100x HP Stream laptops that were effectively ‘unmanaged’ with local administrator users and were being replaced with Lenovo N24 laptops. Upgrading over 350 machines represented a significant amount of work, where typically a systems administrator would be on site at the school building a custom image based off the required applications requested by the school.

Cyclone briefly considered implementing Microsoft SCCM into the environment to manage all of the school devices, however quickly opted to use a hybrid approach with more cloud technologies for the following reasons:

  1. It was more in line with the Ministry of Education and their clear strategic push towards schools leveraging the cloud more effectively.
  2. Cyclone could reduce costs by not using SCCM as there would be no need to deploy a local server and the associated overheads with running and maintaining the environment.
  3. SCCM requires considerable technical skill sets to manage effectively and Cyclone has been strategically focusing on Microsoft Cloud Certifications for their engineers as a priority over traditional on premise infrastructure.

Planning For A Successful Upgrade:

This was the first foray into using Windows Analytics by Cyclone and they opted to deploy this via Microsoft CSP, provisioning an OMS workspace into Christchurch Girls’ High School Azure tenant. Allowing shared visibility between Cyclone and the school into the status of the machines needing upgrading introduced a new level of transparency for the school. Using Upgrade Readiness the team at Cyclone had full visibility into the school devices and could easily see which were still on Windows 7 and, for the handful of devices that had previously been upgraded to Windows 10, they could see which version of Windows 10 was running. This level of reporting made it easier to sign off completion of the upgrade when all devices were on the latest version of Windows 10.

Upgrade Readiness
An example dashboard in Upgrade Readiness as part of Windows Analytics

Furthermore, the ability to see various drivers on the devices and identify ones that were causing issues provided a pathway to quicker resolution of issues during the upgrade as technicians could then physically track down any remaining ‘troublesome’ devices that needed manual intervention.

“Moving forward, our goal will be to use Windows Analytics and Upgrade Readiness across all schools as part of our standard deployment practice. This will allow us to reduce costs and reactive support calls by proactively targeting and resolving any issues on specific devices” – Stefan van der Busse

In addition to Windows Analytics, Cyclone used Microsoft App-V for the first time. This is a form of virtualization where applications are ‘containerized’ when deployed:

Microsoft Application Virtualization (App-V) can make applications available to end user computers without having to install the applications directly on those computers. This is made possible through a process known as sequencing the application, which enables each application to run in its own self-contained virtual environment on the client computer. The sequenced applications are isolated from each other. This eliminates application conflicts, but the applications can still interact with the client computer.

App-V is provided at no cost as part of Windows 10 Enterprise or Windows 10 Education (compare features here) which is available to schools under the Ministry of Education Schools Agreement. Cyclone now deploy the Windows 10 Education SKU as the standard operating system into all of their managed schools. Stefan explained the motivation to use App-V in these schools as allowing them to:

“Dynamically control consistent application deployment to the right people, at the right place, at the right time.”

For example, a student studying music can be sitting in the music tuition room accessing specific course related music applications on a school desktop machine but could equally be using a school laptop in the common room or outside on the lawn and have the same experience on either device. Conversely, if another student who was not studying music logged into the same machine after the music student had signed out they would have no access to the music applications. This degree of dynamic application control provided by App-V delivers real and immediate benefits to Cyclone in terms of saving time and money spent previously on creating base images for schools.

Essentially, Cyclone is now able to create a standard barebones image that will suit most schools and through using App-V they only need to sequence and deploy applications once and know they will be running the same version across all school sites they manage. Stefan shared the example of Sketchup Pro, a product licensed for schools by the Ministry of Education, by packaging and sequencing this with App-V it can be opened in a virtual container across any school on any device using the provided licensing information. Cyclone can now use their growing catalog of pre-packaged applications in App-V and supplement this with a school’s unique applications as required. This significantly reduces the amount of work required by a technician customizing a deployment for each school.

Seeing The Benefits Of Cloud Management:

For Christchurch Girls’ High School the benefits of this new cloud-first approach has been immediate. One of the biggest benefits is seamless sign on across multiple educational cloud platforms through the implementation of AzureAD P1 and Seamless Single Sign On, which now enables students and staff to use a single set of credentials and a tailored CGHS user experience to sign into:

With Seamless Single Sign On, students only need to enter their username and password when logging into Windows 10. Seamless SSO then authenticates the user to any of the integrated services, regardless of browser choice (Internet Explorer, Chrome, Opera & Firefox)

What’s next?

From the perspective of the Cyclone team, this is only the beginning of leveraging cloud-first technologies to drive efficiencies and reduce costs for schools. They have only touched the surface of the feature sets of Intune, using largely the automatic enrolment into AzureAD to drive device reporting in Windows Analytics and have already identified features they will use Intune for in their school management.

Cyclone plans to further refine their Windows 10 deployment service, making it accessible to all of Cyclone’s managed customers across the education sector, ideally without the need for any on-premise infrastructure or investment. Stefan explained:

Our end goal will be to equip our engineers with a standardized USB key that can be inserted into any internet connected device, which will then boot and connect to Azure Web Services back ended by an Azure SQL Database for acquiring site specific deployment decisions at install time. This will be particularly important for schools that Cyclone are supporting to reduce on premise infrastructure investment and leverage cloud service.

Clearly, this will lower both the cost for schools through reduced hardware on premise, but also the overheads for Cyclone in terms of managing different schools by standardizing on a single, consistent approach.

My Perspective:

This is a great example of a System Integrator recognizing that the management of Windows devices is changing significantly, as Microsoft pivots towards increasing use of cloud-first MDM technologies. Future releases of Windows 10 will have even greater management capabilities in Intune and this will require all IT administrators to re-think their traditional standard deployment methods of local on-premise domain controllers, with Group Policy and Active Directory as the primary means of managing devices.

As the students and staff at CGHS have experienced first-hand, starting with a cloud identity in AzureAD opens up seamless single sign on to a wide range of other cloud services providing a simpler experience and faster access to learning tools in the school. Perhaps most importantly, it’s also driving down costs for the school as their IT partner can leverage greater levels of automated device reporting and remote management through these services.

Categories
Microsoft365 Windows 11

Leveling the Playing Field at Manurewa High School with Innovative BYOD Programme

Manurewa.PNG

This blog post first appeared on the Microsoft Case Studies website here.

Today digital technology is in every aspect of our lives. But what if you’re living in a digital landscape where not everyone has access to the technology they need?

For students of Manurewa High, New Zealand’s largest decile one school, this problem is anything but academic. Principal, Peter Jones considered the following: “How do we bring the digital opportunities through Bring Your Own Device (BYOD) into our community in an affordable way? And how do we make sure that our students aren’t falling behind and aren’t disadvantaged?”

That’s why the school’s innovative BYOD programme, which allows students to bring their own Windows 10 devices to class with access to Office 365, is pivotal to their students’ future.

 

Conquering the Digital Divide

Within the school there were inequalities before BYOD began. Not all students were using the same computer operating systems, and there were many different devices with varying degrees of capability. In some cases, no device at all. This meant not all students were able to learn at the same level.

Deputy Principal, Lawrence Naicker, says, “The biggest inspiration would be equity. If we provide them with the BYOD experience, that gives them another skill set in terms of adapting to the changing world. So, our success will be measured in terms of their career pathways in the future.”

Naicker also describes the BYOD programme as a vehicle to bring the world to them through virtual experiences. “Not all our students can easily take a trip to Japan, but what if we could bring Japan to them through tools such as Skype? This is where we see BYOD supporting us to create equitable opportunities for our students.”

Partnering to Succeed

To develop their long-term digital technology strategy, they enlisted the help of Microsoft and Cyclone Computers to transform learning at the school. E-Learning Coordinator, Craig Render, explains,

“The relationship between Cyclone and Microsoft has been paramount to what we’ve been trying to achieve. We went to them and asked what they could offer the school in terms of the technology they had available. And for the last six years they’ve been working side by side with us, not only with our students but also our teachers.”

The full-scale implementation of BYOD throughout the school began in 2017. It’s phase one of an exciting three-year project. The relationship with Cyclone Computers was crucial to delivering an equitable BYOD programme for the school’s students – they enabled parents to buy suitable devices with affordable weekly payments, and without credit checks.

Bringing the Community on the Journey

Once the technical side of the equation had been solved, the school still had another challenge – getting buy-in from parents and the wider school community. With 80% of the roll Maori or Pasifika, community involvement and support were vital. In fact, BYOD could not succeed without it.

But right from the very first parent evening held to discuss BYOD, it was clear that the community was behind it 100%. Naicker  had worried that parents might not be enthusiastic about them bringing devices and extra schoolwork home. “Many Manurewa students, beyond the normal teenage responsibilities, have extra responsibilities that they carry in their families such as supporting younger sisters and brothers. So, when they are at school or home it’s important for us to optimise their time spent learning,” says Naicker.

Craig Render also highlights affordability as a key challenge. “One of the challenges around bringing devices in is the potential cost it could have for the community. We found that our biggest supporters of the programme were our community and they’ve driven our motivation to continue it.”

As an unexpected bonus, the benefits have extended into the community too, as children can pass on their new digital skills and knowledge at home all while being able to work on or offline as Windows 10 and Office 365 continue to provide 100% functionality even without an internet connection.

The Right Platform with Real Benefits

Manurewa High chose Microsoft as a vendor for several reasons. Office 365 gave their teachers greater flexibility, and their students the freedom to work either offline, or online, at home or at school. With Windows 10 they wanted to make sure their students weren’t limited with what they could do from a functionality standpoint.

For the school’s Principal, Peter Jones, future skills and success of students was a key focus too. “Every employer tells us that digital fluency is crucial, so we need to make sure that our students are agile and have the learning skills to keep learning because technology is changing so quickly.”

Render elaborates further,

“We’re really mindful of ensuring our students leave Manurewa High with the digital skill sets they’ll need to be able to contribute immediately in the workforce. This influenced our decision to go with the Windows 10 and Office 365 platforms for our BYOD devices as we knew that developing familiarity and skills with these would directly benefit our students.”

Beyond this, they saw additional benefits for their teachers. “With the pressures that teachers are under such as marking, moderation and assessment, it leaves them time-poor. But when we bring in something like Office 365 which saves teachers time, they can see the real benefits coming into practice,” says Render. For their students, “Feedback is really crucial to student development. The Office 365 platform allows teachers to give real time, anecdotal feedback on student work.”

Manurewa High School’s favourite application is Classroom OneNote. “Classroom OneNote has been the tool they’ve used the most and has seen a large buy-in from the staff. It allows students to have their own creative space, teachers to check on work and put course content that can be accessed anywhere at any time, on any device.”

BYOD Prepares Manurewa Students for the Future World

Among the most dramatic impacts, Principal Peter Jones has seen is the difference BYOD has made to the self-esteem of his students. “For the students, it’s been the opportunity to access that digital world, that digital space, that global community which they haven’t always been able to do in our context. It’s helped them realise that they add real value.”

For their students, cultural identity is significant. “It’s important to have young people who are confident in where they come from, who they are and where they are going. The digital space helps enhance that for them and they see their value across the world and across New Zealand. This raises their expectations, their horizons, their views of what opportunities are out there for them.”

For the staff, students and parents of Manurewa High School, BYOD is more than just a way to access digital technology, it has become an essential component of their world now. It’s made a profound difference to the whole community. Now their children have a level playing field from where they can set their sights on a brighter future.

Categories
Microsoft365 Windows 11

Guest Post: Cultivate Collaborative Learning With OneNote

This post originally appeared in the Interface Magazine, April 2017 edition and has been republished with permission. You can see the online edition by clicking here.

Spade … check. Seeds … check. Compost … check. Watering can … check. OneNote … er … um … what? Three teachers and a group of Year 10 students at Mairehau High School are running a collaborative gardening project, with the aim of:

  • Giving the students practical gardening (as well as digital) skills;
  • Seeing something come out of their time; and
  • Offering an authentic context for their learning.

“It has grown and is not just about their learning but also providing for families and home, and potentially a market garden,” said Tania Swann. “It has become a bit of an entrepreneurial project for the students.

1

Making a connection

The school’s planning team was assisted by Tim Muir, Microsoft Teacher Ambassador, Cyclone, Arnika Macphail, Professional Learning Manager, Cyclone, and Curriculum Consultant Kate Brown.

“In order for this to be successful, we needed the right balance of curriculum support and digital support. Kate helped us to come up with our big idea: ‘Communities work together to connect, nurture and grow’. We’d been using Google Docs with our staff and students. However, after hearing from Tim, we felt OneNote was going to be the right tool for this project. With the help of Tim and Arnika, we set up a OneNote Class Notebook for all the teachers and students.
“We’re also lucky enough to have our hands on the Digital Learning Experience from Cyclone, which means each one of the students and teachers involved has a Surface to work from, which definitely added hype to the project.”

Share and articulate

The project was allotted three hours a week in Flexible Learning Time.

“The students have had such a great attitude towards getting outside and it’s created a nice atmosphere to work in. They opted in and can opt out at any time but no one has.”

Among the green-fingered skills students learned were:

  • How to plant potatoes;
  • How to create beds; and
  • Watering, digging and sieving.

“They love getting into the garden and out into the community, and enjoy doing their classwork on the Surface. We have made the most out of our trips to local nurseries, Cultivate Christchurch, and Bunnings by using the devices to take pictures and notes, all in the OneNote. Students can draw diagrams, annotate work, add videos, add audio, and share their ideas more freely.”

2Everyone is enthused

The project has had a “massive ripple effect” through other staff members.
“We started with a big picture of the fact that it was so cross curricular in possibility, incorporating Biology, Maths, Media, etc., and wanted to connect all of these,” explained Kimberley Walker.

“On a daily basis, a person comes to the team to ask about it and how they can help. It started off as Social Sciences, English and Maths. We now have Hard Materials, the Arts and Science involved. Everyone involved is enthused.

3“We have achieved so much from this one project and it has certainly snowballed into other ideas. The best bits have been the collaborative learning. The students are passionate and enthusiastic. Running something like this has kept them engaged at school and keen to participate.

“Having a shared outcome that we can physically see and touch has brought us closer together. We have things growing in our school garden. That is an achievement in itself. But thanks to the technology, we also have a detailed, up-to-date, accurate record of learning. OneNote has been fantastic. Through using the program, the students have been more forthcoming to share and articulate their understandings.”