Microsoft Intune is a cloud-based service supporting management of desktop and mobile devices. In HKUST, our implementation focuses on Windows devices that are owned by the university. These desktops and notebooks are managed with enforcement policies regarding device compliance and security baseline.
- Support Windows logon using ITSC accounts (even when off-campus), with the benefits of single sign-on to most Microsoft services as well as on premise domain resources
- Enablement of passwordless authentication via device pin or biometric authentication (if equipped)
- Windows Security settings enforcement via Microsoft Defender for Endpoint and Windows Update will be configured centrally to reduce the risk of being tampered
- Software version of Windows system and Office 365 are managed centrally, avoiding the risk of having security vulnerability after reaching end-of-life
- Microsoft Defender for Endpoint leverages modern cybersecurity technologies (e.g., AI based behavior detection, cloud-based sandbox verification) which are not available in traditional signature based Anti-virus tools like F-secure.
- Locate and wipe device when it is lost or stolen.
All university owned Windows 10/11 devices used for administrative purpose are expected to be managed under Microsoft Intune and protected by Microsoft Defender for Endpoint in order to meet the Minimum Security Standard as defined in our Cybersecurity policy.
Enrollment is currently available for new or re-installed university owned PC / Notebook. We also provide a procedure for existing non domain joined device to enroll.
For on premise domain joined devices, ITSC recommends continuing using them until next replacement or re-installation.
Departments must assign either their CSC (or other colleague) to take up the role of desktop support coordinator. He / She will work with ITSC Intune administrative team for the followings:
- Assist their department users to remediate insecure configuration if discovered (e.g., Windows update has paused)
- Work with ITSC for major upgrade (e.g., Windows 10/11 version reaching end-of-life)
- Handle security alerts (e.g., machine infected by malware)
Roles of users, departments and ITSC
Users, department CSC and ITSC work jointly to protect the devices.
Users, usually granted with local administrator privilege of the device, will manage installation of applications
They should also follow security practice provided on and off by ITSC (via their CSC) e.g., responding to security update prompt, upgrade OS and software to the latest versions, do not install unsafe software
ITSC will define and mandate most security configurations on their devices, by referencing Enterprise level security best practice suggested by Microsoft
By leveraging Intune and Microsoft Defender for Endpoint, ITSC will detect security incident promptly and inform affected users for quick remediation
- The device to be enrolled must be running Windows 10 version 1703 or later.
- ITSC will not examine the data stored in the PC
- The system configurations of the PC and the software installed will be recorded for the purpose of providing the endpoint management services
- If security incident happens (e.g., malware infection, unsafe software being installed, users clicking a malicious URL), ITSC will be alerted and may perform investigation by examining the security log files.
- Set up newly acquired desktop and onboard Microsoft Intune
- Set up newly acquired notebook and onboard Microsoft Intune
- Re-install Windows 10/11 devices and onboard Microsoft Intune
- Onboard existing device to Microsoft Intune
- Onboard device to Microsoft Intune via third party