You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Frontline Workers such as retail associates, flight crew members, and field service workers often use a shared mobile device to do their work. That becomes problematic when they start sharing passwords or pin numbers to access customer and business data on the shared device.
21
+
Frontline workers such as retail associates, flight crew members, and field service workers often use a shared mobile device to do their work. That becomes problematic when they start sharing passwords or pin numbers to access customer and business data on the shared device.
22
22
23
23
Shared device mode allows you to configure an Android device so that it can be easily shared by multiple employees. Employees can sign in and access customer information quickly. When they are finished with their shift or task, they can sign out of the device and it will be immediately ready for the next employee to use.
Copy file name to clipboardExpand all lines: articles/active-directory/develop/msal-ios-shared-devices.md
+4-4Lines changed: 4 additions & 4 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,7 +1,7 @@
1
1
---
2
2
title: Shared device mode for iOS devices
3
3
titleSuffix: Microsoft identity platform | Azure
4
-
description: Learn how to enable shared device mode to allow Frontline Workers to share an iOS device
4
+
description: Learn how to enable shared device mode to allow frontline workers to share an iOS device
5
5
services: active-directory
6
6
author: brandwe
7
7
manager: CelesteDG
@@ -21,7 +21,7 @@ ms.custom: aaddev
21
21
>[!IMPORTANT]
22
22
> This feature [!INCLUDE [PREVIEW BOILERPLATE](../../../includes/active-directory-develop-preview.md)]
23
23
24
-
Frontline Workers such as retail associates, flight crew members, and field service workers often use a shared mobile device to perform their work. These shared devices can present security risks if your users share their passwords or PINs, intentionally or not, to access customer and business data on the shared device.
24
+
Frontline workers such as retail associates, flight crew members, and field service workers often use a shared mobile device to perform their work. These shared devices can present security risks if your users share their passwords or PINs, intentionally or not, to access customer and business data on the shared device.
25
25
26
26
Shared device mode allows you to configure an iOS 13 or higher device to be more easily and securely shared by employees. Employees can sign in and access customer information quickly. When they're finished with their shift or task, they can sign out of the device and it's immediately ready for use by the next employee.
27
27
@@ -91,7 +91,7 @@ On a user change, you should ensure both the previous user's data is cleared and
91
91
92
92
### Detect shared device mode
93
93
94
-
Detecting shared device mode is important for your application. Many applications will require a change in their user experience (UX) when the application is used on a shared device. For example, your application might have a "Sign-Up" feature, which isn't appropriate for a Frontline Worker because they likely already have an account. You may also want to add extra security to your application's handling of data if it's in shared device mode.
94
+
Detecting shared device mode is important for your application. Many applications will require a change in their user experience (UX) when the application is used on a shared device. For example, your application might have a "Sign-Up" feature, which isn't appropriate for a frontline worker because they likely already have an account. You may also want to add extra security to your application's handling of data if it's in shared device mode.
95
95
96
96
Use the `getDeviceInformationWithParameters:completionBlock:` API in the `MSALPublicClientApplication` to determine if an app is running on a device in shared device mode.
97
97
@@ -226,6 +226,6 @@ signoutParameters.signoutFromBrowser = YES; // Only needed for Public Preview.
226
226
227
227
## Next steps
228
228
229
-
To see shared device mode in action, the following code sample on GitHub includes an example of running a Frontline Worker app on an iOS device in shared device mode:
229
+
To see shared device mode in action, the following code sample on GitHub includes an example of running a frontline worker app on an iOS device in shared device mode:
230
230
231
231
[MSAL iOS Swift Microsoft Graph API Sample](https://github.com/Azure-Samples/ms-identity-mobile-apple-swift-objc)
Copy file name to clipboardExpand all lines: articles/active-directory/develop/msal-shared-devices.md
+13-13Lines changed: 13 additions & 13 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,7 +1,7 @@
1
1
---
2
2
title: Shared device mode overview
3
3
titleSuffix: Microsoft identity platform | Azure
4
-
description: Learn about shared device mode to enable device sharing for your Frontline Workers.
4
+
description: Learn about shared device mode to enable device sharing for your frontline workers.
5
5
services: active-directory
6
6
author: brandwe
7
7
manager: CelesteDG
@@ -18,18 +18,18 @@ ms.custom: aaddev
18
18
19
19
# Overview of shared device mode
20
20
21
-
Shared device mode is a feature of Azure Active Directory that allows you to build applications that support Frontline Workers and enable shared device mode on the devices deployed to them.
21
+
Shared device mode is a feature of Azure Active Directory that allows you to build applications that support frontline workers and enable shared device mode on the devices deployed to them.
22
22
23
23
>[!IMPORTANT]
24
24
> Shared device mode for iOS [!INCLUDE [PREVIEW BOILERPLATE](../../../includes/active-directory-develop-preview.md)]
25
25
26
-
## What are Frontline Workers?
26
+
## What are frontline workers?
27
27
28
-
Frontline Workers are retail employees, maintenance and field agents, medical personnel, and other users that don't sit in front of a computer or use corporate email for collaboration. The following sections introduce the aspects and challenges of supporting Frontline Workers, followed by an introduction to the features provided by Microsoft that enable your application for use by an organization's Frontline Workers.
28
+
Frontline workers are retail employees, maintenance and field agents, medical personnel, and other users that don't sit in front of a computer or use corporate email for collaboration. The following sections introduce the aspects and challenges of supporting frontline workers, followed by an introduction to the features provided by Microsoft that enable your application for use by an organization's frontline workers.
29
29
30
-
### Challenges of supporting Frontline Workers
30
+
### Challenges of supporting frontline workers
31
31
32
-
Enabling Frontline Worker workflows includes challenges not usually presented by typical information workers. Such challenges can include high turnover rate and less familiarity with an organization's core productivity tools. To empower their Frontline Workers, organizations are adopting different strategies. Some are adopting a bring-your-own-device (BYOD) strategy in which their employees use business apps on their personal phone, while others provide their employees with shared devices like iPads or Android tablets.
32
+
Enabling frontline worker workflows includes challenges not usually presented by typical information workers. Such challenges can include high turnover rate and less familiarity with an organization's core productivity tools. To empower their frontline workers, organizations are adopting different strategies. Some are adopting a bring-your-own-device (BYOD) strategy in which their employees use business apps on their personal phone, while others provide their employees with shared devices like iPads or Android tablets.
33
33
34
34
### Supporting multiple users on devices designed for one user
35
35
@@ -45,12 +45,12 @@ Azure Active Directory enables these scenarios with a feature called **shared de
45
45
46
46
As mentioned, shared device mode is a feature of Azure Active Directory that enables you to:
47
47
48
-
* Build applications that support Frontline Workers
49
-
* Deploy devices to Frontline Workers and turn on shared device mode
48
+
* Build applications that support frontline workers
49
+
* Deploy devices to frontline workers and turn on shared device mode
50
50
51
-
### Build applications that support Frontline Workers
51
+
### Build applications that support frontline workers
52
52
53
-
You can support Frontline Workers in your applications by using the Microsoft Authentication Library (MSAL) and [Microsoft Authenticator app](../user-help/user-help-auth-app-overview.md) to enable a device state called *shared device mode*. When a device is in shared device mode, Microsoft provides your application with information to allow it to modify its behavior based on the state of the user on the device, protecting user data.
53
+
You can support frontline workers in your applications by using the Microsoft Authentication Library (MSAL) and [Microsoft Authenticator app](../user-help/user-help-auth-app-overview.md) to enable a device state called *shared device mode*. When a device is in shared device mode, Microsoft provides your application with information to allow it to modify its behavior based on the state of the user on the device, protecting user data.
54
54
55
55
Supported features are:
56
56
@@ -65,15 +65,15 @@ Your users depend on you to ensure their data isn't leaked to another user. Shar
65
65
66
66
For details on how to modify your applications to support shared device mode, see the [Next steps](#next-steps) section at the end of this article.
67
67
68
-
### Deploy devices to Frontline Workers and turn on shared device mode
68
+
### Deploy devices to frontline workers and turn on shared device mode
69
69
70
-
Once your applications support shared device mode and include the required data and security changes, you can advertise them as being usable by Frontline Workers.
70
+
Once your applications support shared device mode and include the required data and security changes, you can advertise them as being usable by frontline workers.
71
71
72
72
An organization's device administrators are able to deploy their devices and your applications to their stores and workplaces through a mobile device management (MDM) solution like Microsoft Intune. Part of the provisioning process is marking the device as a *Shared Device*. Administrators configure shared device mode by deploying the [Microsoft Authenticator app](../user-help/user-help-auth-app-overview.md) and setting shared device mode through configuration parameters. After performing these steps, all applications that support shared device mode will use the Microsoft Authenticator application to manage its user state and provide security features for the device and organization.
73
73
74
74
## Next steps
75
75
76
-
We support iOS and Android platforms for shared device mode. Review the documentation below for your platform to begin supporting Frontline Workers in your applications.
76
+
We support iOS and Android platforms for shared device mode. Review the documentation below for your platform to begin supporting frontline workers in your applications.
77
77
78
78
*[Supporting shared device mode for iOS](msal-ios-shared-devices.md)
79
79
*[Supporting shared device mode for Android](msal-android-shared-devices.md)
Copy file name to clipboardExpand all lines: articles/active-directory/fundamentals/service-accounts-principal.md
+2-1Lines changed: 2 additions & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -93,6 +93,7 @@ For more information see [Get-AzureADServicePrincipal](/powershell/module/azurea
93
93
To assess the security of your service principals, ensure you evaluate privileges and credential storage.
94
94
95
95
Mitigate potential challenges using the following information.
96
+
96
97
|Challenges | Mitigations|
97
98
| - | - |
98
99
| Detect the user that consented to a multi-tenant app, and detect illicit consent grants to a multi-tenant app | Run the following PowerShell to find multi-tenant apps.<br>`Get-AzureADServicePrincipal -All:$true ? {$_.Tags -eq WindowsAzureActiveDirectoryIntegratedApp"}`<br>Disable user consent. <br>Allow user consent from verified publishers, for selected permissions (recommended) <br> Use conditional access to block service principals from untrusted locations. Configure them under the user context, and their tokens should be used to trigger the service principal.|
@@ -122,4 +123,4 @@ When using Microsoft Graph, check the documentation of the specific API, [like i
122
123
123
124
[Governing Azure service accounts](service-accounts-governing-azure.md)
124
125
125
-
[Introduction to on-premises service accounts](service-accounts-on-premises.md)
126
+
[Introduction to on-premises service accounts](service-accounts-on-premises.md)
Azure AD and Microsoft Endpoint Manager teams have combined to bring the capability to customize, scale, and secure your Frontline Worker devices.
275
+
Azure AD and Microsoft Endpoint Manager teams have combined to bring the capability to customize, scale, and secure your frontline worker devices.
276
276
277
277
The following preview capabilities will allow you to:
278
278
- Provision Android shared devices at scale with Microsoft Endpoint Manager
279
279
- Secure your access for shift workers using device-based conditional access
280
280
- Customize sign-in experiences for the shift workers with Managed Home Screen
281
281
282
-
To learn more, refer to [Customize and configure shared devices for Frontline Workers at scale](https://techcommunity.microsoft.com/t5/azure-active-directory-identity/customize-and-configure-shared-devices-for-firstline-workers-at/ba-p/1751708).
282
+
To learn more, refer to [Customize and configure shared devices for frontline workers at scale](https://techcommunity.microsoft.com/t5/azure-active-directory-identity/customize-and-configure-shared-devices-for-firstline-workers-at/ba-p/1751708).
0 commit comments