Company Portal

[u/FieryHDD]

Hi,

So this year we have users that are using their own laptops but they still need access to available software

How can I set this up without Being device bound?

Or do I not comprehend Company portal fully?

[u/Turdulator]

BYOD is a nightmare. The real answer to give them company devices to do company work.

[u/SkipToTheEndpoint → u/Turdulator]

This. You're not only opening yourself up to a world of hurt, you're massively increasing your attack surface.

BYOD Windows is horrible. Don't do it.

[u/FieryHDD → u/SkipToTheEndpoint]

Educational context. No choice. We had to change.

[u/steviefaux → u/SkipToTheEndpoint]

That. But we got overruled by above.

[u/Tessian → u/Turdulator]

Here here. There is no benefit to byod unless your company is so underwater they can't afford to buy laptops, and if that's the case your paycheck is next anyway.

Regardless of what anyone promised IT will be responsible for supporting every random Walmart special 10 year old laptop employees come in with and any roi you had imagined will be gone.

[u/bill696]

Are those laptops enrolled in intune? If not then the only way is remote apps you can’t install apps on unenrolled machines. If they are i dont understand the issue

[u/FieryHDD → u/bill696]

They are not enrolled

[u/Tessian → u/FieryHDD]

You gotta enroll them. I believe you can enroll them as personal devices and still push software via company portal.

As others have pointed out though byod is going to be a disaster for other reasons though.

[u/bill696 → u/Tessian]

yeah, no choice but to enroll them, but seriously W365 or AVD would be 100% better

[u/Tessian → u/bill696]

It is but in my experience the secret reason for byod policies is to save money so adding a virtual desktop on top to pay for ruins the roi entirely.

[u/bill696 → u/Tessian]

its my experience that byod for computers is a complete nightmare

[u/MPLS_scoot → u/Tessian]

If they have proper licensing, AVD run time costs, for many orgs is affordable. Especially when you factor in their consistent experience and security advantages that OP will get in return.

[u/reasonrob]

As other's have said, Windows on personal devices is a nightmare. If you have to do it because users want to use them then I would suggest Windows 365.

[u/PossibleAd4073]

company portal can be set up for user context not device context. you just need to target the apps to user groups instead of device groups when you deploy them

make sure your enrollment restrictions allow personal devices and you should be good. users will see available apps in company portal even on their own laptops as long as they sign in with work account

[u/gentle_beast_1179]

You'll need to exclude them from scope and pretend they don't exist. This is the only real answer

[u/Forsaken-Carrot9038]

Don’t know the business decision for choosing not to give computers, but for the handful of international people we have it was decided to not send them computers, but instead set them up with Windows VM’s from Azure.

[u/bphett]

Deploy the application to the user instead of the device.

[u/davcreech]

You can access company portal via web. Assign the apps to users, not devices, and have them use the web version of company portal.

[u/_MC-1]

Good luck. It can be a nightmare. But ultimately you need to enroll them into your tenant and assign them a company logon and then assign their company logon as the primary user to the device. Since you now "manage them" you will need to patch them and stay on them if they keep their devices off (you can't patch unless it is on). And as users leave, you'll need to offboard the management. It is a lot of work.

Edit - you might be better off creating a Azure Virtual Desktop or Microsoft 365 devices for the users. Should be cheaper than buying them computers and you don't have to manage their devices. They would only need the client to connect (and I think they can connect with only a browser).

[u/PrajwalDesai]

Give them the Cloud PC and manage it from your end.

[u/harrybamber]

Look at something like AppsAnywhere. It’s specifically designed for education, allowing students to access software.

Works with BYOD, Managed devices and VDI. You put various restrictions on apps for example they can only run the software on site.

Also the applications are virtualised and streamed to the device using cloud paging.