What exactly is Enterprise Mobility Suite (EMS)? Microsoft offers a collection of management solutions for everything from devices and (organizational) permissions to people. EMS consists of various software solutions, which can also be purchased separately. The products that together form EMS are:

• Azure Active Directory Premium
• Microsoft Intune
• Azure Rights Management
• Microsoft Advanced Threat Analytics

EMS is part of Microsoft’s SaaS solutions and is most useful for organizations looking to work more flexibly by moving to the cloud. EMS consists of several solutions, each implementing a specific aspect of IAM, creating a synergistic whole.

Azure Active Directory Premium (Azure AD)
Azure AD is an identity management service based on a multi-tenant cloud-based directory and also includes MIM. For technical and functional management, Azure AD easily grants employees SSO access to countless SaaS applications such as Office 365. The premium version has no limitations on the number of applications or users.

Azure AD can also be used as a complete identity management solution with features such as multi-factor authentication (MFA), self-service management (e.g., passwords and group assignments), privileged account management (PAM), role-based access control (RBAC), and auditing and monitoring. Access and usage reporting and analytics can also be generated using Azure AD Premium data.

A key feature is Cloud App Discovery. This feature can discover unmanaged cloud applications that users are using on their PCs. An example of an unmanaged application running in the cloud is Evernote, an application that allows you to create, save, and sync notes to other devices (e.g., your laptop or phone). Cloud App Discovery then analyzes the unmanaged application for “normal” usage (compared to a login attempt abroad), presents it in a usage report, and can also apply SSO for usage management.

Azure AD Premium also brings hybrid IAM, a combination of on-premises and cloud solutions, within reach. Hybrid IAM within Azure is made easy because complex architectures can be easily adapted.

A dedicated portal for the Connect Health feature displays alerts, allows for performance monitoring, and allows for usage analysis. It offers a bird’s-eye view of the entire system or a detailed focus on a specific service.

Microsoft Intune
Intune is a software solution fully focused on mobile devices and mobile applications. Access to Microsoft products like Exchange can be managed, and (temporary) certificates for VPN and Wi-Fi connections can also be issued. With Intune, there’s no need to purchase any hardware to set up infrastructure. All data is stored in the cloud, secure, and accessible only to those with permission.

Azure Rights Management (Azure RMS)
While Azure AD and Intune primarily focus on (changing) access rights for applications and accounts, Azure RMS focuses on content. Azure RMS enables control over the fate of files and messages, such as Office 365 or SharePoint files. It not only allows you to manage who can view, edit, or copy a file on a registered Microsoft device, but also ensures that an RMS-protected object on non-Microsoft devices complies with established access requirements.

The term “Information Management” might be more appropriate, since Office 365 messages can also be encrypted, and Azure RMS consists of two components: Information Rights Management (IRM) and Office 365 Message Encryption. IRM offers various options for protecting emails, whether accessed online or offline. IRM also enhances the security of your SharePoint data. Office 365 Message Encryption makes file sharing secure and encrypted.

Microsoft Advanced Threat Analytics (ATA)
Advanced Threat Analytics (ATA) is the latest addition to the Enterprise Mobility Suite. Your company data is constantly under threat from malicious actors. These hackers often have access to your database for some time through social engineering, searching for admin account credentials—the holy grail for these hackers. ATA uses self-learning to study the habits of account users and recognizes when a user (or malicious actor) attempts to log in or performs other actions. You can configure ATA’s response accordingly. Read more in our ATA article.

Microsoft Enterprise Mobility Suite consists of four solutions that, when combined, amount to more than just the sum of their parts. EMS enables secure access to databases, applications, mobile applications, account information, and more. Your data, whether in Office 365, SharePoint, or Exchange, can be shared and accessed reliably and encrypted. ATA also recognizes potential threats and alerts users and administrators. You can configure how ATA handles these alerts, just like the rest of EMS.