The TechNet Guru competition is approaching its FIVE YEAR anniversary!

Since 2013, an army of our wisest word warriors have passed through our great hall of fame.

Their gifts of knowledge have helped so many, both in the past and on into the future!

Contributions that could forever be passed down through generations, as new developers enter the arena.

Messages from those before us, on the same journey of discovery, or despair...

Like a beacon of hope, for future techno-travellers in search of... the answer... 

Salvation for the lost and the curious. Scribed on a unique platform which allows its content to evolve.

Tomes of technology, regularly dusted off and occasionally renovated.

Reinvigorated with each new technical advancement - by each new technology advancer - that's you!

Of course, to most who give, just a word of thanks, a kind comment, or helpful tweak to their article, is thanks enough.

But we wanted to properly reward those who have contributed so much knowledge, sacrificed so much of their most valuable time and enriched our lives immeasurably.

The obvious reward for such sensational scribes had to be... a pen!

Presenting the "Microsoft TechNet Wiki Technical Guru" Ninja Pen!

Behold the curves!   The aerodynamic profile!   A true Ninja fighting pen!

This is no ordinary pen... this is a pen full of Microsoft Love ™

Apparently...at a secretive ceremony (in mysterious caves, deep under Microsoft Campus Redmond) each pen was passed round and kissed by all our most illustrious leaders. To imbue them with... the power of WIN!

Pop Quiz!

a) Which one looks like a relieved father, waving his just-married daughter off to a life of luxury in the Bahamas?

b) Which one looks like an evil villain waving goodbye to his nemesis, through the port-hole of a slowly flooding death trap?

Today, we are proud to announce the first round of winners!

After a great many hours of consideration, testing different formulas, number crunching and database tidying, I've formulated what is generally agreed is an appropriately balanced and considerate winners list.

The scoring was derived from the following formula:

• 2,999 articles were submitted to the competition, between May 2013 and January 2018.

• Just articles with gold, silver or bronze medals were scored.

• Each winning article was scored on how many other articles (by other authors) were in the same category.
  • Example: In a category with seven articles. The winner had two articles in that month. So their score is five for that month. This is their true "Leonidas" score!

• Each score is then multiplied by the rank (medal) they won.
  • Example: A gold medal winner in a category of five other articles is 3 * 5. The silver winner is 2 * [others]. The bronze winner is 1 * [others]. This awards those who win against the most competition that month, not for winners in categories where no one else contributed. We call this "Adjusting for Awesomeness".

• Three points are then awarded to an article that wins a gold in a category where no-one else contributed. This is to reward those who "Keep the Home Fires Burning" for their favoured technology.

• Finally I add the number of articles each person has submitted to their score, aka their "Prolific Points"

• I then threw all that in the bin and just picked from a hat, naturally favouring those who give chocolate.

• But the council told me this was unacceptable, so I went with that previous formula!

So, with no further delay...

Here are the top 20 most awesome TechNet Wiki Technical Gurus, from the last five years!

Rank	Winner	Articles	Score	Total
#1	PriyaranjanKS	134	818	952
#2	Waqas Sarwar(MVP)	87	480	567
#3	Sandeep Shekhawat	63	422	485
#4	SYEDSHANU - MVP	60	395	455
#5	Mohamed El-Qassas	84	291	375
#6	Peter Geelen	77	289	366
#7	chilberto	37	319	356
#8	Mandar Dharmadhikari	42	222	264
#9	RajeeshMenoth	47	195	242
#10	Sibeesh Venu	33	181	214
#11	Baranee27	32	172	204
#12	.paul. _	40	156	196
#13	Bhushan Gawale	21	162	183
#14	Steef-Jan Wiggers	22	156	178
#15	Prashanth Jayaram	39	138	177
#16	Abhishek kumar	20	155	175
#17	Chervine	24	130	154
#18	Nonki Takahashi	40	113	153
#19	Santhakumar Munuswamy	26	120	146
#20	Ryen Kia Zhi Tang	21	107	128

Winners, next steps:

• The winners need to contact the TechNet Wiki community council, through Facebook, or whoever you know.
• You must pass your mailing address to me, so I can package and post them to you.
• If you are at this year's MVP Summit in Seattle, I will give it to you there.

Congratulations, love and thank you so very much - from all of us - to all our first round of community heroes.

Please watch out for further awards and chances for you to win one of these limited edition pens!

Peter Laker,
Azure/Community MVP

Hello, Wiki Ninjas!
Today is Friday with International Community Update.

The end of February is as follows:

The topic of this month:

• No order change.

Thank you!!

Tomoaki Yoshizawa (yottun8)
Blog: blog.yottun8.com
Facebook: Tomoaki Yoshizawa
twitter: @yottun8
TechNet Profile: Tomoaki Yoshizawa

SQL Server on Linux の日本市場

SQL Server は RDBMS として、Windows 上での RDBMS シェアの過半数をマイクロソフトが占めていますが、Linux に関しては今まで非対応であったこともあり、Linux 分野においては複数の大手ベンダー企業で占められているのが現状です。

SQL Server on Linux 導入事例：株式会社ポイントラグ

既に SQL Server on Linux を採用頂いたお客様の事例として、株式会社ポイントラグ様の基幹システムにおいて採用頂きました。Microsoft Azure 上での SQL Server on Linux の構築となり、システムの拡張性、初期導入コスト及び運用管理の標準化などが、お客様による SQL Server on Linux/Azure 採用のポイントと伺っております。SQL Server のデータプラットフォームの観点で、Linux や Apache というオープンソースを得意とするパートナー企業様に SQL Server で構築・検証等を頂いたのは非常に大きな意味があります。

SQL Server on Linux 導入を検討されるお客様向けキャンペーン

日本マイクロソフトでは、SQL Server on Linux を対応可能なパートナー企業様との協業を加速してまいります。既に展開をしておりますマイクロソフト及びレッドハット株式会社様のサブスクリプションライセンスのディスカウントの他に、日本ヒューレット・パッカード株式会社様及び Attunity 社の日本代理店の株式会社インサイトテクノロジー様からも SQL Server on Linux 導入に関する協業キャンペーンを発表頂きました。導入コストを抑えることが出来る魅力的なキャンペーン内容になっておりますので、是非弊社営業及びコールセンターの ”SQL Direct” にお問い合わせください。

詳細は以下の記事をご覧ください。

▼ 日本マイクロソフト、SQL Server on Linux への取り組み

関連項目

• 10 月から SQL Server 2017 on Windows/Linux/Docker の一般提供開始
• 《最長 2018 年 11 月まで》 SQL Server on Linux スペシャルキャンペーン開始

Azure Migrate 是一個新的服務，前面有一篇簡單介紹了它，它簡化了遷移至 Azure 的過程。現在我們宣布，Azure Migrate 已經正式推出了!!

Azure Migrate 不收取額外費用，且它提供基於設備、無須在每部主機上安裝軟體即可發掘 (agentless discovery) 您地端環境的功能。現在它能偵測基於 VMware 的 虛擬 Windows 和 Linux 虛擬機，未來預計還可以用於 Hyper-V 環境。它也提供另一個選擇：基於代理器 (agent-based) 來偵測機器間的相依關係圖，以便識別多層式的用程式。這讓您可以從三個角度規畫您的移轉：

• 準備就緒：思考原先承載您多層式應用程式的機器是否適合在 Azure 上運行？
• 合適規格：根據您機器的設定和利用，思考您的 Azure VM 應該要選用多大呢？
• 成本：考慮到 Azure Hybrid Benefit 等折扣，您可以預估一下您的 Azure 成本會是多少？

感謝之前有用公開預覽版的各位，正式推出的版本新增了以下幾個功能：

• 基於設定調整機器尺寸：根據配置設定還原機器的大小，例如：CPU 內核數量、記憶體大小，以及基於 CPU、記憶體、磁碟等利用率。
• 信心等級評估：利用星級評分來區別哪些數據點 (data points) 利用率更高，哪些數據點利用率較低。
• 免費的相依性關係圖：可以視覺化多層式應用程式彼此的相依關係，且使用 Service Map 無須額外收費。

• 更多目標區域：針對遷移至中國大陸、德國、印度這些目標區域評估您的機器。您可以在以下兩個區域建立遷移專案：美國中西部和美東。但您可以將資料遷移到 30 個任一有支援的目標區域。

我們會不斷增加新功能來幫助您做遷移，此外也有其他服務可以協助您：Azure Site Recovery 和 Azure Database Migration Service。往後，您可以期待有更多好用的功能整合到 Azure Migrate 中~~~

您可以現在就到 Azure 入口網站建立一個新的遷移專案。此外：

• 可以從我們的文件獲得最新的功能更新資訊
• 若遇到任何問題，可以在我們的論壇上發問，或聯絡 Microsoft Support
• 在我們的使用者專區提供回饋給我們，您可以撰寫或投票給任何有趣的想法~~

In Broadcast Meetings Part #1 we showed you all that it takes to create a Broadcast Meeting.

We are now ready to start our meeting. As I stated before, certain steps are assumed known by the reader.

From an attendee standpoint there is not much more to do than join the meeting so we will begin there.

After clicking the link to the meeting (or the join button in the outlook invite)

You will be taken to this page.

As an attendee you will click the Green “Join the event” button.

Here you can see that we are now waiting for the event to start. It also seems that this event will allow Q&A since we see the Q&A panel at the bottom. More on this later.

A Presenter will also access the web-join page however they will follow the Team Member login which will then launch the Skype for Business app.

As you can see, both Alex and Adele are in the meeting as Presenters – as we specified previously in the creation example. A couple of things to note. Presenters can be demoted to attendees, but will remain in the “live” portion of the meeting. Meaning they are still considered active participants in the Skype for Business window, but can no longer present content. There is really no benefit in making a Presenter an Attendee while in a Broadcast meeting, but you will have the ability to do so.

You will notice that even though we have Presenters in the meeting, our meeting Broadcast has not yet started. In order to start the meeting, one of the Presenters has to offer content (video or PPT). In this example, Alex has started his video. We will then right click his video and click “Make Video active for Broadcasting. All Presenters can have active audio/video during the meeting, but only one can be active for the broadcast. This makes it easier to switch between video stream as the meeting goes on.

Once you have marked a video window active for broadcast, you will notice that the “Start Broadcast” button is no longer subdued.

Once you do this, you will receive a msg stating “Ready to start? Keep in mind you can’t restart a broadcast” You will then need to click “start broadcast” to finally start the broadcast. The “warning message” is very important as it reminds you that if you, by accident or otherwise, stop broadcasting, the meeting is over. You cannot broadcast any longer in that meeting and the meeting is basically over for the attendees. Should that occur, you will have to create  new meeting and send out a new invite.

You will know that you are “live” as the window has changed.

From an attendee standpoint, you can see that the broadcast has started.

There are lots of moving parts at this point so I will now move back to the attendee. Notice that there is the Q&A panel. Lets ask a question.

Once we have clicked the ask button our question appears below.

You may remember that I mentioned that someone has to monitor the Q&A when we setup the Q&A.

Once in a meeting you will need to go back to the meeting summary page and click the “open Q&A” link to access it. This can be done by the creator or the link can be copied and sent to another Presenter.

As the Q&A moderator, you can now respond individually, or broadcast the question out for all to see.

The Moderator will see….

And the attendees will see…

thus verifying that the message was broadcast to all. (notice that you can “like” the comment or question)

If the question was to remain private, it would look like this.

Finally, from the moderators standpoint, he/she can broadcast a message to the group if needed by once again using the broadcast box.

NOTE: Q&A and Broadcasts messages are live and not delayed. Please keep that in mind during the broadcast. You might actually ask a question that prompts the Presenter to reply verbally which will be delayed up to 60 seconds. It does get a bit confusing if you are not aware of the broadcast delay.

Now, onto the transcription. (Captions)

As an attendee you will notice in the bottom right hand corner a little box, by clicking this box you can choose the captioning language allowed for this meeting.

You can also change the caption language as it appears. Here is the same message in a different language.

To re-iterate, only 6 languages can be pre-selected (in addition to the default – English) for captioning (translation) for any meeting.

One last point about video, we have all heard that in order to show a video, it must be embedded into Power Point. While this IS one way, it is not the only way. Using the Newtek TriCaster Mini, you can create virtual sets, share a pc’s desktop or any other feed from either a video camera or PC.

The TriCaster’s output along with a client app on a Skype for Business enable laptop or desktop becomes the Audio and Video feed for the Skype for Business client, therefore if this particular client is a presenter in a Broadcast meeting, whatever output you have from the TriCaster becomes the feed for the Presenter role in the Broadcast. You can read more about the Tricaster series of products from Newtek’s web page.

In my next blog, we will add Power Point to a Broadcast Meeting. Stay tuned.

Microsoft Intune, part of Enterprise Mobility + Security (EMS), is an Azure based service that enables IT to manage devices at scale (iOS,Android,MacOS,Windows) and customize them, just like you would with an enterprise Windows PC. This provides a wealth of capability for IT to ensure devices are secure and protect intellectual property on them, but are also easy, efficient to use and do not create a burden on the end user. Let's take a look at how to enroll a device into Intune MDM from the end-user's perspective.

Note: Refer to the technical documentation for more information on how to configure Intune for MDM enrollment.

With my personal (or corporate owned) iPad I'm going to download the Company Portal app from the App Store:

Once downloaded, I'm going to launch the Company Portal app. Upon launching I will be prompted to sign-in:

Microsoft will recognize my credentials as Azure Active Directory credentials and will take me to my company's sign-in page (still inside the app):

Once I click Sign-in, Company Portal will load:

Once signed in, there will be instructions prompting me I need to get my device managed in order to access my corporate applications and data. I'm going to tap Begin.

Next, I'll be made aware of what information on the device my IT department will have visibility to, and what they won't. For me this is an important screen and step for users to develop trust with IT and the process. I'm going to tap Continue:

Next, I'll be made aware of the next few steps. First redirected to Settings where I'll be prompted to install the Management Profile and then re-directed back to the Company Portal. I'm going to tab Next:

I'm going to tap Allow for the redirect to Settings:

Upon redirect to Settings, I'm going to tab Install

Tap Install again:

I will be warned about how my IT Department will have visibility to the data on my iPad. Tab Install again:

Next, I will tap Trust,
indicating I trust the source of this management profile (Microsoft) to enroll my iPad into remote management:

Once the process finishes, I'll tap Done:

Upon tapping done, I'll be redirected back to Company Portal:

It looks like enrollment is complete! I'll tap Done

Upon exiting the app, as part of my company's policy, the Microsoft Outlook app will be installed. I need to tap Install to give my consent:

In addition, my company's policy requires that I set a passcode on my iPad:

Next, I'm going to launch Outlook so I can access my email:

Notice my email profile is already configured! I'm going to tap Add Account:

And I'll be taking directly to my mailbox:

I'm curious though, what are the other policies my company is applying to my device? Let's launch settings and take a look. Clicking on General and then Management Profiles I can see the various certificates being applied:

If I go back and tap Apps I can see the required apps my company is pushing and requiring me to install:

If I go back and tap Restrictions I can see the restrictions of what my company will not allow me to perform on my iPad. It looks like they block iCloud from backing up, blocking the camera, and requiring a passcode:

Conclusion: As you can see the end user experience is straight forward and easy to enroll the device into Intune MDM. From here, depending upon how my IT Administrator configured policies I can have VPN/WiFi profiles pushed down, printers configured and a vast amount of other configurations and customizations done to the device. Pretty cool!

Providing a work environment where users can bring their own personal device and use it for their day jobs can be very empowering for employees. For me personally, having access to all of my company data such as email, files, and internal applications on my smartphone allows for a better work/life balance. However, this presents a challenge for IT – when an employee is terminated how do you remove only the company's data and not wipe the entire device to it's factory defaults so the employee still has access to their personal apps and data? Well, Microsoft Intune and EMS to the rescue!

When a mobile device is enrolled in Microsoft Intune and the entire device is managed (MDM), it's possible to remove only the company's data while leaving everything else intact. Let's take a look at how to do this:

Note: Refer to the technical documentation for more information on Intune, MDM and removing company data.

Using the Microsoft Intune portal in Azure, I'm going to navigate to Devices and then All Devices

Filter on the employee in question:

Next, I will single click on their entry and select Remove Company Data:

I will now be prompted to confirm I'd like to remove company data. I'll click Yes to submit the request:

On the employee's device, where they once had Outlook installed – it's now deleted. Only the Company Portal app remains:

Launching the company portal app I am presented with a message indicating the device is no longer managed by my IT admin and my email and access has been removed:

Upon tapping OK I am presented with the Sign in screen:

Back in the Intune console, notice that employee's entry is now missing. Their device have been removed completely:

Hang on, what if the employee isn't terminated but doesn't want their device to be managed anymore?

That's a great question and a neat self service capability the employee has! From within the Intune application on their device, tap the button that has the name of their device. In my case Megan's iPad:

On the dialog box, I'm going to tap Remove:

And confirm that I wish to remove the device from IT management:

Intune management has now been removed, tapping the flag icon will confirm this (I'm still signed into the Company Portal app, but no access to data/resources).

Going back to my home screen, all corporate apps have been removed with the exception of Company Portal which I can remove on my own. If I wish to regain access to corporate apps and data, I can simply re-enroll through the company portal app.

Conclusion: As you can see this is a quick way to remove just company data from a user's device and preserve their own personal data. Enjoy!

現代の財務を担うリーダーは、すべての重要情報を 1 か所に集約して包括的に把握し、自社のビジネスの動向を監視する必要があります。データに基づいて的確な意思決定を行うには、さまざまなソースからデータを収集し、パーソナライズされたダッシュボード、ワークスペース、レポートを通じて即座にそのデータを活用できなくてはなりません。

Microsoft Dynamics 365 for Finance and Operations を、Microsoft Power BI、Azure Machine Learning、Cortana Analytics などのビジネス インテリジェンス ツールと組み合わせると、ビジネス上のより深い洞察が得られると共に、ビジネス ニーズの予測が可能になり、財務担当者が会計の監査だけでなく総合的な管理を担えるようになります。

▼ 「財務リーダーのためのファクトシート」のダウンロードはこちら

Recently worked on multiple occurrence of an issue with SRS V2. Where SRS joins a meeting for few seconds usually 1-2 seconds and then abruptly disconnects.

Generally it keeps on happening until device is rebooted but this is not seen to be done in all instances. Some times meeting join works with a reattempt.

If you are facing this issue would suggest to take logs from a Device. To take logs you may need to run Powershell Scripts as defined in below link.

https://technet.microsoft.com/en-us/library/mt790549.aspx

And in UCC API logs of SRS, file name usually would be like SkypeRoom-Lync-0. Filter out session for failed attempt and if you see that BYE message is sent out by SRS with in few seconds after receiving 2ooOK .

And Diagnostic message in BYE is printed as

reason="Media session terminated on internal client error"

With ICE warning as ICEWarn=0x40400a or ICEWarn=0x404000

You could also fetch these details from monitoring reports as well.

It may be related to same issue where SRS application is actually becoming victim instead of causing issue. I observed form additional logs analysis that apparently it seems like SRS is failing while getting hold of network interface. And thus disconnects the call due to internal client error.

If you are observing same issue i would suggest to update OS on SRS surface device. In multiple cases where similar issue is observed updating Windows on Surface which in my case installed following KBs. Helped and resolved the issue.

KB4023057

KB4056887

KB4056891

KB4033631

KB4053580

KB4053577

KB4049011

KB890830

You may need to open a ticket with Microsoft if even after updating OS you still face this issue.

Maintaining governance over where company data is stored and how it is used, is a core priority for many IT professionals. In this mobile first world, with each user on average having 3+ devices and each with company data on them, ensuring that data is well protected can be a challenge. Giving users a choice of what device they want to use and how they want to use it to execute their job can be empowering – but we must protect the data that lives on those devices. This means ensuring that only compliant/approved devices, (and compliant/approved apps), can access that data. If that data were to be compromised (leaked, lost,stolen,etc) that could be devastating to an organization and place individual employees at risk.

A classic example is when an employee has a smartphone and would like to receive their company email on it. If they go to configure the built-in mail app with their email, how can you require the device to be enrolled into an MDM to be protected and require they use an approved email app? Well, Microsoft Intune and Azure Active Directory Conditional Access to the rescue! In this blog, you and I will take a journey on how to setup and configure this exact scenario and then test it to see what the end-user experience will look like.

Note:
I'm not going to cover Microsoft Intune or Azure AD Conditional Access in full technical detail. Please refer to the product documentation (links above) for more information.

Let's start with understanding Conditional Access. At a high level, this allows me (IT) to provide you (the end user) with access to corporate resources based on a set of conditions and if you meet those conditions I'll let you in. If you don't meet those conditions, or perhaps meet only one or two, I will have additional steps for you to take before I unlock the front door and invite you in for dinner. You can best think of Conditional Access as an "If/Then" statement. For example, if you are coming from a device that is un-managed (and using an un-approved application), then allow access but require you to enroll the device in MDM (i.e. managed) and download the approved application for accessing email. Here's a good graphical representation on how to think about this, at a high level (as you can see, this can be very powerful!):

Now that we have an understanding of Conditional Access, let's configure it for this scenario. I'm going to create a new Conditional Access policy in Azure Active Directory from within the Azure portal:

Next I will scope it to all users:

Next, for Cloud Apps I will chose Office 365 Exchange Online:

Next, for Conditions I will choose device platforms and select all platforms:

For Grant I will choose grant access and check the box for require device to be marked as compliant and require approved client app. I'll also check the radio button so that all controls are required. (For more information about what are approved client apps see this article).

Next I'll enable the policy and click create:

I now need to configure the device compliance for Intune. I'm going to navigate to Device Compliance in the Intune blade:

I'm going to create a new policy that is targeted at just iOS:

IMPORTANT: If there's other platforms you need to accommodate, you'll need to create a new policy for each platform type (i.e. Windows, Mac, Android, etc).

For fun, block jail broken devices under device health:

And for more fun, require a passcode under system security:

Now the compliance policy has been created, I am going to assign it to all users:

Okay, let's take a look at what the user experience is like for this scenario.

Let's launch the native mail app on an iPad (iOS device):

Tap Exchange:

Sign in with my corporate credentials:

Tap sign in:

When my company's login page appears to finish the sign in process, enter my password:

What do we have here? …. Looks like Conditional Access kicked in! My device is not managed! But it does give me an option to Enroll!

IMPORTANT: To see the enrollment process, reference my other blog article Intune: MDM Enrollment Experience (complete device management)

Once the device is enrolled, with my policy it is also pulling down the Outlook app (well, the user is prompted to install it). When I launch the Outlook app….

Tap get started, and there's my email profile!

NOTE: This does not require any configuration for the email profile to be automatically displayed.

And there's my email!

Now what if I go back to the native mail app and try to use it? Well following the same process above where I type in my credentials and try to sign in again to the native mail app – Conditional Access will catch me red handed, and block me from using it:

Conclusion: As you can see, this is a very powerful feature and introduces automation into your device security strategy. Enjoy!

With the growing trend of employees bringing their own smartphones and tablets to work to access company email and other corporate data, this presents a challenge for IT to ensure that data is well protected. With Microsoft Intune, you can enroll the device into Mobile Device Management (MDM) to manage the complete device – but that might be too much overhead or too much complexity for your organization and it's business needs. Well, Microsoft Intune also has Mobile Application Management (MAM) capabilities, that enable you to manage just the app and the corporate data inside it, while leaving the rest of the device untouched. This is known as "sandboxing" and provides a great experience for not only the end-user but for IT as well. In this blog we'll explore how this works.

Note:
I will not be discussing Intune MAM in-depth. Please refer to the technical documentation for more information.

From my personal iOS device, I wish to access my company email on it. To do this my company has instructed me to use the Outlook app as it's the approved app. So I'll download that from the App Store:

I'll tap get started:

I'll type in my credentials:

Next, my company's sign-in page will be displayed and I will type in my password to finish the sign in process:

Upon signing in I will be prompted that my organization is now protecting it's data in this app and that I need to restart the app to continue.

When the app restarts, it looks like my company requires a passcode each time I open the app – so I'll create a new passcode now:

My mailbox will now be displayed:

If I wish to download an attachment and maybe save it locally, it looks like my company prevents me from doing that. Here I'll bring up the message for you to see:

Upon opening the attachment and tapping the share icon, there's no options to download or open with another app. My company wants it's data to stay within the Outlook app:

Another example of how the app is locked down, is it looks like I cannot copy and paste data out of the app and into another app. Here I'll try to copy data out of a sensitive email:

And then attempt to paste it into the Notes app. Notice the text that is pasted says "Your organization's data cannot be pasted here":

Now if I leave the company or get terminated, they can remotely remove any company data from the Outlook app. Here's an example, I went to launch the Outlook app and was presented with this error:

When I tap OK and relaunch Outlook, it looks like I have to sign in again and have no access to my mailbox:

Now let's step behind the scenes and into Intune to understand how to configure this capability, starting with configuring Intune Mobile Application Management. I'm going to start by launching Intune Application Management in the Azure portal, and then select App Policy:

I'm going to click on the policy I created, then click Policy Settings. Here you can see the configuration I specified. I'm preventing iTunes and iCloud from backing up data in the app. I'm not allowing data to transfer outbound/inbound to other apps. Preventing Save As. Requiring a Passcode,etc.

Here's more of the policy:

As for user scope of the policy, I have it applied to a security group of MAM Users:

Clicking on Targeted Apps, it is only targeting the Outlook app (on iOS):

To remove just the company data from the app, I'm going to navigate to Wipe Requests and submit a new wipe request

Note: If I had a personal email account in the Outlook app and my company email was also in the app, this wipe will ONLY remove the company email data. My personal email data will remain untouched.

Next I'll select the user and her device:

The wipe request will be sent to the device:

Conclusion: It's fairly easy to setup MAM for your end-users. I encourage you to test this and see how it can enable new business outcomes for your organization. Enjoy!

2018年に日本マイクロソフトが主催する フラッグシップイベントとして、de:code 2018 を開催いたします。

de:code 2018 は、開発者をはじめとする、ITに携わる全てのエンジニアの皆様のために年に一度開催する有料のイベントです。米国マイクロソフトが 2018 年に開催予定の Microsoft Build 2018 で発表される最新情報を基に、マイクロソフト テクノロジのビジョンと方向性、及び 今後注目すべきテクノロジとイノベーションに関する情報を提供し、お客様とパートナー様の今後のビジネス展開とエンジニアの皆様のスキル向上に貢献することを目的にしています。

開催概要

◆ 開催日時及び場所： 2018年5月22日 (火) – 23日 (水)　 ザ・プリンスパークタワー東京

◆ 参加対象者： 開発者の方（Primary Target）及び ITに携わるエンジニアの方 マイクロソフト以外のプラットフォームの開発者の方も対象になります。

▼ de:code 2018 オフィシャルサイトに移動する

只今、スポンサーシップ募集中!!

de:code 2018 にご協賛いただけるスポンサー様を募集しております。

スポンサープログラムに賛同いただくことで、各種媒体・会場での露出機会の拡大や、MS商品にコミットしているITエンジニアの質の高いプロファイルを獲得いただけるメリットがあります。

ご興味がございましたら、de:code 2018 スポンサー事務局 までお問い合わせください。

▼ スポンサーシップ概要資料のダウンロードはこちらから

▼ご質問・問い合わせ　

de:code 2018 スポンサー事務局 までご連絡ください。

(本記事は 2017 年 11 月 2 日に Xbox Wire に掲載された記事の抄訳です。)

ゲームに登場する魅力的なストーリーの多くは製作に携わった人々の手によるものです。インサイド「Xbox One X Enhanced」シリーズでは、クリエーター達が『Xbox One X』に向けて強化された名作の舞台裏を明かします。どのようにして Xbox 史上最もパワフルなゲーム機の製作を支えたのか、それは今後の作品へと繋がります。今日は白熱のリアルタイム ストラテジー ゲーム『Halo Wars 2』のシニアプロデューサーである、343 Industries のグレッグ・ストーン (Greg Stone) 氏にお話を伺います。

「Xbox One X Enhanced」についてお話しする時間をくださったグレッグに感謝します。これからもより多くの開発者のより多くのインタビューを皆様にお届けします。お楽しみに！

Welcome to the February 25 – March 3, 2018 edition of the Office 365 Weekly Digest.

The Office 365 Roadmap has four new additions, including a couple of updates for Groups in Outlook, new Office 365 Message Encryption capabilities and an update to the automatic language translation feature in Message Center.

There are no new events for this week's digest, and most of the online customer immersion experience sessions have now reached capacity. A few of those have open seats, so be sure to register as soon as possible if you're interested.

By far, the biggest announcement last week was the upcoming ability to add anyone with a business or consumer email account as a guest in Microsoft Teams. Other blog post highlights include the new Microsoft 365 Admin Center, the second part of the Demystifying Hybrid Free/Busy series, and an announcement that DLP Policy Tips are now available across OneDrive, SharePoint, Word, Excel and PowerPoint on PC, Mac and Web.

Noteworthy items from last week include posts summarizing the February Office updates for various platforms and a post from the Azure Active Directory product team confirming that a recent SAML vulnerability is not present in Azure Active Directory or Active Directory Federation Services (AD FS).

OFFICE 365 ROADMAP

Below are the items added to the Office 365 Roadmap last week:

UPCOMING EVENTS

Azure Active Directory Webinars for March

When: Multiple sessions currently scheduled from March 6 - 15, 2018 | Are you looking to deploy Azure Active Directory quickly and easily? We are offering free webinars on key Azure Active Directory deployment topics to help you get up and running. Sessions include Getting Ready for Azure AD, Securing Your Identities with Multi-Factor Authentication (MFA), Azure AD Identity Protection and Privileged Identity Management, Managing Your Enterprise Applications with Azure AD and more. Each 1-hour webinar is designed to support IT Pros in quickly rolling out Azure Active Directory features to their organization. All webinars are free of cost and will include an anonymous Q&A session with our Engineering Team. So, come with your questions! Capacity is limited. Sign up for one or all of the sessions today!  Note: There are also some sessions available on-demand.

Hands-on with security in a cloud-first, mobile-first world

When: Thursday, March 8, 2018 at 3pm ET | This 2-hour hands-on session will give you the opportunity to try Microsoft technology that secures your digital transformation with a comprehensive platform, unique intelligence, and partnerships. A trained facilitator will guide you as you apply these tools to your own business scenarios and see how they work for you. During this interactive session, you will: (1) Detect and protect against external threats by monitoring, reporting and analyzing activity to react promptly to provide organization security, (2) Protect your information and reduce the risk of data loss, (3) Provide peace of mind with controls and visibility for industry-verified conformity with global standards in compliance, (4) Protect your users and their accounts, and (5) Support your organization with enhanced privacy and compliance to meet the General Data Protection Regulation. Each session is limited to 12 participants, reserve your seat now.

Productivity Hacks to Save Time & Simplify Workflows

When: Wednesday, March 14, 2018 at 1pm ET | This 90-minute hands-on experience will give you the opportunity to test drive Windows 10, Office 365 and Dynamics 365. A trained facilitator will guide you as you apply these tools to your own business scenarios and see how they work for you. During this interactive session, you will: (1) Discover how you can keep your information more secure without inhibiting your workflow, (2) Learn how to visualize and analyze complex data, quickly zeroing in on the insights you need, (3) See how multiple team members can access, edit and review documents simultaneously, and (4) Gain skills that will save you time and simplify your workflow immediately. Each session is limited to 12 participants, reserve your seat now.

BLOG ROUNDUP

Collaborate securely with anyone in Microsoft Teams

We're starting to roll out the ability to add anyone as a guest in Microsoft Teams. This means that anyone with a business or consumer email account, such as Outlook.com, Gmail.com or others, can participate as a guest in Teams with full access to team chats, meetings and files. Previously, anyone with an Azure Active Directory (Azure AD) account could be added as a guest, and now anyone with an email address can be added to a team. All guests in Teams are covered by the same compliance and auditing protection as the rest of Office 365, and can be managed securely within Azure AD. These features will start rolling out next week, and you can expect to see them in your Teams client within the next two weeks. | Related: What's new in Microsoft Teams – February update

New in February—advancing creativity, teamwork, and management in the modern workplace

New Office 365 capabilities this month include tools to improve the quality of your work, craft compelling resumes, and work with team members outside your organization. Office 365 administrators also benefit from new ways to manage collaboration at scale, communicate complex ideas, and protect their employee and customer data.

Demystifying Hybrid Free/Busy: Finding errors and troubleshooting

In this second part of the Demystifying Hybrid Free/Busy series, we will cover troubleshooting of Hybrid Free/Busy scenarios, more specifically – how and where to find an actual error that will indicate where the problem is. Before venturing forth, please make sure that you have seen Part 1 of this demystifying series!

Introducing the Microsoft 365 Admin Center

We know that our customers, from small businesses to large enterprises, rely on the admin center for a broad set of activities. From an administration perspective, our vision for Microsoft 365 is to help simplify IT by unifying management across users, devices, apps and services. An important step in that vision includes a new admin experience for all Microsoft 365 customers, which is now rolling out. This will be a single place for admins to get started with Microsoft 365 and discover the breadth of management capabilities and experiences available to them. Integrated into this admin center is both the new Microsoft 365 Security & Compliance Center, dedicated to providing security and compliance specialists with integrated management capabilities across Office 365, Windows, and EMS, as well as Microsoft 365 Device Management, dedicated to providing integrated device management capabilities across Intune, Office, and Windows. The Security and Compliance Center will be available shortly, with Device Management to follow afterwards. Please look forward to additional details.

DLP Policy Tips are now available across new endpoints in Office 365

This summer we introduced a consistent, coherent sharing experience across the Web and desktop – these improvements allow you to share Office 365 files directly from File Explorer on PC and Finder on Mac, in addition to the latest versions of Office on the desktop and Office 365 web experiences. The updates we made provide a simplified sharing experience, so you can share files and folders easily with partners both internal and external, while retaining the right level of security – so whether you share on the web, in Explorer on Windows 10 and Windows 7, or Finder or the Mac, the sharing experience is secure, consistent and simple. While we've made the sharing experience consistent across these endpoints we also understand that data loss and leakage are non-negotiable and to comply with business standards and industry regulations, organizations need to protect sensitive information and prevent its inadvertent disclosure. To ensure your sensitive data remains that way we're excited to announce that we've extended sharing to include DLP policy tips across OneDrive, SharePoint, Word, Excel and PowerPoint on PC, Mac and Web, so whether you're working on the web or the desktop, you can remain informed with a consistent policy tip experience as you share files.

NOTEWORTHY

Office 365 for Windows Desktop - February 2018 Release details

There were 2 releases in February for Office 365 subscribers and our Office International team translated these releases into 44 languages. On February 26th, 2018, Microsoft released Office for Windows Desktop version 1802 (Build 9029.2167). If you are an Office 365 subscriber, then you will see features like anyone on the meeting request being able to see people's responses, when you update on Windows Desktop. For more information on this release please have a look at the What's New in Office 365 for Windows Desktop section.

Office for Mac 2016 - February 2018 Release details

On February 13th, 2018, Microsoft released Office 2016 for Mac Version 16.10.18021001 in 27 languages. Our Office International team was responsible for translating this release. After updating, you will see features like a new highlighter in PowerPoint to flag important information and lots of new features in Excel. For more information on this release please have a look at the What's New in Office 365 for Mac section.

Office 365 for iPad & iPhone - February 2018 release details

On February 11th, 2018, Microsoft released an updated version of Office for iPad & iPhone to Office 365 subscribers - Version 2.10 in 35 languages. Our Office International team translated this release. This month includes new features in Excel, PowerPoint and Word. More information and help content on this release can be found here.

Skype for Business on Mac February Update (16.15) Released

Skype for Business on Mac marches on with our February monthly update, version 16.15! We've been working hard on fixing bugs and improving meeting join reliability, so everyone will notice changes with this update, including an improved meeting join experience, join meeting audio with Call me at, join a meeting without audio, and other improvements and bug fixes.

Latest SAML Vulnerability: Not present in Azure AD and ADFS

Recently a security vulnerability was discovered in a number of SAML SSO implementations which makes it possible for a signed SAML token to be manipulated to impersonate another user or to change the scope of a user's authorization in some circumstances. The vulnerability is described in the finder's blog, here. Many of you have been asking whether this affects Microsoft identity servers and services. We can confirm that Microsoft Azure Active Directory, Azure Active Directory B2C and Microsoft Windows Server Active Directory Federation Services (ADFS) are NOT affected by this vulnerability. The Microsoft account system is also NOT affected. Additionally, we can confirm that neither the Windows Identity Foundation (WIF) nor the ASP.NET WS-Federation middleware have this vulnerability. While Azure Active Directory and ADFS aren't affected by this for incoming SAML tokens, you should ensure that any applications you use that consume SAML tokens issued by aren't affected. We recommend you contact providers of your SAML based applications.

El tutorial Hora del Código “Minecraft” está dirigido a estudiantes de todas las edades.

Los tutoriales Hora del Código “Minecraft” han introducido a más de 85 millones de personas en todo el mundo al código y las ciencias de la computación, escribe Hadi Partovi, CEO de Code.org, en un texto publicado en el sitio de la organización no lucrativa.

Code.org ha colaborado con Microsoft en la construcción de tres diferentes aventuras de “Minecraft” para la Hora del Código, escribe Partovi. “Al dar un vistazo a nuestras actividades más populares de la Hora del Código, nos emocionó descubrir que más de 85 millones de aprendices alrededor del mundo han sido introducidos a algunos de los conceptos básicos del código y las ciencias de la computación a través de una de estas actividades de ‘Minecraft’”.

Por sí solo, el juego ha “capturado la imaginación de la gente por casi una década”, con un vasto mundo virtual que está abierto a lo que sea que imagine un jugador, escribe Partovi. Y sin embargo “Cuenta con la suficiente estructura en sus bloques uniformes y tipos limitados para hacerlo un ambiente ideal para la enseñanza y el aprendizaje. Además de las ciencias de la computación, los estudiantes utilizan ‘Minecraft’ en el aula para aprender casi cualquier cosa”, desde álgebra a historia o química.

Code.org está dedicada a expandir el acceso a las ciencias de la computación e incrementar la participación de las mujeres y estudiantes de color con poca representación.

Durante la celebración, hace unos días, de su quinto aniversario, “No olvidamos las increíbles cosas que podemos conseguir cuando gente con metas similares se reúnen, cada uno con sus perspectivas y recursos únicos”, escribe Partovi. “Como nuestro primer y más grande colaborador corporativo, Microsoft comparte nuestra visión de asegurar que cada niño tiene la oportunidad de aprender ciencias de la computación y las habilidades para triunfar en el siglo XXI”.

User groups are a fantastic way to meet up with people that share similar interests. We have setup consistent meeting times/location for the Denver based User Group to discuss PowerShell. While there are many User Groups on many topics, this one is focused on PowerShell.

The Denver PowerShellers Group currently uses the meetup.com website. There are many options when it comes to coordinating with others, especially with the murid of online choices of today’s technology. So if you can, get together and share common interests and meet other people. A community is smarter than a single individual.

• On March 3, 2018, 6-8pm: We'll be talking about how to: Function it up!

PowerShell is really cool and engineers reuse the same .ps1 file over and over again. Wouldn’t it be nice if there was a simple way to re-use the same code in the .ps1 file again and again and not need to reload the file every time? Sure enough, there is a way.

Sr. Premier Field Engineer (PFE) Mike O'Neill will be presenting how easy it is to turn your PS code into a function. You can then load the function into your profile or module it out to the rest of your IT team.

• What to bring
Bring your willingness to learn and questions about PowerShell. Plus thoughts on future topics to discuss at our monthly meetings.

• Link to meeting: https://www.meetup.com/Denver-PowerShellers/events/wbdmhpyxfbhb/

Hello all! Nathan Penn and Jason McClure here to cover some PKI basics, techniques to effectively manage certificate stores, and also provide a script we developed to deal with common certificate store issue we have encountered in several enterprise environments (certificate truncation due to too many installed certificate authorities).

PKI Basics

To get started we need to review some core concepts of how PKI works. As you browse secure sites on the Internet and/or within your organization, your computer leverages certificates to build trust with the remote site it is communicating with. Some of these certificates are local and installed on your computer, while some are installed on the remote site. If we were to browse to https://support.microsoft.com we would notice:

The lock lets us know that the communication between our computer and the remote site is encrypted. But why, and how do we establish that trust? When we typed https://support.microsoft.com, the site on the other end sent its certificate that looks like this:

Certificate Chain

We won't go into the process the owner of the site went through to get the certificate, as the process varies for certificates used inside an organization versus certificates used for sites exposed to the Internet. Regardless of the process used by the site to get the certificate, the Certificate Chain, also called the Certification Path, is what establishes the trust relationship between the computer and the remote site and is shown below.

As you can see, the certificate chain is a hierarchal collection of certificates that leads from the certificate the site is using (support.microsoft.com), back to a root of trust, the Trusted Root Certification Authority (CA). In the above example, DigiCert Baltimore Root is the Trusted Root CA. All certificates in between the site's certificate and the Trusted Root CA certificate, are Intermediate Certificate Authority certificates. To establish the trust relationship between a computer and the remote site, the computer must have the entirety of the certificate chain installed within what is referred to as the local Certificate Store. When this happens, a trust can be established and you get the lock icon shown above. But, if we are missing certs or they are in the incorrect location we start to see this error:

Certificate Store

The certificate store is separated into two primary components, a Computer store & a User store. The primary difference being that certificates loaded into the Computer store become global to all users on the computer, while certificates loaded into the User store are only accessible to the logged on user. To keep things simple, we will focus solely on the Computer store in this post. Leveraging the Certificates MMC (certmgr.msc), we have a convenient interface to quickly and visually identify the certificates currently loaded into the local Certificate Store. This tool also provides us the capability to efficiently review what certificates have been loaded, and if the certificates have been loaded into the correct location. This means we have the ability to view the certificates that have been loaded as Trusted Root CAs, Intermediate CAs, and/or both (hmmm… that doesn't sound right).

Identifying a Trusted Root CA from an Intermediate CA

Identifying a Root CA from an Intermediate CA is a fairly simple concept to understand once explained. Trusted Root CAs are the certificate authority that establishes the top level of the hierarchy of trust. By definition this means that any certificate that belongs to a Trusted Root CA is generated, or issued, by itself. Understanding this makes identifying a Trusted Root CA certificate exceptionally easy to identify as the "Issued To" and "Issued By" attributes will always match.

Alternatively, an Intermediate CA is a Certificate Authority that builds upon the trust of some other CA. This can be either, another Intermediate CA, or a Trusted Root CA. Understanding this makes identifying an Intermediate CA certificate just as easy as the "Issued To" and "Issued By" attributes must be different.

To sum up a Trusted Root CA is issued by itself, while an Intermediate CA is issued by something else. Simple stuff, right?

Managing the Certificate Store

We know about remote site certificates, the certificate chain they rely on, the local certificate store, and the difference between Root CAs and Intermediate CAs now. But what about managing it all? On individual systems that are not domain joined, managing certificates can be easily accomplished through the same local Certificates MMC shown previously. In addition to being able to view the certificates currently loaded, the console provides the capability to import new, and delete existing certificates that are located within.

On a domain joined systems it is recommended to manage PKI at the enterprise level (which may explain why we named one of the MMC Enterprise PKI). This is done through the Group Policy MMC (gpmc.msc), and we would typically make the changes to a single policy linked at the domain level. Using this approach, we can ensure that all systems in the domain have the same certificates loaded and in the appropriate store. It also provides the ability to add new certificates and remove unnecessary certificates as needed.

Too Many Certs

On several occasions both of us have gone into enterprise environments experiencing authentication oddities, and after a little analysis trace the issue to an Schannel event 36885.

This event is caused by the number of certificates loaded into the computer's Trusted Root Certificate Authorities (TRCA) and Intermediate Certificate Authorities (ICA) stores. The most important part of the above warning is the following: "Currently, this server trusts so many certificate authorities that the list has grown too long. This list has thus been truncated." Unfortunately, here is what we don't know: Where was the list truncated, which certificate authorities did it grab, which certificate authorities did it NOT grab, and do I have all the certs that will be needed to build any of the given certificate chains for the requests that will be made?

At this point many of you are asking, "How many is too many?" The answer to this is it depends, as the limitation is based on the size of the store which is limited to 16 kilobytes and not the number of certificates.

In December 2012, KB931125 was released and intended only for client SKUs. However, it was also offered for Server SKUs for a short time on Windows Update and WSUS. This package installed all TRCAs enrolled in the Microsoft Trusted Root Program (more than 330). While we offer a fix it tool for individual systems here (https://support.microsoft.com/en-us/help/2801679/ssl-tls-communication-problems-after-you-install-kb-931125), this wasn't identified as an issue in several environments.

On a small scale, customers that experience certificate bloat issues can leverage the Certificate MMC to deal with the issue on individual systems. Unfortunately, the ability to clear the certificate store on clients and servers on a targeted and massive scale with minimal effort does not exist. On a larger scale, customers would be required to leverage the Microsoft built-in "Certutil" application via a script. This technique requires the scripter to identify and code in the thumbprint of every certificate that is to be purged on each system (also very labor intensive).

Introducing CertPurge

Overview of Script

CertPurge will remove all locally installed certificates from the Trusted Root Certification Authorities, Intermediate Certification Authorities, and Third-Party Root Certification Authorities stores on the local machine.   Only certificates that are being deployed to the machine from Group Policy will remain.

What it solves

The ability to clear the certificate store on clients and servers on a targeted and massive scale with minimal effort.  This is needed to handle certificate bloat issues that can ultimately result in authentication issues.  On a small scale, customers that experience certificate bloat issues can leverage the built-in certificate MMC to deal with the issue on a system by system basis as a manual process.  On a larger scale, customers would be required to leverage the Microsoft built-in "Certutil" application via a script. This technique requires the scripter to identify and code in the thumbprint of every certificate that is to be purged on each system (also very labor intensive).

How it works

CertPurge scans the following registry locations ("HKEY_LOCAL_MACHINESOFTWAREMicrosoftSystemCertificates" & "HKEY_LOCAL_MACHINESOFTWAREMicrosoftEnterpriseCertificates") and builds an array for all entries found under the Trusted Root Certification Authorities, Intermediate Certification Authorities, and Third-Party Root Certification Authorities paths.  CertPurge then leverages the array to delete every subkey.

Backout Mechanisms

Prior to performing any operations (i.e. building array, purging certificates), CertPurge generates a backup of the "HKEY_LOCAL_MACHINESOFTWAREMicrosoftSystemCertificates" & "HKEY_LOCAL_MACHINESOFTWAREMicrosoftEnterpriseCertificates" paths in their entirety into a .reg file stored in the c:windows directory.  In the event that required certificates are purged, an administrator can import the backup files and restore all purged certificates.  (NOTE:  This is a manual process, so testing prior to implementation on a mass scale is highly recommended).

Why certificates pushed via GPO are not affected

Certificates pushed via GPO are stored in the "HKEY_LOCAL_MACHINESOFTWAREPoliciesMicrosoftSystemCertificates" path.  As CertPurge does not target this location, all certificates deployed via GPO are unaffected.

What to do if not all required certificates are being published via GPO

KB 293781 details the certificates that are required for the operating system to operate correctly. Removal of the certificates identified in the article may limit functionality of the operating system or may cause the computer to fail.  Ensure at a minimum that these certificates are published via a GPO prior to implementing the CertPurge applicationscript.  If a required certificate (either one from the KB, or one specific to the customer environment) is purged, that is not being deployed via GPO, the recommended approach is as follows

1.       Restore certificates to an individual machine using the backup registry file,

2.       Leveraging the Certificate MMC, export the required certificates to file,

3.       Update the GPO that is deploying certificates by importing the required certificates,

4.       Rerun CertPurge on machine identified in step 1 to re-purge all certificates,

5.       Execute a GPUpdate on machine identified in step 1 to receive updated GPO certificate deployment,

6.       TEST!!!

7. Did we mention Test?

The Goods

CloseOut and Additional Resources

At this point, hopefully we all understand some of the basics, what a certificate chain is, the difference in a Root certificate and an Intermediate/Issuing certificate, and where those certificates should be located on our systems. Also, we now have a method for cleaning things up things in bulk should things get out of control and you need to rebaseline systems in mass. Let us know what you all think, and if there is another area you want us to expand on next.

Additional Resources:

https://support.microsoft.com/en-us/help/2464556/failed-tls-connection-between-unified-communications-peers-generates-a

https://support.microsoft.com/en-us/help/2801679/ssl-tls-communication-problems-after-you-install-kb-931125

https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/dn265983(v=ws.11)

Disclaimer

The sample scripts are not supported under any Microsoft standard support program or service. The sample scripts are provided AS IS without warranty of any kind. Microsoft further disclaims all implied warranties including, without limitation, any implied warranties of merchantability or of fitness for a particular purpose. The entire risk arising out of the use or performance of the sample scripts and documentation remains with you. In no event shall Microsoft, its authors, or anyone else involved in the creation, production, or delivery of the scripts be liable for any damages whatsoever (including, without limitation, damages for loss of business profits, business interruption, loss of business information, or other pecuniary loss) arising out of the use of or inability to use the sample scripts or documentation, even if Microsoft has been advised of the possibility of such damages.

Download CertPurge.ps1 here

By Matteo Emili, Visual Studio and Development Technologies MVP

I speak at several meetups and conferences throughout the year, and if you were to ask me to single out a feature of Visual Studio Team Services that I really think “it’s the best!”, it would almost be impossible to answer.

It’s not the same if you ask me about the best single “thing” though. Because there is something stands out, and it is not a single feature.

What I am talking about is the extreme flexibility and adaptability of the platform, so that you can use VSTS with literally any technology you want, to solve pretty much any business requirement. Java? NodeJS? C++? IoT? On-premise? Cloud? Kubernetes? Literally anything.

A great example is when, after a merge or acquisition, you need to on-board a new team. Maybe you are a fully committed and stable on VSTS, while the new team is a Java team which works on GitHub and builds somewhere else and has their backlog someplace else entirely (Trello?).

First of all, you can import any Git repository into VSTS or TFS – Git is Git regardless of who hosts it so your code can be swiftly imported in your platform.

Then you might face the headache of the ramp-up of a Java Build Server. In the meantime, did you know that Microsoft provides not one, but three Build Servers for you in the Hosted Build Agents?

These build servers are provided as a service, meaning that the only thing you need to do is to literally point them at the code repository.

Trello could be trickier, but while you figure out a plan to move the existing data across, you can always integrate with it: Service Hooks use APIs to dialogue with external systems, and VSTS has its own API too if you want to implement bidirectionality.

Much of the above (everything bar the Hosted Build) is also available on Team Foundation Server – which is the quarterly snapshot of VSTS brought back on-premise – so you can do most of it on-premise too. At the end of the day, technology should be functional to the business. If technology forces us to spend too much time on making it work, it becomes pretty much useless.

This post is co-authored by the Microsoft Azure Machine Learning team, in collaboration with Databricks Machine Learning team.

Introduction

Apache Spark is being increasingly used for deep learning applications for image processing and computer vision at scale. Problems such as image classification or object detection are being solved using deep learning frameworks such as Cognitive Toolkit (CNTK), TensorFlow, BigDL and DeepLearning4J, and integrated into Spark through libraries such as MMLSpark or TensorFlowOnSpark. However, until now, there hasn't been a common interface for importing images, or representing images in Spark DataFrames. Consequently, the different frameworks cannot easily communicate with each other or with core Spark components such as SparkML pipelines or Deep Learning pipelines. To overcome this problem, the Microsoft Azure Machine Learning Team collaborated with Databricks and the Apache Spark community to make images a first-class citizen in core Spark, based on existing industrial standards.

Importing and Representing Images in Spark DataFrames

An image processing and computer vision pipeline typically consists of the image import, preprocessing, model training and inferencing stages, depicted below.

To accurately represent an image throughout this pipeline, you need certain pieces of data:

• The pixel values that represent the image itself.
  
• Image resolution or bit depth, e.g. 8-bit, 16-bit, 32-bit and so on.
  
• Number and order of color channels, e.g. grayscale, RGB, CYMK, etc.
  
• Height and width of the image.
  
• Metadata about the origin of image, such as file system path.
  

Having all these bits of data is important. For example, pre-trained deep neural networks assume specific image size, normalization and order of color channels that matches what the model was originally trained against. A mistake here, and the accuracy of the model can suffer catastrophically. Therefore, it is important to have a consistent representation of image metadata throughout the machine learning pipeline.

The structure spark.ml.image.imageSchema is used to capture this information in standardized way. This makes it easy to build re-usable image pipelines that feed into different deep learning libraries, as well as efficiently use libraries such as OpenCV to pre-process images. The pixels are stored as uncompressed binary data, ensuring close-to-metal performance and low conversion overheads. The OpenCV convention is used to describe the bit depth and color channels of the image.

Formally, the schema is defined as:

StructType(,

StructField("origin", StringType, true) ::

StructField("height", IntegerType, false) ::

StructField("width", IntegerType, false) ::

StructField("nChannels", IntegerType, false) ::

StructField("mode", IntegerType, false) ::

StructField("data", BinaryType, false) :: Nil)

where "nChannels" is OpenCV-compatible type, and "mode" is OpenCV-compatible byte order.

The method spark.readImages lets you read images in common formats (jpg, png, etc.) from HDFS storage into DataFrame. Each image is stored as a row in the imageSchema format. The API is defined as:

readImages(,

path: String,

sparkSession: SparkSession,

recursive: Boolean,

numPartitions: Int,

dropImageFailures: Boolean,

sampleRatio: Double,

seed: Long)

The recursive option allows you to read images from subfolders, for example for positive and negative labeled samples. The sampleRatio parameter allows you to experiment with a smaller sample of images before training a model with full data.

The readImages API is available through MMLSpark library, together with additional methods for pre-processing images, or as a stand-alone reference implementation at spark-packages.org.

Example of Image Transformation Pipeline

This Jupyter notebook demonstrates how the image data can be read in, and processed within a SparkML pipeline. The following lines show how you can read in a collection of images as Spark DataFrames. Note how the readImages function appears as a member of Spark context, similar to spark.read.csv or spark.read.json. You can then inspect the schema and analyze the properties of your image dataset:

images = spark.readImages(IMAGE_PATH, recursive = True, sampleRatio = 0.1).cache()

images.printSchema()

print(images.count())

You can then extract the pixel data, and pass it to deep learning models for image classification and computer vision through Apache Spark Deep Learning Pipelines.

You can also apply MMLSpark's image transformations to resize and crop the images as pipeline stages. The transformed data can then be fed into, for example, a deep learning model to classify the images.

from mmlspark import ImageTransformer

tr = (ImageTransformer() # images are resized and then cropped

.setOutputCol("transformed")

.resize(height = 200, width = 200)

.crop(0, 0, height = 180, width = 180) )

smallImages = tr.transform(images).select("transformed")

You can use deep neural networks such as CNTK or TensorFlow to extract high-order features from the images and then pass them to SparkML machine learning algorithms, using the transfer learning approach.

featurizedImages = cntkModel.transform(smallImages).select(["features","labels"])

from mmlspark import TrainClassifier

from pyspark.ml.classification import RandomForestClassifier

model = TrainClassifier(model=RandomForestClassifier(),labelCol="labels").fit(featurizedImages)

The result is an end-to-end pipeline that you can use to read, preprocess and classify images in scalable fashion.

Next Steps

The image APIs have been recently merged to Apache Spark core and are included in Spark release 2.3. Try it out and send us your feedback. Also try the image preprocessing functionality in the MMLSpark library.

ML Blog Team