What is Azure Active Directory Enterprise State Roaming?

In today’s Ask the Admin, I’ll walk you through Microsoft Azure’s new Enterprise State Roaming (ESR) feature, which was made available as a preview in early February for customers with an Azure Active Directory Premium subscription.

If your organization uses Azure Active Directory (Azure AD), or Azure AD and Windows Server Active Directory, Enterprise State Roaming brings the ability to sync user settings and Universal Windows Platform (UWP) app data between devices, much like what is provided today in Windows 10 by using a Microsoft Account and OneDrive.

Azure AD is the directory services cloud-based sibling of Windows Server Active Directory that provides a subset of AD’s features to customers in the cloud. ESR can be used in conjunction with Azure AD to provide the benefits of synchronized settings, as enjoyed by consumers using Microsoft Accounts, but with the extra security required by business. For more information, see What is Azure Active Directory? and Join Windows 10 to Azure Active Directory on the Petri IT Knowledgebase.

Unlike consumer synchronization capabilities in Windows, Enterprise State Roaming gives organizations the control needed to make sure data stays safe, and separated from consumer account data. ESR settings and app data are stored in an Azure region that’s selected based on the country associated with the Azure Active Directory tenant, and ESR provides control and visibility over who is syncing what.

ESR uses Azure Rights Management (Azure RMS) to ensure that data is encrypted before it leaves Windows 10, and remains encrypted when at rest in the cloud, with the exception of namespaces that represent ‘settings’ names and UWP apps. A separate subscription for Azure RMS isn’t required to use Enterprise State Roaming.

Windows 10 devices — Version 1511, Build 10586 or greater — joined to Azure AD can still have Microsoft Accounts, but OS settings and app data will only roam with the primary Azure AD account, although Microsoft plans to add multiple identity support in a future version of Windows 10. Equally, logging in to a personal device using a Microsoft Account doesn’t support synching of roaming data for apps purchased using an Azure AD account.

Enable ESR in Azure Active Directory

To enable Enterprise State Roaming, follow the instructions below.

• Log in to the Azure management portal.
• Scroll down the menu on the left and click Active Directory.
• Select a directory on the right and switch to the CONFIGURE tab.
• If your region and subscription support ESR, you’ll see USERS MAY SYNC SETTINGS AND ENTERPRISE APP DATA under the available settings.
• From there you can select ALL, SELECTED or NONE, which is the default setting.

ALL allows you to enable ESR for all users, and SELECTED allows you to choose specific users or groups.

• Once you’ve picked the desired setting, click SAVE.

User synchronization settings can be set under Accounts in the Windows 10 Settings app.