
close
close
Chance to win $250 in Petri 2023 Audience Survey
In today’s Ask the Admin, I’ll walk you through Microsoft’s Azure Active Directory Enterprise State Roaming (ESR) feature, which is available for customers with an Azure Active Directory Premium subscription.
If your organization uses Azure Active Directory (Azure AD), or Azure AD and Windows Server Active Directory, Enterprise State Roaming brings the ability to sync user settings and app data between devices, much like what is provided in Windows 10 by using a Microsoft Account and OneDrive.
Sync your settings in the Windows 10 Settings app with Azure Active Directory Enterprise State Roaming (Image Credit: Russell Smith)
Azure AD is the directory services cloud-based sibling of Windows Server Active Directory. It provides a subset of AD’s features to customers in the cloud. ESR can be used in conjunction with Azure AD to provide the benefits of synchronized settings, as enjoyed by consumers using Microsoft Accounts, but with the extra security required by business. For more information, see Join Windows 10 to Azure Active Directory on the Petri IT Knowledgebase.
Unlike consumer synchronization capabilities in Windows, Enterprise State Roaming gives organizations the control needed to make sure data stays safe, and that it is separated from consumer account data. ESR settings and app data are stored in an Azure region that’s selected based on the country associated with the Azure Active Directory tenant, and ESR provides control and visibility over who is syncing what.
ESR uses Azure Rights Management (Azure RMS) to ensure that data is encrypted before it leaves Windows, and that it remains encrypted when at rest in the cloud, with the exception of namespaces that represent ‘settings’ names and modern Windows apps. A separate subscription for Azure RMS isn’t required to use Enterprise State Roaming.
Windows 10 devices – Version 1511, Build 10586 or greater – joined to Azure AD can still have Microsoft Accounts. But OS settings and app data will only roam with the primary Azure AD account, although Microsoft plans to add multiple identity support in a future version of Windows. Equally, logging into a personal device using a Microsoft Account doesn’t support synching of roaming data for apps purchased using an Azure AD account.
To enable Enterprise State Roaming, follow the instructions below.
ALL allows you to enable ESR for all users, and SELECTED allows you to choose specific users or groups.
User synchronization settings can be set under Accounts in the Windows 10 Settings app.
More in Microsoft Azure
Azure Native New Relic Service Provides Full Stack Observability To Boost Digital Transformation
Jan 25, 2023 | Rabia Noureen
Microsoft to Roll Out EU Data Boundary Plan for Cloud Services on January 1
Dec 15, 2022 | Rabia Noureen
Most popular on petri