Consumerization of IT at Microsoft:

Adapting to Change Published March 2014

The following content may no longer reflect Microsoft’s current position or infrastructure. This

content should be viewed as reference documentation only, to inform IT business decisions

within your own company or organization.

Microsoft IT is embracing the consumerization of IT. The trend is spurring

substantial investment at Microsoft in the areas of devices, identity,

applications, and social experiences.

Strategy

Microsoft is an environment of change, with the latest software and hardware advances constantly

pushing the boundaries of corporate IT’s charter. To effectively manage both users’ expectations

and the mandates of information security, Microsoft IT needed to develop a programmatic

approach to technology adoption—one that would foster innovation without increasing risks by

introducing uncontrolled technologies. This is particularly true when considering the impacts of

trends in Bring Your Own Device (BYOD) scenarios.

MSIT’s assumption is that employees do their best work when using the devices they love, and

that allowing greater flexibility in the methods of access to information helps employees be more

productive. Thus, Microsoft’s internal investments in Consumerization of IT have focused on

delivering solutions centered on the desires of our end-users, and on delivering the usability they

are requesting. Through multiple efforts across the four key CoIT categories, Microsoft

implemented practices to enhance individual productivity with developments in Internet access,

remote access, and LOB application experiences.

2 | Consumerization of IT at Microsoft: Adapting to Change

Executive Overview

Microsoft Information Technology (Microsoft IT) manages the infrastructure, applications, and services

across the global operations of Microsoft. At Microsoft IT, we began to see a shift in how employees

were accessing corporate resources. As in other IT organizations around the world, an increasing

number of users were bringing their own devices, Internet identities, applications, and social networks

with them to work. Moreover, these entities were being linked to Microsoft systems in a way that

simultaneously let employees conduct work on personal devices and engage consumer services from

company-owned systems. We call this shift the consumerization of IT.

These changes have influenced employees’ daily lives, enabling a comingling that at once improved

productivity and efficiency. These changes also assisted in developing a better balance between home

and work. In addition, new product launches of Windows Phone and Microsoft Surface devices in

2012 meant that employees were rapidly adopting a new generation of company-owned

smartphones and tablets. These products introduced myriad applications and services designed for

mobile platforms. The fast-moving business environment at Microsoft pushed users to seek new

collaboration tools and communication methods that integrated with personal social networking

technologies.

This case study provides an overview of how Microsoft is adopting initiatives for the consumerization

of IT, along with trends and benefits.

Opportunities in the Consumerization of IT

The driving force behind the consumerization of IT is to encourage and enable employees’

productivity by using whichever portable and mobile devices they prefer to use. Providing such a

work environment at Microsoft is a top priority as we seek to empower users in a rapidly changing

business. We believe that the benefits of the consumerization of IT can be measured in terms of end-

user productivity gains and better control of work versus personal demands.

The New IT

There are numerous definitions for the consumerization of IT across the industry. In 2011, after

extensive research, Microsoft IT developed an approach and strategy for the consumerization if IT. We

defined it around four primary categories with which to evaluate industry needs and developments.

Table 1 defines these categories.

Table 1. Categories of the consumerization of IT.

Category Definition

Devices

Individuals expect to use personal devices to gain access to work data and

applications.

Identity Identity spans both personal and work experiences, enabling access to

enterprise resources through consumer identities.

Applications Consumer applications exist in the enterprise, and business applications

exist on employees’ personal devices.

Social experiences Social experiences exist for collaborating and for augmenting line-of-

business (LOB) applications.

Industry View

The major industry trends associated with the consumerization of IT provide an overview of the

pressures on enterprise IT groups from consumer technologies.

3 | Consumerization of IT at Microsoft: Adapting to Change

4 | Consumerization of IT at Microsoft: Adapting to Change

Devices

Smartphones achieved a major milestone in 2012: For the first time in history, the number of devices

sold worldwide exceeded the number of PCs sold. With this growth, enterprises will continue to see

user demand for access to corporate resources from personal devices.

Industry research shows that adoption of personal devices for work-related usage (sometimes called

“Bring Your Own Device” or BYOD) has been steadily increasing and is now at an all-time high. For

example, almost 100 percent of Microsoft employees have at least one companion device that they

use to read and compose email from both work and personal accounts.

Identity

Many businesses employ identity federation (the sharing of identities across organizational

boundaries) as the method to enable collaboration between entities. But deployment is time-

consuming and requires IT organizations to establish trusted relationships with one another. We are

now seeing demands for simpler methods to authenticate users from modern devices that still meet

corporate requirements.

For example, entering a 20-character password along with a domain\username combination is not a

good experience on a small-screen phone. Users need alternatives for authentication on personal

devices, because today’s smart cards do not work with phones or tablets. In addition, we believe that

more organizations will view consumer identity providers (such as Google, Yahoo!, Facebook, and

Microsoft) as not only acceptable, but preferred as the authentication method to gain access to

certain business functions.

Applications

The primary opportunities in the application category are the expected growth in LOB marketplaces

and the use of consumer applications in the enterprise. The use of consumer applications in the

enterprise can increase by users’ choices or by being embedded in enterprise products.

Industry players—including Amazon, Microsoft, Google, and Salesforce—recognize the consumer

trends around mobile marketplaces (for example, Microsoft Windows Store or Google Play). These

companies are delivering application store platforms and ecosystems to bring compelling value to

end users. As new mobile devices join work environments, enterprises will want to distribute LOB

applications to users through the same model. We expect to see continued interest in the

development of such marketplaces, and in the guidance for businesses to implement their own

application stores.

In addition to the blurring between consumer and business purchasing mechanisms, we are seeing

increased integration of consumer applications and services with enterprise software. However,

businesses must educate employees about proper usage. Security controls are not readily available

for these types of consumer services. Corporate IT groups generally do not have jurisdiction to

control them, either. Essentially, this end-user empowerment means that users wield greater control

over, and greater responsibility for, the actions that they take on company-owned data.

Social Experiences

The continued massive growth of Facebook, Twitter, and other social media environments is leading

to a convergence of social experiences in classic software applications. Early evidence shows that

users appreciate when social and mobile usage is combined with search, email, and LOB applications.

These developments are inspiring enterprises to foster such experiences in order to benefit from the

social phenomenon. These enterprises anticipate increased productivity resulting from greater sharing

and collaboration within their organizations.

5 | Consumerization of IT at Microsoft: Adapting to Change

Understanding the Consumerization of IT at Microsoft

The approach to the consumerization of IT at Microsoft centers on delivering solutions that deliver

the usability that users want.

Our assumption at Microsoft IT is that employees do their best work when they are using the devices

that they love. So allowing greater flexibility in the methods of access to information helps employees

be more productive. This provides the business impetus for giving employees varied options to use

devices and applications in the way that suits them best. The choice of personal device also enables

employees to more effectively balance work and life demands. And it increases user satisfaction with

their work environment.

We completed an internal in January 2013 that gauged Microsoft employees’ usage of personal

tablets. Figure 1 shows the results of the January 2013 tablet survey.

Figure 1. Number of hours per week that employees spent doing work with a personal tablet.

Excluding the most advanced users, 56 percent of Microsoft employees said they used their personal

tablet for up to 10 hours per week for work-related tasks. At the other end of the spectrum, 17

percent said they did not want to use their tablet for work at all. Those employees most commonly

cited a preference to keep their personal and work tasks separate.

The survey also detailed what work employees were doing with their devices. Figure 2 provides survey

results of replies to the question "How important is it to you to be able to do the following activities

on your tablet?" Results like these help us understand what employees want.

5–10 hours per week29%

5 hours or less per week

27%

More than 10 hours per week

27%

Not likely / not at all

17%

6 | Consumerization of IT at Microsoft: Adapting to Change

Figure 2. Activities that employees want to perform on their tablets.

In line with our expectations and investments, the top three tasks that employees identified included

surfing the Internet, accessing email, and viewing Microsoft Office files or PDFs.

As an example of the overall approach to the consumerization of IT at Microsoft, we focused on these

areas by making it easier for employees and business guests to connect wirelessly to the Internet via

MSFTOPEN. MSFTOPEN is a wireless guest network that is similar to a public hotspot. It helps

encourage productivity while helping to prevent unknown devices from joining the main corporate

wireless network.

The fundamental goal was to deploy a basic infrastructure that would support simplified, security-

compliant access to the Internet from mobile endpoints (personal phones, tablets, and laptops) on

internal networks.

In Review: Microsoft IT Investments

We have implemented practices to enhance individual productivity through measured programs and

support. These investments are in the areas of Internet access, remote access, and LOB application

experiences.

Devices

Most full-time Microsoft employees have a Windows 8 phone as well as a Microsoft Surface RT tablet,

yielding an IT-provided device-to-person average ratio of 2:1. And although other device types at

Microsoft will not grow significantly, employees, business guests, and vendors on the network are

using other technologies such as Android, Apple iPad, Kindle Fire, Windows 8–based computers, and

Microsoft Surface Pro.

0%

10%

20%

30%

40%

50%

60%

70%

80%

90%

100%

7 | Consumerization of IT at Microsoft: Adapting to Change

Recent improvements in Windows-based devices, such as device encryption, mean that modern tablet

designs and phones will see greater security controls. These controls will make them better suited to

access the Microsoft corporate network.

We expect individuals to continue using non-corporate devices for access to consumer-level and

enterprise-level applications and services—from both on and off the corporate network. Users

increasingly want to be productive with these personal devices. This productivity takes advantage of

the broad range of mobile client software that is now available for cloud applications (such as

Microsoft Lync communications software and Microsoft SkyDrive storage technology).

Core Device Scenarios

Our goals include enabling users to be more productive with enterprise information, communication

services, and business tools. The adoption of mobile devices, therefore, leads to a set of use cases.

Each employee or guest needs to:

Easily access the Internet wirelessly.

Use a device to access email, calendar, and contacts.

Use a device to access Microsoft Office files.

Easily identify how to enroll in “light management” experiences.

Enroll in data governance mechanisms to gain greater levels of access (virtual private network

[VPN] or corporate applications).

Access applications that were typically used only from IT-provided computers via Remote

Desktop.

Investments and Progress

Microsoft IT has undertaken a number of projects to bring the preceding scenarios to life.

We deployed MSFTOPEN at scale for business guests and employees to use with their personal

devices, while still maintaining the security and integrity of corporate data. MSFTOPEN is operational

across Microsoft buildings in the Puget Sound region. A focus on broader deployment to other US

and worldwide offices is under way.

We partnered with the Microsoft System Center product team to define the concept of a “light

management” scenario” and improve multiple-device management capabilities. The latter task

included implementing health validation capabilities such as machine certificates, security policy,

device encryption, monitoring, and logging. These efforts also enabled both employee-owned and

managed devices to access resources on the corporate network.

In addition, working with the Windows Division, we helped develop a VPN client for Windows RT to

enable remote access. We have invested in the VPN infrastructure to accommodate greater scalability

for an increasing number of user devices.

Identity Providers and Consumer Identity Providers

The technology industry is moving toward accepting identity credentials from multiple providers—

instead of strictly corporate directory services—for accessing data and applications. This acceptance

will apply to federation agreements with business partners, consumer identities for public services (for

example, marketing event sites), and online service offerings.

At Microsoft IT, we must provide clear guidance for acceptable usage to internal developers and

product teams when we are integrating such public services with the Microsoft implementation of

Active Directory Domain Services (AD DS) or other corporate online services. In the near term, this

mandate requires us to develop an inventory of identity providers, and then categorize the providers

into levels of assurance and acceptable usage for various levels of data privacy for resources at

Microsoft.

8 | Consumerization of IT at Microsoft: Adapting to Change

Core Identity Scenarios

As with mobile devices, we developed several key use cases for authenticating to different identity

mechanisms.

In the first group, end users need access to LOB applications and services through a simple solution

that is appropriate for a variety of modern devices, such as tablets and smartphones. In addition,

users need corporate access services (for example, VPN or Remote Desktop Gateway) which use

virtual smart cards or other form factors that are appropriate for strong security.

In the other group, developers must be able to easily build applications that accept an authentication

solution for modern devices. The authentication solution must be able to validate device health and

user claims to determine appropriate levels of access. This use case includes new and compelling

scenarios for applications by using social graph information from different Microsoft online services.

Investments and Progress

Our investments have focused on building a virtual smart-card provisioning service for Surface RT and

Windows 8–based client computers. In addition, we drafted formal guidance for the appropriate

usage of consumer identities for Microsoft business needs.

Applications

As one of the higher priorities for investments, applications represent the largest change in thinking

from prior strategies. Previously, we focused on proper access to consumer applications, and enabling

remote access to existing applications in the enterprise via either web publishing or Terminal Services

solutions. The assumption was that keeping applications on the internal corporate network without

exposing them to the Internet would be the most secure approach. Access required users to transit

via VPN or Terminal Services publishing connections.

However, recent research has shown increased protection by enabling enhancements in application

development so that more sensitive applications (for example, applications that access Human

Resources information) can enforce appropriate security controls. These enhancements will, in turn,

validate device and user attributes that allow applications to make authorization decisions instead of

having an infrastructure service make access decisions on their behalf.

To be a leader in this area and an example to customers, Microsoft IT must itself seek to publish these

sensitive applications to employees’ consumer devices. We must also encourage product teams to

deliver aligned capabilities. We are currently defining this application design model, and future

investments will focus on developing architectures and standards that are related to this approach.

Core Application Scenarios

The primary audience for these more compelling mobile applications and experiences is, of course,

the end user. Microsoft employees need to access sensitive information—such as personal

employment data or healthcare data—wherever they may be. They need access not just from a web

browser on a laptop, but from personal devices at remote locations.

Thus, developers need to be able to:

Build applications that make authorization decisions based on user and device attributes.

Access repeatable guidance and reference architectures to accelerate the development of

applications for modern devices.

Have one process for submission of applications to LOB marketplaces for Windows, Microsoft

Office, and Windows Phone.

An additional community, security professionals, must review and confirm that LOB applications have

the right level of security controls to permit access while helping to protect the applications and

corporate data.

9 | Consumerization of IT at Microsoft: Adapting to Change

Investments and Progress

Our investments have focused on developing a company hub application (an application that equates

to the corporate intranet portal) on Windows Phone. Our investments have also focused on providing

guidance for developers to produce compatible modern applications that can display certain sensitive

data on personal devices, and broader information on corporate devices or corporate-connected

devices.

In addition to the company hub, Microsoft IT delivered pilots for application publishing via Terminal

Services. These pilots demonstrated how the mechanism is an effective solution that provides good

segmentation of security boundaries.

Social Media

In 2012, Microsoft acquired social networking service Yammer. The direction in the industry is that

social experiences and capabilities will become integrated with enterprise applications and services

such as Microsoft Office, Windows, and Microsoft Office 365 hosted productivity software. Product

groups within Microsoft are moving the same direction.

From an enterprise perspective, it is interesting to have software with built-in social capabilities. But

the real value of social experiences will occur when social capabilities are integrated across LOB

applications in addition to packaged products and services.

Core Social Scenarios

We carefully consider how users interact with peers and information through social services. And we

realize the importance of fostering communications without impeding productivity, and without

risking exposure to information leakage, trademark and brand reputation issues, or patent and

copyright issues.

The steps that we are taking center on:

Enabling users to collaborate with internal and external users, share data, and participate in

conversations easily and securely.

Enabling users to access media content on personal devices for training, education, and business

purposes.

Enabling developers to build applications with social experiences in mind.

Investments and Progress

The focus so far has been on providing education and awareness to employees regarding acceptable

use of social media and networks. With the Microsoft acquisition of Yammer, we are also focused on

proofs-of-concept for external network collaboration along with new forms of user-empowered

governance for these social communities.

Future Efforts

To determine further investments in the consumerization of IT, Microsoft identified goals for

providing rich experiences while allowing personal devices and services to be used inside the

company. Indeed, to provide leadership to the industry, Microsoft had to re-envision how its own

users could consume emerging technologies through simplified, consistent mechanisms.

The basic strategy for enabling the use of personal devices and services in Microsoft is to build on

what we defined as the Variable User Experience (VUE) concept. Figure 3 illustrates the concept. The

idea is simple: gaining access to application and data resources requires validation of the user, device,

and location.

10 | Consumerization of IT at Microsoft: Adapting to Change

Figure 3. VUE concept.

We believe that in the future, employees will use their own devices for accessing LOB applications

natively, without going through additional steps for connectivity (for example, VPN or Terminal

Services).

In the short term, our investments in consumerization of IT will focus on enabling productivity

through enhanced experiences on modern devices:

Device management and registration across multiple platforms

Delivery of “showcase” modern LOB applications on employees’ personal devices

Remote connectivity to corporate desktops to enable user productivity from personal devices

Security-compliant synchronization of data across multiple devices

Summary

We see a great opportunity to accelerate the adoption of the consumerization of IT at Microsoft. We

also see a great opportunity to provide guidance to the industry by enabling our own users to access

both work and personal resources from the devices that they prefer. The consumerization of IT is

important to Microsoft employees who want to save time and be more efficient. We estimate that, on

average, Microsoft will see a benefit of an additional hour in employee productivity each week.

We recently defined a longer-term strategy for consumerization at Microsoft. And we initiated a

number of proofs-of-concept and pilots to deliver experiences where users can be productive on

personal devices. Collaboration between Microsoft product groups to align consumerization scenarios

and use cases across multiple products and services will benefit our customers in the future by

providing new ways to take advantage of innovative technologies.

We will continue our investments in enabling the use of personal devices for LOB applications, with

integrated identity and social experiences.

11 | Consumerization of IT at Microsoft: Adapting to Change

For More Information

For more information about Microsoft products or services, call the Microsoft Sales Information

Center at (800) 426-9400. In Canada, call the Microsoft Canada Order Centre at (800) 933-4750.

Outside the 50 United States and Canada, please contact your local Microsoft subsidiary. To access

information via the World Wide Web, go to:

http://www.microsoft.com

http://www.microsoft.com/microsoft-IT

© 2014 Microsoft Corporation. All rights reserved. Microsoft, Active Directory, Lync, Office 365, SkyDrive,

Surface, and Windows are either registered trademarks or trademarks of Microsoft Corporation in the

United States and/or other countries. The names of actual companies and products mentioned herein

may be the trademarks of their respective owners. This document is for informational purposes only.

MICROSOFT MAKES NO WARRANTIES, EXPRESS OR IMPLIED, IN THIS SUMMARY.