LESSON 5: COMPENSATION AND BENEFITS

Understand all the things that must be considered when designing a compensation and benefits package.

LESSON 6: EMPLOYEE HEALTH AND SAFETY

Learn the ins and outs of complying with OSHA, protecting against workplace hazards, and investigating, recording, and preventing accidents and employee illnesses.

LESSON 7: THE LEGAL ENVIRONMENT

Gain knowledge of employment law as well as an understanding of equal employment opportunity, avoiding discrimination, and what happens when an employee files an EEOC claim.

LESSON 8: MAKING HR DECISIONS

Learn how to make decisions based on various company growth strategies and how to use HRIS Software as well as job analysis as a tool for decision-making.

LESSON 9: AFFIRMATIVE ACTION

Learn the full spectrum of affirmative action, how to create an affirmative action plan, and information on the AAP you will need to know.

LESSON 10: DIVERSITY

Understand what diversity is and why it is a good thing in an organization as you learn to manage it and handle conflict.

LESSON 11: EMPLOYEE RIGHTS AND DISCIPLINE

Learn the laws that protect employee rights and privacy and how to properly monitor and document behavior and discipline employees.

LESSON 12: TERMINATION

Understand the alternatives to firing as well as how to prepare for termination including proper separation agreements as well as what to do in the event of wrongful discharge.

LESSON 13: INVESTIGATIONS

Learn why it is so important to investigate problems as well as the steps of an effective investigation including preparing, conducting, and wrapping it up.

LESSON 14: MANAGING LABOR RELATIONS

Get a quick overview of the history of unions as you learn how they work and why employees join them.

LESSON 15: CREATING A HIGH-PERFORMANCE WORKPLACE

Learn how to ask employees for input and act on it, delegate authority, keep communication open, and continuously ask for feedback as you strive to develop a high-performance workplace.

LESSON 16: GLOBAL HUMAN RESOURCES

Understand the basics of staffing strategy, cultural differences, HR in other countries, choosing global employees, and issues faced by expatriates.

LESSON 17: RETENTION

Learn the top reasons employees leave a company and how you can encourage them to stay as well as the importance of succession planning.

LESSON 18: MOTIVATION, REWARDS, AND RECOGNITION

Find out fun ways to motivate workers and gain nine strategies for creating a great rewards program.

LESSON 19: PREPARING FOR THE PHR EXAM

Gain information on externships and internships as you review the basics of the PHR exam and begin to study.

Formerly known as Microsoft Operations Manager v3, System Center Operations Manager 2007 provides end-to-end event, service and application monitoring and reporting.

The platform supports Service Model Language (SML) for monitoring IT and software services -- required for service-level agreements -- and features audit collection services for compliance auditing and a customizable reporting tool.

At the Microsoft Management Summit, which started Tuesday in San Diego, the Redmond, Wash., software giant also announced a technology licensing agreement with EMC that will bolster the network management capabilities of System Center Operations Manager 2007. As part of the deal, Microsoft said it will integrate EMC's Smarts network discovery and health monitoring software into a future version of Operations Manager.

In addition, Microsoft, EMC and Cisco unveiled a pact to develop a set of network common models that exploit the SML to simplify network management. As part of the arrangement, the companies have submitted SML -- which is based on Microsoft's System Definition (SDM) Model -- for adoption as a standard to the W3C. That would allow partners and customers to manage software and hardware, as well as Windows systems, on the System Center platform.

Operations Manager 2007 is just one of several System Center products Microsoft is preparing for release this year.

System Center Configuration Manager 2007, formerly referred to as Systems Management Server v4, is scheduled to ship this summer. To add more value to the software configuration and deployment platform, Microsoft plans to roll out an add-on for Configuration Manager 2007 after it ships that will support Intel's next-generation vPro client management technology, code-named Weybridge, which is also due for a midyear release.

Microsoft also highlighted its progress in virtualization, backup and service management.

System Center Virtual Manager, formerly code-named Carmine, will move into Beta 2 testing in the next 45 days, the company said. And the second version of System Center Data Protection Manager -- which will provide backup and recovery for SharePoint 2007, Virtual Server 2005, Windows XP and Windows Vista -- will move into Beta 2 testing in the next 30 days.

Microsoft also announced System Center Service Manager, the formal name of its former Service Desk offering, and said plans to release the first beta in the next 30 days.

In addition, Microsoft announced an update for partners and customers awaiting Systems Management Server Service Pack 3. SMS Service Pack 3 with AssetMetrix software asset-management capabilities will be released to manufacturing this spring, the company said.

Central to the SNA network is the SNA server, which is responsible for performing connections between local and remote hosts on a local area network (LAN).

Note:   An unqualified reference to Windows means all Windows platforms - Windows NT, Windows 95, Windows 98, and Windows 32s.  

Network Administrator

To set up an SNA network perform the following tasks:

1. Install the SNA server.
2. Configure the SNA server.
3. Configure SNA clients.
4. Optionally configure Host Account Synchronization Service. For details about installing this service, see Microsoft SNA Server Getting Started and Installing and Configuring Host Security Integration.

You install and configure the SNA server on a Windows NT computer, and you configure SNA clients on any of three Windows platforms: Windows NT, Windows 32s, Windows 95, and Windows 98. After the SNA server and the SNA clients are installed and configured, users of SAS/CONNECT and SAS/SHARE can make connections transparently from their local hosts to the remote hosts that they want by using the SNA server.

The following figure shows an SNA network.

Typical SNA Network Configuration

It is assumed that you already have completed installation of the SNA server product. Before you can configure the SNA server, verify that the following tasks have been completed.

1. Install the appropriate drivers (for example, 802.2 Token Ring, Ethernet, or X.25).
2. Select the appropriate networking protocols (for example, DLC for LAN).
3. Install the SNA Server link services.

   Link services define the protocol that is used between the SNA Server software and the communications adapters installed in your computer (for example, 802.2 Token Ring, Ethernet, SDLC, or X.25).

   If the setup program detects more than one network operating system on your computer, you must specify which systems you are using (for example, Microsoft LAN Manager, Novell Netware, or both).

After you have installed the SNA server and link supports, use the SNA Server Administration Program (SNA Server Admin) to perform the following tasks:

1. Configure the server.
2. Specify connections.
3. Configure Logical Units (LU) (local and remote).
4. Define LU-to-LU pairs and modes.

Configuring the Server

Configure the SNA server by specifying the local Network Name and Control Point Name.

Specifying the Connection Name

Specify the connection name (for example, 802.2 Token Ring, SDLC, or X.25) and other properties that are appropriate to your configuration.

Connection properties are the software components of the SNA server that communicate through the device driver to a particular communications adapter.

Configuring Logical Units

Perform the following steps to configure the desired number of logical units:

1. Configure the desired number of local logical units (LUs) to be used.

   An LU may be dependent or independent. An LU's ability to perform dependently or independently in a SAS/CONNECT remote host session is based on the communications software that your network uses.

   SAS/CONNECT can use either a dependent or an independent LU. If you are using dependent LUs, you must have one dependent LU defined for each concurrent remote session established by the local session. A single independent LU allows multiple concurrent SAS/CONNECT sessions.

   SAS/SHARE requires an independent LU. When using Remote Library Services (RLS), SAS/CONNECT also requires an independent LU.

2. Configure the desired number of remote logical units (LUs) to be used.

   You must define all remote LUs to the SNA Server because the Microsoft SNA Server does not support end node (EN) Advanced Peer-to-Peer Networking (APPN) capabilities. You must also define remote (or partner) LUs to connect to a remote host with SAS/CONNECT or to access a SAS/SHARE server.

   When defining a remote LU for an MVS remote host in a SAS/CONNECT session, you must also account for the LU pooling capabilities of the remote MVS SAS session so that appropriate surrogate LUs are defined to the SNA Server.

   Your options for defining remote LUs follow:

   • If using the APPC access method, you may assign a specific LU to the APPC_SURROGATE_LUNAME variable. For information about the APPC_SURROGATE_LUNAME variable, see SAS/CONNECT Only Options. In this case, you must define this remote LU to the SNA server.
   • You may allow the remote OS/390 session to supply an LU from a pool of LUs. Although you do not need to assign a value to APPC_SURROGATE_LUNAME, you must define to the SNA server all possible MVS LU names that reside in this surrogate LU pool.
   • Instead of defining surrogate LUs to the SNA server, you may configure the local LU to accept Implicit Incoming Remote LUs.

Defining LU-LU Pairs and Communications Mode Properties

Define the local LU-remote LU pairs, and specify the properties of the communications mode to be used between each pair.

If site-naming conventions permit, specify the mode name SASAPPC. The APPC access method uses this mode name if the APPC_LU62MODE variable has not been defined. See SAS/CONNECT and SAS/SHARE Options for information about setting APPC_LU62MODE.

Specify the minimum contention-winner parameter, which is relevant for SAS software because only contention-winner sessions are used for locally initiated communication.

Communication between SAS/CONNECT local and remote hosts requires only one contention-winner session. However, this limit affects the number of data sets that can be accessed concurrently by means of the SAS/CONNECT Remote Library Services or a SAS/SHARE server.

When defining session limits, define enough sessions so that session limits will never be reached. If session limits are reached, the next time a user attempts to connect to a remote host with SAS/CONNECT or a client host attempts to access a SAS/SHARE server, the APPC layer will not return to the application layer until a session is available. Although a lengthy wait may seem like an error condition (such as no response from SAS or a loop), the underlying APPC layer is waiting for a session to become available.

You have completed the configuration of a Windows NT SNA server.

Client configuration tasks are based on the platform on which the client is running:

• Windows NT
• Windows 95
• Windows 98
• Windows 32s.

Tasks for configuring a Windows NT, a Windows 95, and a Windows 98 client are identical.

Configuring a Windows NT, a Windows 95, or a Windows 98 Host as a Local Host or a SAS/SHARE Client

Use the SNA Server Client Setup Program to configure Windows NT, Windows 95, and Windows 98 clients.

This section highlights the general tasks that you perform to configure an SNA client. For complete details, see the Microsoft SNA Server Installation Guide and the Microsoft SNA Server Administration Guide. (Contact the Microsoft Corporation for information about this documentation.)

Perform the following tasks:

1. Identify the transport (for example, client/server protocols) for communication with the SNA server (e.g., TCP/IP, Named Pipes, or IPX/SPX).
2. Specify the network domain in which a server can be located so that data can be routed to it over a local area network (LAN).
3. Specify client mode (local or remote).

If you intend to use the Windows NT, Windows 95, or Windows 98 computer strictly as a local host connecting to a remote host in a SAS/CONNECT session or as a client accessing a SAS/SHARE server, you have successfully completed the configuration process.

Configuring a Windows NT, a Windows 95, or a Windows 98 Host as a Remote Host or as a SAS/SHARE Server

If you intend to use either of these computers as a remote host for a SAS/CONNECT session or as a SAS/SHARE server, you must perform additional configuration tasks.

1. Configure TPs (transaction programs) that can be invoked.

   You may execute a program named TPSETUP.EXE, which was supplied by Microsoft and enhanced by SAS Institute, to configure and modify TP properties. Running the program automatically adds entries to the registry, which is a configuration file.

   For Windows NT, the TPSETUP.EXE program is located at !sasroot\CORE\WINNT\TPSETUP.EXE. For Windows 95 and Windows 98, the TPSETUP.EXE program is located at !sasroot\CORE\WIN95\TPSETUP.EXE.

   The TPSETUP.EXE command with arguments follows:

   TPSETUP <-TP TP-name> <-CMD 'SAS-command-line'>

   where:

   -TP TP-name

   specifies a transaction program. Two TPs are provided: SASRMT and SASTP62. See SASRMT Transaction Program and SASTP62 Transaction Program for more information about these programs.

   -EDIT

   allows you to modify an existing -TP entry in the registry. The TP configuration dialog window opens, showing previously entered TP properties. Omission of the -EDIT argument invokes an empty dialog window, where you define properties.

   -LU local-LU-alias

   is the client's alias for the local-LU that you configured at the SNA server. The assignment of a local-LU-alias to a specific Windows NT, Windows 95, or Windows 98 client allows the SNA server to route the incoming request for attachment (ATTACH) to the appropriate client computer by alias name. The SNA server checks each client's configuration file for its local-LU-alias to determine where to route the request. If you are going to define SASTP62 and would like more than one remote window host, you must specify the local-LU-alias.

   -CMD command-line

   specifies a command that automatically executes SAS at the remote host when a local host connects to it in a SAS/CONNECT session. A command line is required only when you have defined the SASRMT transaction program.

SASTP62 Transaction Program

For Version 7 and later, the APPC access method performs dynamic TP naming which automatically generates the SASTP62 TP definition for you.

Note:   Dynamic TP naming is only available when communicating between two Version 7 (or later) sessions.  

For Version 6.12 and earlier, you must still define a SASTP62 transaction program at the host where a SAS/SHARE server will be executing or where a remote SAS/CONNECT session will be established.

To define the SASTP62 transaction program in the registry, specify the following command:

TPSETUP -TP SASTP62

SASRMT Transaction Program

You must define a SASRMT transaction program at the host where a remote SAS/CONNECT session will be established.

To define the SASRMT transaction program in the registry, specify the following command:

TPSETUP -TP SASRMT

Note:   For Windows NT, you must run the SASRMT transaction program as an application, not as an NT service. Therefore, make sure that you start the Microsoft program TPSTART.EXE before allowing users to establish SAS/CONNECT sessions with remote hosts.  

You have completed the configuration of the Windows NT, Windows 95, or Windows 98 host as a SAS/CONNECT remote host or a SAS/SHARE server.

Configuring a Windows 32s Client

Use the SNA Server Client Setup Program to configure a Windows 32s client.

This section highlights the general tasks that you perform to configure an SNA client. For complete details, see the Microsoft SNA Server Installation Guide and the Microsoft SNA Server Administration Guide.

Note:   A Windows 32s host is supported only as a local host that connects to a remote host in a SAS/CONNECT session.  

Perform the following tasks:

1. Identify the protocol for communication with the SNA server (for example, TCP/IP, Novell, or IPX/SPX).
2. Specify the domain in which a server can be located so that data can be routed to it over a local area network (LAN).
3. To enable the client to connect automatically to the SNA server when booted, insert the following variable assignment in the [windows] section of the WIN.INI configuration file:

   [windows]
   load=wnap.exe

4. If you intend to create or to access a SAS/SHARE server on this host, you must define the SASTP62 transaction program in the WIN.INI file.

   You either may edit the WIN.INI file directly, or you may execute a program named TPSETUP.EXE, which is supplied by Microsoft, that automatically updates the configuration file.

   The appropriate entries to the WIN.INI file follow:

   [SNAServerAUTOTPs]
   SASTP62=sastp62

   Define the local-LU that you configured at the SNA server by inserting the following variable assignments in the [sastp62] section of the WIN.INI file:

   [sastp62]
   LocalLU=local-LU-alias
   Queued=operator

   The assignment of a local-LU-alias to a specific Windows 32s client allows the SNA server to route the incoming request for attachment (ATTACH) to the appropriate Windows 32s computer by an alias name. The SNA server checks each Windows 32s client's configuration file for its local-LU-alias to determine where to route the request.

You have completed the configuration of the Windows 32s client.

For details about how to install and configure the SNA server and SNA clients using the SNA Server Setup Program, see the Microsoft SNA Server Installation Guide and the Microsoft SNA Server Administration Guide.

For details about configuring Windows NT Host Security Integration features, see Microsoft SNA Server Getting Started and Installing and Configuring Host Security Integration.

Contact the Microsoft Corporation to obtain information about this documentation.

Copyright 1999 by SAS Institute Inc., Cary, NC, USA. All rights reserved.

Learning how to change and configure Microsoft Edge Proxy Settings is quite important to users who would like to protect their online privacy. Many web browsers, including Microsoft Edge, have features that support proxy. However, some users don’t know to go about it, which is relatively simple. A proxy server intercepts your computer network traffic before it gets to you; it’s just another remote computer. The are many reasons why users switch to a proxy, but the main one is to get an extra measure of online security.

What is Edge Proxy Server?

The Edge proxy server is a server that is located on the intranet and connects to the main server via the Internet. It is not bound to other proxy servers. It resolves a request for content from a local cache and proxying from the original server. Edge proxy server cannot request to any other proxy server.

The proxy works so that your IP address will not be revealed. You access the Internet using the proxy’s IP address. It is a great way to ensure you are safe online, especially for sites or malicious people tracking your activities online. It’s good to know that there are paid and free proxy server services.

There are two ways to configure a proxy server in MS Edge and it’s simple. You can use the manual way or simply use the automatic configuration. We will discuss this later in this article. This post will elaborate on changing and configuring Microsoft Edge Proxy settings. If you want to access geo-restricted content, protect your devices or conceal your IP address, you are in the right place. Continue reading.

Changing and configuring Edge proxy settings is a straightforward process, but you don’t need some specific browser proxy settings to surf on standard web pages. However, these settings can be changed to access geo-restricted pages or just for security purposes. To change and configure Microsoft Edge proxy settings, use any of the following methods:

1. Manual proxy setup
2. Automatic proxy setup

To turn off proxy settings in Microsoft Edge, go to the menu (three dots) on the top right and scroll down to Settings. Choose System and, on the left side, click on Open your computer’s proxy settings. From there, toggle off the buttons next to Automatically detect settings, Use setup script, and Use a proxy server. To complete the process click Save.

1] Manual proxy setup

To set up a proxy setting manually, you need to use Wi-Fi or Ethernet internet connections. If you are connected to any VPN, you need to disable it while setting up and using the proxy server. Here is how:

• Open Edge by clicking the icon on the taskbar or by typing Edge on the search box.
• On the top right, click on the three dots for more options. From the list, go down to see Settings and click on it.
• Scroll down the Settings menu. You will Advanced settings, go ahead and select View advanced settings option.
• Select Open proxy settings and head to the Manual proxy setup option and toggle the Use a proxy server button on.
• Enter the required details and select the Save button.
• Now, you will get a prompt asking you to put in a Proxy username and password. Enter these details correctly and your proxy server on Microsoft edge will be configured and ready to run.

Read: Can’t connect to the proxy server says Microsoft Edge

2] Automatic proxy setup

If you feel setting up a proxy server manually is a lot of work, you can choose the automatic mode option. As in the manual setup, you need only to use Ethernet or Wi-Fi connections. Deactivate any VPN running on your computer. This setup automatically detects settings and uses a setup script. Here is how:

• Open Windows Settings by pressings the Windows key + I.
• Head to the Network & Internet and go to the Proxy tab.
• Here, toggle the Automatically detect settings button on, as well as the Use setup script options.
• Insert the script URL and hit the Save button to complete the process.

Let us know if these methods helped you change and configure Microsoft Edge proxy settings.

Read: Ethernet works but not WiFi in Windows.

Windows 11 natively supports passkeys, a modern passwordless technology that lets you sign in to your online accounts using Windows Hello. From a security standpoint, passkeys are as effective as using an authenticator app. But they’re even easier to use, and that rare combination of secure and convenient has already catapulted passkeys to a level of acceptance and usage those other two solutions never achieved.

Note: Be sure to configure your Microsoft account securely with two-step authentication and multiple alternate sign-in and security verification methods using the instructions I outline in a previous post. This write-up, like that one, is based on content I’ve created for new chapters of all-new content in the Windows 11 Field Guide, in this case one that covers passkeys and security keys.

2023 was notable for so many reasons, but one of the biggest shifts was the rapid spread of passkey support across popular online accounts from Amazon, Apple, Google, and many others. But despite doing more than any of these other companies to enable a passwordless world, Microsoft was curiously quiet when it came to passkeys this past year. Meanwhile, Google was widely acclaimed for making passkeys the default sign-in option for its online accounts this past October. This, despite the fact that Microsoft had allowed its customers to literally remove the password from their Microsoft accounts for over two years by that point.

But this is on Microsoft: Aside from briefly mentioning passkey management as one of the many new features in Windows 11 version 23H2, the software giant didn’t promote its support for this technology in any meaningful way this past year. Nor does Windows 11 really mention passkeys in any meaningful way when you access your Microsoft account, while Google, especially, makes a big deal about it when you access its accounts on the web. Instead, Microsoft seems content to let its users keep using the passwordless sign-in functionality provided most commonly by authenticator mobile apps.

But that’s not the full story.

As I wrote in The Secret Lives of Passkeys (Premium), Microsoft silently saves a passkey to your PC’s Trusted Platform Module (TPM) security chip when you sign in to Windows 11 with a Microsoft account or Microsoft work or school account. And so the passkey for one of your most important online accounts is already there on the PC, and you can authorize its use online, in any web browser, using Windows Hello (PIN or biometric, whichever you have configured), the secure method you’re already using to sign in to your Microsoft account (or work or school account) when you fire up the PC.

So that’s a lackluster tip, I guess: To create a passkey for your Microsoft account, just do nothing. It’s already there.

Of course, you still have to know how to use that passkey. And you may have other Microsoft accounts, and would like to create a passkey for those accounts on this PC too. And you use a phone: Can you create a passkey for your Microsoft account there? Should you? And if so, how?

First, a quick explainer.

What are passkeys?

At a high level, a passkey is another alternative for bypassing the password associated with an online account, albeit one that is based on an industry standard with broad adoption from platform makers and service providers. Like authenticator apps, passkeys help protect against and phishing attacks and other password-related compromises. And as with authenticator apps, passkeys rely on the modern security technologies we take for granted these days on our devices, including secure, encrypted storage of some kind and secure sign-in technologies like PINs and, ideally, biometrics like facial and fingerprint recognition.

There is one wrinkle: Each passkey you create is specific to the device on which it was created. That means you will have a different passkey for each supported online account on one PC. And a different passkey for each supported account on each of your PCs and other devices. This may seem complex, but in practice, it works seamlessly after a one-time set up process. And unlike with an authenticator app or security key, you don’t have to have or use another device when you need to sign-in.

Once you’ve stored a passkey on your PC (or Microsoft has done so for you with your Microsoft account), subsequent sign ins, on the web or in apps will be seamless. When you’re prompted by some online service to sign in for whatever reason, all you’re expected to know is the email address associated with the account. (And in most cases, that will be auto-filled by your browser, OS, or password manager anyway.) Then, instead of typing a password or dealing with an authenticator app on your phone, you can authenticate yourself using a secure Windows Hello PIN or biometric method. When you prove who you are to Windows, the system will communicate this success back to the service that prompted you to sign-in. And because it trusts that this authentication is both correct and secure—you configured it together, after all—it grants you access to the service.

Passkeys can also be implemented in Windows (and elsewhere) using security keys, as noted, or in certain password managers. What we’re discussing here is the native platform capability in Windows. What Windows 11 version 23H2 adds is passkey management capabilities (noted below). But there’s more work to do: The Microsoft account’s support for passkeys is not particularly obvious, and Windows 11 doesn’t (yet?) sync your passkeys through your Microsoft account, a capability that would make passkey usage (for all of your accounts) much more seamless. Today, you need to manually create a passkey for each account on each PC.

We’ll get there, I bet. But for now, I’ll keep this focused specifically on creating and using a passkey with your Microsoft account on a Windows 11-based PC. (This works nearly identically for Microsoft work or school accounts as well.)

Note: Windows has long supported authenticating online accounts using physical security keys like those made by Yubico, and these hardware fobs also support passkeys. Security keys have their place, but their complexity and cost make them non-starters for most individuals. Authenticator apps and passkeys are much more convenient. But no worries, I’m covering security keys in the book too.

Create a passkey for a Microsoft account

If you sign in to Windows 11 with a Microsoft account, you’re done: Microsoft already created a passkey for that account, and you can see it in the Settings app by navigating to Accounts > Passkeys. On this PC, there is just a single passkey, for the Microsoft account used to sign in to Windows 11.

If this is all you need, you can move on to the next section. But if you have other Microsoft accounts, you can create a passkey for each on this PC too. And you create a passkey for a Microsoft account the same way you create any other additional account sign-in or verification method, by navigating to the Additional security options page on the Microsoft account website, authenticating as prompted, and then clicking “Add a new way to sign in or verify.” (Note that this may be easier to do in a secondary web browser as handling multiple Microsoft accounts in a single browser can be problematic.)

In the “Select an additional way to verify or sign in” dialog that appears, click “Use your Windows PC.” The “Use Windows Hello to sign in to your account” page appears. Click “Next.” Windows 11 will display a prompt explaining that the sign-in data for your Microsoft account will be stored on this PC, allowing you to sign-in to that account later using this credential. Click “OK.” Windows will then prompt you to authenticate using Windows Hello PIN, facial recognition, or fingerprint recognition so that it can securely save the passkey on this PC. (This will vary according to which methods you’ve configured. Click “More choices” here to choose a different method than the one presented.)

Once you’ve authenticated using Windows Hello, Windows will store the account credential in the TPM’s secure storage on the PC. And the Microsoft account website will note that you can now use Windows Hello to sign-in to this account in the future, instead of your password (or a phone-based verification method or whatever other methods you’ve configured).

Sign-in to your Microsoft account on a PC using a passkey

To use the passkey to sign-in to your Microsoft account, click “Other ways to sign in” when prompted in the future. (Note that you will not see this option at the Windows 11 lock screen: Windows already provides Windows Hello device-specific sign-in capabilities and these methods are as seamless as they can be. I used an InPrivate browser window for these shots.)

This prompt will typically default to whatever authentication method you used most recently. But you can choose between different ways to authenticate yourself. Click “Sign in with Windows Hello or a security key” and then authenticate using whichever method you prefer that is available on that PC. (Windows Hello in this case.)

And that’s it: You’ve signed into your account securely and seamlessly, and without needing to fish your phone out of your pockets and deal with its on-screen prompts.

Manage passkeys in Windows 11 version 23H2

Passkey management is an interesting course in part because many online accounts provide limited capabilities in this regard. But your Microsoft account is among the worst: Once you create a passkey on a particular PC from the Microsoft account website, there’s no way to manage that from the web: It does not appear in the list of additional sign-in and verification methods alongside your password, email addresses, authenticator app, and other methods. Other companies, including Google, offer centralized passkey management on their online account management websites.

But it doesn’t matter. If your PC is lost or stolen, your passkey stays safe because it’s stored in encrypted storage and further protected via a PIN or biometric authentication method. But I still expect this to change in the future, if only because customers will expect to be able to remotely delete passkeys or in some way disconnect existing passkeys from the underlying service.

Until that happens, you can manage the passkeys on a PC using the Settings app in Windows 11 version 23H2 and newer, as noted above: Navigate to Accounts > Passkeys settings to see what’s available.

As expected, the capabilities are limited to deleting passkeys one at a time: Just click the “See more” (“…”) item next to a passkey and then “Delete passkey.” Note that these passkeys are system-wide: I created some of those using a different Windows 11 sign-in account. As long as I have admin privileges, I can delete any and all passkeys stored on that PC, except for the passkey associated with the account I’m currently using.

And that’s literally all you can do with this new Windows 11 version 23H2 feature.

What about mobile?

Because Microsoft doesn’t have its own mobile platform anymore, those with a Microsoft account (or Work or School account) tend to approach their Android phones and tablets, iPhone, and iPads from the perspective of the apps they use there. That is, we sign in to this account when we need to configure our Microsoft account in a Microsoft (Outlook, Microsoft 365, OneDrive, etc.) or third-party (Gmail, Google Calendar, etc.) app, using some form of password auto-fill (native or third-party), and then hopefully configure an authenticator app like Microsoft Authenticator to further protect our Microsoft account and other online accounts.

And that does appear to be Microsoft’s solution on mobile, as it does not support saving passkeys for Microsoft accounts (or Microsoft work or school accounts) on mobile. Instead, you’re expected to use Microsoft Authenticator, the idea being that it works similarly to a passkey since you can verify sign-in attempts using that app on the same device on which you’re making the sign-in attempt. That is, while an app on a phone is a bit inconvenient when you’re using a PC, it’s not at all inconvenient when you’re using that phone. So the benefit of a passkey would be minimal on that one device.

This is perhaps misguided. Like Windows 11, these mobile platforms—Android, iOS, and iPadOS—all support passkeys natively, each device type has secure storage in a TPM-like security chip, and each supports secure PIN and biometric sign-in methods to protect those passkeys. And you won’t typically use Authenticator on an Android tablet or iPad. Using a passkey on those devices would be convenient too.

Maybe someday.

News

Microsoft Outlines New Outlook for Windows Rollout Plan

Microsoft will deliver organizations advance notice of the coming change.

• By Kurt Mackie
• 09/12/2023

Microsoft is planning to replace the current Outlook for Windows client application with a new product, but it could take maybe two years for that transition to get finalized for organizations.

That view was outlined by Microsoft luminaries Margie Clinton, group product manager on the Outlook team, and Robert Novitskey, partner engineering manager for Outlook for Windows, in an online presentation. The presentation was published last week, but it's noted in this Sept. 12 Microsoft announcement.

The two Microsoft luminaries mostly described why Microsoft is redoing its 25-year-old Outlook for Windows product. Some planned feature improvements were highlighted. They also addressed IT department concerns about the transition's timing.

Clinton said that Microsoft had no strict timeline for the end of life of the classic Outlook for Windows product. Microsoft's timing is "going to be determined on overall readiness, based on us delivering the core capabilities to the point where we believe that we're ready for opt out." However, she added that the end of the classic product is coming, and it would occur maybe "in a little bit more than two years."

The online presentation offered the following slide, showing the expected phases for rolling out the new Outlook for Windows client app:

Novitskey noted that Microsoft tries to deliver a one-year advance notice of disruptive changes for its commercial software. IT pros will get such a notice via the Message Center. Microsoft eventually will switch the apps, though, which Novitskey called a "cutover":

But at some point, we will decide that we think that the new outlook is good enough for all users and we will interface, called "cutover." And this is where classic Outlook or universal mail and calendar are no longer supported. And so, users will have to move to the new Outlook.

Some things won't work in the new Outlook for Windows, namely COM add-ins. Instead, the new Outlook for Windows will use Web add-ins. The following slide made those declarations:

Microsoft initially plans to roll out the new Outlook for Windows app as an option for users, with a toggle switch to try it located at the top right corner of the legacy client. The toggle switch, currently in the "Off" position by default, now appears for organizations that are using the monthly enterprise channel releases of Microsoft 365, Novitskey said.

IT pros initially will get Registry and Group Policy Object controls over whether end users can see this toggle switch, before total replacement with the new app. The IT controls were briefly outlined in the following slide:

Novitskey noted that the coming new Outlook for Windows client app can be a big change for large organizations with lots of users. He suggested that Microsoft's "support can work with you to kind of develop a personalized timeline, and they can secure kind of whatever extensions you may need for your tenant."

The new Outlook for Windows has a more simplified user interface, which looks somewhat like its Outlook on the Web predecessor. However, Microsoft is really making the switch to the new app because its current Outlook for Windows app is available in more than three offerings that all work differently, Clinton explained. Instead, with the new product, Microsoft wants to "apply all of our engineering energy on Windows into delivering and then maintaining a single, fast and agile codebase," she added. This change will allow Microsoft to address customer issues in hours and days, rather than weeks and months.

The new Outlook for Windows client will be customizable for various users. It also will get Microsoft's artificial intelligence enhancements, which Microsoft believes will deliver a "10x productivity" improvement, Clinton said.

Microsoft really wants to earn "Outlook love" with the new client, and so is actively seeking early feedback from organizations, Clinton indicated.