{"id":1120,"date":"2016-10-05T01:00:00","date_gmt":"2016-10-05T01:00:00","guid":{"rendered":"http:\/\/inswwdev.azurewebsites.net\/au\/insights\/uncategorized\/securing-fslogix-profile-and-office-365-containers\/"},"modified":"2016-10-05T01:00:00","modified_gmt":"2016-10-05T01:00:00","slug":"securing-fslogix-profile-and-office-365-containers","status":"publish","type":"post","link":"https:\/\/www.insentragroup.com\/us\/insights\/geek-speak\/modern-workplace\/securing-fslogix-profile-and-office-365-containers\/","title":{"rendered":"Securing FSLogix Profile and Office 365 Containers"},"content":{"rendered":"

So far I\u2019ve shown you\u00a0<\/span>how FSLogix helps improve user experience for Office 365 customers<\/a>\u00a0<\/span>and\u00a0<\/span>how simple it is to get up an running for an evaluation<\/a>. In this article, I\u2019ll describe how to secure access to FSLogix Profile Containers and Office 365 Containers.<\/p>\n

FSLogix Storage Requirements<\/h3>\n

When designing for deployment of FSLogix Profile Containers and Office 365 Containers, the most challenging part of that design will be a solution for storage \u2013 you\u2019ll need to ensure whichever solution you go with meets your high availability requirements. Underneath though, a simple SMB location is required for storing the virtual disks that contain the Profile and Office 365 containers.<\/p>\n

When a user logs onto a desktop enabled with FSLogix, the virtual disk container stored in the target location, is mounted by desktop with a junction created into the user\u2019s profile.<\/p>\n

The screenshot here shows this in action:<\/p>\n

\"\"<\/p>\n

To secure the share that hosts the FSLogix containers, we can draw from existing permissions recommendations for user home directories and folder redirection. The following two articles are a great reference:
*\u00a0<\/span>How to dynamically create security-enhanced redirected folders by using folder redirection in Windows 2000 and in Windows Server 2003<\/a>
*\u00a0<\/span>Deploy Folder Redirection with Offline Files<\/a><\/p>\n

Recommended Permissions<\/h3>\n

To secure the share, here are my recommendations for NTFS permissions. Share permissions are straight-forward \u2013 users will need to write access; however, also ensure that the target desktop computer accounts have read-only access.<\/p>\n

Recommended NTFS permissions are below. This will ensure that the FSLogix agent can create a virtual disk for each user with secure permissions, preventing access to other user\u2019s virtual disks.<\/p>\n