A clear brand builds identity and affiliation. Microsoft 365 and Endpoint Manager has a rich set of tools for customizing your brand into the products. This will look nice and integrated, and it will help the end users detect security attacks. Let's take a deep dive into the possibilities associated with branding your tenant and endpoints!
A brand is a name, term, design, symbol or any other feature that distinguishes one company's good or service from those of other companies. Brands are used for recognition, creating values and identification. A brand is the sum of all expressions by which an entity (person, organization, company, business unit, city, nation, etc.) intends to be recognized.
With a workforce spread all over the modern hybrid workplace, it is more important than ever to spread the love of the company's brand. This blogpost will focus on how your brand can be incorporated to Microsoft 365 and all endpoints by Microsoft Endpoint Manager.
Add company branding to Microsoft 365
Microsoft has added features for branding your Microsoft 365 tenant in several ways, both with text, colors and graphics. This will give a consistent experience when users sign in with their user identity from your organizations Azure Active Directory (AAD). The branding can define and strengthen the experience of working in your company, even if the work is performed outside of the office locations. This will all be small but important steps for the identity of the company. At the same time, we can relate this to the security work, as users can distinguish a legal login from a falsified one with a quick glance on the branding.
I have searched for ways of doing these brandings through GraphAPI and PowerShell, but unfortunately I have not achieved this - yet. The most concrete I have found is the Microsoft reference for updating the organizationalBranding which Kevin Telgelaar also has made a small routine from. Until I have this all covered in one scripted routine, I will walk you through the branding process inside the portals.
It's worth mentioning that a custom branding requires Azure AD Premium 1 or higher.
Branding the sign-in experience
- Sign in to https://portal.azure.com and navigate to Azure Active Directory - Company Branding.
- Configure your policy with your branding.
- The first policy is based on your default local and can't be changed. Once the default sign-in experience is created, you can add language specific customized brandings.
- Create the sign-in page background image at size of 1920x1080. In order to keep under the 300kb limit, I often use JPG.
- The Banner Logo is created as a transparent PNG at size 280x60 with a file size less than 10KB.
- The Username hint will be the text appearing to users if they forget their username.
- Sign-in page text is the text appearing at the bottom of the sign-in page. I often add information about helpdesk to this field. New paragraphs can be inserted with the enter key twice. Bold can be created with **text**, italics with *text*, underline with ++text++ and hyperlinks with [text](link).
- The Square Logos are also saved as transparent PNGs at size 240x240 and file sizes less than 50KB.
- I like to remove the check mark for Show option to remain signed in since this gives less questions for the users at each sign in.
- This should now give a new branded sign-in experience for the users signing in with their identities from this tenant.
Branding Office 365
- Sign in to https://admin.microsoft.com as a Global Administrator and navigate to Settings - Settings - Organization Profile - Custom Themes.
- The General tab has options to prevent the users to override your official theme. You can also set to display the users display name on the navigation bar when signed in.
- The Logos tab allow you to upload a theme logo and specify an URL linked from the logo.
- The Colors tab allows you to defined the color elements for your profile. If you don't have access to the official branding profile, the color codes can often be found on the company's official web pages. The Color Picker utility from PowerToys is a handy tool for carving these codes out of the webpage. Pay attention to the warnings if your colors don't meet the recommended color contrast ratios.
- Saving the theme and refreshing the page gives you the result of your creation.
Branding Helpdesk information
- Navigate to Help desk information found under Organization profile in the Org settings. Add information about you helpdesk services.
- This will be available for the users under the Office 365 help pane.
Branding helpdesk information for SSPR
If you try to do a Self Service Password Reset from passwordreset.microsoftonline.com and get into trouble, the link to contact your administrator will be the address defined above.
Add company branding to Microsoft Endpoint Manager
Branding the Company Portal
- Sign in to https://endpoint.microsoft.com and navigate to Tenant Administration - Customization. Click Edit to start configure the branding.
- You can use the same color codes as earlier to create a unified branded experience. If the logos from earlier has the correct dimensions, you can also reuse these at this point.
- Next you will add support information. Use the same information as provided for Helpdesk on the tenant.
Branding Windows endpoints
Branding AutoPilot onboarding
This branding will verify that you are on the right track immediately after unboxing and booting a new device.
Branding Autopilot Enrollment notifications
Deliver branded organizational messages to Windows 11
A public preview of this functionality will be available starting in November 2022. Read more information about this feature here: Deliver organizational messages with Windows 11 and Microsoft Intune - Microsoft Community Hub
Branding the wallpaper, lock screen and color scheme
Branding Windows OEM info
The PowerShell script is available in my GitHub: Community-By-SSkotheimsvik/Win11-OEMInformation.ps1 at main · SimonSkotheimsvik/Community-By-SSkotheimsvik (github.com)
Branding Microsoft Defender
Branding Microsoft Edge
Adding managed favorites and force sign in and synchronization of the user in the browser is also a nice addition to get the company brand into the browser:
When applied, this will give a uniform shortcut folder in Edge for all users and you can set a fixed starting page for the browser.
Branding Microsoft Outlook
Today this is often solved by third parties which can integrate with Azure Active Directory for getting user details and Microsoft Endpoint Manager for distributing the signatures to the devices. There are several providers of this functionality in the market like Letsignit and CodeTwo. These tools can also be used for marketing campaigns which in turn gives even more branding to the e-mails sent by the company's employees.
Branding Microsoft Word, Microsoft Excel and Microsoft PowerPoint
There are several alternative backgrounds available out of the box, and it is even possible to add your own backgrounds. I often see people create a folder in Sharepoint with the company's branded Teams backgrounds with corresponding long descriptions on how to download and add these to Teams.
Branding the Viva Connection icon in Teams
Branding the Teams Store
Branding Surface Hub's
Branding macOS endpoints
I use a shell script provided by Neil Johnson to download the image from the same URL as used on windows devices earlier. This script is available from Github: shell-intune-samples/downloadWallpaper.sh at master · microsoft/shell-intune-samples (github.com)
With the local wallpaper picture distributed to the macOS, I can use a Device Configuration Policy for macOS where the local picture path is specified under User Experience. I am also specifying a branded login window text in this policy which will be displayed on the login window for the devices:
Branding iOS supervised devices
Branding Android Corporate Owned devicesAt the same way as for the iOS supervised devices, we can add branding to Android corporate owned devices. This will give a branded look and feel on the device.
Branding the general user interface
This name will actively be used by the system, for instance in messages related to updates and patch management on the devices.
Branding Windows 11 Search
If you click on a colleague from the Search field, you will have more information available on that specific person as found in the system. This will help you bond with the collegiate, and it shows the importance of keeping the catalog current. Here you will find a shortcut to the floorplan as described in one of my previous blog posts.
Branding Windows 11 Custom theme and Start menu
Branding Third Party Integrations
This seems like a small detail, but it will be one of many parts forming the total experiencing of working in the company. It will also help to provide a safe experience for the users working for the company.
A love for the brand for the distributed workforce
This has been a long blog post. It might be that you have other new ideas of implementing the brand - Please share this in a comment.