Windows 11 SE: Why it’s both more and less locked down than Windows 10 S

Microsoft has long thought about how to tailor PCs for education, wanting to mix the flexibility of the PC ecosystem with the control that schools require. It’s a complex problem. Do we simply accept the free-for-all that’s Windows general purpose computing model, or do we move to ChromeOS’s browser-based world where keeping everything in the browser makes everything easier to lock down?

Windows RT was one approach, limiting what could be run to a managed view of the Windows Store. That same approach carried over into the Windows 10 world, with S mode, locking devices down to Store access only. But Microsoft is closing the Education and Business versions of its Store, making that model no longer tenable. It also had pushback from education departments that were used to making their own licensing deals for software and tools and so preferred not to buy from a vendor’s own store.

Here comes a new Windows for education

And so the wheel turns, and Microsoft is now launching a new, education-focused version of its latest Windows, Windows 11 SE, launching with a slightly simplified user interface. Coming with the new low-cost Surface Laptop SE, it’s a tightly managed version of the familiar Windows available only to education customers. That’s because it’s only available with Windows 11 SE hardware, from Microsoft and hardware partners like Lenovo, which are intended to be sold only through education channels.

The SE doesn’t stand for anything; it’s intended purely to be a brand identifier, like Home or Pro. But the policies associated with it will certainly make purchasers think it’s a “Student Edition.” While there are no actual restrictions on how Windows 11 SE hardware is sold, it’s branding that should let potential purchasers know that this isn’t a Windows for home or the office: This is only for the classroom.

SEE: Schools could be ripe for cyberattacks amid ransomware open season (TechRepublic)

Run anything…

Unlike Windows 10 S, there’s no limit to what types of application packages are supported. Where Windows 10 S wouldn’t be able to run, say, the Win32 Zoom client, it’s supported on Windows 11 SE. It’s a shift that puts the Windows education release in line with
Microsoft’s new Windows Store policies

. You can now run all types of packaged software, even Java apps. In fact, the FAQs for the platform go out of their way to note it installs Zoom.

That’s where the new flexibility comes in, loosening the restrictions on the type of code that can be run. If it’s supported in Windows 11, it’ll run on Windows 11 SE. Or it would if it had permission. And that’s where the new level of lockdown comes in, giving system managers far more control over devices than they used to have. Where Windows 10 S could access the general Windows Store, downloading Appx and MSIX packages, Windows 11 SE is limited to using the browser or applications delivered by Windows Intune for Education.

…that we say you can run

Approved applications are limited to a curated list in one of six categories: content filters, test-taking apps, accessibility tools, classroom communications, management and support tools, and browser. In addition, both Office and Minecraft’s education edition are included with Windows 11 SE. School IT departments can work with their sales channel to get new applications added to the list, with Microsoft taking requests for education software to evaluate. If a school needs more outside the curated app list, it’ll need to switch to Windows 11 Pro Education, which removes most of the guardrails of Windows 11 SE. That option may well be preferred for higher grades, as Windows 11 SE is recommended for K-8.

SEE: Windows 11: Tips on installation, security and more (free PDF) (TechRepublic)

That means there’s no access to the Windows Store and no support for standalone installers. If you want the capabilities of a standard Windows install, you’ll need to bring your own Home or Pro license as well as installation media. Once you upgrade there is no way back to Windows 11 SE.

Offering a tightly curated list of supported applications makes sense; schools will want to keep devices under control and avoid use of non-educational software. If users want to go outside the software installed by a school, they can use a browser, taking advantage of the capabilities built into Edge, Firefox or Chrome.

Curation and management

Users can still access services like YouTube and Spotify; they just have to use them through their browser versions. With many common apps and services offering browser-based options, this should give most users a Chromebook-like experience. That may well be what Microsoft is doing here, using Office and a set of curated apps to make Windows 11 SE devices a Chromebook+ option for schools, where traditional software supplements newer web options. Microsoft describes it as a cloud-first operating system.

Microsoft is having to balance on a tightrope here. There’s clearly demand for low-cost devices outside of education, but at the same time, schools need devices they can control and manage. That’s why it’s making it very clear that Windows 11 SE is not for home users. Without an Intune for Education backend, and other modern management tools like Windows Autopilot, it’s going to be pretty much useless.

Using Intune for Education

At the heart of Microsoft’s Windows 11 SE strategy is Intune for Education. Here, teachers and school IT staff can configure and manage devices. Unlike the Microsoft 365 Intune there’s no subscription required to use the Education release: Licenses come bundled with Windows 11 SE. You can use Azure Active Directory to manage users, with support for multi-factor authentication. There’s the option to use Microsoft Accounts, though this isn’t recommended as it limits use to only the built-in software.

Taking a per-device approach to management makes sense here, as schools have limited budgets. Instead of separating hardware and management, everything comes bundled with a $250 laptop. Schools can buy hardware and know that it’s automatically licensed for use with the management platform. All they need to do is turn on the laptop and register it with their tenant, before provisioning users and software.

Finding the balance

There’s a fine balance to be navigated between open and locked down in Windows 11 SE. Microsoft is aiming to have the best of both worlds, limiting the applications that can be installed to a curated list, while allowing both Win32 and UWP applications to work. Still, the focus is clearly on web apps in the cloud, offering an alternative to Chromebooks, while augmenting the web experience with a limited number of essential Windows applications. It’ll be interesting to see how schools respond to this approach, and whether using Intune for Education gives them the extra control they need above and beyond traditional Windows installs.

Also see