Google is loading AI directly into Chrome, and for once, that is actually good news for your team right now, today, without doing anything extra.

The way it works is Chrome is watching the sites you visit as you go and warning you if something looks like a scam. We are talking about the kind of attack where a bad site tells you to copy a command and paste it somewhere on your computer. That is a real thing people fall for, and now Chrome is trying to catch it before your employee does something they should not.

The Bad Guys Are Still Ahead

I want to be straight with you: the tools the bad guys have are outstripping the tools the good guys have. That is just the reality. The bad guys are always at the bleeding edge, and everybody else is always following. You cannot get around that.

But that does not mean improvements do not matter. This one is free, it is already in Chrome, and if your team is already using Chrome, they get it. That counts for something.

What to Actually Do With This

Make sure your team is running Chrome and that it is up to date. That is really it for this one. You do not have to configure anything or pay for anything. The protection is just there.

And if you want to pair it with something that actually covers the bigger gaps, go back to the basics: DMARC and DKIM on your email, multi-factor authentication on your accounts, and some kind of monitoring that alerts you when your email gets accessed from two places at once. That stack will do a lot more heavy lifting than any single browser feature. But a free layer on top of that? I will take it.

Questions about how this affects your setup? Schedule a free IT consultation and we’ll walk through it with you.

Wherever your team is based, ACS provides hands-on managed IT support — see how we help businesses in Central Florida.

I had never heard of 3D Systems before I came across this story, and I will be honest, my first reaction was not about the company at all. It was about location. The center opened in Colorado. And my immediate thought was: where is the Michigan version of this?

There probably is one somewhere. But Traverse City should be asking that question out loud.

What This Center Actually Does

The idea is straightforward. 3D Systems opened an industrial technology center in the US specifically to expand domestic capacity for advanced manufacturing. The goal is to give manufacturers, including smaller operations, access to equipment, expertise, and training that would otherwise be completely out of reach for a company that cannot afford its own R&D lab.

That is the part that caught my attention. This is not just for the big guys. It is designed to pull smaller manufacturers into capabilities they could not touch on their own.

And it fits into something bigger. This is exactly what people mean when they talk about reshoring and strengthening US manufacturing. I think that is tremendously important. There is no reason we cannot build that stuff here, and this kind of center is one way to make that actually happen.

Why Northern Michigan Should Pay Attention

I will be straight with you: I do not know enough about advanced manufacturing techniques to tell you exactly which ones would matter most for businesses up here. That is something I want to learn. If any of you are in manufacturing and want to come on and talk through what you do and how you do it, I would love that conversation. I would ask a lot of questions and learn a lot.

What I do know is that having something like this nearby would be a real opportunity for local manufacturers to grow into next-generation production. Right now, if you want to go use their equipment and see what it could do for your operation, you are booking a trip to Colorado. It would be a lot better if we had it here.

What to Actually Do About This

If you are a manufacturer in Northern Michigan, here is where I would start:

• Go talk to NMLNMC or the Michigan Economic Development Corporation and find out what programs already exist around advanced manufacturing access.
• Talk to your industry association. There may already be grant opportunities or coalitions forming that you are not plugged into yet.
• Think about whether there is a larger company, maybe a big aerospace or automotive-level operation, that might sponsor bringing a high-end next-generation manufacturing training and production facility to this area. That kind of sponsorship is how these things get built.
• Ask yourself honestly whether the domestic manufacturing push is creating real opportunities for your size of business, and what you would need to take advantage of them.

The domestic manufacturing push is real. I hope it is creating opportunities for small businesses, not just the large ones. Getting connected locally is the fastest way to find out.

Questions about how this affects your setup? Schedule a free IT consultation and we’ll walk through it with you.

Wherever your team is based, ACS provides hands-on managed IT support — see how we help businesses in Traverse City & Northern Michigan.

AI agents are coming to manufacturing, and the question everybody needs to be asking right now is: can you trust one to make the right call at 2 a.m. when nobody’s watching?

That’s not a hypothetical. That’s where we’re headed. And I think we’re getting close to a point where the answer is yes, but we’re not quite there yet, and the gap matters a lot when you’re talking about production equipment, parts specs, and scheduling.

Assistant vs. Agent: The Difference Actually Matters

An AI assistant is basically a chatbot. You talk to it, it responds, it does what you ask. An AI agent is different. An agent makes decisions. It acts on its own, based on rules and data you’ve given it, without you asking it to do anything in that moment.

When I publish this, an agent is making a whole bunch of decisions behind the scenes. There’s a pile of information behind that agent so the decisions it makes are at least close to what I’d expect. That’s the idea. But in manufacturing, if an agent decides at 2 a.m. to change your production calendar, or starts pumping out parts to the wrong spec, that costs real money. That’s not a chatbot giving you a weird answer you can ignore. That’s a machine doing the wrong thing for hours before anyone notices.

I’m Building One of These Right Now, and It’s Humbling

I’m working on an AI service coordinator for my own business. It’s supposed to look at all the work my team has, who has what, how much, their skill sets, how urgent each issue is, how important the customer is, and then decide who handles what and when, and let the customer know how long it’ll be. Humans do that job right now, and honestly, I’m not that impressed with how humans do it. We get pulled into things. We forget. More important stuff pops up and we miss it.

An AI should handle that better. It should be able to stay on top of everything at once and flag when something needs attention. So I built it. I tested it against real historical data, with the human decisions as the gold standard. It scored 57%.

But here’s the thing I actually found useful: it told me why it scored so low. And it wasn’t the AI’s fault. It was rules I had put in that made it make those decisions. So we’re tweaking those. I’ll keep you posted on how it goes.

The point is, even in a relatively low-risk situation like mine, getting the data right and the rules right takes real work. On a shop floor, the stakes are higher.

What You Should Actually Do This Week

If you’re running any AI automation tools right now, or if your vendors have started rolling out features that sound like they’re doing things automatically, here’s where to start:

• List every AI automation tool currently running in your business. If you have any, I’d love to hear how it’s going for you.
• Put one person on your team in charge of being the AI checkpoint. Don’t let decisions just happen without someone reviewing them. Build a dashboard if you can, watch what it’s doing, and train it over time before you let it run loose.
• Check with your vendors on whether any recent updates have added agentic or autonomous features. If a vendor turned on autonomous features without telling you, that’s a problem. Find a new vendor.

I want to get there with AI agents making real shop floor decisions. I think we all will. I just don’t want to be the first one to find out what happens when it goes wrong.

Questions about how this affects your setup? Schedule a free IT consultation and we’ll walk through it with you.

Wherever your team is based, ACS provides hands-on managed IT support — see how we help businesses in Chicagoland.

This one doesn’t surprise me at all, but it’s worth talking about because a lot of business owners think they’re covered when they’re not.

There are technologies called DKIM and DMARC. As part of our managed services, when we have the access, we set those up on your email. What they do is authenticate your email system so that not just anybody can send emails that look like they came from you. It makes it harder for bad guys to fool your vendors or your customers by spoofing your domain. That’s great, and it works.

Why Authentication Alone Is Not Enough

The problem is this: if someone gets into your actual email account, none of that matters. The email they send is legitimate. It came from your real account, from your real domain. DKIM and DMARC look at it and say, yep, checks out. And it gets delivered. And it fools people.

How do they get in? Usually because there’s no MFA, no multi-factor authentication, and nobody’s watching the account. We run alerting systems that flag when an email account gets accessed from two different places at once, or accessed from one city and then a short time later from somewhere far away. If you check your email in Traverse City and then it gets checked in Bangladesh an hour later, something’s wrong and the system reacts. Most businesses don’t have anything like that.

So the bad guys get in, and now they’re sending emails from inside your legitimate, authenticated email account. The message inside that email may be completely fraudulent, but the email itself is real. It’s going to get delivered, and it’s going to fool people.

What You Actually Need to Have in Place

Start with DKIM and DMARC if you don’t have them. That’s the foundation. Then get an email monitoring system that watches for suspicious access patterns. Those two things together will take care of about 95% of your problems.

The remaining 5 to 10% comes down to your team, especially whoever handles accounts payable. Do not send a payment just because you got an email. Double-check it. And it’s even worse than that now, because you can’t just call the number on the email and assume you’re talking to the right person. The AI voice tools out there are convincing. You’ve seen what they can do with public figures, making it look and sound like someone it isn’t. They can do the same thing with the voice of whoever you think you’re calling. So verify through a separate channel, a number you already have on file, not one that came in the email.

Train your team. Make sure they know this can happen. We offer that training if you want to hand it off.

The short version: just because you have a secure email setup doesn’t mean your email is secure. Those are two very different things.

Questions about how this affects your setup? Schedule a free IT consultation and we’ll walk through it with you.

Wherever your team is based, ACS provides hands-on managed IT support — see how we help businesses in Traverse City & Northern Michigan.

AI virtual receptionists are now being aimed specifically at small service businesses, and honestly, I am not surprised at all. This is exactly where things are going.

What We Are Actually Talking About

An AI-powered virtual receptionist handles calls and scheduling for small businesses. Not enterprise companies with big IT budgets. Small service businesses. The kind of businesses I work with every day.

And there is an important distinction here. There is a difference between an AI that just answers a question when you ask it and an AI that actually does something on your behalf. A receptionist that books appointments, answers the phone, and keeps things moving without a human sitting there doing it, that is an AI agent doing real work.

Why This Makes Sense for Small Business Owners

Routine tasks are exactly what AI is built for. The real work is getting everything connected so the AI can actually do its job. Once that is done, you get to stop doing the stuff that was eating your time.

Missing calls costs you customers. Drowning in scheduling eats up time you do not have. If an AI can sit on top of that and handle it, that is a real win. And the cost is coming down to where small businesses can actually look at this without laughing.

Before You Jump In

My advice is the same as it is with any AI tool right now. Do not just turn it on and walk away. Put a person in the loop, at least at first. Train it on your actual business, your services, your customers, how you want things handled. Check what it is doing. The tools are good, but they need the right information to make the right calls, literally and figuratively.

If you are a service business and you are losing time to phone tag and scheduling chaos, this is worth a serious look. Just go in with your eyes open and make sure somebody on your team knows what the AI is doing until you trust it.

Questions about how this affects your setup? Schedule a free IT consultation and we’ll walk through it with you.

Wherever your team is based, ACS provides hands-on managed IT support — see how we help businesses in Traverse City & Northern Michigan.

AI Agents on the Shop Floor: Cool Engineering, Real Questions

I read a piece from Industry Week this week on AI agents coming to manufacturing — it’s a little ahead of itself. But the core question it raises is worth sitting with: if an AI agent is making decisions at 2 a.m., do you trust it?

First, the distinction the article draws is actually useful. An AI assistant is a chatbot. You ask it things, it responds, maybe it does a task when you tell it to. An AI agent is different. An agent has context, has rules, has data behind it, and it makes decisions on its own — without you in the loop. That’s what we’re talking about.

For manufacturing, the concern is obvious. An agent that misreads a spec or reshuffles your production calendar at 2 a.m. doesn’t just cause a headache — it costs real money. Parts come out wrong. Schedules collapse. You wake up and nothing is working right.

I’m building one of these myself right now. A service coordinator agent — something that looks at the work across my whole team, checks skill sets, evaluates how urgent each issue is, figures out who should handle what and when, and notifies the customer on timing. Humans do that job today. I’m not always impressed with how humans do that job, because humans get pulled into things. The most urgent item in front of them becomes the most important thing in the world, and meanwhile three other things are quietly on fire.

An agent shouldn’t have that problem. It should be able to hold the whole picture at once.

My agent scored about 57% on its last test run against historical data. That sounds bad. But it told me exactly why — and the problem wasn’t the AI, it was some rules I’d put in that were steering it wrong. That’s actually the right failure mode. It’s fixable. I’ll keep you posted on how it goes.

The article’s practical advice for this week is solid, so I’ll pass it along with my own commentary:

• List every AI automation tool currently running in your business. If you don’t know what’s running, you can’t supervise it.
• Put one person on your team in the AI checkpoint role. Don’t let autonomous decisions just happen without a human reviewing the dashboard, at least while you’re still training the thing.
• Check with your vendors whether recent updates have added agentic or autonomous features. This one I want to underline. If a vendor quietly turns on autonomous decision-making without telling you — get a new vendor. That’s not a feature rollout, that’s a liability you didn’t sign up for.

We’re getting close to the point where agents can make sound decisions if they have the right data. The data part is always the hard part. But we’re moving in the right direction.

Authenticated Email Has a Gap You Should Know About

This one’s been making the rounds as a big revelation. Authenticated emails can still be faked. I’m not surprised. Let me explain what’s actually going on.

There are email authentication technologies called DKIM and DMARC. When set up correctly, they essentially sign your outgoing email so that the receiving server can verify it actually came from your domain — not from some bad actor spoofing your address. We set these up as part of our managed services work whenever we have the access to do it. They work. They’re worth having.

The gap is this: DKIM and DMARC protect your domain. They don’t protect your account. If someone gets into your actual email account — because you don’t have multi-factor authentication turned on, because there’s no monitoring watching for impossible logins — they don’t need to spoof anything. They’re sending from the real account. The email is legitimate. Every authentication check passes. And the message inside it is a fraud.

We run alerting systems that flag when an email account gets accessed from two different locations in a timeframe that doesn’t make sense — Traverse City in the morning, somewhere overseas an hour later, that kind of thing. Most businesses don’t have that. Most businesses also don’t have MFA turned on. Those two gaps together are how this plays out in the real world.

What to do this week, in order:

1. Make sure DKIM and DMARC are configured on your domain. Start there.
2. Get email account monitoring in place so impossible logins get flagged.
3. Turn on MFA. I know I say this every week. Turn on MFA.
4. Train your accounts payable team specifically. Don’t release a payment because you got an email. Don’t even release it because you called the number on the email and someone answered and sounded right — AI voice cloning is convincing enough now that this is a real attack vector. Call a number you already have on file from a previous invoice or your own records.

Secure email and email security are not the same thing. Your domain can be fully authenticated and your account can still be wide open. Both matter.

3D Systems Opens a Manufacturing Center, and I Have a Question for Northern Michigan

3D Systems, a company I’ll admit I hadn’t heard of before this week, just opened an industrial technology center in Colorado. The goal is to give manufacturers — including smaller operations — access to advanced manufacturing equipment, expertise, and training that would otherwise require a full R&D lab budget to touch.

My immediate reaction: where’s the Michigan version of this?

There probably is one somewhere in the state. But I’d love to see something like this in Northern Michigan. Traverse City should be asking how to get a facility like this here — whether that means going to the Michigan Economic Development Corporation, talking to NWMCA, or finding a large manufacturer or aerospace company willing to sponsor a next-generation production and training facility that our local manufacturers could actually use.

The broader push toward domestic manufacturing reshoring is real, and I think it’s important. There’s no good reason we can’t build more of this stuff here. If any of you are in manufacturing and want to come on the show and talk about what advanced manufacturing techniques would actually move the needle for your operation, I would love that conversation. I’d learn a lot and I’d enjoy every minute of asking questions.

Quick Hit: Chrome Is Getting an AI Scam Spotter

Google is rolling a Gemini-powered feature into Chrome that watches the sites you visit and flags potential scams in real time. It’s a useful idea. The caveat is that the bad guys are always at the bleeding edge and the defensive tools are always following. That’s just the nature of this. But making the browser itself a layer of protection — rather than relying entirely on the user to notice something’s off — is the right direction.

It won’t catch everything. It’s one more layer, not a replacement for the others. But I’ll take it.

That’s the week. If you’re curious about the November 18th webinar, stay tuned — more on that soon. See you next time.

— Albert

Questions about anything we covered today? Schedule a free IT consultation and we’ll walk through it with your business in mind.

Wherever your team is based, ACS provides hands-on managed IT support — see how we help businesses in Traverse City & Northern Michigan.

We have had so much feedback from people worried about AI in their business that I did a special edition of Nerds News instead of waiting for our regular Thursday show.

Chapters

• 0:00 What shadow AI is and why this is a special edition
• 2:37 How big it is: PagerDuty, Gartner, Microsoft, IBM
• 6:56 Your best people, not bad guys
• 7:38 What it looks like in a real shop: quotes and pricing
• 9:14 The bookkeeper and your P&L
• 10:43 Blocking it at the firewall doesn’t work
• 11:13 Customer data and your obligations
• 12:02 The three fixes
• 13:21 Free AI policy template
• 15:04 The two-minute test
• 16:28 How ACS runs AI
• 18:34 Where to start this week

What shadow AI is, and why this could not wait

Shadow AI is the AI that gets used without anybody knowing about it, except the people using it. It is AI tools your staff use for company work that the company never approved. Usually it is a personal ChatGPT, Copilot, or Gemini account, on a phone, a computer, or in a browser tab.

What scares me is that the free accounts are very powerful. People can get a lot of work done with them and create a lot of damage at the same time.

So why now? Because AI went from a curiosity to a normal way to work, and that happened in the last 18 months. Most owners have not caught up.

How big it is, and why this is not about bad guys

PagerDuty ran a survey in June of this year, 2026. It found 66% of office workers have used AI tools they believed were not allowed at work, and 88% have put work information into an AI tool. A third of them put in customer data, and a third put in financial or confidential documents. Public AI versus private tools is a big deal, and I will get to why.

Gartner has 68% of employees using unauthorized AI, up from 41% in 2023. They are doing it because they would rather drive than walk.

The Microsoft and LinkedIn Work Trend Index looked at small and medium companies and found that 80% of the people using AI at work there bring their own AI. If you are not providing it, they are bringing it. It might be a free public AI, or they might be paying for it themselves. If it is not configured correctly, whatever goes into it could end up as training data. That is why the difference between public and private matters. Big corporations have this locked down. Small business is where it is worst.

IBM’s 2026 breach report says shadow AI was involved in 43% of incidents, up from 20% the year before. That is better than a 100% increase in a year. Breaches involving it cost about $400,000 more than average.

We are not talking about bad guys. We are talking about your best people doing their best work with the best tools. Why walk when you can drive? Why take a bus when you can take a plane, and not just any plane, Delta quality at discount airline prices, up to and including free?

What it looks like in a real shop

Quote generation is the one I know is happening, because I have talked to people about it. Take a custom manufacturer. Every quote is unique. There are general guidelines around it, but for the most part each one is different. An AI tool can make that faster, better, and more consistent. It is a powerful tool, and you want your employees using it.

The problem is a free tool, or an AI program that is not set up correctly. The pricing, the customer, and the methodology you use to build the quote all get fed into the AI. You are training it on how you do business, and it can turn around and use that same information for your competitors.

Say your bookkeeper uses an AI tool you do not know about. She takes the profit and loss, the asset lists, what you spend on administration or parts, and dumps it into Gemini on her free account. If you want to train your competitors on how your financials work, more power to you. I highly recommend we not do that.

Say you try to stop it at the firewall so nobody can reach ChatGPT. It is just as easy to use a cell phone to get around that. You are not stopping it with a block alone. You need teeth.

Customer data is probably the biggest one. We have a fiduciary responsibility to protect our customers’ information. If our employees feed it into AIs, and the AIs train on it or pull it in for whatever purposes those companies have, we are not doing our job. In some cases it is illegal. If you do defense work or you are in healthcare, you cannot let that information walk out the door.

The three things that fix it

Visibility. You cannot write a rule for tools you do not know about. Your Microsoft 365 sign-in and app consent logs show more than people expect, and that is the first thing the ACS readiness assessment looks at. Where are people signing in? What can we pull from firewalls and browser history so we know what is being used, who is using it, and how?

A policy people physically sign. It lists the approved tools, what data can go into them, that everything going out gets reviewed, and what happens if someone breaks the rules. Have your lawyer look at it. We are providing one for free at acsapp.com/aipolicy, our AI acceptable use policy template. Bring it to your team so nobody is confused.

An approved path. You have to give people the tools, because these tools are going to be good for you, maybe even better for you than for them. Not using AI today is like telling people in 1992 they could not use a word processor and had to use a typewriter. You are hurting your own bottom line because your people cannot be as productive. Shadow AI happens because the approved option is slower or does not exist. Copilot inside Microsoft 365, with the permissions cleaned up and ready, beats a personal ChatGPT, and your data stays in your tenant. Claude and GPT have the right ways to do it too, and so do all the big players.

The two-minute test, and how we run AI at ACS

To see where your company sits today, we have a small, simple tool. Do you have a written policy? Are your permissions set up right, and have you reviewed them? Do you know what AI tools your employees are using today? If you cannot answer all three, you are not behind. You are normal.

The full version is 10 questions and takes a couple of minutes. It scores you and tells you what to do first. We are not collecting anything. It is a free check at acsapp.com/aicheck, our AI readiness self-assessment.

At ACS we run a highly advanced AI setup. We have our own in-house AI on our own hardware, and we use the most advanced models from the biggest companies. We have built dozens of integrations, close to a hundred, between our own software and the vendors we use. We know how to make it so data never leaves the building.

We call our solution Managed Intelligence. The foundation is the policy, shadow AI monitoring, and Copilot or other AI license management. It runs from the assessment through creating and managing agents, training your employees, and building workflows that make them more productive.

So go get your free assessment at acsapp.com/aicheck. Go get your free download of the policy at acsapp.com/aipolicy. Take the test, get the policy, and give it to your team.

Questions about anything here? Schedule a free IT consultation and we will walk through it with you. More episodes are on the Nerds News page, where you can subscribe on Spotify, Apple Podcasts, or YouTube. Managed IT services in Traverse City from Advanced Computer Solutions, 402 S Union Street Suite B, Traverse City, MI 49684, 231-267-TECH (8324).

This guide is for small-business employees using Windows 11 who need to manually add or change domain-name-to-IP-address mappings on their computer. Editing the hosts file lets you redirect specific domain names to a chosen IP address without changing any DNS settings on your network. The fix requires opening Notepad as an administrator so Windows grants you permission to save changes to the file.

Where the Hosts File Lives

On Windows 11, the hosts file is located at C:\Windows\System32\drivers\etc\hosts. It does not have a .txt extension, so you must change a filter in Notepad’s Open dialog to see it.

Steps to Edit the Hosts File

1. Open Notepad as an administrator. Click the Start button and type Notepad. When Notepad appears in the results, right-click it and select Run as administrator.
2. Open the hosts file. In Notepad, go to File > Open. In the file explorer window that appears, navigate to C:\Windows\System32\drivers\etc.
3. Change the file type filter. At the bottom of the Open dialog, change the file type dropdown from Text Documents (.txt) to All Files (.*). The hosts file will now appear in the folder.
4. Select and open the file. Click on the file named hosts and then click Open.
5. Edit the file. Add a new line with your desired IP address followed by the domain name, or modify an existing entry. Any line that begins with a # is a comment and is ignored by Windows.
6. Save your changes. Go to File > Save. Because you opened Notepad as an administrator, Windows will allow the file to be saved.

Need Help?

If you run into trouble or are unsure what entries to add, contact the ACS support team at acsapp.com/contact-us and we’ll be happy to assist.

Common questions

Why do I have to run Notepad as an administrator to edit the hosts file?

The hosts file is stored in a protected Windows system folder. Standard user accounts do not have permission to save changes there. Running Notepad as an administrator gives it the elevated rights needed to write to that location.

Why can’t I see the hosts file when I browse to the folder in Notepad?

Notepad’s Open dialog defaults to showing only Text Documents (.txt). Because the hosts file has no extension, you must change the file type filter at the bottom of the dialog to All Files (.*) before it will appear in the list.

What does a ‘#’ symbol mean in the hosts file?

Any line that starts with a ‘#’ is treated as a comment. Windows ignores those lines entirely, so they will not affect how domain names are resolved on your computer. Comments are often used to leave notes or temporarily disable an entry without deleting it.

This guide is for small businesses using Microsoft 365 Exchange Online without Intune device management. If your employees use iPhones or iPads, those devices may be connecting to company email through native mail apps or other third-party clients that bypass your security controls. By enabling Modern Authentication, blocking legacy protocols like Exchange ActiveSync, and setting up Conditional Access policies, you can ensure that iOS users can only access company email through the Microsoft Outlook app — and you can further restrict what they can do with that data.

Step 1: Enable Modern Authentication and Block Legacy Protocols

1. Enable Modern Authentication for your Exchange Online environment. This requires users to sign in using modern authentication methods such as OAuth 2.0 rather than older, less secure login methods.
2. Disable Exchange ActiveSync (EAS). ActiveSync is an older protocol used by many built-in mobile mail clients. Disabling it prevents those apps from connecting to Exchange Online, where they can often bypass more granular security controls.
3. Confirm that going forward, users must access email only through approved Microsoft applications, specifically the Outlook for iOS and Android app.

Step 2: Configure a Conditional Access Policy

1. Sign in to the Microsoft Entra admin center.
2. Create a new Conditional Access policy and target the Office 365 ExchangeOnline cloud app.
3. Under client apps, select Mobile apps and desktop clients.
4. Under device platforms, select iOS.
5. Under Grant controls, enable both Require approved client app and Require app protection policy. These controls together ensure that only approved, managed apps can access company email and that app protection policies are enforced on those apps.

Step 3: Create and Link an App Protection Policy

1. In the Microsoft Entra admin center, create a new App Protection Policy scoped to iOS.
2. In the policy settings, configure data transfer restrictions. At a minimum, consider blocking Copy and paste, Save As, and Downloaded to device actions to limit how company data can be moved or stored on unmanaged devices.
3. Link this App Protection Policy to the Conditional Access policy you created in Step 2. This ensures the restrictions are enforced whenever a user on an unmanaged iOS device accesses Exchange Online through an approved app such as Outlook.

Need Help Setting This Up?

These configurations touch several layers of your Microsoft 365 environment. If you would like assistance implementing them correctly for your organization, contact the ACS team and we will be glad to help.

Common questions

Why can’t I just block all mobile access to company email?

Blocking all mobile access would prevent employees from using company email on their phones entirely, which is often not practical. The approach in this guide takes a middle path: it blocks unapproved apps and legacy protocols while still allowing access through the Outlook app, where you can control what users can do with company data.

Do my employees need to do anything after these policies are set up?

Yes. Once the Conditional Access policy is in place, any iOS user who tries to access Exchange Online through a native mail client or other unapproved app will be blocked. They will need to install the Microsoft Outlook app and sign in there instead. Users already on Outlook may be prompted to re-authenticate.

Does this setup require Intune or device enrollment?

No. This guide is specifically designed for businesses that do not use Intune. By combining Modern Authentication, blocking Exchange ActiveSync, and enforcing Conditional Access with app protection policies, you can protect Exchange Online email on unmanaged iOS devices without requiring full device enrollment.

This guide is for small-business employees who connect to a work server or remote computer using Remote Desktop Protocol (RDP) and cannot print to their local printer from inside that remote session. Enabling the printer redirection setting in your RDP connection file will make your local printers appear automatically every time you connect, with no changes needed on the server.

What Is RDP Printer Redirection?

Remote Desktop Protocol includes a built-in printer redirection feature. When it is turned on, RDP forwards print jobs from your remote session back to your local computer, where your own print driver handles them. This means you can print documents from a remote desktop just as easily as if you were sitting at your own desk—without an IT administrator having to set up your printer on the remote server.

How to Enable Printer Redirection

1. Locate your RDP connection file (it ends in .rdp).
2. Right-click the file and select Edit.
   Note: On Windows 11 you may need to select Show More Options first before the Edit option appears.
3. Click the Local Resources tab.
4. Under Local devices and resources, check the box labeled Printers.
5. Save the file if you want the setting to persist, then connect to the remote machine as normal.

Once connected, your local printers will appear inside the remote session with the word (redirected) after each printer name.

Things to Be Aware Of

Printer redirection can change the default printer inside your remote session to match the default printer on your local computer. If the remote system was previously set to use a specific network printer by default, you may notice it has switched—this is expected behavior and not an error.

In rare cases, a network-shared printer on the remote server may be unable to print unless the redirected default printer from your local computer matches that same printer. This unusual situation has only been observed when the target printer on the remote machine was added using the share printer on network feature and the local client machine is sharing that printer over a USB connection. If you run into this, contact your IT provider for assistance.

Need Help?

If you are still unable to print after following these steps, the team at Advanced Computer Solutions is ready to help. Contact ACS here.

Common questions

Why do my printers show the word ‘redirected’ in the remote session?

When printer redirection is active, RDP labels your local printers with ‘(redirected)’ so you can tell them apart from any printers configured directly on the remote server. They work the same as any other printer—just select one and print as normal.

Will enabling printer redirection change my default printer on the remote server?

It can. RDP printer redirection may set the default printer in your remote session to match the default printer on your local computer. If the remote system was using a specific network printer as its default, you may see that change after connecting. This is normal behavior built into the feature.

Do I need to do anything on the server to make printer redirection work?

In most cases, no. Printer redirection is handled on the client side—meaning you only need to enable it in your RDP connection file on your own computer. No administrator setup on the remote server is required for your local printers to appear in the session.