Office 365 with SSO availability question

[themightymrp]

Just a quick one,

 

If I setup Office 365 with the AD FS services and single sign-on, what happens to people being able to access emails from home if there is a powercut in school?

 

The way I am reading things, with SSO users would be authenticated against the school Active Directory via the FS proxies. If the school itself is down, is email also unavailable from home?

 

Does that make sense?

 

Cheers

[jamesbmarshall]

You're correct - once you deploy AD FS you become the single point of failure, so if your AD FS servers go down for whatever reason, your users will be locked out.

 

There are partner solutions, such as IAM Cloud, that can help mitigate against this, but your summary above is accurate.

[themightymrp]

Just been looking at the IAM Cloud you mentioned, do you have any clue how much it costs? I can find no pricing structure anywhere!

[Michael]

This is why for Primary schools I've not rolled out the SSO option. Generally they have one or two servers at most. You also have to consider that sometimes LAs have a habbit of performing maintenance on weekends or holidays, cutting the link between your servers and the outside world. Again this would prevent your users signing into their e-mail accounts.

[themightymrp]

A very valid point. But we are looking to move away from our LA supplier and go-it-alone as it were.

 

I'm getting there with the actual setup of 365, its just this downside of SSO which is bugging me. Powers that be would prefer it but I don't really see a need for SSO. Management is straight-forward using online tools....

[Michael]

Bulk import users with a CSV, then using PowerShell you can reset user passwords to something different, then force them to change it. That's how I've gone about it and it's been absolutely fine.

 

It basically means if users cannot login, odds are there may be an issue with Office 365 as a service anyway, rather than trying to work out where in the chain things are broken.

[Cache]

If I was going to roll out Office 365 I would want the SSO as well which is the main thing holding me back currently unfortunately (that and time).

 

I did go to a Microsoft Hybrid IT Roadshow the other week and while it was pitched way way above any level I could possibly want to achieve, it did give me an idea. One of the key things it was showing was Azure, SCCM and the private/public cloud. While an added cost, it did make me think one possible way arround it if it could work would be to have a vpn to an Azure server, on that server host the ADFS and a Read-Only domain controller to handle all that side of things.

 

It's certainly not something I would know how to do or if it's technically possible or not, but in my mind it seemed to make sense.

[themightymrp]

What you are describing sounds a lot like the IAM Cloud service mentioned above. It's paid for (no clue how much) but does something very similar

[Cache]

Your right, reading through IAM cloud it seems to do what I was suggesting. Guess it would just be matching the costs up between doing it yourself and the price they charge (FAQ on their site suggests the pricelist should be up there somewhere but can't find it)

[Edu-IT]

I'm not sure I understand how this IAMCloud works. It looks to still need to be contacting Active Directory?

[themightymrp]

I received this in my Inbox from @paulgreeniamcloud

 

Hi,

I'm one of the identity specialists at IAM Cloud.  You're right in thinking that the solution contacts Active Directory, but only to periodically (every 2 hours) refresh the information which is sync's to the IAM Cloud hosted directory, from which authentication requests are performed.  That means the school/organisation's directory/Internet connection can be completely unavailable but authentication can still happen, so long as IAM Cloud's service is available.  Although the identity sync is two-hourly, password resets are immediate.  All this is done with virtually no on-premises component: only a password filter is needed to be installed on each domain controller for password transmission.

To make the service as resilient as possible, we provide multiple servers for every mission-critical aspect of the solution (so multiple directory/federation servers), and for added resilience, load balance the solution geographically by hosting it in two Azure data centres, but ensure data never leaves a geographic region: i.e. European customers have data hosted in, and which never leaves Europe.

Please contact me privately or log a 'contact us' request on the website if you'd like some more information; the cost for education is typically under £2000 for all students, including set up, customisation and support for both the hosted identity and SSO service.  We're UK-headquartered and me and my colleagues would be delighted to explain more about the solution.

Many thanks,
Paul

[Cache]

I was doing some more research yesterday and actually came across this: http://activedirectory.windowsazure.com

 

Still in preview at the moment, but looks like they might be offering it for free, would be a way of achieving the IAM cloud/the method I roughly outline without any cost I think..... Access Control Service 2.0 & Identity: Windows Azure Active Directory

 

Edit: actually never mind with that, think I've got completely the wrong end of the stick with it.

Edited March 24, 2013 by Cache

[AngryTechnician]

I've been quite hung up on the SSO side of Office 365 too, but after a conversation with another local school who are using it without SSO, I'm coming around to the idea. Points to consider are:

 

1. Outlook users have their credentials saved so don't have to re-enter them for day-to-day email access.
   
2. If you tick 'Keep me signed in' on the Office 365 portal, you don't have to re-enter credentials every session.
   
3. Unless your current email system is already very good, the improvement brought by Office 365 may well offset the inconvenience of a separate sign-in.
   
4. Users these days generally have at least a couple of other accounts that don't have synchronised passwords anyway (even our Year 5s have Edmodo accounts with separate passwords)
   
5. There's nothing to stop users from setting their password to be the same as their on-premises one to help them remember it.
   

 

I've just set up the AD Directory Sync part to at least get that part working (and it was relatively painless, even on Windows Server 2012 Core), and will be trying it out without SSO to see how we get on.

[jamesbmarshall]

I was doing some more research yesterday and actually came across this: http://activedirectory.windowsazure.com

 

Still in preview at the moment, but looks like they might be offering it for free, would be a way of achieving the IAM cloud/the method I roughly outline without any cost I think..... Access Control Service 2.0 & Identity: Windows Azure Active Directory

 

 

Windows Azure Active Directory is the identity platform that underpins Office 365; it's an extensible service that allows customers and partners to develop solutions that can hook into the WAAD identities to use with other services. It isn't the same as your traditional AD, hosted in the cloud, but I think you've figured that out!

 

Every existing, and new, Office 365 tenant has WAAD at the core.

[themightymrp]

If you have setup AD synchronisation with the Azure system, does that not then have the ability to authenticate users when they try to sign on? So that, in the event of the schools AD system being down, people can still log into email?

[AngryTechnician]

If you have setup AD synchronisation with the Azure system, does that not then have the ability to authenticate users when they try to sign on?

No, because directory sync does not copy passwords to Azure.

[themightymrp]

Bu**er. Thanks

[jamesbmarshall]

No, because directory sync does not copy passwords to Azure.

 

Yet

[jamesbmarshall]

If you have setup AD synchronisation with the Azure system, does that not then have the ability to authenticate users when they try to sign on? So that, in the event of the schools AD system being down, people can still log into email?

 

If you set up DirSync you can still log into Office 365 even if your AD is unavailable because Office 365 holds a separate set of credentials for your users; it is only if you deploy AD FS that you become that single point of failure that requires your AD to always be available.

[Cache]

Windows Azure Active Directory is the identity platform that underpins Office 365; it's an extensible service that allows customers and partners to develop solutions that can hook into the WAAD identities to use with other services. It isn't the same as your traditional AD, hosted in the cloud, but I think you've figured that out!

 

Every existing, and new, Office 365 tenant has WAAD at the core.

 

Yeah that's what I figured out, althoguh I think I went arround 20 different sites until I found out that it was just what underpinned it, not holding the password.

 

It's such a shame that it doesn't though........

[AngryTechnician]

Directory sync does not copy passwords to Azure.

 

Yet

 

 

It's not nice to tease!

 

Seriously though, I realise you may not be authorised to talk about it, but I'm going to ask anyway: any estimate on when that might happen? Even a hint?

[EduTech]

 

It's not nice to tease!

 

Seriously though, I realise you may not be authorised to talk about it, but I'm going to ask anyway: any estimate on when that might happen? Even a hint?

 

I don't believe any date has been officially published yet, but watch this space i can't see it being long now... :-)

 

I believe it was also spoken about at one of the recent Office 365 Conferences... so it's been put out there but with no dedicated information at present but this will be coming soon enough!

 

..

 

James.

[jamesbmarshall]

It's not nice to tease!

 

Seriously though, I realise you may not be authorised to talk about it, but I'm going to ask anyway: any estimate on when that might happen? Even a hint?

 

Are you kidding? It's not often I get to tease, so I take the opportunity when I can!

 

We've been working with some customers on testing PCNS-style functionality with Office 365 but at the moment we have no more information to share publicly. As soon as, and if, I can, I will.

[chazzy2501]

I'm just looking into 365 and SSO. I believe that I'm going to have a hard time. my users currently use their domain login locally 'dcc-sch-4505' domain their username '06thomph' and password. They currently use owa for email which can assume the domain name so its a simple domain username and password again. The issue is what happens if I move them to 365? Their email addresses are [email protected] not [email protected]?

 

What lies ahead for me?!

Edited April 23, 2013 by chazzy2501

[EduTech]

Hi Chazzy,

 

The current username can stay the same and will not need to be changed, when you implement office 365 with SSO you modify the users Universal Principal Name (UPN)... You will add: beaminster.dorset.sch.uk as an alternative UPN and then you will assign this to all users, the first part of the UPN will most likely currently match the username, but it is recommended to change this to match the Primary SMTP Address.

 

I hope that helps,

 

Regards,

James.