Multiple O365 Portals

[truebluesteve]

I think I am about to get the OK to move from our onsite Exchange Server to O365 however I have a quick question....

 

We currently have a 365 account for our students - domain is school.org; however our staff email domain is school.org.uk. Student email accounts and passwords are created manually at the moment but we will be using dirsync for the staff domain.

 

Although I understand we can add another domain to our existing tenancy, we have been advised that it will be easier to manage if we create a new one for staff. Any thoughts on this from the experts? 😄

[Michael]

Easier to manage? I can't see why or how. Keep the existing domain/e-mail addresses for pupils and staff. You can even create aliases between the two different domains if that helps?

[snagrat]

Putting everything in the same Tenant is the best method. Sharing between the two would then be seemless.

 

Who told you separating them would be easier to manage?

[Haptic]

Once you enable DirSync on a tenant you can not disable it.

 

My advice would be to think about how you are managing pupil accounts now and how it is likely that you may be managing them in the future.

If you split them onto two tenants you will find it easier to manage the pupils and staff on separate domains or else you will be setting up complex routing and content filtering. If you need some free advice, give our consultant a call and run your intentions past him.

 

Joe

[snagrat]

Once you enable DirSync on a tenant you can not disable it.

 

My advice would be to think about how you are managing pupil accounts now and how it is likely that you may be managing them in the future.

If you split them onto two tenants you will find it easier to manage the pupils and staff on separate domains or else you will be setting up complex routing and content filtering. If you need some free advice, give our consultant a call and run your intentions past him.

 

Joe

 

You can disable DirSync on a tenant. All users are then converted to cloud based users and they can be managed like any other cloud based user. If you then re-enable DirSync then the user will be converted back to a AD Sync user.

 

Once you have the tenants created you cannot move the data to a new tenant. Therefore make sure you fully decide what you want to do s once done you may have trouble changing it at a later date.

[FN-GM]

Once you enable DirSync on a tenant you can not disable it.

 

You can actually. There is now a De-active button under users.

[truebluesteve]

We had a company in to provide a quote to do the work and their technical people suggested that it would be easier to manage because the domains are different and we won't be syncing the passwords for students - well not just yet anyway.

 

From the responses to my post I'm still not sure which way to go so I may give CPL a call!

 

PS

 

I had the quote from the company today and I'm still trying to relocate my jaw:eek:

[snagrat]

How much was it?

[truebluesteve]

Well it was a shade under £10,000 - although there were a couple of optional items which would knock about £1100 off that.

 

Bargain eh!

[snagrat]

That's ridiculous.

 

I know companies that will do it for about £ (not allowed to say I don't think)

 

How can they justify that? How many accounts are there to migrate - not that that should make a difference.

Edited June 27, 2014 by snagrat

[truebluesteve]

There are about 300 accounts to migrate and I have no idea why their price is so high. I was expecting a price somewhere around £1500 to you can imagine my surprise when I got the quote.

 

I would do it myself but I really don't have the time as there are a number of other things happening now and over the summer so I don't really want to overload myself with work.

[witch]

That's ridiculous.

 

I know companies that will do it for about £ (not allowed to say I don't think)

 

How can they justify that? How many accounts are there to migrate - not that that should make a difference.

Yes, you can say. You can recommend suppliers as well

[snagrat]

I'm in shock about that.

 

Are they a big company who do big migrations? Just wondering if they have a set fee regardless of size or customer.

[snagrat]

Yes, you can say. You can recommend suppliers as well

 

In which case I know companies that have migrated >2000 accounts from an Onsite Exchange for around £1000.

 

£1500 is a good figure to be working with.

[truebluesteve]

Yes recommendations are good

 

They aren't a huge company but deal in a few different markets - some of which obviously have deeper pockets than the education sector! Having said that, they sent me a case study of a college they did exactly the same work for.

 

Anyway suffice to say we won't be using them!

[pantscat]

That seems a bit steep! What on earth was their day rate?!

[themightymrp]

How much!!!! That's outrageous!

[truebluesteve]

I don't what the day rate is but this is a breakdown of the quote

 

Design & Planning £700.00

Project Completion £6,360.00

Post Project Consultancy Visit (optional) £650.00

Enhanced Implementation Package (optional) £595.00

Documentation £700.00

Project Management £650.00

 

I think they are used to dealing with corporate customers who almost expect these sort of charges - but I have no idea what you get in terms of documentation for £700. Answers on a postcard please (older geekers will get that reference!)

[snagrat]

Project Management?

 

Laughable if you ask me.

[EduTech]

I think I am about to get the OK to move from our onsite Exchange Server to O365 however I have a quick question....

 

We currently have a 365 account for our students - domain is school.org; however our staff email domain is school.org.uk. Student email accounts and passwords are created manually at the moment but we will be using dirsync for the staff domain.

 

Although I understand we can add another domain to our existing tenancy, we have been advised that it will be easier to manage if we create a new one for staff. Any thoughts on this from the experts? 😄

 

Hi,

 

I am sorry for the delay in the response, I did see this yesterday but was out of the office all day. anyhow, let me see if I can at least guide you in the right direction based on what you have said here.

 

I would recommend that you keep both your students & staff e-mail under the same tenant. If you were to split this out your only going to potentially end up in more pain later down the line and it's not easier to manage that is for sure.

 

I'll give you an example, at the moment you have all of your user accounts as Cloud Users. It would be far simper for you to setup OU filtering and sync your staff user objects to the same tenant. this will ensure that your current cloud user objects for students do not get linked together and stay as cloud managed users. If you were to setup different tenants, you need to be VERY careful with what objects you are going to be synchronizing to be sure that in the future, if you come to maybe setup Directory Sync in the other tenant that you do not end up with trying to sync the same on-prem object to two different tenants as this will cause you pain. furthermore, in the future if you choose to setup directory sync for students you'll then have to manage 2 separate DirSync Installation as your not able to Sync objects to two different tenants using One DirSync Installation.

 

furthermore, you just have a large administrative overhead by having them separate and complexity that is just not required. what if in the future, you want to allow the students/staff to e-mail each other? they won't have the GAL to look up. If you use other features like SharePoint, Lync, OneDrive, Yammer etc. then the integration between your staff and students will always be separate. I can think of loads of reasons not to go ahead and split it, seriously i wouldn't recommend doing it. might sound all great now, but you'll find over time when you want to do more you'll hit complexities.

 

You should just add your staff domain into the existing tenant, and host your staff mailboxes on that tenant. yes you will have to ensure that you filter out your student accounts upon the directory sync installation but that is well documented although if your at it.. i would just do it all in one go and sync both your staff and your students and have the students on-prem objects soft-matched.

 

In terms of disabling directory sync, you do have the ability to do this.

 

The main thing to remember here as well is when you sign-up for Office 365 you get so much more than the SaaS applications you see in the portal that Tenant/Directory Instance can become quite powerful... and having two separate ones just does not make sense at all.

 

I am not in a position to comment on the costs, but I shall just end with saying lol.

 

I hope that helps, If you have any further questions let me know.

 

James.

[truebluesteve]

Thanks James - your reply was really helpful.

 

I had originally thought that I would host the staff email on the same portal but I wasn't sure how this would work in terms of dirsync. I was also under the impression (wrongly it seems) that a password change was needed to enable the sync to work - which is why I didn't want to include the students as part of the process.

 

When it was suggested to me that 2 portals would be best in terms of management I assumed it was because of dirsync but what you say makes sense.

 

So the long and short of all this is that I will stick to the one tenancy. I'm right that if I register the domain now it wont have any affect until the MX and DNS records are changed?

[EduTech]

Thanks James - your reply was really helpful.

 

I had originally thought that I would host the staff email on the same portal but I wasn't sure how this would work in terms of dirsync. I was also under the impression (wrongly it seems) that a password change was needed to enable the sync to work - which is why I didn't want to include the students as part of the process.

 

When it was suggested to me that 2 portals would be best in terms of management I assumed it was because of dirsync but what you say makes sense.

 

So the long and short of all this is that I will stick to the one tenancy. I'm right that if I register the domain now it wont have any affect until the MX and DNS records are changed?

 

No Problem.

 

You can limit the objects that are synchronized via Directory Sync if you so wish although really I do not see the benefit in you doing this, you may as well allow your students to also use the same Username and Password as well surely this is a better experience and better management from your perspective going forward.

 

In terms of the Password Sync the Password Hash's get synchronized immediately. or/ if there is an issue you can force a Full Password Sync.

 

Indeed, You would have your objects going to one single tenancy/directory and it will all be managed via the single Office 365 Administration Portal. In terms of adding the Domain you can do this but no mail will flow for this particular domain until MX Records are applied although be mindful of the accepted domain in exchange, you may find that you have to change this to shared so that it delivers student emails sent to staff to external mail provider and not Office 365 to prevent NDRs from being generated.

 

I hope that helps,

James.

[truebluesteve]

No Problem.

 

You can limit the objects that are synchronized via Directory Sync if you so wish although really I do not see the benefit in you doing this, you may as well allow your students to also use the same Username and Password as well surely this is a better experience and better management from your perspective going forward.

 

In terms of the Password Sync the Password Hash's get synchronized immediately. or/ if there is an issue you can force a Full Password Sync.

 

Indeed, You would have your objects going to one single tenancy/directory and it will all be managed via the single Office 365 Administration Portal. In terms of adding the Domain you can do this but no mail will flow for this particular domain until MX Records are applied although be mindful of the accepted domain in exchange, you may find that you have to change this to shared so that it delivers student emails sent to staff to external mail provider and not Office 365 to prevent NDRs from being generated.

 

I hope that helps,

James.

 

@EduTech

 

I have added and confirmed our staff email domain to our existing and all is OK. However regarding setting the domain from accepted to shared, I assume you mean new (staff) domain? There is an option to change it to internal relay but I am still getting NDR's for email sent from student email accounts (.org) to staff email accounts (.org.uk). Its fine the other way round.

 

Any suggestions?

 

Thanks

 

Steve

[EduTech]

@EduTech

 

I have added and confirmed our staff email domain to our existing and all is OK. However regarding setting the domain from accepted to shared, I assume you mean new (staff) domain? There is an option to change it to internal relay but I am still getting NDR's for email sent from student email accounts (.org) to staff email accounts (.org.uk). Its fine the other way round.

 

Any suggestions?

 

Thanks

 

Steve

 

Hi Steve,

 

You will need to setup a connector so that it sends the e-mail out over to a smarthost (MX Record) I believe for the domain that is still handling mail on-premise.

 

Many Thanks,

James.