soveryapt Posted October 8, 2014 Posted October 8, 2014 Afternoon all Ok, so back in March, we went O365 as a part of a bigger move away from the LEA Online Services. This was basically because it was the way that needed least training for staff who were used to an Outlook service from the LEA. Anywho, I rolled it out keeping the Active Directory separate and manually configured all the users on O365 (well from CSVs) and then migrated from the LEA Exchange. Now I've got a bit more time to look at things properly, I'm considering using Azure to sync the users from the AD, but can I do this and essentially take control. The idea is so that users have SSO abilities and they have one less password to remember or have reset, and then also looking at rolling out OneDrive and other facilities from O365. Any pointers or advice on this would be most welcome. I've had a bit of a Google about, but probably not my most in depth Google session ever, but I'm yet to find the answer as to whether you can merge the 2 or whether I would have to go about setting it all up again and migrating users into new boxes set up by Azure DirSync. Thanks all Andy
FN-GM Posted October 8, 2014 Posted October 8, 2014 If you want SSO you will need to use ADFS. Password sync will not provide SSO. Also if you use the full outlook client you won't get SSO with any service, however you will for OWA. Outlook will prompt the user for the AD password. Other services such as Lync will use SSO. 1
soveryapt Posted October 8, 2014 Author Posted October 8, 2014 So, assuming I've read the results I did find correctly, I could do this using ADFS with a backup on Azure for redundancy purposes. It's OWA that most use anyway (I'm trying to coax the office staff away from their desktop version too .. lol).
FN-GM Posted October 8, 2014 Posted October 8, 2014 Erm not sure with the Azure side. You could use password sync so the user have the same password for the service as they do on AD. But it won't be SSO. The good thing with ADFS you can brand the OWA login page with your own logo etc. 2
soveryapt Posted October 8, 2014 Author Posted October 8, 2014 Erm not sure with the Azure side. You could use password sync so the user have the same password for the service as they do on AD. But it won't be SSO. The good thing with ADFS you can brand the OWA login page with your own logo etc. Ok, I'll take a look then and see what there is. I mean, even having the same password would be a benefit, so I might just do that for now and read properly into ADFS and the requirements as we're looking to upgrade our servers anyway with SIMS stopping support for 2008R2 and all that .. Thanks Andy 1
FN-GM Posted October 8, 2014 Posted October 8, 2014 ADFS is pretty easy and quick to setup. Most of the time taken is prepping the server. Some people seem to be reluctant to use it for some reason.
chazzy2501 Posted October 8, 2014 Posted October 8, 2014 ADFS will require that you already have a PKI setup up and running (public .CRL etc) Password sync requires far less infrastructure. It gives you SameSignOn and syncs every 15 minutes. This means also that o365 can be used if you loose connectivity to the servers. (bad internet, planned out of hours maintenance) Just need to plop it onto a member server and set it up 15 minutes and no firewall rules, certs, public facing crl list servers etc..
FN-GM Posted October 8, 2014 Posted October 8, 2014 But a cert and a firewall rule is hardly worth worrying about.
Marshall_IT Posted October 8, 2014 Posted October 8, 2014 I sync local ad to office 365. I would definitely say yes, do it. To get some of the extra features you'll need to extend your schema with the exchange features. It's easy to do. It allows users to use the same logon and password, so not true SSO but Same Sign On SaSO. 2
PotNoodleTech Posted October 9, 2014 Posted October 9, 2014 (edited) This has been a useful thread - I've effectively got 3 days to set up O365 for staff (finishing Friday 3pm!). What plan are you guys on? I don't think I am on the right plan, the only free one available was "Office 365 Education E1 for Faculty" but I was originally planning to be on "Office 365 Education A2" I submitted a support call but Microsoft aint got back to me yet, it's been over a day Can you clever peeps confirm one thing, will implementing password synchronisation (only password sync, not SSO) require changes to the AD Schema or anything? I am part of LEA network so don't have cart blanche to fiddle around too much. Basically, I just want to get the user accounts dumped in, I can do the groups and whatnot myself really (I haven't got too much time!) Edited October 9, 2014 by PotNoodleTech
fairm010 Posted October 9, 2014 Posted October 9, 2014 What I want to know is: My users have been on Office 365 since March with their own mailboxes. If I start syncing with on site AD will it overwrite their mailboxes with new accounts or simply change the password for the existing ones if it sees the email address match?
FN-GM Posted October 9, 2014 Posted October 9, 2014 What I want to know is: My users have been on Office 365 since March with their own mailboxes. If I start syncing with on site AD will it overwrite their mailboxes with new accounts or simply change the password for the existing ones if it sees the email address match? As long as the full username including UPN match on both systems it will do the latter If not it will create 2 accounts. 1
FN-GM Posted October 9, 2014 Posted October 9, 2014 This has been a useful thread - I've effectively got 3 days to set up O365 for staff (finishing Friday 3pm!). What plan are you guys on? I don't think I am on the right plan, the only free one available was "Office 365 Education E1 for Faculty" but I was originally planning to be on "Office 365 Education A2" I submitted a support call but Microsoft aint got back to me yet, it's been over a day Can you clever peeps confirm one thing, will implementing password synchronisation (only password sync, not SSO) require changes to the AD Schema or anything? I am part of LEA network so don't have cart blanche to fiddle around too much. Basically, I just want to get the user accounts dumped in, I can do the groups and whatnot myself really (I haven't got too much time!) They have changed the name of the plans. It might be the same thing. It may require some AD changes. Is the AD UPN suffix yours public domain? For example is it school.com and not school.local? If it is not the public domain you will have to add a new UPN suffix - - - Updated - - - Thats good to know, thanks! Your Welcome
fairm010 Posted October 9, 2014 Posted October 9, 2014 Are there any other benefits to linking the two via ADSync other than the same password?
FN-GM Posted October 9, 2014 Posted October 9, 2014 Are there any other benefits to linking the two via ADSync other than the same password? Only 1 system to manage. You won't have to create, delete and rename accounts in 2 different locations. Just do it once and it will sync up to the cloud. It will also sync AD groups. You might want these groups for SharePoint or Exchange online. 2
fairm010 Posted October 9, 2014 Posted October 9, 2014 Hmm it's something I've wanted to do for ages but to be honest I don't think it is worth it at the moment. (Only our staff are on O365) Cheers!
PotNoodleTech Posted October 9, 2014 Posted October 9, 2014 They have changed the name of the plans. It might be the same thing. It may require some AD changes. Is the AD UPN suffix yours public domain? For example is it school.com and not school.local? If it is not the public domain you will have to add a new UPN suffix AH - I just saw the blog post on James Marshall's blog - Education A2 has been renamed Education E1 - so it looks like I am on the right plan!! Hmm @ AD Changes. its a .local domain and the domain is the whole LEA so I am not sure if I will be able to add our UPN suffix. So you're saying that it must be [email protected] as the domain suffix, no [email protected] ? :/ Cheers!
FN-GM Posted October 9, 2014 Posted October 9, 2014 AH - I just saw the blog post on James Marshall's blog - Education A2 has been renamed Education E1 - so it looks like I am on the right plan!! Hmm @ AD Changes. its a .local domain and the domain is the whole LEA so I am not sure if I will be able to add our UPN suffix. So you're saying that it must be [email protected] as the domain suffix, no [email protected] ? :/ Cheers! Yep that's what I am saying. The new UPN suffix doesn't have to apply to all users on the domain, it can only apply to yours if you want that (I suspect so).
PotNoodleTech Posted October 9, 2014 Posted October 9, 2014 Ok thanks for that. It looks as if I am going to have to manually create accounts via the CSV import whilst I get permission/arrange for the LEA to change the UPN suffix. One Q - can the "strong password" feature be disabled in the cloud settings? I.e caps, lowercase, numbers requirement?
Marshall_IT Posted October 9, 2014 Posted October 9, 2014 Ok thanks for that. It looks as if I am going to have to manually create accounts via the CSV import whilst I get permission/arrange for the LEA to change the UPN suffix. One Q - can the "strong password" feature be disabled in the cloud settings? I.e caps, lowercase, numbers requirement? The strong password feature cannot be turned off for cloud accounts. Sorry.
sted Posted October 9, 2014 Posted October 9, 2014 The strong password feature cannot be turned off for cloud accounts. Sorry. i think it can with powershell
FN-GM Posted October 9, 2014 Posted October 9, 2014 i think it can with powershell Not 100% sure but I also think it can.
Marshall_IT Posted October 10, 2014 Posted October 10, 2014 You can run the following command Set-MsolUserPassword -UserPrincipalName [userPrincipalName] -NewPassword [NewPassword] -ForceChangePassword $false However, most reports seem to suggest it doesn't work so well. It also definitely doesn't work on admin accounts. I think, it still requires a password of 7 characters. Just without the number/symbol/capital. For myself, this is pretty pointless. Might as well just leave it strong.
gshaw Posted October 10, 2014 Posted October 10, 2014 i think it can with powershell It definitely can, have to use PowerShell and users changing password via the GUI still seem to get a complexity requirement. However it does let you sync and \ or create simpler initial passwords, which can be useful in some situations. If you're putting DirSync in after already manually provisioning accounts on O365 be careful as we were warned in some scenarios you could end up deleting existing accounts. Here's the link we were given: How to Map OnPrem Active Directory users to existing Office365 Users « Software Development and Infrastructure in the Cloud Also when you first put it in set the deletion threshold down to 1 (or something similarly low) so that way if bad things start happening you'll catch it before any damage gets done. Finally, think about whether the benefits from ADFS are worth the extra complexity and element of risk (if you lose your on-prem servers you lose ability to sign into O365 etc.)
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now