O365 and OnSite Active Directory - Should I merge?

[jamesbmarshall]

My two cents on this...

 

Connecting your local AD to Azure AD: YES. Makes managing the whole user lifecycle much easier. Password sync is more than adequate for most scenarios. It's a total no-brainer in my view. Plan carefully, then celebrate your sensible decision with a little dance.

 

ADFS: (probably) NO. I've written this up and shared it on this forum numerous times: Deploying Office 365 Education? You don't need single sign-on, and here's why!

 

I still stand by what I say in the post, even if it is probably slightly out of date now (I need to go back and update with some of the changes that have happened in the year since I wrote it).

[gshaw]

@jamesbmarshall I'd be inclined to agree if we weren't going head-on into SharePoint and need some form of desktop SSO functionality. Although passwords are the same multiple logon screens really do annoy users, especially for something like an Intranet page that people load up regularly.

 

We're currently trying out a couple of third party alternatives as the whole ADFS setup seems to be a bit overcomplicated (and more potential for service disruption) just to get an AD password to load up an Office 365 page. Seems there's a gap in the market for some sort of desktop app that can take a Windows password hash on logon and auto-fill the Office 365 credential screen with the same details. Whether it's technically feasible I'm not sure but somehow feels like it could be possible.

 

There's also the great Windows 10-shape hope on the horizon that might finally be able to tie everything together if the (hastily deleted) blog post that came out a week or so back from Microsoft Germany is correct

Edited October 13, 2014 by gshaw

[FN-GM]

@jamesbmarshall I'd be inclined to agree if we weren't going head-on into SharePoint and need some form of desktop SSO functionality. Although passwords are the same multiple logon screens really do annoy users, especially for something like an Intranet page that people load up regularly.

 

We're currently trying out a couple of third party alternatives as the whole ADFS setup seems to be a bit overcomplicated (and more potential for service disruption) just to get an AD password to load up an Office 365 page. Seems there's a gap in the market for some sort of desktop app that can take a Windows password hash on logon and auto-fill the Office 365 credential screen with the same details. Whether it's technically feasible I'm not sure but somehow feels like it could be possible.

 

Its not complicated, its easy to setup! Doesn't take long at all. Anyone who knows server stuff will fine it easy.

[gshaw]

Its not complicated, its easy to setup! Doesn't take long at all. Anyone who knows server stuff will fine it easy.

 

I know the process, been following it since 2010

 

Are you running any of it in Azure? More of the worry is bringing reliance back to your in-house servers to handle authentication to O365. Quite a bit of additional risk for what's a fairly minimal gain (e.g. Outlook doesn't SSO)

[soveryapt]

I feel I opened a can of worms again, but never the less, thanks to all who have responded. I think initially, I'll probably look at password sync just to get that a step easier, and then at some point down the line maybe go to ADFS if it's felt it's needed.

 

I just want to try and remove some steps when staff come and say "I've forgotten my password" - which .. your logon, e-mail, BSquared, Mahara, Espresso.... etc..

[FN-GM]

I know the process, been following it since 2010

 

Are you running any of it in Azure? More of the worry is bringing reliance back to your in-house servers to handle authentication to O365. Quite a bit of additional risk for what's a fairly minimal gain (e.g. Outlook doesn't SSO)

 

No Azure here. There isn't much risk. Internet has a backup connection, everything has high availability. Hardly anything to go wrong. Outlook doesn't have SSO but OWA, Lync and Sharepoint does. Infact more stuff than doesn't has it.

[Ben-BSH]

Bare in mind you can always ( and id recommend) DirSync as a backup / failover for ADFS, so you can always get in to your cloud services should the source of authentication go down.. With the last password hash http://social.technet.microsoft.com/wiki/contents/articles/17857.dirsync-how-to-switch-from-single-sign-on-to-password-sync.aspx

[gshaw]

@FN-GM seeing as you've got a pretty much textbook setup could you answer a couple of quick questions?

 

- does the OWA app for iOS work OK with ADFS authentication? Suspect it should be fine but it's vital for our users and they'd be most unhappy if we broke it!

 

- have you created smart links so SharePoint goes straight in rather than taking you to an email address screen first?

Office 365 – Single Sign-On for SharePoint, Skydrive, CRM, etc. via Smart Links | Jack Stromberg

 

- does Lync automatically sign in on first logon with ADFS or do you have to supply any details in the logon box?

 

- if you're running Office 2013 does it automatically populate the Office 365 \ SharePoint save locations (assuming it signs you into O365 as well as the domain)

Edited October 14, 2014 by gshaw

[FN-GM]

@FN-GM seeing as you've got a pretty much textbook setup could you answer a couple of quick questions?

 

- does the OWA app for iOS work OK with ADFS authentication? Suspect it should be fine but it's vital for our users and they'd be most unhappy if we broke it!

 

- have you created smart links so SharePoint goes straight in rather than taking you to an email address screen first?

Office 365 – Single Sign-On for SharePoint, Skydrive, CRM, etc. via Smart Links | Jack Stromberg

 

- does Lync automatically sign in on first logon with ADFS or do you have to supply any details in the logon box?

 

- if you're running Office 2013 does it automatically populate the Office 365 \ SharePoint save locations (assuming it signs you into O365 as well as the domain)

 

-Yep, its fine.

-Not in use Yet

-Yes it populates the address and logins in without a password. To auto populate the sign in address populate the msRTCSIP-PrimaryUserAddress attribute in Active Directory.

-Not using sharepoint as yet.

Edited October 14, 2014 by FN-GM

[jamesbmarshall]

Its not complicated, its easy to setup! Doesn't take long at all. Anyone who knows server stuff will fine it easy.

 

It's not if you know what you're doing, but the concept of federated identity and single sign-on is relatively advanced. Not everyone who works in schools IT has that experience or confidence. If you've got the skills, the budget and time to implement it properly then go for it!

 

 

Are you running any of it in Azure? More of the worry is bringing reliance back to your in-house servers to handle authentication to O365. Quite a bit of additional risk for what's a fairly minimal gain (e.g. Outlook doesn't SSO)

 

You can actually split your ADFS infrastructure between Azure IaaS and your local DC. There's a whitepaper on this (Download Office 365 Adapter: Deploying Office 365 Single Sign-On using Windows Azure from Official Microsoft Download Center) which has been around for a while now. Probably still all valid, certainly the general gist is.

[FN-GM]

It's not if you know what you're doing, but the concept of federated identity and single sign-on is relatively advanced. Not everyone who works in schools IT has that experience or confidence. If you've got the skills, the budget and time to implement it properly then go for it!

 

A network manager should have these skills to be in that post. If you don't there are loads of videos and blogs on the net, very easy to follow those.

[Ephelyon]

A network manager should have these skills to be in that post.

 

But we know plenty of schools don't have standards for that sort of thing because they wouldn't know how to set them. It's very easy in this sector to be improperly recruited unless you're a teacher (and sometimes even then I'm sure).

Edited October 16, 2014 by Ephelyon

[FN-GM]

But we know plenty of schools don't have standards for that sort of thing because they wouldn't know how to set them. It's very easy in this sector to be improperly recruited unless you're a teacher (and sometimes even then I'm sure).

 

You have a point and I do think it needs fixing. Far to many people in IT in schools who don't know what they are doing.

[Ephelyon]

Well, we don't exactly attempt to set standards ourselves, do we? Some are available (through SFIA, CITP etc) but there is no universal, active encouragement to ensure that IT professionals - you know, the ones who manage the technology that half the bloody planet now hangs off the back of - are actually any good. And the BCS won't touch us of course. Personally I think all IT professionals ought to be regulated and licensed to practise, just like a plumber or a doctor. In fact, I think it's so important for the world in general that I'd support the introduction of such a measure even if it meant I myself didn't meet those standards and had to retrain or find another career. Edited October 16, 2014 by Ephelyon

[gshaw]

And the BCS won't touch us of course

 

That's surprising, I'm a member (MBCS) - 5 years experience and a reference from another professional who has BCS membership will get you in no problem.

 

As for not uunderstanding the techologies behind ADFS and so on Microsoft (and partner blog sites etc.) all put plenty of content out there so at the very least IT professionals in any industry who are using these cloud products should understand the options available and use that to make an informed choice of how they're going to set it up.

Edited October 16, 2014 by gshaw

[FN-GM]

Well, we don't exactly attempt to set standards ourselves, do we?

 

Speak for yourself

 

Anyway I don't think the mods will like us going off topic, sorry its my fault

[Ephelyon]

Oh, you can become a member, but they won't do anything to recognise how the education sector is a different beast from many of the rest, as those on their Policy Hub know only too well.

 

*Clumsily attempts summoning charm for @GrumbleDook*

 

- - - Updated - - -

 

Speak for yourself

 

Anyway I don't think the mods will like us going off topic, sorry its my fault

 

Well, quite. But what I mean is as a general sector, we don't.

[GrumbleDook]

A network manager should have these skills to be in that post. If you don't there are loads of videos and blogs on the net, very easy to follow those.

 

Erm, why is it a must that they have that? Heck, if I want to incorporate OpenDirectory into an open LDAP service why do I need have the skills myself when someone else might have them that I can either bring in or employ? The same applies for any tech. If you are talking about a SysAdmin then you are closer to the the truth ... but in Education all our skillets are very stretched and sometimes having a little knowledge means we try things but they can go *very* wrong.

[FN-GM]

Erm, why is it a must that they have that? Heck, if I want to incorporate OpenDirectory into an open LDAP service why do I need have the skills myself when someone else might have them that I can either bring in or employ? The same applies for any tech. If you are talking about a SysAdmin then you are closer to the the truth ... but in Education all our skillets are very stretched and sometimes having a little knowledge means we try things but they can go *very* wrong.

 

A school that is heavily reliant on AD should have staff who know how it works and how authentication works.

[GrumbleDook]

That's surprising, I'm a member (MBCS) - 5 years experience and a reference from another professional who has BCS membership will get you in no problem.

 

As for not uunderstanding the techologies behind ADFS and so on Microsoft (and partner blog sites etc.) all put plenty of content out there so at the very least IT professionals in any industry who are using these cloud products should understand the options available and use that to make an informed choice of how they're going to set it up.

 

Going *very* OT on this for a sec (and not aimed specifically at you but the general EG membership) ... and it is worth having a search for other rants and frustrates posts by both me and @Ephelyon ... BCS will take pretty much anyone as a member. It doesn't mean that they recognise your role as part of the 'profession', that they actively work to align your roles against any standards, or even provide advice / guidance / expertise for that matter.

 

You mention working in education to BCS and you *will get pushed towards BCS Academy ... and they want nothing whatsoever to do with us. They are only interested in pushing coding into schools and talking to a handful of teachers. Getting onto the SIGs for Learning and Development gives you a slightly better position, but that is very centred around professional CPD (i.e. L&D in companies as part of their CPD programmes) and HE/FE.

 

The one time BCS Academy did open their eyes a bit it was only to push towards the membership team ... basically passing the buck. The membership team were interested in seeing if something could be done so a few of use tried to generate some interest from the Admins, Mods and members here ... and were met with complete apathy!!!!!!! And let's face it, if folk here can't be bothered then why on earth are BCS going to bother in return.

 

So, until EG members start hammering on BCS' door there were be little out there to get them to support us in a professional capacity. The work that Rich and co at ANME could provide a bit of a groundswell ... but that will take time to build up. At the moment we are still in the same position. No-one wants to actively engage with us as there is a strong does of apathy around and no-one here will get off their backsides to join in the work. And before anyone says that they expressed an interest in helping ... 5 people does not make a movement.

 

Yes, it is something I am passionate about ... yes, I have tried to do stuff before but it died due to apathy and no, I am not going to directly get involved again on it as I don't have time, my day job does not directly give me a role looking after IT folk in schools and I have other work and life priorities. If anyone does want to get off their backsides and get involved then @Ephelyon and @RichPowell are good folk to start with.

[GrumbleDook]

A school that is heavily reliant on AD should have staff who know how it works and how authentication works.

 

No, they should ensure that the skill set and knowledge is available. You are presuming that a) every schools works on AD b) every school has a tech team on site and c) that understanding authentication and understanding the configuration complexities of federation are the same.

[PotNoodleTech]

Going *very* OT on this for a sec

 

We appreciate your efforts over the years dook master general.

 

One question I have - summarise in one sentence, why I NEED to join the BCS?

[GrumbleDook]

We appreciate your efforts over the years dook master general.

 

One question I have - summarise in one sentence, why I NEED to join the BCS?

 

BCS offers a non-vendor specific recognition that you work in the IT sector, providing access to information and expertise that may help you in your professional standing (including local branches who hold regular meetings and demos), as well as a framework for *you* to match yourself against, including the opportunity to achieve Chartered Status due to knowledge and expertise in a range of Areas within the IT sector.

 

in short, it is a club that could help but you have to do some of the leg work, but it is an internationally recognised club that still has a lot of weight, even if it isn't for your particular area or job. It is not a union, not a social body (though some local branches are good for that) or a guarantee of a job.