O365 Dirsync to ADFS

[synaesthesia]

Allo Another daft 365 question!

 

We're currently using Dirsync to good effect, it all works well. (touches wood, crosses fingers).

 

We'd like to expand a little and make use of some Sharepoint stuff, however for what we have in mind we'd need single sign on as opposed to Dirsync's same sign on. So that brings us to ADFS.

 

Questions for the floor:

 

Is it possible/simple to move from Dirsync to ADFS?

 

What are the rough, real life requirements and vague steps for setting up ADFS? (that's from real experience rather than the muddle of information from Technet!)

 

I keep hearing about massive changes to the way both Dirsync and ADFS work. Does anyone have any information as to whether that's something that will have any effect on this, if we should hold fire for (how long) until it's done and go to that instead?

 

Some of the information we've found says the new tool is a direct replacement for Dirsync and is called "Windows Azure Active Directory Sync". However, that's exactly what the version of "Dirsync" we have installed is called...

 

Cheers

Edited October 21, 2014 by synaesthesia

[jamesb]

It is possible to move.

 

It's been a while since I've done it, but the basic steps back then were:

1. Deploy ADFS server in each client domain

2. Set up Authentication provider within SharePoint

3. Configure Auth provider in SharePoint to point at client ADFS server(s)

 

I was configuring it for SharePoint in a resource domain, with a couple of dozen client domains, so for you it should be simpler since O365 has half the work already completed. The main problem I found was the lack of information out there, but this was a few years ago now so hopefully there's more.

[synaesthesia]

Cheers - yeah the information going from one to the other seems very scarce indeed. I think I can rule out this "new tool" because we are in fact already using it with password sync, so that's certainly not an issue.

My main worry is ADFS overwriting any accounts/changes for obvious reasons. We're in two minds whether to do it or not; one of the main reasons is to provide SSO in school and also to knock up a sharepoint "portal" or intranet, where we can provide staff and students a separate home page for the internet based on their login groups/credentials.