On Premises ADFS / SSO Project

[IAMCloud_Curt]

Hi all,

 

As always, I prefer to share an idea on here as I appreciate there are many of you what have tried and experimented with things in the past and have produced a working solution or you can give me the best feedback possible.

 

Currently looking at designing a 3-year plan and basically, I would like to invent new ways of making student/staff's day-to-day tasks easier.

 

I am starting with Project #1 - Revamping our intranet for one of our high schools, which eventually will flow down our MAT and get deployed into our other schools. As part of this new Intranet platform, I want to integrate our O365 system into the new intranet, and use features such as MS Classroom, OneDriveFBusiness, and much more things MS has released the last few months, which I think will benefit our students and I could create something they could benefit from.

 

The main thing I wanted to discuss was the migration over to One Drive, and how to go about mapping users OneDrive's as a drive letter. I have previously configured AADSync with Azure and it's running nicely, and syncs AD passwords to be same as their email password.

 

I want to take that a step further, and get them using the One Drive, the way I see it is, it's such a ball ache to open your emails/MS products and open documents that way. Instead, I want users to get a drive map for One Drive and they save/open work that way.

 

Now, I know the current release of AADSync doesn't support what I am trying to do, so I looked into ADFS and doing it that way.

 

So, what I am looking for is;

 

- Has anyone accomplished this? I know it can be done (https://gallery.technet.microsoft.com/office/OneDriveMapper-automaticall-d7d498b0#content)

 

- Feedback from your users when migrating over to One Drive?

 

- Guide to setting up ADFS/SSO?

 

- Did you use a wildcard SSL for ADFS domain?

 

- Recommend Srv2012 or 2016 for this?

 

 

Thanks alot. Appreciate any feedback/help.

 

Curt

[Liam]

With limited time to reply at present I'll reply to the one drive bit. There is a new version this year that will change the way we use onedrive . It's a syncless client I believe.

[mukz]

Hi Curt, if im not mistaken @Arthur posted something on here 2 weeks ago about OneDrive no longer needing to be synced.

You can also use Liebensraum's OneDriveMapper for what it says on the tin, mapping a users onedrive to a driveletter. I used it when i started testing OneDrive and it worked great.

[Liam]

It's called one drive on demand

[gshaw]

OneDrive Files on Demand, coming soon as part of Windows 10 Fall Creators Update

 

I'd look at hosted SSO providers personally.

[psydii]

ADFS isn't really needed these days. You can achieve similar with Azure AD connect which replaced AD Sync a couple of years ago:

https://docs.microsoft.com/en-us/azure/active-directory/connect/active-directory-aadconnect-sso

 

If you need authentication for web based clients from outside your network, then there is Azure App Proxy:

https://docs.microsoft.com/en-us/azure/active-directory/active-directory-application-proxy-publish

 

 

Going in fresh at this point I would start with 2016, by the time you get into production they will likely have ironed out the most critical bugs. Also setting up the above you get access to the Azure/Office365 online support which is great.. they've fixed everything I have called about in a couple of hours. If you hit problems, don't be shy to log a call with them.

[Simcfc73]

I've had Azure AD connect running for a few years but am delving into MFA. The easiest way would be to use Azure APP Proxy but you need a AAD Basic subscription to use it and we are skint.

 

I'm going to have to use ADFS to use it for my Remote Desktop Gateway Server and OWA protection.

[gshaw]

I've had Azure AD connect running for a few years but am delving into MFA. The easiest way would be to use Azure APP Proxy but you need a AAD Basic subscription to use it and we are skint.

 

I'm going to have to use ADFS to use it for my Remote Desktop Gateway Server and OWA protection.

@Simcfc73

Azure AD Basic is free on your EES, you just have to request the licenses

[Simcfc73]

@Simcfc73

Azure AD Basic is free on your EES, you just have to request the licenses

 

Ahhh, I was waiting for my reseller to get back to me as I asked for Azure Premium pricing which was £££

[gshaw]

Premium is irritatingly priced per user rather than FTE but Basic will give you the App Proxy at no cost.

 

We use it for RDS access too, did a blog post about it recently funny enough.