Arthur Posted July 16, 2017 Posted July 16, 2017 Just come across this in the Office 365 Admin Center. Azure Active Directory Basic for Education will be included in your Office 365 subscription (MC109721) Published On: 14 July 2017 In the coming month, a new service plan Azure Active Directory Basic for EDU will be included in your current Office 365 for Education subscription. How does this affect me? We're letting you know in advance to let you know that this will not affect any functionality that you already have today. This service plan provides you all Azure AD Basic features. In addition the following capabilities are available for configuration/use: Enterprise State Roaming - allow users to sync their settings and app data between Windows 10 + Azure AD joined devices Allow SSO access for more than 10 applications The new service plan does help you to manage licensing easier: If you have already added the Azure AD Basic service plan separately, you are not required to assign individual licenses for Azure AD Basic. If you have not added the Azure AD Basic service plan, you do not need to add the additional service plan. What do I need to do to prepare of this change? There is no explicit action to add the new service plan and you do not need to notify users to take any specific action. Once this change is completed, you can choose to just use the service plan that comes with your Office 365 subscription instead of configuring the Azure AD Basic service plans and the associated license assignment. Please note that any Azure AD premium service plans will still need to be configured and assigned. 3
jmak Posted July 17, 2017 Posted July 17, 2017 Sounds good.... What does it mean in practice? I'm pretty sure it would be useful, but I'm also not clear on exactly what it offers and how easy it would be to set up. We have SSO to web services which use Groupcall which calls our onsite AD - so a single point of failure and also means that passwords can only be changed while in school. If I'm right, this would give me resilience for users away from school and allow authorised users to reset their own password offsite. Am I correct? Could it also offer me resilience onsite?
gshaw Posted July 17, 2017 Posted July 17, 2017 (edited) Still no password write-back for SSO users without the stupidly priced AAD Premium plan So frustrating MS don't get how much users value that feature and don't even make AAD Premium financially viable for Education. Only good thing is that you get Azure AD Application Proxy features without needing to request the Azure AD Basic licenses separately as you did in the past. Edited July 17, 2017 by gshaw
zag Posted July 17, 2017 Posted July 17, 2017 Basically Microsoft has made ADFS much easier(to the point where you do not need an ADFS server any more) and single sign on should now work with a single connector with most modern apps like skype and office. It looks like they finally may have nailed it.
gshaw Posted July 17, 2017 Posted July 17, 2017 But if a user wants to change their password from home you can't without third party product or AAD Premium
AlanD Posted July 17, 2017 Posted July 17, 2017 Oh...this sounds really good...if I understand it correctly. And does it mean that I no longer need to have a third party service like RM unify to provide SSO? And for apps in RM unify? If so that is a £1000 extra saved per year.
Cache Posted July 17, 2017 Posted July 17, 2017 (edited) But if a user wants to change their password from home you can't without third party product or AAD Premium I'm fairly certain Azure AD Connect does Password Writeback without an Azure premium plan? Edit: Maybe not, never looked at it that closely before! Edited July 17, 2017 by Cache
gshaw Posted July 17, 2017 Posted July 17, 2017 (edited) I'm fairly certain Azure AD Connect does Password Writeback without an Azure premium plan? Edit: Maybe not, never looked at it that closely before! Sadly not, the page redirects you to AAD Premium If MS licensed it for Edu at FTE count I'd buy it tomorrow but charging per user (including students) is just insane. It annoys me in the same way when MS tried to charge for the O365 mobile apps, too much £££ for non-profits and they know it. Edited July 17, 2017 by gshaw
jmak Posted July 18, 2017 Posted July 18, 2017 So is this free? Azure Active Directory Basic is free... But it doesn't include password reset 😔 Just a thought; could you hack together something using your entitlement to replicate your server in Azure (pretty sure that's now part of server licensing)? So essentially set up your DC, replicate it to Azure, use ADFS to sign in with domain credential via Azure Active Directory/O365 and give delegated rights for certain users to reset passwords? Seems overly optimistic, but you can always hope...
mrbios Posted July 18, 2017 Posted July 18, 2017 So does this remove the need for Azure AD premium from the equation if you wanted to use autopilot and intune?
mjk Posted July 19, 2017 Posted July 19, 2017 Azure Active Directory Basic is free... But it doesn't include password reset more confused than ever! Suppose I have an ancient 2003 or 2008 windows active directory and don't buy the annual schools agreement from microsoft because the licenses are perpetual: Could I then get free O365 and get free azure active directory to authenticate windows computers so I don't need to pay for a 2012/16 active directory server update and can get rid of my onsite AD? And I can't change a password ? ever ? Isn't that a tad insecure? I think I missed the point here.
mavhc Posted July 19, 2017 Posted July 19, 2017 more confused than ever! Suppose I have an ancient 2003 or 2008 windows active directory and don't buy the annual schools agreement from microsoft because the licenses are perpetual: Could I then get free O365 and get free azure active directory to authenticate windows computers so I don't need to pay for a 2012/16 active directory server update and can get rid of my onsite AD? And I can't change a password ? ever ? Isn't that a tad insecure? I think I missed the point here. a) Surely a Windows Server 2016 licence for education is only about £100, perpetual. b) Not sure, you'd need Windows 10 clients to join Azure AD, and you don't get group policy. You'd still need dhcp and dns of course. c) I think the password reset is self service, the admin can probably reset them
ellsandell Posted July 19, 2017 Posted July 19, 2017 more confused than ever! Suppose I have an ancient 2003 or 2008 windows active directory and don't buy the annual schools agreement from microsoft because the licenses are perpetual: Could I then get free O365 and get free azure active directory to authenticate windows computers so I don't need to pay for a 2012/16 active directory server update and can get rid of my onsite AD? And I can't change a password ? ever ? Isn't that a tad insecure? I think I missed the point here. Azure Active Directory (AAD) is not a replacement for onsite AD. The closest replacement for onsite AD would be Azure Active Directory Directory Services (AAD DS) but even that doesn't replace it fully. If you want to migrate your domain controllers in the cloud to use them for traditional task you could deploy domain controllers in Azure Virtual Machines and replicate via VPN.
mjk Posted July 19, 2017 Posted July 19, 2017 a) Surely a Windows Server 2016 licence for education is only about £100, perpetual. b) Not sure, you'd need Windows 10 clients to join Azure AD, and you don't get group policy. You'd still need dhcp and dns of course. c) I think the password reset is self service, the admin can probably reset them a) it's the User or Device CAL's that seem to be the expense. b) lack of GPO might be a problem, but almost anything can do DHCP/DNS c) ok Azure Active Directory (AAD) is not a replacement for onsite AD. The closest replacement for onsite AD would be Azure Active Directory Directory Services (AAD DS) but even that doesn't replace it fully.If you want to migrate your domain controllers in the cloud to use them for traditional task you could deploy domain controllers in Azure Virtual Machines and replicate via VPN. Good explanation. Thanks.
Popular Post bb12489 Posted August 15, 2017 Popular Post Posted August 15, 2017 I just thought I would reply to this thread, since I saw you guys making mention of the AAD Premium prices for password reset. I too found this to be completely ridiculous, so I did some digging and found their licensing page for SSPR here.... https://docs.microsoft.com/en-us/azure/active-directory/active-directory-passwords-licensing In the first paragraph is states "We do not enforce per-user licensing on the password reset experience" . this seemed to completely contradict everything I've heard and read about setting up the password reset(writeback) using AAD Premium. To my knowledge I thought you needed an AAD P1 license for each user in the tenant. At over 2000 users here, that would of gotten expense real fast, and just doesn't make sense. So I decided to buy a single AAD Premium license ($70 for the year), assign it to myself(global admin) and see if it would magically enable SSPR for everyone. Sadly this was not the case, and SSPR was complaining about not having enough licenses, but I soon figured out why. It seems that when you buy an AAD Premium license, you don't need to assign the license to anyone. Just having the license in the tenant enables certain premium features that aren't user specific. So I removed the license from myself, and all of a sudden the SSPR works correctly! I honestly couldn't believe it at first, so I tested it with multiple synchronized AD accounts, and test student accounts. Changing the password online through 365 does successfully write back changes to our on-prem AD! Now we have a fully working password reset solution, and way happier end-users! Long story short..... Purchase 1 AAD P1 license Do NOT assign the license to anyone in the tenant Open the Azure AD Connect application in your on-prem AD and configure password writeback Go to the Azure AD management online portal to enable password reset Profit! I hope this helps you guys out! 9
jurajt Posted August 15, 2017 Posted August 15, 2017 I just thought I would reply to this thread, since I saw you guys making mention of the AAD Premium prices for password reset. I too found this to be completely ridiculous, so I did some digging and found their licensing page for SSPR here.... https://docs.microsoft.com/en-us/azure/active-directory/active-directory-passwords-licensing In the first paragraph is states "We do not enforce per-user licensing on the password reset experience" . this seemed to completely contradict everything I've heard and read about setting up the password reset(writeback) using AAD Premium. To my knowledge I thought you needed an AAD P1 license for each user in the tenant. At over 2000 users here, that would of gotten expense real fast, and just doesn't make sense. So I decided to buy a single AAD Premium license ($70 for the year), assign it to myself(global admin) and see if it would magically enable SSPR for everyone. Sadly this was not the case, and SSPR was complaining about not having enough licenses, but I soon figured out why. It seems that when you buy an AAD Premium license, you don't need to assign the license to anyone. Just having the license in the tenant enables certain premium features that aren't user specific. So I removed the license from myself, and all of a sudden the SSPR works correctly! I honestly couldn't believe it at first, so I tested it with multiple synchronized AD accounts, and test student accounts. Changing the password online through 365 does successfully write back changes to our on-prem AD! Now we have a fully working password reset solution, and way happier end-users! Long story short..... Purchase 1 AAD P1 license Do NOT assign the license to anyone in the tenant Open the Azure AD Connect application in your on-prem AD and configure password writeback Go to the Azure AD management online portal to enable password reset Profit! I hope this helps you guys out! it sure does! i regiestered just to thank you and also to let everyone know, that if you contact your local MS reseller/volume representative, you can get much better prices, as they have some special education-discounted prices for variuous MS products. for example, aad premium p1 for faculty is (here, in slovakia, at least) 50c/month, and for student it's even 20c/month. hope it helps.
bb12489 Posted August 15, 2017 Posted August 15, 2017 it sure does! i regiestered just to thank you and also to let everyone know, that if you contact your local MS reseller/volume representative, you can get much better prices, as they have some special education-discounted prices for variuous MS products. for example, aad premium p1 for faculty is (here, in slovakia, at least) 50c/month, and for student it's even 20c/month. hope it helps. Glad it works for you as well! And glad I could help.
ICTICJTilson Posted August 15, 2017 Posted August 15, 2017 Hi zag, interested to read your post. Can I ask how this new feature replaces ADFS and what you mean by single connector?
SebD Posted August 17, 2017 Posted August 17, 2017 I would be careful with this, it also states "To maintain compliance with your Microsoft licensing agreement, you need to assign licenses to any users that use premium features." And there are comments at the bottom of the article: While it is possible to do that it would make you non-compliant with the licensing terms. Microsoft requires each user to have the appropriate license per the doc found linked below and in my original response. You will need to work with your licensing vendor of choice to make sure that you are compliant. In this case for Self-Service Password Reset/Change/Unlock with on-premises writeback you would need an Azure AD Premium P1 or P2 license as of today's date.
gshaw Posted August 17, 2017 Posted August 17, 2017 Yeah that seems risky to me, I'll raise a query with my MS reseller
bb12489 Posted August 17, 2017 Posted August 17, 2017 See, this is what's been confusing me on this. If it's this easy to enable with a single license, and they specifically stated that they don't enforce per-user licensing for the password reset experience, then why also include that part about providing a license for each user? This really needs clarification I guess. Why is MS licensing this difficult to decipher :/
bb12489 Posted August 18, 2017 Posted August 18, 2017 it sure does! i regiestered just to thank you and also to let everyone know, that if you contact your local MS reseller/volume representative, you can get much better prices, as they have some special education-discounted prices for variuous MS products. for example, aad premium p1 for faculty is (here, in slovakia, at least) 50c/month, and for student it's even 20c/month. hope it helps. I'll be checking this out here for sure. I honestly can't believe that we as an educational institution can't get AAD P1 for better than $6 per user per month.... 20c sounds a lot more reasonable!
gshaw Posted August 18, 2017 Posted August 18, 2017 (edited) Just confirmed with my MS reseller... just because the SSPR license check isn't enforced in Azure doesn't mean you can use it without paying for each user. Basically anyone following those steps above will be in breach of their licensing and could get caught out if audited. As far as AAD Premium goes the best price I've had was £1 \ user \ year for Edu. That may be workable for some of you but for us it's nearly £10k \ year, still crazy money and in very poor taste considering all other products are FTE based. I've said it over and over again and will keep doing so until MS see sense. In the meantime I'm looking at Dovestones instead who have a nice on-prem product for about £700. Not as perfectly integrated as AAD Premium but it'll do the job and at 100x less cost (!) See, this is what's been confusing me on this. If it's this easy to enable with a single license, and they specifically stated that they don't enforce per-user licensing for the password reset experience, then why also include that part about providing a license for each user? This really needs clarification I guess. Why is MS licensing this difficult to decipher :/ It's similar to how you're granted access to pretty much every product in the Microsoft inventory via VLSC but you can't just go and run them all on your network without purchasing the appropriate licenses on your EES Agreement. Basically the old adage "just because you can, doesn't mean you should" Your reseller should be able to advise on any queries and if they can't... move your licensing to someone who can. Edited August 18, 2017 by gshaw
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now