Azure AD or Local AD ?

[rlculver]

Hi,

 

I am looking setup a complete brand new network.

 

Would you use a Local AD or would you consider moving to Azure AD ?

 

Do you know where I can find some good articules regarding Azure AD and the process of creating the "domain" in the cloud !!!

 

Many Thanks

[FishCustard]

I would use a local AD with Azure sync or (probably better) ADFS for cloud integration. This way you get the best of both worlds.

[Norphy]

The first thing you need to understand is that Azure AD is not the same as an ADDS Domain in the cloud. You don't join a PC to Azure AD in the same way, users don't authenticate in the same way

 

There are advantages and disadvantages to both approaches but it's not easy to declare which is the more suitable option without knowing a few things like:

 

Budget

Whether you have space for a local server

Computer allocation: 1:1 or shared devices

Where your people work: All in one office/multiple offices/working from home

 

If it's a small business where everyone has their own laptop or computer, I would consider using Azure AD and Intune to manage devices.

[FishCustard]

Yes I made some sweeping assumptions (mainly - it's a school of a reasonable size!) when making my recommendation. It's all horses for courses at the end of the day.

 

Norphy put it better than I could.

[chaplic]

If its completely greenfield, I'd use Azure AD. Have the network setup basically 'untrusted' with no local servers. Mean that (say) during an epidemic you can get a supplier to ship a laptop to the user with a vanilla windows on it, they log in with corp credentials and boom, thier apps download and they have access to all their data.

 

AD is easier only because it's been around 20 years and well understood. Hybriding is a complex mess only warranted as an interim step.

[HPlum78]

I am with @chaplic on this and mirror's my previous posts on this very question on here. If its greenfield site it would take something big in the world to persuade me to have an on prem AD deployment these days (coming from someone who loves AD) seems strange me advising not to have an on prem directory. But hay the world has changed so must I... Anyhow ADFS v Azure auth is now really not a thing (again love me an ADFS farm!) just take a cloud first approach and make the argument for on prem is what I would say in your position. Edited April 9, 2020 by HPlum78

[BroganOs]

Can I ask what is the main differences between the two? I’m only just beginning to use and learn about Azure and I assumed they were both essentially the same except for one is cloud based. But you could authenticate off it.

 

@HPlumb78 are you recommending Azure AD because you’d be preparing the site for the cloud?

[chaplic]

Other than the name, there is not a line of code that’s shared. They essentially do the same thing, log you in and apply policy

 

if you are using office365 then you are already using Azure AD, so would need a specific reason to also add on premise AD

[BroganOs]

Other than the name, there is not a line of code that’s shared. They essentially do the same thing, log you in and apply policy

 

if you are using office365 then you are already using Azure AD, so would need a specific reason to also add on premise AD

 

So, can you use it to within a domain to authenticate with?

[chaplic]

So, can you use it to within a domain to authenticate with?

 

Well you can use the convention azuread\[email protected] with a few caveats but that doesn’t make much sensE in the context of the OP where we don’t have a domain.

[mavhc]

MS really want you to move everything to Azure, that's where all their programmers are working, they'd kill off Windows Server tomorrow if they could.

 

Of course you need the school to understand they've got to pay for it every month/year forever, no random budgets. The reason MS want you to switch is so they get all your budget instead of some going to HP or Dell to buy hardware.

[MS2011]

MS really want you to move everything to Azure, that's where all their programmers are working, they'd kill off Windows Server tomorrow if they could.

 

Of course you need the school to understand they've got to pay for it every month/year forever, no random budgets. The reason MS want you to switch is so they get all your budget instead of some going to HP or Dell to buy hardware.

 

Agreed

[Norphy]

Somehow I doubt Microsoft care too much which of their products you pay for, just so long as you pay for it. Either way, if you’re a largish enterprise of some sort you’re likely to be paying for their stuff on a subscription.

[supportman]

How do group policies work with Azure AD?

[Mr.Ben]

How do group policies work with Azure AD?

Everything is done by creating Device configuration profiles and applying them to groups or devices.

 

DCP's come is various forms: Traditional Group Policies (although not all options are there), Intune CSPs (Preconfigured options and custom options) and Powershell scripts.

 

CSP's can do things like add certificates, Wireless settings etc.

 

It all rather straight forward once you get into it!

[HPlum78]

Hmm @mavhc not sure that's the case, I was listening to the Azure guys (think it was at tech summit) and they accept that there is a need for hybrid deployments and these will be around for some years. Also when I was talking with Jeff Snover (not so long ago) about the serves OS roadmap he said there are plans at least to ~2026.

[mavhc]

Right, a need, not a desire. They'd kill Windows Server tomorrow if they could, just people would complain, so they're telling you you have 6 years to get rid of it now.

 

Having to support a billion hardware combinations is hard for a start, they'd rather just support the 100 they've deployed themselves.

[HPlum78]

Yeah I ain't saying that they would not love to kill it as an OS but they would also rather burn in hell than let data center hardware not have an MS OS sat on it! (or at least an option)

[rlculver]

Hi,

 

Thanks for the comments.

 

What is the best way forward for me to just authenticate users on a network?

 

Thanks

[supportman]

Hi,

 

Thanks for the comments.

 

What is the best way forward for me to just authenticate users on a network?

 

Thanks

 

Hybrid i'm guessing with the ad connect sync tool. Pretty straigt forward to setup and future proofs you. Also allows single sign on.

[mavhc]

You read up on azure ad domain joins, and pay for that, or buy a server install windows server 2019 and do it the old fashioned way. Advantage of Azure is it happens to work fine if everyone's suddenly working from home for some unexpected reason. Just need finance people to be aware they're going to have to continue to pay for it forever, no "we don't have the budget this year". Another advantage is you can in theory just send them a laptop straight from the manufacturer, they login with their school email address, and it auto configures everything without you ever seeing or touching the laptop.