AzureAD domain join / hybrid join

[Bruce123]

Hi all,

 

Has anyone tried joining their laptops / PCs to AzureAD (or to both AzureAD and local AD - called Hybrid joined)?

 

This will allow users to logon to the laptop using their Office 365 account (useful when off-site)?

 

Thanks,

 

Bruce.

[altecsole]

Hi all,

 

Has anyone tried joining their laptops / PCs to AzureAD (or to both AzureAD and local AD - called Hybrid joined)?

 

This will allow users to logon to the laptop using their Office 365 account (useful when off-site)?

 

Thanks,

 

Bruce.

 

No, but I'd be interested in this too.

[snagrat]

We do this at one of our schools. The other schools are moving to AzureAD only this Summer.

 

This will allow us to remove all servers on site, with only 3 running in Azure as well.

 

Let me know what specific questions you have

[kevin_lane]

What complications have you had ? How did the SLT react to this? what backups do you have in place? What is your connection speed to the internet ? Have you been challenged with keep that much data off site ?....can’t think of a ur thing else but will let you know lol

[robyholmes]

We have hybrid join by AD Connect for all our AD machines but not gone down the 'Azure AD First' route yet where your primary auth is to Azure AD not local. I did test it quite a while back but we don't have any Intune licences so couldn't do a lot.

[snagrat]

What complications have you had ? How did the SLT react to this? what backups do you have in place? What is your connection speed to the internet ? Have you been challenged with keep that much data off site ?....can’t think of a ur thing else but will let you know lol

 

Filtering was a problem as there is no AD authentication. We got round that by using Netsweeper that support AzureAD authentication.

 

Papercut printing was also a problem. We use Printix to get around that.

 

SLT were fully behind the whole thing. They actively push the latest trends so are willing to accept problem and solutions.

 

No backups in place apart from Office 365 general stuff. Although we are looking into it.

 

We have 1Gb connections at all schools now. Generally sit at around 700meg most of the day.

 

This is a Microsoft Showcase School, 1:1 Surfaces for Y2 upwards. There is a lot of Data in Office 365 and with the Teams and ClassNotes this creates a lot of traffic.

[mrstrong]

We do this at one of our schools. The other schools are moving to AzureAD only this Summer.

 

This will allow us to remove all servers on site, with only 3 running in Azure as well.

 

Let me know what specific questions you have

 

@snagrat can you say some more ?

 

Our situation is we use office 365 and G Suite for education. We also have a physical server (2012 R2)

does the DNS, DHCP etc.

 

I'd love to get rid of the Domain controller and go cloud but I thought "azure" wasn't a direct replacement for a

physical on site domain controller ?

 

I've heard people mention hybrid which seems to mean just syncing the local AD user accounts to office 365 (not computer accounts) ?

But our office 365 login names are different from the local AD ones so not sure how that would work and what

benefits would be anyway ?

 

Be interested to know how you went serverless on site

 

Could you link to any MS docs / roadmap with options / benefits / limitations etc?

[mavhc]

first thing to do is set up azure AD sync, get those online accounts the same as local ones

[Simcfc73]

I've just setup hybrid and uploaded all my machine accounts to the cloud because I was trying to get the Office 365 machine activation working until I realised there is a cost.

 

No idea what to do with it now

[altecsole]

Filtering was a problem as there is no AD authentication. We got round that by using Netsweeper that support AzureAD authentication.

 

Papercut printing was also a problem. We use Printix to get around that.

 

SLT were fully behind the whole thing. They actively push the latest trends so are willing to accept problem and solutions.

 

No backups in place apart from Office 365 general stuff. Although we are looking into it.

 

We have 1Gb connections at all schools now. Generally sit at around 700meg most of the day.

 

This is a Microsoft Showcase School, 1:1 Surfaces for Y2 upwards. There is a lot of Data in Office 365 and with the Teams and ClassNotes this creates a lot of traffic.

 

Many thanks for this. What Microsoft licenses do you use? Azure AD Premium? Enterprise Mobility + Security? The cost implications seem like a major stumbling block to moving from on-premise to the cloud?

[mrstrong]

yeah forgot to say We'd be looking at free (as in beer ) as on A1 Plus

 

I guess if we could get rid of the server completely, the cost savings (e.g. hardware)

could be used for extra licenses

Edited May 21, 2020 by mrstrong
added extra info

[altecsole]

yeah forgot to say We'd be looking at free (as in beer ) as on A1 Plus

 

I guess if we could get rid of the server completely, the cost savings (e.g. hardware)

could be used for extra licenses

 

I'm not sure I'd want to give up on-premise AD though. The hardware spec for a DC is minimal and could you manage without group policies?

[RobD]

Its designed to work with intune i.e. device is delivered to a user at home, user logs on with school/corp account, laptop is joined to azure, computer "gets ready" and intune delivers apps and policies.

 

I've not done it but its meant to be very good although intune isnt as complete as Group Policy and SCCM (yet). You'll need to ensure you have itune licences.

 

Info:

https://docs.microsoft.com/en-us/microsoft-365/business/manage-windows-devices?view=o365-worldwide

[altecsole]

Its designed to work with intune i.e. device is delivered to a user at home, user logs on with school/corp account, laptop is joined to azure, computer "gets ready" and intune delivers apps and policies.

 

I've not done it but its meant to be very good although intune isnt as complete as Group Policy and SCCM (yet). You'll need to ensure you have itune licences.

 

Info:

https://docs.microsoft.com/en-us/microsoft-365/business/manage-windows-devices?view=o365-worldwide

 

Yes, this is exactly what I'd like to do for staff laptops, and laptop for pupils. It's the license cost that that bothers me?

[mavhc]

The entire reason Azure exists is so Microsoft can get paid for hardware and software, not just software. And not have to support that weird install of Windows Server you have.

[snagrat]

Many thanks for this. What Microsoft licenses do you use? Azure AD Premium? Enterprise Mobility + Security? The cost implications seem like a major stumbling block to moving from on-premise to the cloud?

 

We buy “Intune for Education” licenses. Faculty costs about £6 per year and you get 15 Student licenses with that.

 

We pay about £250 per month to host all the Azure servers.

[snagrat]

@snagrat can you say some more ?

 

Our situation is we use office 365 and G Suite for education. We also have a physical server (2012 R2)

does the DNS, DHCP etc.

 

I'd love to get rid of the Domain controller and go cloud but I thought "azure" wasn't a direct replacement for a

physical on site domain controller ?

 

I've heard people mention hybrid which seems to mean just syncing the local AD user accounts to office 365 (not computer accounts) ?

But our office 365 login names are different from the local AD ones so not sure how that would work and what

benefits would be anyway ?

 

Be interested to know how you went serverless on site

 

Could you link to any MS docs / roadmap with options / benefits / limitations etc?

 

What do you want to know.

 

We sync O365 with AD. AD is hosted in Azure but it isn’t actually required for what we do with Intune. You could just create an Office 365 account and they login with that.

 

We need AD for Papercut and some other apps we run, mainly our help desk tools.

 

DHCP and DNS is handled by the switches.

 

Most of it we have figured our ourselves. We use AutoPilot so devices are shipped to school, unboxed and instantly put into circulation. The Student will enrol the device by logging in first time.

Staff devices get different policies based on a GroupTag loaded into AutoPilot.

OneDrive auto signs in, KFM kicks in. We use Cloud Drive Mapper to map some SharePoint Sites are drive letters.

Everything MS is SSO without the need for any additional servers.

Bitlocker automatically gets enabled and keys saved in Intune.

 

Look at everything you do currently then see what cannot be replicated.

 

Intune has a lot less control than GPO but its getting more. Simple things like hiding the c: drive is possible but must be done PowerShell scripts so we mainly don’t bother now.

[Bruce123]

I've just setup hybrid and uploaded all my machine accounts to the cloud because I was trying to get the Office 365 machine activation working until I realised there is a cost.

 

No idea what to do with it now

 

Sorry, where does the cost come in?

[Bruce123]

yeah forgot to say We'd be looking at free (as in beer ) as on A1 Plus

 

I guess if we could get rid of the server completely, the cost savings (e.g. hardware)

could be used for extra licenses

 

We have the A1 plan, are you inferring you can't do AzureAD joined/hybrid without a better license plan?

[jmak]

We have the A1 plan, are you inferring you can't do AzureAD joined/hybrid without a better license plan?

It's included in A1 - O365 accounts *are* Azure AD accounts.

[altecsole]

We buy “Intune for Education” licenses. Faculty costs about £6 per year and you get 15 Student licenses with that.

 

We pay about £250 per month to host all the Azure servers.

 

Many thanks for this. Out of interest, can I ask how many pupils and staff you have?

[altecsole]

We buy “Intune for Education” licenses. Faculty costs about £6 per year and you get 15 Student licenses with that.

 

We pay about £250 per month to host all the Azure servers.

 

I've just asked my reseller for pricing and it's coming back as £11.88 per faculty?

[Bruce123]

It's included in A1 - O365 accounts *are* Azure AD accounts.

 

I appreciate that Office 365 (user) accounts are Azure AD (user) accounts. But what I was asking about is Azure AD/Hybrid joining, and what this extra cost is that has been mentioned?

 

Are there any issues with A1 in relation to Hybrid joined? Can computer objects be syncronised to AzureAD? Can replication happen in reverse (AzureAD > AD)? If not, does this matter?

 

Thanks, Bruce.

[snagrat]

Many thanks for this. Out of interest, can I ask how many pupils and staff you have?

 

Across the Trust about 180/1000 at the moment.

 

New school coming in Summer and one of the others is only KS1 currently as only 2 years old

[snagrat]

I've just asked my reseller for pricing and it's coming back as £11.88 per faculty?

 

Get a better reseller then!

 

Have they given you the part number of the Microsoft product?