AzureAD for Office365 authentication

[grbarker83]

Hi guys, any help or guidance would be much appreciated

 

Basically MS has given us Office 365 to give to staff and students so they can have Office at home for free (yayyy) but we currently have to spend a few minutes setting up each individual user (booo). We have over 2,000 students so basically I dont want to do this.

 

Azure AD seems to be the answer and I want to create a test server in their free trial but used my free trial up studying for AZ900, so this will have to wait until I can get a new bank account

 

Basically I wanted some advice on what server to build and ideas on costs.

 

I assume the Azure AD free teir is the way to go with 0 Premium users

How many User Forest hours do you think will be needed?

 

Thanks in advance for any light you can shed on this

[3s-gtech]

Do you have an onsite Active Directory already? Or are you looking to set up a domain completely offsite?

[Katy]

If you've got Office 365 then you already have Azure AD Free - it is where your 365 accounts are stored. Presumably if you already have 2000 students then you have on-premise infrastructure such as Active Directory? If so your best bet is going to be to install Azure AD Connect, which will let you sync the AD users to the cloud - so they will sign in with the same username/password - and if configured properly you'll also get single sign on.

When doing this usually you'd make sure that the user's UPN is the same as their email address, so their cloud accounts are created with their UPN you just tell people "Use your email address to log on".

You don't need to use any Azure credits to do any of this so just read up about AADConnect What is Azure AD Connect and Connect Health. | Microsoft Docs

 

Alternatively you might want everything in the cloud - in which case you'd script the creation of the accounts with PowerShell, or import via CSV. If you're planning on keeping your on-prem infrastructure I can't see why you'd go down this route.

 

Edit: I think you are talking about "Azure AD DS" in your original post mentioning user forest hours? You won't need that (and it's a separate thing to Azure AD). Azure AD = Free (at the basic tier) new cloud stuff, Azure AD DS = Not free, basically it's a set of Windows domain controllers running in the cloud.

Edited June 17, 2021 by Katy

[grbarker83]

Great, thanks guys. I'm new to Azure as I havent done anything except sit through CBTNuggets AZ-900 videos and a few labs so any help and advice is very helpful.

 

We have AD setup onsite and have all our servers inhouse. We have no intentions of moving to the cloud until we get our moneys worth from our current VMware system. We just want an automatic way creating and managing Office365 accounts.

 

I am trying to find a solution that has no cost (or a cost I can predict) as we currently have no IT manager to plead our case and it is damn near impossible to get the schools bank card (I have to purchase apps personally for use by our SEN pupils)

 

Azure AD DS and forest hours - I am quite possibly taking about AD DS. I essentially looked up Active Directory in the Azure cost calculator and it automatically has an input in Forest hours. I assumed that this was time spent updating Azure AD from our onsite AD

 

When I look up AD Connect it says it is free and included in my Azure subscription (I dont have one).

Am I correct in thinking I would not need a Azure server running (or even created)? We would just need Azure Connect running on our AD server and this linked to an Admin account on Office.com?

 

I found this guide

https://blog.bemopro.com/cybersecurity-blog/azure-ad-connect-step-by-step-instructions

 

Thanks again

 

- - - Updated - - -

 

Great, thanks guys. I'm new to Azure as I havent done anything except sit through CBTNuggets AZ-900 videos and a few labs so any help and advice is very helpful.

 

We have AD setup onsite and have all our servers inhouse. We have no intentions of moving to the cloud until we get our moneys worth from our current VMware system. We just want an automatic way creating and managing Office365 accounts.

 

I am trying to find a solution that has no cost (or a cost I can predict) as we currently have no IT manager to plead our case and it is damn near impossible to get the schools bank card (I have to purchase apps personally for use by our SEN pupils)

 

Azure AD DS and forest hours - I am quite possibly taking about AD DS. I essentially looked up Active Directory in the Azure cost calculator and it automatically has an input in Forest hours. I assumed that this was time spent updating Azure AD from our onsite AD

 

When I look up AD Connect it says it is free and included in my Azure subscription (I dont have one).

Am I correct in thinking I would not need a Azure server running (or even created)? We would just need Azure Connect running on our AD server and this linked to an Admin account on Office.com?

 

I found this guide

https://blog.bemopro.com/cybersecurity-blog/azure-ad-connect-step-by-step-instructions

 

Thanks again

[3s-gtech]

Azure AD Connect will be the missing link for you, connecting onsite accounts to those on M365. You set it up, making sure your domain suffixes are correct for your AD users (to match your registered domain), sort the DNS checks that it needs (some records will be needed on your external DNS) and off you go. You can set it to only create accounts in certain OUs, you can set SSO, etc.

 

This is all included with a UK schools entitlement, so it's free. That comes with an Azure backend included - that's how it's all powered. You don't need to spin up an actual Azure server as such.

[Katy]

If you have Office 365, you already have Azure AD (which doesn't need an Azure subscription itself). So you just need to use Azure AD Connect running on one of your on-premise Windows VMs to sync your AD user accounts to Azure AD/365. It won't cost anything to run this.

(If you go to https://portal.azure.com/ and then look for "Azure Active Directory" you should find it lets you in and you've got a domain named whatever you picked when you set up Office 365 - e.g. school.onmicrosoft.com. You can look at Users and see your 365 user accounts)

 

If you make sure your on-prem users have the same UPN or mail attribute as their cloud versions, when you run the AADConnect sync it should merge the matching accounts so they will turn into a "synced from AD" account and no longer be "cloud only".