ChromeBooks and Office 365

[JonnyAlpha]

Hi,

 

I need some independent advice please.

Our school has a Server / Windows 10 Client setup. A year or so ago we bought a new Server and upgraded everything to Windows 10.

Our fleet of 60 pupil Laptops is about 6 years old and I managed to get agreement to renew everything.

 

Each pupil has an Active Directory Username and Password and an O365 account which is thier AD username with our domain added to the end. When logging into O365 Teams etc they need to enter thier username and the domain name. Even for Year 5's etc I am finding this a nightmare!!!

 

After researching our requirement I managed to get agreement to buy 32 Fujitsu Core i3 Laptops and 32 ASUS Chromebooks.

 

We have just taken receipt of 32 ASUS ChromeBooks. When discussing whether to get ChromeBooks or Laptops in a meeting with my HT and our offsite IT company, it was sold to us on the basis that pupils would be able to sign into the device using thier existing Active Directory username and password (e.g. username:joeb password:cat123). This was supposed to be a single sign in process, so that when they then opened O365 / Teams etc they would not be prompted for a username or password.

 

Now that the hardware has turned up the IT rep that came to deploy everything showed me that to login to the ChromeBooks, the pupil would enter thier email address and password and IIRC would still have to sign into other MS apps.

 

I have explained that this was not how we believed it would work and this now means that the Chromebooks (that were supposed to be switch on and go) would now be a nightmare for anyone in year 5 and below. I want to make things simple for my teachers, to encourage them to use this technology.

 

So - is there a way of setting up a ChromeBook so that you sign in using a simplified login (e.g. the current AD username and password). Is it also possible for this login to be linked to the full domain name and prevent the user then having to enter an email address and password for O365 online apps?

[dylanm]

Yes - There is three ways that I can think of off the top of my head.

 

1. You can use the Google Cloud Directory Sync with the Google Password Sync to sync over the users from your existing Active Directory. This will automatically create accounts, disable accounts, groups, password sync (only when the user changes the password on a AD computer - Its a one way sync (AD -> Google)) etc. You can then set the policies for the Chromebooks to auto complete the domain for the students (see the below screenshot).

 

 

2. If users already have an Office 365 account and your school has Azure AD sync (not required by makes the whole SSO idea better and seamless), then you can do is single sign in into Google from Office 365. For example, if a user was to sign into Google Drive, they would be redirected to a Microsoft login page to login, then once logged in, they will be redirected back to the application.This also works for logging into Chromebooks.

 

The only downside to this is that the user needs to type their username in twice, once for Google (to check if they need to be redirected to Microsoft to sign in) and once again for Microsoft. In theory, when students are logging into Chromebooks they will be authenticated with both Microsoft and Google so if the users was to browse to Outlook on a Chromebook, they will not be prompted to sign in again.

 

Google has a great guide on how to set this up - https://cloud.google.com/architecture/identity/federating-gcp-with-azure-ad-configuring-provisioning-and-single-sign-on

 

3. You could opt for the Wonde to handle the sign in, students are issued with Emoji passwords and magic badges (QR codes) where they can scan their magic badge with the webcam on the Chromebook. More info here: https://www.wonde.com/single-sign-on

 

We have implemented the Azure to Google (option 2) in a few schools and it works quite well, it has no reliance on local infrastructure (local syncs from on-prem AD) and it is cloud native. Given the way that technology is moving (Microsoft moving towards Intune), I would opt for this way of doing it. However, the Google Cloud Directory Sync with the Google Password Sync also works well and something that we have implemented in a few schools.

 

The Wonde solution is okay (something that I have never used) but this is something that comes at a yearly cost and isn't free like the aforementioned.

 

Hope this helps in some way

[jmak]

Edit: the answer above is more complete. I got distracted before finishing my post and got ninja'd

 

#########

 

Yes it is completely possible. There are a few things to set up, but it can be a straightforward user experience.

 

The way I've set it up in the past (I don't currently have access to a Google Workspace admin account) has some pre-requisites:

 

You need:

An admin account in Google Workspace for education

Management licences for the Chromebooks

 

Once the devices are enrolled, they can be set to auto-complete the domain without users having to type it in.

 

To use the actual AD accounts, you'll need to set up Azure AD Connect to provision the Google Workspace accounts

Edited December 15, 2021 by jmak

[Squip]

Using Chromebooks in a O365 environment

 

We followed this guide and it works perfectly!