Intune Hybrid AD Licences?

[talksr]

Does anyone have any experience of the licencing implications for Azure Active Directory Synchronisation?

I have a 2016 server and around 10 Windows 11 and 10 stations.

We already have InTune but I am assuming there would be an additional licencing cost to enable us to link and sync our 2016 server to the Intune tenancy?

 

Hybrid is a step in the right direction for cloud for our site, and will hopefully allow us to run custom start menus on 11 via Intune as well as far better device management and MDM. Just unsure on what licences we would need other than the standard Intune one?

[Katy]

Depends what you want to achieve by "linking 2016 server to Intune". Do you mean Azure AD Connect (directory sync)? Or do you want to manage the server with Intune?

 

Managing the server with Intune (if it's even supported, can't remember) then the users logging on to it (i.e. interactively, so just admins unless it's an RDS host) would need an Intune licence, or the device itself would need an Intune device licence.

Just enabling directory sync, there is no licence requirement for that.

 

What licensing do you have at the moment that covers Intune? e.g. M365 A3, or EM+S A3, or Intune on its own? Presumably each user has an Intune licence that will use the 10 devices (or device licences, if they are shared devices with no primary user)

[talksr]

Depends what you want to achieve by "linking 2016 server to Intune". Do you mean Azure AD Connect (directory sync)? Or do you want to manage the server with Intune?

 

Managing the server with Intune (if it's even supported, can't remember) then the users logging on to it (i.e. interactively, so just admins unless it's an RDS host) would need an Intune licence, or the device itself would need an Intune device licence.

Just enabling directory sync, there is no licence requirement for that.

 

What licensing do you have at the moment that covers Intune? e.g. M365 A3, or EM+S A3, or Intune on its own? Presumably each user has an Intune licence that will use the 10 devices (or device licences, if they are shared devices with no primary user)

 

Hello,

Thanks for your reply.

Ideally, I would like to be able to manage things like the Windows 11 start menu which I gather I can only do with Intune linked to the device. It would also be good to make use of things like Autopilot.

 

Our current licencing is M365 A3 for faculty and students.

We also have the A1 but everyone gets those as they are the free ones.

 

Do you think I would need to purchase additional licencing to achieve what I want?

[chaplic]

To answer your first question, merely syncing user accounts into Azure AD using Azure AD Connect doesnt attract any licensing requirements and you can do it now. Not that it'll be all that useful but at least its a task to get out of the way.

[Katy]

Hello,

Thanks for your reply.

Ideally, I would like to be able to manage things like the Windows 11 start menu which I gather I can only do with Intune linked to the device. It would also be good to make use of things like Autopilot.

 

Our current licencing is M365 A3 for faculty and students.

We also have the A1 but everyone gets those as they are the free ones.

 

Do you think I would need to purchase additional licencing to achieve what I want?

 

Okay, so you just need to sync identities from the server to Azure AD then, and enrol the Windows 11 devices so you can use the start layout profile. Anybody with an M365 A3 licence is already licensed for Intune (and Azure AD P1, and Windows Education device uplift), no extra licences needed.

[talksr]

Okay, so you just need to sync identities from the server to Azure AD then, and enrol the Windows 11 devices so you can use the start layout profile. Anybody with an M365 A3 licence is already licensed for Intune (and Azure AD P1, and Windows Education device uplift), no extra licences needed.

 

Ahah, thank you. That makes sense, you have very good knowledge of licencing!

The user accounts are actually already synced to O365 as our ISP does this for us and these are the accounts we use both for non-O365 email and for O365 along with Google for pupils.

So if possible, I would need to get O365 to sync the accounts down to the server. Not sure if that is possible?

 

The only thing binding us to the physical server really is the shared drives which are physical and on prem.

 

You mention about enrolling the Windows 11 devices but would this not enrol them to Intune and not the local domain?

Sorry if these are stupid questions, but I am quite new to this. If there are any specific courses that would help, do let me know and I will join them as I have quite a few other sites I would like to start doing this to, and this is my first.

[chaplic]

Are you ​sure​ those O365 accounts are synced from on-premise AD (they have the same password and you can only modify users details in AD not in O365)

 

O365 cannot sync down to the server as thre should be no need if AD is the source of these accounts/

 

Theres a few options. My suggestions would be to have your machines ONLY Azure Active Directory joined and Id use onedrive for personal files

[Katy]

If you have a look in Azure AD Users https://portal.azure.com/#view/Microsoft_AAD_UsersAndTenants/UserManagementMenuBlade/~/AllUsers does it say "Yes" or "No" under the "On-premises sync enabled" column?

 

If yes, you already have sync set up from your local server AD to Azure/365. So your users are already hybrid.

 

If no, you don't, and your users are cloud only. You can't sync from cloud to on-premises, only the other way round. Will be a rather complicated task syncing the users and getting them to match up with the existing cloud accounts, to turn them into synced accounts.

 

The devices can be enrolled as Azure AD joined (preferable, but they have no relationship with the on-premises domain) or as hybrid joined (they join the local domain but are Azure AD registered). If the users are hybrid then they can log on to an Azure AD joined device and access local domain resources - hybrid user accounts receive some data from Azure when logging on which will let them authenticate to on-premises resources - basically a kerberos ticket within the Azure Primary Refresh Token (PRT). Although it might be easier if the shared stuff is migrated to SharePoint or Teams, and personal drives to OneDrive - it's what we did at the last school I worked at although it is a big change for the users and a big project that needs proper management and planning.

 

If the devices are Azure AD joined, they are managed from Intune only. If they are hybrid joined, they are managed through Group Policy with a limited amount of management capable from Intune - probably includes the start layout stuff, but I've never looked into it.

[talksr]

Are you ​sure​ those O365 accounts are synced from on-premise AD (they have the same password and you can only modify users details in AD not in O365)

 

O365 cannot sync down to the server as thre should be no need if AD is the source of these accounts/

 

Theres a few options. My suggestions would be to have your machines ONLY Azure Active Directory joined and Id use onedrive for personal files

 

Thanks, we use LGfL for our broadband and they provide all user accounts which get synced with our MIS. These then get populated to both Google and Microsoft.

I did wonder about machine only Azure AD but I am looking to slowly transition users away from the current Server 2016 setup and this would not be possible if I added machines only to Azure AD.

 

If you have a look in Azure AD Users https://portal.azure.com/#view/Microsoft_AAD_UsersAndTenants/UserManagementMenuBlade/~/AllUsers does it say "Yes" or "No" under the "On-premises sync enabled" column?

 

If yes, you already have sync set up from your local server AD to Azure/365. So your users are already hybrid.

 

If no, you don't, and your users are cloud only. You can't sync from cloud to on-premises, only the other way round. Will be a rather complicated task syncing the users and getting them to match up with the existing cloud accounts, to turn them into synced accounts.

 

The devices can be enrolled as Azure AD joined (preferable, but they have no relationship with the on-premises domain) or as hybrid joined (they join the local domain but are Azure AD registered). If the users are hybrid then they can log on to an Azure AD joined device and access local domain resources - hybrid user accounts receive some data from Azure when logging on which will let them authenticate to on-premises resources - basically a kerberos ticket within the Azure Primary Refresh Token (PRT). Although it might be easier if the shared stuff is migrated to SharePoint or Teams, and personal drives to OneDrive - it's what we did at the last school I worked at although it is a big change for the users and a big project that needs proper management and planning.

 

If the devices are Azure AD joined, they are managed from Intune only. If they are hybrid joined, they are managed through Group Policy with a limited amount of management capable from Intune - probably includes the start layout stuff, but I've never looked into it.

 

 

Thanks again for your post.

I have checked and under On-prem syn enabled, all 515 users are showing 'No'.

 

What you are saying makes sense to me.

As, in this example, I am talking about around 10 computers and a similar amount of users (just the admin department), would I be able to create new users in Azure>Users with on-prem sync enabled and work that way?

The 515 users are all users at the site, but I am only interested in the admin staff which is a far smaller number of people.

You mentioned it would be a complicated task of syncing the users and getting them to match up, but if there are only around 10, maybe it won't be so difficult? Or maybe I could just remove the licences from the current 10 users and make new accounts for them manually, then add the respective licences?

Hybrid sounds best for this particular example. Are there any official guides on how I can link the server to Azure so when they log into a Azure AD joined device, they could access local domain resources?

The idea would be to eventually migrate everything over to OneDrive and yes, exactly as you say, it is a big change for users in particular which is why I am looking to do this very gradually and start with the most competent people and get them onto a hybrid environment before weening them onto OneDrive, then the other users can follow and I will have some early adopters to help the others get the hang of things!

[chaplic]

How Id do this

 

1) Setup Azure AD connect and configure it ONLY sync an OU that no-one else is in. Create a few test accounts and get comfortable seeing them sync to the cloud

 

2) For a user who has an AD account and a 'Synced: No' account, get their Object ID from Azure AD. e.g.

$upn =

$user = Get-MsolUser -UserPrincipalName $upn

$immutableid = $user.immutableId

 

$immutableid will be something like5c49ad3c-db2e-402a-b8da-901ec4f481a4

 

Then do some maths to convert that do an MS-DS-Consisntecyguid:

 

[system.convert]::FromBase64String($immutableid) | %{$a += [system.String]::Format("{0:X}", $_) + " "};$result = $null;$result = $a.trimend();$result

 

$result will something like

 

CB 69 08 D8 D3 34 D8 45 88 F5 53 5D 64 AE DF 0F

 

Put this value in the ms-ds-consistencyguid in AD (use the attribute editor in ADUC or powershell)

 

Sync AAD, possibly twice. Look at the Azure AD audit logs to see changes.

 

Once you're happy, scale out. Note the users O365 password is now their AD password and lgfl will be unable to edit their values as they are sourced from AD.

 

Do NOT let a user account sync from AD unless you've got the right value in ms-ds-consistencyguid otherwise it'll get confusing with duplicates.

 

[Katy]

As, in this example, I am talking about around 10 computers and a similar amount of users (just the admin department), would I be able to create new users in Azure>Users with on-prem sync enabled and work that way?

No - if you create users within Azure, they are cloud-only. The only way to create a user and have it on-prem synced is to create it on-prem in AD, and configure Azure AD Connect (...or Cloud Sync, long story but just use Connect instead) to sync the accounts.

 

You mentioned it would be a complicated task of syncing the users and getting them to match up, but if there are only around 10, maybe it won't be so difficult? Or maybe I could just remove the licences from the current 10 users and make new accounts for them manually, then add the respective licences?

 

The problem you have is that I presume all 515 users have accounts in the on-premises AD domain, so unless you sync just a specific OU containing these 10 users, you've got to cope with users matching up (e.g. via the msDs-ConsistencyGUID) although in theory they should match based on UPN or e-mail address before you have to worry about the GUID.

 

Hybrid sounds best for this particular example. Are there any official guides on how I can link the server to Azure so when they log into a Azure AD joined device, they could access local domain resources?

The idea would be to eventually migrate everything over to OneDrive and yes, exactly as you say, it is a big change for users in particular which is why I am looking to do this very gradually and start with the most competent people and get them onto a hybrid environment before weening them onto OneDrive, then the other users can follow and I will have some early adopters to help the others get the hang of things!

 

It's a bit more complex than just linking the server to Azure - you'd need the following, probably not an exhaustive list:

 

- Azure AD Connect to sync identities to Azure - preferably sync all users and sort out the user mapping. You would first need to make the UPN suffix on-premises match that used in Azure AD and get the UPNs of your users matching the cloud sign-in addresses (AzureAD UPNs).

- Devices either Azure AD joined or hybrid Azure AD joined

-- if hybrid joined, can use group policy preferences to map drives to the local server, and cloud management to set the start layout

-- if Azure AD joined, ??? there isn't really a way to map drives as it's not designed for this, would need something like a script in the user's startup folder (typically placed in the default user's startup folder before anybody logs on, so that this copies to their profile). You'd have to use something like a Win32 application app deployment to push a script which installs the drive map script, or maybe a PowerShell script targeting the device.