True Microsoft Cloud Education Setup without the need for Active Directory -thoughts?

[ConceroEdu_Brad]

Thoughts on True Cloud Microsoft School/MAT without the requirement for an Active Directory Domain - anything missing?

 

Microsoft Education M365 A5 Licensing for:

- AzureAD for user management

- Intune/EndPoint Manager for device management including patch management

- Exchange Online for Emails

- OneDrive for user data

- Sharepoint for shared data and collaboration

- Teams for communication, collaboration and classrooms

- Microsoft Office applications for productivity and teaching and learning

- Security and enhanced security (endpoint, email, data, user access, proactive monitoring) for Cyber Security

- Compliance for data management such as GDPR

- PowerBI for data analysis

 

Printix for AzureAd connected Cloud Print Management

senso.cloud ⚡ for safeguarding monitoring

iamcloud.dev (CloudDriveMapper) for familiarised shared data access

Bromcom / Itis / Arbor Education for cloud based MIS

Azure Virtual Desktop for SIMS/FMS or any other server dependent legacy software if required

Paxton Access Ltd V10 for cloud access control

cloud based firewall/filtering and fast internet connectivity

Wonde for SSO to Third Party Applications

Barracuda for 365 Cloud Backup

Redundant Layer 3 Core Switch for DHCP and traffic management

Cloud Managed networking infrastructure solution such as Ubiquiti Inc. / Hewlett Packard EnterpriseISP for DNS services

Edited October 10, 2022 by ConceroEdu_Brad

[IT_JB]

I think that is a fairly complete list, but what is often even more important are the processes and technologies used to get from point A (on prem) to point B (fully cloud). Some of these bespoke migration services can create a significant cost barrier for those looking at going in this direction. What do you use at Concero to achieve these migrations? e.g exchange to exchange online, file server to Onedrive/Sharepoint etc.

[chaplic]

I moved a school I look after to be AD/ serverless. best thing I did.

 

Azure AD can surely do the SSO stuff you want, or even Azure AD App gateway at a push?

 

You might need some very basic on prem monitoring still

 

What about end user experience monitoring (which could just be 'they moan quickly enough' )

[ConceroEdu_Brad]

We use the inbuilt tools in 365 to move data from onprem into the cloud storage - really simple and free.

Exchange can be done by doing a cutover or you could use CodeTwo.

We've done it many times

[Steve21]

I'm curious about recommendations for things (generally older software) that still relies on on-site storage. Most the previous threads around this seem to rely on either manual fixes (things like the USB below for imaging), or just refusing people usage of these until they pay for upgrades etc

 

As a few examples:

 

1) The kind of software that require "shared tool" areas, or something like Techsoft that requires locally hosted license files to run the software locally (Sibelius license server etc)? Are you then having a small server still to run this? doing it off a pc that's not backed up etc? Paying through the roof for Azure VMs/VPN?

 

2) Things like re-imaging for dead HDDs, as unless you're using USB drives etc to manually install Windows first before autopilot? Or again running a localised WDS/SCCM off a non-server hardware?

 

3) Supporting legacy devices like old printers/sublimations that won't support Universal printing? Again I assume long term wise you'd phase them out, but in terms of usage until that case

 

4) Things like CCTV servers/heating/boiler systems, that either rely on heavy storage locally, or on-site tech/bits

 

Just some random examples that don't seem to be covered by any new cloud-based setups, or require almost dumbing down the current solution to be able to work with cloud setups (USBs for imaging as an example), just wondering if you've seen any other alternatives for these kind of things

 

Thanks,

Steve

[foofighterjim]

You don't appear to have mentioned backups of user storage or is that part of "Compliance for data management such as GDPR"?

[TechMonkey]

You don't appear to have mentioned backups of user storage or is that part of "Compliance for data management such as GDPR"?

Barracuda for O365 backs up OneDrive.

[Mr.Ben]

We use A3, but have almost all of this already in place.

 

Biggest missing part is Azure Active Directory Domain Services.

 

You'll need cloud based servers to run legacy apps (the inertia of finance and HR teams will otherwise hold your customers back)

[ConceroEdu_Brad]

We use A3, but have almost all of this already in place.

 

Biggest missing part is Azure Active Directory Domain Services.

 

You'll need cloud based servers to run legacy apps (the inertia of finance and HR teams will otherwise hold your customers back)

 

With the latest version of AVD - AADDS is no longer required

[Mr.Ben]

With the latest version of AVD - AADDS is no longer required

Was thinking more about the software itself, which relies on file shares - could move that to Azure file shares though!

[MS2011]

Thoughts on True Cloud Microsoft School/MAT without the requirement for an Active Directory Domain - anything missing?

 

Microsoft Education M365 A5 Licensing for:

- AzureAD for user management

- Intune/EndPoint Manager for device management including patch management

- Exchange Online for Emails

- OneDrive for user data

- Sharepoint for shared data and collaboration

- Teams for communication, collaboration and classrooms

- Microsoft Office applications for productivity and teaching and learning

- Security and enhanced security (endpoint, email, data, user access, proactive monitoring) for Cyber Security

- Compliance for data management such as GDPR

- PowerBI for data analysis

 

Printix for AzureAd connected Cloud Print Management

senso.cloud [emoji298] for safeguarding monitoring

iamcloud.dev (CloudDriveMapper) for familiarised shared data access

Bromcom / Itis / Arbor Education for cloud based MIS

Azure Virtual Desktop for SIMS/FMS or any other server dependent legacy software if required

Paxton Access Ltd V10 for cloud access control

cloud based firewall/filtering and fast internet connectivity

Wonde for SSO to Third Party Applications

Barracuda for 365 Cloud Backup

Redundant Layer 3 Core Switch for DHCP and traffic management

Cloud Managed networking infrastructure solution such as Ubiquiti Inc. / Hewlett Packard EnterpriseISP for DNS services

 

Second internet line as you are moving everything onto cloud.

[ConceroEdu_Brad]

Second internet line as you are moving everything onto cloud.

 

Redundant line is a must, yes, that’s a great addition.

 

We actually recommend the second line through a different supplier and takes a different exchange route

[KK20]

Training. Dont forget training. Teachers moving from a shared drive mentality (assuming this is what you do) to an online only infrastructure is a big change for some. Onedrive and sharepoint sync too, again not all teachers are used to this.

[supportman]

Thoughts on True Cloud Microsoft School/MAT without the requirement for an Active Directory Domain - anything missing?

 

Printix for AzureAd connected Cloud Print Management

senso.cloud ⚡ for safeguarding monitoring

iamcloud.dev (CloudDriveMapper) for familiarised shared data access

Bromcom / Itis / Arbor Education for cloud based MIS

Azure Virtual Desktop for SIMS/FMS or any other server dependent legacy software if required

Paxton Access Ltd V10 for cloud access control

cloud based firewall/filtering and fast internet connectivity

Wonde for SSO to Third Party Applications

Barracuda for 365 Cloud Backup

Redundant Layer 3 Core Switch for DHCP and traffic management

Cloud Managed networking infrastructure solution such as Ubiquiti Inc. / Hewlett Packard EnterpriseISP for DNS services

Thats an excellent list.

 

Good to see a print solution other than papercut which hasn' t had the best reviews when used in the cloud.

 

I'd also be interested in how the core layer 3 swithc would work giving out DHCP address. Could you still whitelist MAC addresses doing that?

 

Does your company install these type or services?

[chaplic]

Redundant line is a must, yes, that’s a great addition.

 

We actually recommend the second line through a different supplier and takes a different exchange route

 

Getting a truly diversely routed connection is very hard, and you usually only realise its not diverse when the digger cuts through both

 

Could you limp by with a 4G/ 5G connection? I've seen some places have this plus a temp block on high bandwidth sites they apply when failed over. Can still suffer from the digger problem but there's a least a few hundred feet where its definitely not shared ducting.

 

That said, my school doesn't have a redundant connection, it is a small outfit and I suspect they would get by

[ConceroEdu_Brad]

Absolutely - I'm not sure how you do it, but any transformation programme we are involved with, we normally have TA (TA Education Home - TA Education) in place to deploy training to all end users.

[ConceroEdu_Brad]

Getting a truly diversely routed connection is very hard, and you usually only realise its not diverse when the digger cuts through both

 

Could you limp by with a 4G/ 5G connection? I've seen some places have this plus a temp block on high bandwidth sites they apply when failed over. Can still suffer from the digger problem but there's a least a few hundred feet where its definitely not shared ducting.

 

That said, my school doesn't have a redundant connection, it is a small outfit and I suspect they would get by

 

5G would be ideal (4G i wouldn't bother), I suppose it depends on whats available in the area.

[ConceroEdu_Matt]

Getting a truly diversely routed connection is very hard, and you usually only realise its not diverse when the digger cuts through both

 

Could you limp by with a 4G/ 5G connection? I've seen some places have this plus a temp block on high bandwidth sites they apply when failed over. Can still suffer from the digger problem but there's a least a few hundred feet where its definitely not shared ducting.

 

That said, my school doesn't have a redundant connection, it is a small outfit and I suspect they would get by

 

It’s within the DFE standards now that schools require a backup line - as not having access to things like cloud MIS or data could be considered a safeguarding risk.

[Mr.Ben]

We went down an SDWAN route so that we can use both primary and backup line efficiently and then block traffic to all but essential services if the primary line is down.

 

The DfE standards also specify multiple routers. That's a little over the available budget at most of our primaries so we just hold cold spares.

[allers61]

Cashless catering solution? We’re waiting for Capita to release their cloud solution for secondary schools (next Easter)?

[georgeescott]

Do you have any computer based exams?

 

We have AAT exams that use the PSI Bridge Secure Browser and that explicitly prevents the use of OneDrive running for the exam. Exam accounts won’t be able to use the native OneDrive client.

 

There’s also some exam software that requires a Windows server to run from e.g. Pearson or ACCA CBE.

[cheekycharly]

Great post and is exactly what I have been thinking of this week as I am sick of worrying about old servers at sites and then keeping up with the migrations.

 

What will you use for a filtering service for those two lines? I ask this as our filter through BT Lancashire uses Netsweeper and is given to machines by group policy based on if they are in the student or staff OU. Ive no idea how we would get around this if we went cloud.

 

My thought on this as I am in a PRU was how do I do the Group Policy side of the server when it goes cloud AD. We cant trust these pupils with the ability to right click delete or change backgrounds etc.

Edited November 17, 2022 by cheekycharly

[TechMonkey]

What will you use for a filtering service for those two lines? I ask this as our filter through BT Lancashire uses Netsweeper and is given to machines by group policy based on if they are in the student or staff OU. Ive no idea how we would get around this if we went cloud.

[/Quote]

 

ISPs can offer filtering services, either their own or a co-located service. So it is at the other end of your internet line, rather than in your server room.

 

My thought on this as I am in a PRU was how do I do the Group Policy side of the server when it goes cloud AD. We cant trust these pupils with the ability to right click delete or change backgrounds etc.

 

Depends on what you choose. Intune can do all that.

[KK20]

This is my quandry. I would love to move off hybrid and fully cloud based but there are quite a few obstacles. Most of those issues will be AD permissions for unavoidable local file shares.

 

Art, Drama and DT. These three subjects create mahoosive files for us. We currently use a (backup up) HA cheap drives NAS with some mapped drives to store files for these pupils. Part of the teams script I use also maintains the shared folders for pupils on a mapped drive. It is simply not feasible for us to sync these work files with the cloud, especially when we are talking gigabytes of raw workfiles per pupil. Cheap SSD caching on these NAS works wonders when the bell goes and people click save. There is no way in hell these files would sync to onedrive in short order! The same can be said for certain software (looking at you finance) that also create large local shared files, im sure there are cloud equivalents but for whatever reason it has been declined or not migrated.

 

Cost. I do like all the companies that claim moving the cloud with everything will save us money. sure, maybe if we were on a 3 year hardware refresh cycle with the latest and greatest SANs and servers but we arent. Moving our BMS offsite, paxton upgrade, CCTV would be a monster undertaking and simply not worth the return on investment to simply get rid of onsite AD. We already have a BYOD that works for our learning with onedrive and sharepoint storage, cloud VLE, cloud printing to email; I would have a hard sell for the SLT. Staff use their laptops with cached credentials and can access all the cloud stuff or they can VPN for apps with "school" storage - not ideal but it worked well enough during lockdown. we wanted to move isams to the cloud but could not get a cast iron guarantee from them that we could access our data - the API does not let you export "staff who have left" for example where we currently grab it from the database - they could not say if we would be given a database access in the future, so onsite it stays. I looked at moving our onsite SQL server server offsite - we only use a 4 core license so this would surely be cheaper using an azure SQL server you would think. Nope. Again, costing this out over say 3 years worked out more expensive in azure than having a local VM instance with its storage burden. Now I could have overestimate the vcore/hour rates I seem to remember running a profiler over a few days (this could have been heavier than normal days) but we get away with a 4 core SQL server on its 3tb datastore quite happily.

 

So for the time being I am stuck with hybrid and all the creaking that entails.

[Steve21]

This is my quandry. I would love to move off hybrid and fully cloud based but there are quite a few obstacles. Most of those issues will be AD permissions for unavoidable local file shares.

 

Art, Drama and DT. These three subjects create mahoosive files for us. We currently use a (backup up) HA cheap drives NAS with some mapped drives to store files for these pupils. Part of the teams script I use also maintains the shared folders for pupils on a mapped drive. It is simply not feasible for us to sync these work files with the cloud, especially when we are talking gigabytes of raw workfiles per pupil. Cheap SSD caching on these NAS works wonders when the bell goes and people click save. There is no way in hell these files would sync to onedrive in short order! The same can be said for certain software (looking at you finance) that also create large local shared files, im sure there are cloud equivalents but for whatever reason it has been declined or not migrated.

 

Cost. I do like all the companies that claim moving the cloud with everything will save us money. sure, maybe if we were on a 3 year hardware refresh cycle with the latest and greatest SANs and servers but we arent. Moving our BMS offsite, paxton upgrade, CCTV would be a monster undertaking and simply not worth the return on investment to simply get rid of onsite AD. We already have a BYOD that works for our learning with onedrive and sharepoint storage, cloud VLE, cloud printing to email; I would have a hard sell for the SLT. Staff use their laptops with cached credentials and can access all the cloud stuff or they can VPN for apps with "school" storage - not ideal but it worked well enough during lockdown. we wanted to move isams to the cloud but could not get a cast iron guarantee from them that we could access our data - the API does not let you export "staff who have left" for example where we currently grab it from the database - they could not say if we would be given a database access in the future, so onsite it stays. I looked at moving our onsite SQL server server offsite - we only use a 4 core license so this would surely be cheaper using an azure SQL server you would think. Nope. Again, costing this out over say 3 years worked out more expensive in azure than having a local VM instance with its storage burden. Now I could have overestimate the vcore/hour rates I seem to remember running a profiler over a few days (this could have been heavier than normal days) but we get away with a 4 core SQL server on its 3tb datastore quite happily.

 

So for the time being I am stuck with hybrid and all the creaking that entails.

 

Yep I think the thing is you “have” to change your curriculum to fit it. At least without lots of workarounds

 

We are just looking at options to move our Trust over time as we are building some new schools so hoping to make a blue print school for the rest to follow

 

For example, use an online CAD/CAM package rather than local therefore no files to sync in the first place

 

Drop Photoshop, use something like pixlr etc

 

Same with media etc, if you’re uploading files to an online editor and editing them there no syncs etc

 

Obviously all added costs. But my go to thought in the way we are looking to plan this is “how would you do this in a chromebook school” (not saying use chrome books, but think about how they’re get around it)

 

Steve