Canva Azure or ADFS

[discoveranother]

Hi all,

 

Have a school that have signed up to Canva (never come across it before). Looks like some cloud service for school resources. Is anyone out there using it ?

 

https://public.canva.site/canva-edu-district-resources/#page-4

 

The school have an onsite AD server, does not have ADFS installed. They use M365 for emails etc.

 

Canva has asked apparently which the school are using Azure or ADFS, but they aren't using either. Has anyone installed ADFS on Window Server ? Is it ok to be installed onto one domain AD server ? It comes as part of one of the roles in Server Manager, but I would like to know if there are any prerequisites or problems on the domain that may occur if I install it ?

 

Thanks all for any help.

Edited April 25, 2024 by discoveranother

[DavR]

Unless you have a very specific usage case, or a personal understanding of ADFS, steer well clear. It's almost certainly too complicated for what you need and is being deprecated.

 

If the school are using M365, then it's Azure (now Entra) that will be managing their authentication to that underneath, which may or may not be sync'd with their onsite AD. It's Azure (Entra) that you'll want to connect to Canva for SSO.

 

Sorry to be the GDPR bore, but have you done a DPIA on a) using Canva in school and b) connecting it to your Azure for authentication? You can probably get away without a) given that it's primarily a graphic design tool but b) connecting to your Azure user database, that probably should be assessed.

[snagrat]

Do you have on-site Exchange server?

[Olliedawg]

As above, ADFS is quite a lot to take in. I wouldn't bother getting into it now unless its already on a site you manage.

 

Since the school already use M365 for email, you can look at using Azure to handle SSO.. its quite easy to get going - much easier than ADFS ever was.

 

Canva is a great tool - it is used in my school by teachers mostly

[discoveranother]

Thanks all for all the very useful replies.

 

If I may ask, will I need to link the AD on site logins with Azure as they are not currently synced with each other ? and if so, if I may ask, if this sync is setup, forgive me, not done it before, does this then mean staff will be logging in to their onsite systems with their M365 credentials ?

 

Interesting point about the DPIA.

 

Thanks all for the responses.

[Olliedawg]

Thanks all for all the very useful replies.

 

If I may ask, will I need to link the AD on site logins with Azure as they are not currently synced with each other ? and if so, if I may ask, if this sync is setup, forgive me, not done it before, does this then mean staff will be logging in to their onsite systems with their M365 credentials ?

 

Interesting point about the DPIA.

 

Thanks all for the responses.

 

Sorry I assumed you were in a hybrid setup and was already using M365/Azure!

So the school is using M365 for email, but not syncing anything to Azure/Entra?

[discoveranother]

Sorry I assumed you were in a hybrid setup and was already using M365/Azure!

So the school is using M365 for email, but not syncing anything to Azure/Entra?

 

Thank you.

 

Yes that is correct.

[Olliedawg]

Thank you.

 

Yes that is correct.

 

In that case, you would need to set up Azure (Entra) AD Connect on a Domain Controller, to sync the users up to Azure (Entra).

 

Check this ms documentation & the pre-reqs : Set up directory synchronization for Microsoft 365 - Microsoft 365 Enterprise | Microsoft Learn

[discoveranother]

In that case, you would need to set up Azure (Entra) AD Connect on a Domain Controller, to sync the users up to Azure (Entra).

 

Check this ms documentation & the pre-reqs : Set up directory synchronization for Microsoft 365 - Microsoft 365 Enterprise | Microsoft Learn

 

Thank you very much for your help.

 

Just one last question, once set up, does this mean that users then log into their on-site systems using their M365 credentials i.e. logon username would be [email protected]

 

Thank you

[Olliedawg]

Thank you very much for your help.

 

Just one last question, once set up, does this mean that users then log into their on-site systems using their M365 credentials i.e. logon username would be [email protected]

 

Thank you

 

No problem.

 

Yes if the devices are Domain Joined they will log in using the same User Login name as previously (sAMaccountname).

 

See here : What are Microsoft Entra registered devices? - Microsoft Entra ID | Microsoft Learn

 

Devices can be

• Entra Joined
  
• Entra Hybrid Joined
  
• Entra Registered
  

 

Users would only use their M365 credentials if the device was purely Entra Joined.

 

If you still have on prem AD, devices would be hybrid joined (domain joined first, then synced to Entra via AD connect)

 

In affect, the login would only be different if the devices were purely setup for Entra ( Entra Joined ) and not domain joined. Hope that makes sense

Edited April 26, 2024 by Olliedawg

[discoveranother]

No problem.

 

Yes if the devices are Domain Joined they will log in using the same User Login name as previously (sAMaccountname).

 

See here : What are Microsoft Entra registered devices? - Microsoft Entra ID | Microsoft Learn

 

Devices can be

• Entra Joined
  
• Entra Hybrid Joined
  
• Entra Registered
  

 

Users would only use their M365 credentials if the device was purely Entra Joined.

 

If you still have on prem AD, devices would be hybrid joined (domain joined first, then synced to Entra via AD connect)

 

In affect, the login would only be different if the devices were purely setup for Entra ( Entra Joined ) and not domain joined. Hope that makes sense

 

 

Thank you very much. Really appreciated.