Azure AD to AD/Hybrid

[DalekSec]

Afternoon All,

 

We are needing the requirement to have an AD environment (currently fully cloud, no on site servers), due to a new bit of sage software. I have the following ideas;

 

1) Whip up an AD in Azure (cloud) and don't hybrid it just run Sage and AD in their own little circle

2) Whip up a full AD environment in the cloud, join it with AAD and then Sage. 

3) Built onsite server setup with then AD, Sage etc. and hybrid join it

 

Ideally i want option 1 but im worried about future servers etc also needing AD and running into issues of it being separate, so i think 2 is the best option (3 i priced out at roughly 100k), i'm also aware going from AAD to Hybrid isn't the most straightforward...

 

Has anyone done a AAD hybrid move? if so can you point me to any guides etc please! 

[paulkerton]

1 minute ago, DalekSec said:

We are needing the requirement to have an AD environment (currently fully cloud, no on site servers), due to a new bit of sage software.

You know what we're all going to ask don't you?
Why was this procured if it requires you to go backward?

[DalekSec]

2 minutes ago, paulkerton said:

You know what we're all going to ask don't you?
Why was this procured if it requires you to go backward?

 

Trust me i am extremely pissed at the whole scenario, Shadow IT of the highest order. Was brought and implemented with a 3rd party cloud hosting provider without IT's knowledge till it was too late.

 

Edit: Finance are now complaining that sage is slow, when in Sages docs, it says it big bold letters, DO NOT RUN OVER A WAN.

Which does rule out 1&2 but the cost of 3 might just have make them deal with it, the plus side of us hosting it in the cloud is the VPN to the cloud Subnet meaning they can use the client software without the need to RDP

[paulkerton]

I feel for ya.
I've just started to reject anything that comes along as a fait accompli at this point.
"Oh but you've already paid? Sucks for ya budget!"

[DalekSec]

5 minutes ago, paulkerton said:

I feel for ya.
I've just started to reject anything that comes along as a fait accompli at this point.
"Oh but you've already paid? Sucks for ya budget!"

 

Normally yes, but the CFO is pushing for this now...

[jmak]

I asked Gemini to explain sunk costs to someone economically illiterate:

 

Quote

Imagine you're trying to build a treehouse. You spend a lot of money on special wood, tools, and fancy paint. You've already paid for all of it, and you can't get that money back. That money is sunk.

 

Now, you realize the tree you picked isn't strong enough, or maybe you're just not enjoying building the treehouse anymore.

A "sunk cost" is any money, time, or effort you've already spent that you cannot get back, no matter what you do next.

The tricky part is, sometimes people make bad decisions because of sunk costs. They might think, "I've already spent so much money on this treehouse, I have to finish it, even if it's going to fall down or I hate building it." This is called the "sunk cost fallacy."

The important thing to remember is that because sunk costs are gone, they shouldn't influence your future decisions. You should only think about what makes sense from this point forward, not what you've already "lost."

Think of it like this: If you spill a glass of milk, the milk is gone. Crying over it won't bring it back, and it shouldn't stop you from getting another glass if you're still thirsty! The spilled milk is a sunk

cost.

 

Edited May 27, 2025 by jmak

[PotNoodleTech]

Yeesh.  This is the probem with cloud only in schools, there is so much badly written software that needs lan/server/shared drive letters.

 

Does it need to be an actual server/full active directory?  Can you not get away with installing on a workstastion and using a shared folder /  file permissions with your existing cloud accounts?

 

(irony is we were all trying to get rid of "lolcal non AD lan recources" 20 years ago and now you need them again!!)

[Roberto]

This whole saga is ridiculous. I'd tell them to sling their hooks with this one if I could.

 

So - you don't need an AD that's joined to AAD for this do you? If it's only a few people in finance, set them up with just the bare minimum they need for that, with separate accounts and passwords for those individuals. Sure it might not be the smoothest experience in the world but it's not terrible and I think my sympathy for them would be somewhat limited in your position...

 

I would do this all in Azure VMs, with remote desktop access to a Remote Desktop system for the users to deliver acceptable performance by keeping the SAGE resources, AD and user endpoints for Sage together and avoid what looks like an extremely high cost to set up on-prem resources (and don't forget, support and upgrades for the on-prem stuff for as long as you need it to run Sage).

Edited May 28, 2025 by Roberto

[RobFuller]

So security the above that Roberto suggested would be best, keeps the systems separated.

 

You can also enable Microsoft Entra login for a Windows VM in Azure. 

 

https://learn.microsoft.com/en-us/entra/identity/devices/howto-vm-sign-in-azure-ad-windows

[DalekSec]

Cheers all, i did think that would be the best way but thought i'd raise it before incase there was any gotchas! We have a year to implement this now as they gave us 5 days notice of the renewal happening so didnt have time to implement the change..

[Davit2005]

Sage is one of those bits of software that gives me a nervous twitch. Would recommend using localized either local servers or a VM with RDP in Azure so the data is local to the user. Start bringing any sort of networking into the picture and Sage will likely blame it for any issues. Or invest in a native web based alternative and migrate 🙂

Edited May 29, 2025 by Davit2005