Welsh schools - Hwb Intune for Windows devices instead of local domain

[Olliekai]

Looking to reach out to anyone in schools in wales with experience in using the hwb provided Intune offering to replace local AD. Ideally looking to find out what the painpoints are, any lessons to be learnt, any regrets etc but also any possitives.

[techwizard]

Sorry we don’t use hwb intune, just the 365 accounts. 

[mikes]

I've been looking into this too - did you get any luck ?  From what I've read, the local authority need to set up the scope for your area and then give you access to manage your school itself.  I have tried to log in but I don't have any access and my message to our LEA hasn't been answered. I suspect they aren't particularly interested in doing it - we haven't been told anything about having to move over to Hwb unlike others on here it seems. 

 

I want it for a few reasons - Visiting staff from other schools should be able to log in with their Hwb logins - meaning nobody showing up randomly asking for temp logins.   The environment hopefully should be standardized too instead of me picking whatever settings staff ask for.   I want to move on soon and I think a Hwb environment will be easier for the school to cope with rather than the patchwork of things I've set up over the last 15 years. 

 

Downsides will be a lack of customisation and flexibility, staff will have to get used to me saying no to certain things. And I'm still confused on how things like SAR requests work as I can't see any way to access Purview on Hwb's 365.  So would also like to hear how this has gone for other people ? LEA aren't bothered and Hwb just say contact LEA  so it kinda seems a lil half baked to me if I'm honest

[garethEds]

I'm hearing that there are LEAs in Wales that are regretting moving their ADs to Hwb InTune. Of course I doubt anyone would admit openly, but from speaking to some people across LEAs - a few are not happy. I'm unsure what to do. The case of one-size fits all isn't sitting well with me - but it does give us the protection of being on a centrally controlled system.

[3s-gtech]

Yay.

 

i will be keeping our current infrastructure running, pared back, for just such an eventuality.

 

Those paid enough to make decisions like this inevitably get promoted out of harm’s way, or ‘head-hunted’ out of the organisation, then vilified by those left.

[mikes]

I am looking into doing this for the end of next summer not this summer, maybe

 

Basically due to budgets. Our servers and SAN are from 2019 and it looks like we are having no budget to replace them; we can barely replace computer rooms it seems.

I've visited a few schools in S Wales, there are some caveats like Google Groups - they had to run their own Google domain because the Hwb one won't let you set up groups in Google; so they had to make the groups on their own domain then add that group in to their Hwb Google Share.

 

In these schools there was a lot of staff pushback; staff had got their way of working which they've used for years - now they are told they have to move their e-mails; home folders, Classrooms etc to a new Hwb system and a lot of staff refuse to do it citing Union concerns.  Other staff disliked it and find it a good way to blame the IT department for any problems they have  e.g. losing files etc.

 

(also what's really sad is the culture of people keeping bad things hidden then lying that things are fine and good. So nobody can ever learn.)

 

But my option is either wait for my servers or SAN to fail, or enroll all our systems into the Hwb intune system so all we need on site is Internet access for them to work.  Or I say my option, our head of IT is the one really pushing for us to move over to Hwb, but I am going with it because I see little alternative at the moment.  Our SMT have come from other schools who used Hwb as well so I am hoping there won't be much staff pushback here (the staff who do complain will just be teaching staff not "important" staff)

 

Any issues with reduced service, the school will just have to deal with it. If they ask me to do a SAR, I will just direct them to the hwb support desk. 

 

I've now got access to the Intune system from our LEA, and have built a machine and deployed some software. It's basically unconfigured though so I have to make all my software packages again, configure GPO's,  configure OneDrive integration, configure AppLocker, compliance policies etc. Which is quite a bit of work but it does mean I do have access to configure it myself.

 

As I work through the summer hopefully I will know more pros and cons. One advantage is again all they need is Internet Access to work so there's no VMware environment, legacy domain setup etc that could fail like I have now.

 

 

[techwizard]

1 hour ago, mikes said:

I am looking into doing this for the end of next summer not this summer, maybe

 

Basically due to budgets. Our servers and SAN are from 2019 and it looks like we are having no budget to replace them; we can barely replace computer rooms it seems.

I've visited a few schools in S Wales, there are some caveats like Google Groups - they had to run their own Google domain because the Hwb one won't let you set up groups in Google; so they had to make the groups on their own domain then add that group in to their Hwb Google Share.

 

In these schools there was a lot of staff pushback; staff had got their way of working which they've used for years - now they are told they have to move their e-mails; home folders, Classrooms etc to a new Hwb system and a lot of staff refuse to do it citing Union concerns.  Other staff disliked it and find it a good way to blame the IT department for any problems they have  e.g. losing files etc.

 

(also what's really sad is the culture of people keeping bad things hidden then lying that things are fine and good. So nobody can ever learn.)

 

But my option is either wait for my servers or SAN to fail, or enroll all our systems into the Hwb intune system so all we need on site is Internet access for them to work.  Or I say my option, our head of IT is the one really pushing for us to move over to Hwb, but I am going with it because I see little alternative at the moment.  Our SMT have come from other schools who used Hwb as well so I am hoping there won't be much staff pushback here (the staff who do complain will just be teaching staff not "important" staff)

 

Any issues with reduced service, the school will just have to deal with it. If they ask me to do a SAR, I will just direct them to the hwb support desk. 

 

I've now got access to the Intune system from our LEA, and have built a machine and deployed some software. It's basically unconfigured though so I have to make all my software packages again, configure GPO's,  configure OneDrive integration, configure AppLocker, compliance policies etc. Which is quite a bit of work but it does mean I do have access to configure it myself.

 

As I work through the summer hopefully I will know more pros and cons. One advantage is again all they need is Internet Access to work so there's no VMware environment, legacy domain setup etc that could fail like I have now.

 

 

with the SMT from hub schools, do those schools have a IT mngr ? 

[mikes]

no idea, there's no IT manager here. But I think different local authorities have much different levels of control/support for their schools

[pooley]

RCT Schools are being directed to move across to HWB from on prem. I'm in BCBC and it's being encouraged.

[mikes]

yes I visited a school in the north of there and they are mostly moved over.  I am southeast of there in my county they aren't really concerned. They provide Internet Access/Switching etc, but everything on the user side of the Ethernet port is the schools concern (e.g. domains, computers etc) . So it is up to me.

 

They have given me access to our LEA's Hwb Intune Portal (it works by Hwb delegating to LEA who can maybe delegate to school techs) and I am working from there.

 

From what I gather in a lot of authorities, it is the authority itself who sets up the Hwb/intune etc environment, they deploy this then to their member schools and the schools work from there. In the Hwb groups the vast majority of posts are from LEA employees hardly any from actual school technicians.

[techwizard]

On 02/07/2026 at 15:18, mikes said:

yes I visited a school in the north of there and they are mostly moved over.  I am southeast of there in my county they aren't really concerned. They provide Internet Access/Switching etc, but everything on the user side of the Ethernet port is the schools concern (e.g. domains, computers etc) . So it is up to me.

 

They have given me access to our LEA's Hwb Intune Portal (it works by Hwb delegating to LEA who can maybe delegate to school techs) and I am working from there.

 

From what I gather in a lot of authorities, it is the authority itself who sets up the Hwb/intune etc environment, they deploy this then to their member schools and the schools work from there. In the Hwb groups the vast majority of posts are from LEA employees hardly any from actual school technicians.

Says a lot

[mikes]

Do any of you get access to a Sharepoint site as part of Hwb ? The schools I visited seemed to have one (were able to set up Sharepoint groups etc)  I'm not seeing any such thing on my Hwb instance at the moment

[Olliekai]

51 minutes ago, mikes said:

Do any of you get access to a Sharepoint site as part of Hwb ? The schools I visited seemed to have one (were able to set up Sharepoint groups etc)  I'm not seeing any such thing on my Hwb instance at the moment

I think you have to request it with hwb. Though it might already exist the format used is 

 

https://hwbwave15.sharepoint.com/sites/

 

followed by full DFE number. Should be a case of hwb giving you permissions for it. 
 

 

[LeonardTwitty]

Reviving this rather than starting another one, since Olliekai's original question from November still hasn't really been answered, and I'm somewhere behind techwizard in the same queue.

Powys secondary, plus three primaries I also cover. The LA has told us we're moving to Hwb. No date yet — they're still in operational planning, because there are a lot of schools to move across and we're one of them. So I'm in the slightly odd position of knowing it's coming, not knowing when, and not yet knowing how much of the estate is in scope.

Where we're starting from: Proxmox cluster, domain-joined Windows off a local DC with Group Policy, Chromebooks, and Google Workspace through Admin Console.

Which brings me to what I actually want to ask, and it's for anyone who's already been through it rather than any one person:

What should I be pinning down with the LA now, while they're still planning, that you wish you'd pinned down before it got decided for you?

My read is that the window where a school has any influence over how this lands is exactly the window I'm sat in, and that it closes quietly and without anyone mentioning it.

[mikes]

I'm not sure what you'd really be able to change, their setup is pretty standard across all schools. 

For us we are messing with Google Classroom and have hit a snag, it seems our Arbor information shows as correct in the Hwb interface, but in Google Classroom  the pupils are in the wrong classrooms; am trying to chase this with support see what's going on !

[LeonardTwitty]

4 minutes ago, mikes said:

I'm not sure what you'd really be able to change, their setup is pretty standard across all schools. 

For us we are messing with Google Classroom and have hit a snag, it seems our Arbor information shows as correct in the Hwb interface, but in Google Classroom  the pupils are in the wrong classrooms; am trying to chase this with support see what's going on !

Well we had a teams call with HWB "experts" and after 25 minutes of questions to them the meeting ended with no answers more questions and them saying we will need to check on that after every question.  As you can imagine confidence is not high atm!  If you manage to solve the classroom problem please let me know so I have a potential fix in the bag just in case.

[mikes]

I filed a ticket with Hwb but they haven't replied; honestly I don't know how good their support is, any complicated questions I get bounced back to my LEA who don't know or care.

It seems when Hwb is working properly it should be delegated Hwb -> Local Authority -> Schools  and you can get a wildly different experience based on your LA.

Now there is a Teams hwb tech group which I haven't taken part in yet as I didn't want to flood it with 50 questions but if the information isn't available anywhere else I'll have no real choice.

 

At the moment I'm having an issue with my LEA disabling Chromebooks if they are not version 148 or higher (which came out in May). They can only be re-enabled when they are up to date. But they won't update when disabled unless I find every one of them, manually log in, then update. So I'm going to have to chase this up with Hwb because I thought Hwb's policy was 6 months.

 

So if you do move over to Hwb be prepared to have your LEA messing with your setup for better or probably for worse

[garethEds]

35 minutes ago, mikes said:

I filed a ticket with Hwb but they haven't replied; honestly I don't know how good their support is, any complicated questions I get bounced back to my LEA who don't know or care.

It seems when Hwb is working properly it should be delegated Hwb -> Local Authority -> Schools  and you can get a wildly different experience based on your LA.

Now there is a Teams hwb tech group which I haven't taken part in yet as I didn't want to flood it with 50 questions but if the information isn't available anywhere else I'll have no real choice.

 

At the moment I'm having an issue with my LEA disabling Chromebooks if they are not version 148 or higher (which came out in May). They can only be re-enabled when they are up to date. But they won't update when disabled unless I find every one of them, manually log in, then update. So I'm going to have to chase this up with Hwb because I thought Hwb's policy was 6 months.

 

So if you do move over to Hwb be prepared to have your LEA messing with your setup for better or probably for worse

 

The Hwb tech group is good. There is an online meeting as well which you can attend. It's usually LEA people although I occasionally drop in - despite not being a Hwb domain school. My issue with it all - and I'm happy to publicly say it - we don't know who is making all the decisions that affect schools. I cannot find the chain of command.

 

Another example - we pulled out of the LEA print service. We have our own PaperCut server and our own contract with KM. Yet from what I've been told, Hwb will allow one print server per LEA. This means we cannot have our own print server connected to our machines. I've thought about putting it on the Papercut cloud - but am yet to me told whether this would be allowed. The print issue is the main red line for us as yet. Once that is in place I'm going to start the move.

[pooley]

Can someone point me in the direction of this HWB Tech group please? I've got to migrate 2 primaries from in house AD to HWB, along with 2 instances of Papercut ffs 

[garethEds]

1 minute ago, pooley said:

Can someone point me in the direction of this HWB Tech group please? I've got to migrate 2 primaries from in house AD to HWB, along with 2 instances of Papercut ffs 

 

Ask your LEA Advisor to get you on board.

[3s-gtech]

16 minutes ago, garethEds said:

 

The print issue is the main red line for us as yet. Once that is in place I'm going to start the move.

 

Printing, for the same reason, is one of ours. Next is decent filtering (can we use our own Smoothwall? No one knows).

[mikes]

I was planning to use the Papercut web mode but after the latest security vulnerability I'm very dubious on that now

[LeonardTwitty]

3 hours ago, mikes said:

I filed a ticket with Hwb but they haven't replied; honestly I don't know how good their support is, any complicated questions I get bounced back to my LEA who don't know or care.

It seems when Hwb is working properly it should be delegated Hwb -> Local Authority -> Schools  and you can get a wildly different experience based on your LA.

Now there is a Teams hwb tech group which I haven't taken part in yet as I didn't want to flood it with 50 questions but if the information isn't available anywhere else I'll have no real choice.

 

At the moment I'm having an issue with my LEA disabling Chromebooks if they are not version 148 or higher (which came out in May). They can only be re-enabled when they are up to date. But they won't update when disabled unless I find every one of them, manually log in, then update. So I'm going to have to chase this up with Hwb because I thought Hwb's policy was 6 months.

 

So if you do move over to Hwb be prepared to have your LEA messing with your setup for better or probably for worse

Oh the joys of external oversight!!

[Olliekai]

8 hours ago, garethEds said:

 

The Hwb tech group is good. There is an online meeting as well which you can attend. It's usually LEA people although I occasionally drop in - despite not being a Hwb domain school. My issue with it all - and I'm happy to publicly say it - we don't know who is making all the decisions that affect schools. I cannot find the chain of command.

 

Another example - we pulled out of the LEA print service. We have our own PaperCut server and our own contract with KM. Yet from what I've been told, Hwb will allow one print server per LEA. This means we cannot have our own print server connected to our machines. I've thought about putting it on the Papercut cloud - but am yet to me told whether this would be allowed. The print issue is the main red line for us as yet. Once that is in place I'm going to start the move.

I believe papercut cloud would be the same as papercut NG/MF. From what I was told it’s Hwb want to limit the number of app approvals / integrations on Entra to keep it manageable 

[mikes]

yes that is one thing to consider. Using external apps that require a Google sign in etc.  Staff may not be able to use certain resources when we use Hwb (there are issues with GDPR/consent and these external apps anyway)

 

Our issue with Google classroom was - we created Hwb google classrooms on Tues 2nd/Wed 3rd,  unfortunately our staff member responsible for timetabling hadn't done them properly or hadn't finished them, so they were wrong.   And Hwb doesn't do an auto sync during the Rollover period of the first 2 weeks back,  so any pupil classes in your MIS  will be what you get in Google Classroom for the first two weeks.

But for us we had loads of pupil moves etc so a lot of students have the wrong classrooms in Hwb.  But this should sort out Monday when it does a sync.

I did find a document from some other school who had written up their migration to Hwb, I will see if I am able to post it here