Serverless and cloud only

[andy_nic]

So most things are stored in the cloud, i'm thinking removing AD, entra Connect and the rest and going fully server less. Maybe apart from a printer server i know papercut and sync with EntraID but is the papercut/paper server just Azure joined? is there any hidden things people have came across which the didn't think of when they started the journey? our firewall can manage the DHCP part.

[nicholab]

Can you work with only Entra AD, you have limited control or are you using another directory?

[dhicks]

1 hour ago, andy_nic said:

is there any hidden things people have came across which the didn't think of when they started the journey?

 

Depends on exactly what services you use and your current setup, but probably very do-able. We've removed our Windows Domain Controller and file servers and now use Google Drive / Workspace instead. We are fortunate in having good, reliable, fiber-to-the-premises connections - we actually have two, running via separate routes, and Google Workspace has proven very reliable (so far!). I think several schools were impacted by Azure outages a month or two ago, but that sort of thing is bound to happen at some point, just as long as your organization understands that sort of thing is out of your direct control, and overall uptime has been much better with cloud services.

 

We still have on-site servers / controllers running our phone system (3CX), door access (Paxton), wireless (UniFi) and print (Papercut) - those things all relate to on-site hardware, a pure all-cloud solution is going to be hard. We run the servers for that lot as a bunch of virtual machines on a single Windows server, with another Windows server on standby and backup daily using Veeam. Still a reasonable amount of on-site hardware, although I suspect the actual servers needed now if we were buying new wouldn't be much beyond a standard Mini PC. We also have a separate Synology backup appliance which takes backups (every half hour?) of our Google Workspace, so we do still have an on-site backup of our files.

 

We also run a remote desktop service for those users (teachers) who need specialist software (Timetabler) or just can't get the hang of not using Windows - I think we're now down to half-a-dozen users. That service could just as well sit in the cloud somewhere, it's just that we have the on-site hardware otherwise spare so we might as well use it.

 

We have an on-site Smoothwall device for filtering, we are currently having issues getting it to recognize users logged on to Windows and MacOS devices - Azure AD joined devices might be better supported.

 

Interestingly, because we have an on-site server cupboard, complete with two internet connections, two separate UPS-backed power supplies and cooling (and backup cooling!), we currently probably have a fair bit of spare capacity. That be useful to move to doing some AI processing locally.

[andy_nic]

Our phones are teams phones,  files in sharepoint, teams, OneDrive etc, most new systems are linked via entraid so we’re just creating accounts in local AD to sync entraID. students 1-2-1 devices are in Intune, iPads also. Staff devices soon will be Intune managed, so then that’s mdt and sccm gone. it rooms we only have 2 rooms and a hand full pc like DT machines, which could intuned. Most other servers is just supporting local ad services. Then was thinking a online service to back up just the printer server. With most in the cloud already we just moving users accounts main home to entraID. 

Edited January 29 by andy_nic

[Davit2005]

I think with everything cloud you have to look at the service you are providing. If it is cloud native i.e. SaaS it is a lot simpler. IMO If it requires anything near IaaS you are potentially creating more work, jus moving the problem and not necessarily making it cheaper or easier to manage. VPNs, Microsoft Gateways, Firewall rules etc then you are managing the server too it if is IaaS

Edited January 30 by Davit2005

[itskdog]

23 hours ago, andy_nic said:

Maybe apart from a printer server i know papercut and sync with EntraID but is the papercut/paper server just Azure joined?

 

If printing is the only service that doesn't have a SaaS equivalent, look into if your MFDs support PaperCut Hive (and that the current features are enough for your needs - individual user quotas have been added, but shared accounts aren't available yet).

 

If you still need NG/MF, then it can integrate with Entra without having the server be Entra joined, you just create a custom application in Entra to sync users, and configure the PaperCut web UI to run on HTTPS to that they can log in to check their balance. Docs: Synchronize user and group details with standard Entra ID | PaperCut

 

The built-in Print Deploy client lets you push out the printers to the users via Mobility Print, they just have a single click "Sign in with Microsoft" on login to install the printers to their PC as long as Edge SSO is enabled. (No idea why it doesn't just use Entra's SSO for zero-touch login like Cloud Drive Mapper does, 🤷‍♂️)

[nicholab]

22 minutes ago, itskdog said:

The built-in Print Deploy client lets you push out the printers to the users via Mobility Print, they just have a single click "Sign in with Microsoft" on login to install the printers to their PC as long as Edge SSO is enabled. (No idea why it doesn't just use Entra's SSO for zero-touch login like Cloud Drive Mapper does, 🤷‍♂️)

Warning: With the print deploy client, you need to make sure it works with an Entra-joined device.  We had an issue as some users had two accounts due to the other company they worked for and it was a pain.  You need a single UPN per user as Papercut used to only look at the username.  What I mean is the upn and the user name need to match.  This also direct connection was needed when printing PDFs as it did not work very well with bigh PDF's.

[itskdog]

1 minute ago, nicholab said:

as it did not work very well with bigh PDF's.

 

Yeah, we ran into that with printing large numbers of photos from File Explorer - after lots of back and forth with PaperCut, the (so far only tested on my PC, going to test with others over the next couple of weeks before half term if I can) fix is to enable Protected Print Mode so it installs the printer using Windows inbox drivers rather than PaperCut's drivers or the OEM drivers. Currently everyone's working around by doing print-to-PDF then printing that PDF.

 

7 minutes ago, nicholab said:

the upn and the user name need to match.

 

I would expect that for most schools the UPN and username will match, only in staff who work across a MAT where they might have aliases at each school might they have a bit of difficulty, but Mobility Print should assign the job to the user who signs in to Print Deploy, so as long as the auto-signin works in the default browser, then it should connect fine. If the user has two unconnected accounts in the same tenant, then you could configure it to let each of those UPNs release print jobs from the other UPNs that belong to that user and have a shared account as their personal quota rather than the user's normal quota.

 

[alanmorris]

I think one challenge for most locations that have had PaperCut for years with AD / On premise printing is that now they have new names for the same people, and these new strings, it is just a string to PaperCut, do not match to the name in Azure.

 

Locations new to PaperCut with Azure do not have the AD print baggage where the old names are either not in use any longer or still in use by Windows.

 

For print job tracking, the default method is to use the name the Windows print system reports as the job owner.  What I have seen with Azure joined machines is that the Windows job owner is NOT the name which is Azure.

 

At device authentication is for alanmorris but Windows tracks the job as alanmo.  PaperCut aliasing can track job created by multiple Windows Owners back to one user in PaperCut.  People have been using this method for the past 15 years in locations where there are a mix of MacOS and Windows.

 

Print Deploy can also be used to track the job to a different string than the one Windows provides as the job Owner.  It all depends on what works best for your situation.

 

I definitely know there have been a few locations which have torched all the AD usernames moving to Azure so the AD strings no longer exist in PaperCut and they track new jobs using the strings from Azure and set up Azure as the authentication authority for users logging onto devices.   

 

Thanks 

 

 

 

 

[alanmorris]

One last note, when you have any problems with Windows Point and Print, then it is time to switch to PaperCut Mobility Print.  You may find Windows authentication does not work for shared queues.

 

If you need advanced finishing options for Mobility queues, then PaperCut Print Deploy can deliver vendor drivers with the Mobility queues.

 

 

[Simcfc73]

I've been having issues with my cluster so think I may look at cloudless as they aren't doing much. Veeam license runs out in 2 months as well.

 

I have a paper cut server. Got a demo of hive soon.

Net2, which looks like it can be stuck on a cloud VM.

All devices are now intuned apart from the servers and a couple of DT machines.

Isams and finance are cloud only.

90% of files have been uploaded to SharePoint. I did use a network folder for some recent exams but I've got a big qnap box when cream goes.

 

I used a sophos box at my last school for DNS and DHCP for my vlans.. we have smoothwall so might still everything on that.  (Might need a fail over box??)

 

Be interested in how far people have got with this.

[itskdog]

We're in a similar boat to you @Simcfc73, but we're planning to keep Net2 on the same PC it's currently on as it's not too much maintenance, and we leave any maintenance to our 6-monthly maintenance visits from our installer. Will need to either move the PC to Windows 11 or put Net2 on its own VLAN, but we've still got a couple of years to go on the ESUs there.

 

The main changes we need to make are moving to PaperCut Hive or directprint.io (a quote we've received on what is apparently framework pricing looks like it might work out more expensive for a Ricoh machine that's half the speed of our current 120ppm RISOs, so we might end up having to go to with directprint for the cost & speed factor, or keep paying for Windows server to use PaperCut MF due to the 20 connection limit on a client machine), and migrating away from Impero EdPro (though with the nightmare stories I've heard about Senso on here, I'm a little hesitant, but we'd be more likely to go with them as we're an LGfL school and already get the safeguarding part free)

[Simcfc73]

We don't have any services on site (unless I discover somethign hidden somewhere) so it shoudl be straightforward. We have a MF license which was renews last month which we can migrate over the Hive. I have a scoping meeting with Sharp to see how this will work and its limitations. 

 

Our NET2 is virtualised so we have options.. just don't want it running on the SAN on its own. . I know the guy from NET2 was on the forum recently talking about sticking it in the cloud.

 

We run Senso v1 already (inherited) which seems ok.. it does miss some devices off the monitoring on occassions which is worrying.  I'm looking at moving to v2 but need to be 100% sure the clients migrate. I used to have PDQ at my last place which I loved but not sure how it would work in intune based devices.. and its soo much more expensive than  when I first got in.

 

 

[dhicks]

2 hours ago, Simcfc73 said:

I know the guy from NET2 was on the forum recently talking about sticking it in the cloud.

 

If you want to be able to run servers / virtual machines / etc off site ("cloud" based or simply on a server in a datacentre somewhere) you could look at one of the various tunneling services available that give you a secure connection between your internal network and a point somewhere outside. We've got on very well with using Cloudflare's tunneling service over the past few years, and at the kind of usage level we're at it's free. You would need a small internal device of some sort to act as the terminating point for the tunnel, but any basic mini PC these days should be able to handle that. If you want something you can self-host and have more control over, then we're also now looking at Pangolin.