Azure Virtual Machines for Trusts

[NathanH99]

Hi All,

 

I work inside a trust of 9 schools, we are experimenting / looking into moving our primary domain controller from onprem into azure. So far I have been able to setup a azure domain controller, an IPSec tunnel and then a local domain controller. I have been able to get them connected and replicating as expected which is great but the cost of the IPSec tunnel was way too high I had to turn it off. (Luckily using the trial money so far...). If you have done this I would massively appreciate it if you could share how you connected your on-prem to azure?

 

Also any experiences / advice in general about azure virtual machines / domain controllers is welcomed!

 

Thanks,

 

Nathan

 

[AlphamaleZed]

Any need for On Prem DC? Entra can do it and you dont have to pay for a VM.

 

Entra to manage Users.

InTune to manage devices and set policies.

 

Unifi to manage DHCP/DNS and then intersite connectivity - I think you can use Magic WAN where one site has static IP and the rest CG-NAT.

Unifi also does site to site VPN or Unifi Identity to do auto wifi and VPN etc....

 

This is the ideal full cloud approach.

[NathanH99]

11 minutes ago, AlphamaleZed said:

Any need for On Prem DC? Entra can do it and you dont have to pay for a VM.

 

Entra to manage Users.

InTune to manage devices and set policies.

 

Unifi to manage DHCP/DNS and then intersite connectivity - I think you can use Magic WAN where one site has static IP and the rest CG-NAT.

Unifi also does site to site VPN or Unifi Identity to do auto wifi and VPN etc....

 

This is the ideal full cloud approach.

Is this something you have tested and done in a working enviroment? The idea of it sounds great but leaves with me concerns... One school has around 1000 devices, all of these devices being azure joined and azure managing the authentication worries me.

[AlphamaleZed]

Just now, NathanH99 said:

Is this something you have tested and done in a working enviroment? The idea of it sounds great but leaves with me concerns... One school has around 1000 devices, all of these devices being azure joined and azure managing the authentication worries me.

Really? AutoPilot does this i think.

i have tested on one machine and works cloud I am still migrating over.

 

Give it a good few years and domain controllers will be EOL with some good reasons. 

 

how does it worry you? MS seems to really be doing a good push and to be honest it seems more secure as it rules out margin for user error which is most outages lol

[lparry]

Just out of curiosity as this has always been my sticking point from going 100% cloud - how would you manage the below situation?

Our computer labs are shared between both sixth form and Y7/11 students, both groups have different restrictions which gets applied ruling out having device based policies. When using intune - user based policies don't always apply fast enough leaving computers in a brief but exploitable whilst it syncs. How is it possible to ensure the policies are applied prior to users being able to access the machine?

 

I haven't properly delved into it for a 1.5/2 years but when I last looked, this is what caused the project to be shelved

[Aprice]

We've found it more cost effective to run something like a virtual Mikrotik in Azure and use that to run the VPN from than using Azure's offering. 

The licensing is perpetual and pretty cheap, especially for something like a 1 gig which is probably more than you need for a DC.

[AlphamaleZed]

1 hour ago, lparry said:

Just out of curiosity as this has always been my sticking point from going 100% cloud - how would you manage the below situation?

Our computer labs are shared between both sixth form and Y7/11 students, both groups have different restrictions which gets applied ruling out having device based policies. When using intune - user based policies don't always apply fast enough leaving computers in a brief but exploitable whilst it syncs. How is it possible to ensure the policies are applied prior to users being able to access the machine?

 

I haven't properly delved into it for a 1.5/2 years but when I last looked, this is what caused the project to be shelved

What policies?

 

I am only secondary but I have tied our students, staff etc.. with same restrictions to be honest 

[NathanH99]

17 minutes ago, Aprice said:

We've found it more cost effective to run something like a virtual Mikrotik in Azure and use that to run the VPN from than using Azure's offering. 

The licensing is perpetual and pretty cheap, especially for something like a 1 gig which is probably more than you need for a DC.

Thank you, I will have a look into this. 

[jmak]

The fleet I'm responsible for is still AD managed and authenticate against a DC, although they are hybrid joined. However we do have a fleet of around 7000 Intune managed Windows devices and they are Entra only managed. They tend to be in clusters as generally whole organisational groups move at the same time, and we haven't found any issues with high density.