RabbieBurns Posted March 2, 2012 Author Posted March 2, 2012 @garethedmondson you can use ILM to automatically provision accounts from AD but it takes a bit of setting up, and costs a little bit. Its set and forget though, once its all done you dont need to go back to it at all. not sure about how to migrate the existing mailboxes but yes it is completely possible passwords cant be migrated per se but you can enable password sync, and password changes are synchronised, again this is done by ILM. SSO not really, once they log in to windows, they need to then log in again to windows live. You can however link live@edu to moodle which is good.
Mr.Ben Posted March 2, 2012 Posted March 2, 2012 (edited) @garethedmondson the Automated Provisioning/Password Sync and SSO isn't that difficult - the UK Live@Edu team have some good resources on doing this (which i'll share if you want). You'll need a server to do it on with FIM, IIS and SQL licences - i would avoid ILM now as FIM is the same product but will be supported for longer. Edited March 2, 2012 by Mr.Ben
plexer Posted March 2, 2012 Posted March 2, 2012 @garethedmondson you can use ILM to automatically provision accounts from AD but it takes a bit of setting up, and costs a little bit. Its set and forget though, once its all done you dont need to go back to it at all. not sure about how to migrate the existing mailboxes but yes it is completely possible passwords cant be migrated per se but you can enable password sync, and password changes are synchronised, again this is done by ILM. SSO not really, once they log in to windows, they need to then log in again to windows live. You can however link live@edu to moodle which is good. If you were setting it up now you would use FIM and PCNS to do the creation and sync bit. SSO by passing through the users current credentials is certainly doable via the SSO tools that are provided by live@edu with no additional logging on required. However if you go the SSO route just think of all the people who'll never be able to remember their username or password at home because it happens automagically within school. Ben
zag Posted March 2, 2012 Posted March 2, 2012 Yeh we found that people actually like to type it in at school as its consistant with using it at home as well. Whats really interesting is you can sign into windows 8 with the live ID. Maybe we could remove all local logins in the future
RabbieBurns Posted March 2, 2012 Author Posted March 2, 2012 @plexer but surely if they have logged into the school machine, its the same password then for live@edu if you are syncing passwords? I opened a support ticket in march 2011 and asked about SSO and this was the reply If you want to using AD authentication with SSO, we could use SSO in Office 365 which is the next version of Live@edu in the future. so i guess the future is now if they have implemented it. I will re-open a ticket. So is there a management agent for FIM now? I wonder if its worth upgrading as the only 2008 Server I have left is my ILM server I wouldnt mind getting it up to 2008R2. But then again, if it aint broke dont fix it.. its been working fine since I first set it up in feb2010 I dont really want to make any more work for myself.. But single sign on sounds promisng if they have implemented it now, can yhou polint me in right direction please?
RabbieBurns Posted March 2, 2012 Author Posted March 2, 2012 Yeh we found that people actually like to type it in at school as its consistant with using it at home as well. Whats really interesting is you can sign into windows 8 with the live ID. Maybe we could remove all local logins in the future I was going to post about it in the w8 thread but ill post here first. Have you tried w8 using the liveID? How does that work for user based group policies and mapped drives etc? Or does it not give them any of that and just their skydrive?
Mr.Ben Posted March 2, 2012 Posted March 2, 2012 (edited) So is there a management agent for FIM now? I wonder if its worth upgrading as the only 2008 Server I have left is my ILM server I wouldnt mind getting it up to 2008R2. But then again, if it aint broke dont fix it.. its been working fine since I first set it up in feb2010 I dont really want to make any more work for myself.. The setup was quite easy, but I wouldn't bother upgrading if it's working - there is no real benefit as far as I can see, apart from being able to run on a 64 bit server (I'm all 2008R2, so no 32 bit for me) Edited March 2, 2012 by Mr.Ben
ICTNUT Posted March 2, 2012 Posted March 2, 2012 (edited) Hi all, Sorry if I reapeat anything that has been said before however we have just finished another school migration to live@edu and have come across a number of gotchas that you may want to be aware of: SSO The mere fact you have to setup a trusted internal site with a certificate provided by the live@edu team in order to have SSO running is a lot of work for very little benefit, and you will end up with two different URLs for accessing thier email (internal/external) FIM / PCNS / OLSync This has got to be one of the hardest things to setup once you have it working back away and leave it alone - Do a bare metal recovery backup on this box so you can recover easily should it fail. First Time Sync When doing your sync for the first time the accounts will be created but the passwords will not, you will need to go through a complete password change cycle in order for PCNS to inform FIM to the inform OLSync Split Domain If you plan to use a different domain on live@edu for your email instead of the one used internally then you will need to add your external domain to your AD Domains & Trusts as a UPN Suffix and then update all of your internal user account to use the new suffix otherwise your OLSync will fail with a very unhelpfull message. I am currently doing all of our migration documentation for this school we just completed so as I go through this I will update this thread with more pearls of wisdom. In the meatime any questions fire away Edited March 2, 2012 by ICTNUT
jamesbmarshall Posted March 3, 2012 Posted March 3, 2012 But single sign on sounds promisng if they have implemented it now, can yhou polint me in right direction please? "Federated" SSO has not been rolled out to Live@edu. The SSO experience, along with user provisioning and password syncing remain unchanged. The new technologies (ADFS, DirSync, etc.) only apply to Office 365 for education which is not yet widely available. "If it ain't broke, don't fixt it" is a good way to view your current ILM installation - unless there's a burning desire to rebuild it all under FIM, I'd leave it alone for now! 1
jamesbmarshall Posted March 3, 2012 Posted March 3, 2012 FIM / PCNS / OLSync This has got to be one of the hardest things to setup once you have it working back away and leave it alone - Do a bare metal recovery backup on this box so you can recover easily should it fail. I'd be interested to hear your feedback on this - we've got some documentation which breaks down how to configure this into some simple steps.
PiqueABoo Posted March 3, 2012 Posted March 3, 2012 (edited) We currently have a centrally hosted Exchange 2007 service from the LEA. Centrally hosted as opposed to your own Exchange might be a sticky point (that's been overlooked in most responses). If time is short and account syncing, integrated passwords aren't that essential you can copy mailboxes to live@edu without OLsync etc. via a Staged Migration where you create the users in live@edu via a CSV, then use the ECP to migrate them via a similar CSV. But you need that Exchange 2007 system to be nicely configured for Outlook Anywhere (RCP/HTTP) with a cert from a recognised CA and you need an account that's got Full Access to all your source Exchange 2007 mailboxes. ["recognised" roughly means any CA that MS have in the Windows cert store by default or via their root cert updates] Disclaimer: There is a live@edu Service Update in progress that promises a new improved migration dashboard that might turn up sometime (ETAs for updates are not very predicatable). There is no reason to think the new features will break what has been possible to date, but until I've used it... Edited March 3, 2012 by PiqueABoo
ihaveaproblem Posted March 3, 2012 Posted March 3, 2012 I've just recently setup FIM, PCNS and SSO for live@edu At the start it might seem hard to setup, but actually it's rather easy and there is lots of good documentation to follow. I'm happy to try help if you have any questions. I find SSO very useful, especially for students. Since all email accounts are created from AD using FIM and olsync everyone's email account name is [email protected]er Very easy for all to remember when using email outside of school, plus having PCNS to sync the passwords makes it even easier. It’s especially good for students as it stops them 'pretending' they've forgot their school email and password to get out of lessons. You can add dns entries so Outlook auto discovers the settings when setting up an Outlook profile. This is good for staff that have laptops because they can easily setup outlook themselves and use the same application in and outside of school.
zag Posted March 5, 2012 Posted March 5, 2012 I was going to post about it in the w8 thread but ill post here first. Have you tried w8 using the liveID? How does that work for user based group policies and mapped drives etc? Or does it not give them any of that and just their skydrive? Works really well. They get lots of rights to do things but I am sure you will be able to change this behaviour. So glad we went Live@edu now instead of Google. I don't see any need to map drives if they have a skydrive link. Surely thats the point of it? Its an exciting future anyway
gshaw Posted March 5, 2012 Posted March 5, 2012 SkyDrive integration is one of Microsoft's trump cards over Google, tbh it could've been done with Windows 7 but it's most likely been held back to give 8 a killer feature
PiqueABoo Posted March 5, 2012 Posted March 5, 2012 SkyDrive integration is one of Microsoft's trump cards over Google, tbh it could've been done with Windows 7 but it's most likely been held back to give 8 a killer feature There's an MS blog somewhere that talks about a SkyDrive for Desktop in the works, which adds it into Explorer on Vista and Win7.
RabbieBurns Posted March 5, 2012 Author Posted March 5, 2012 There's an MS blog somewhere that talks about a SkyDrive for Desktop in the works, which adds it into Explorer on Vista and Win7. theres a 3rd party app that works pretty well that does it. http://download.cnet.com/windows/3055-20_4-10907413.html?tag=pdl-redir
Tricky_Dicky Posted March 6, 2012 Posted March 6, 2012 I'd be interested to hear your feedback on this - we've got some documentation which breaks down how to configure this into some simple steps. I'd love some documentation if you have it please.
plexer Posted March 6, 2012 Posted March 6, 2012 You can also just map a drive letter to your skydrive Ben
jamesbmarshall Posted March 6, 2012 Posted March 6, 2012 Have a look at this! FIM 2010 GalSync Installation - Standalone (Customer Friendly).pdf
jamesbmarshall Posted March 6, 2012 Posted March 6, 2012 @jamesbmarshall it needs full blown SQL server? Yes, as per Hardware and Software Requirements
drewp Posted March 6, 2012 Posted March 6, 2012 Did anyone catch the Webcast on Migrating to Live@edu and Office 365 for education? MigrationWiz was mentioned as a partner with software to help with live@edu migration. I trailed the Mail Migration feature and it works well MigrationWiz - Complete cloud-based mailbox migration solution for Microsoft Exchange Server, Microsoft Exchange Online , Office 365, Novell GroupWise, Lotus, Notes, Google Apps/Gmail, VMware Zimbra, IMAP and POP systems They have a nice looking AD sync tool as well, which is part of the MigrationWiz licence Introducing MigrationWiz AD to Office 365 DirSync Tool « MigrationWiz Blog
zag Posted March 6, 2012 Posted March 6, 2012 Did anyone catch the Webcast on Migrating to Live@edu and Office 365 for education? MigrationWiz was mentioned as a partner with software to help with live@edu migration. I trailed the Mail Migration feature and it works well MigrationWiz - Complete cloud-based mailbox migration solution for Microsoft Exchange Server, Microsoft Exchange Online , Office 365, Novell GroupWise, Lotus, Notes, Google Apps/Gmail, VMware Zimbra, IMAP and POP systems They have a nice looking AD sync tool as well, which is part of the MigrationWiz licence Introducing MigrationWiz AD to Office 365 DirSync Tool « MigrationWiz Blog I did the migration last year, it was a simple case of logging onto outlook and moving peoples emails. It worked really well as we had to reconfigure the client for people anyway. Did it in 2 days for all the teachers.
MattGibson Posted March 7, 2012 Posted March 7, 2012 I've found another tool called EasySync think they charge £500 for a licence and it'll automatically sync AD and passwords. Does MigrationWiz do the same job or is it purely a tool for migrating existing mailboxes to the cloud? I'm guessing we have to pay for use of the tool?
plexer Posted March 7, 2012 Posted March 7, 2012 As live@edu is becoming Office 365 for education will it be possible to use this in the future: Office 365 DirSync (x64) Installation Walkthrough « Mike Crowley's Whiteboard ??? Seems as though Office 365 supports sql express for the sync tool. Ben
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now