itskdog

Good luck with that once they're part of XMA. We only have licence renewals with them but they seem to take forever to reply back, and even when we request quotes for other IT equipment to compare prices and get multiple quotes, we often don't get a reply before we've already filled out a PO for someone else. Especially difficult in February when you're trying to use the last bits of your budget before the accounts close.

I recently tried switching BrowserSignIn to 2 (Force) rather than 1 (Enabled) to see if that would help.

When we were on A1 it seemed to just work with no configuration. Just set the encryption on the email (yellow padlock icon on the "Options" tab on the ribbon) to either "Do Not Forward" or "Encrypt" The only problem was opening attachments that were made with Office as those would automatically get stamped with IRM and would cause trouble with Office 2016/2021.

By cost I was more talking about things like SSO services, patching solutions for everything other than the OS (to meet the 14-day deadline), replacing servers to have a supported OS, etc. that were already in there before, it was more that there's still no enforcement even in the updated version, which will affect the number of schools who will be ready by 2030. And of course even MFA for staff will get pushback from technophobic SLT members, and you can't really have an exception for them as otherwise everyone else will complain and you can't say "Even XYZ has to do it, we're not even making an exception for them".

Installed Outlook Classic the other day to work with PSTs, and I opened it as soon as it finished installing - said "Welcome to Outlook 2016" in the wizard, clearly M365 Apps are just Office 2016 with a coat of paint now.

Strongly doubt there will be too much buy-in from many SLTs without any enforcement. As long as it's just a stick with no carrot, the expense and inconvenience will put people off.

We use Riso MFDs here so Hive isn't suitable as they only have the Lite version in the firmware, so still have an on-site MF server. Configured Entra as our sync source, set up SAML for web authentication (found that was quicker than using OAuth). We're using Print Deploy + Mobility Print to authenticate to the printers, users just need to click "Sign in with Microsoft" once upon logging in to a PC for the first time to authenticate (doesn't support automatic Entra auth like CDM or OneDrive, unfortunately). Pushed out Print Deploy and User Client as Win32 apps, PaperCut have documentation in the manual on how to do that. (User client needs manually updating with every server update) Also make sure to change the config key to make the User Client check the UPN rather than the username, see this post for details:

Looked into CapCut - it's getting blocked on the web filter for AI, and the titles in the search results say it's AI, too. Possibly not permittable for under 13s, plus we'd need to update the school's AI policy and get that re-approved. We already have Canva as our replacement for Publisher, and AI is already set to staff-only there, so I've asked the teachers to check that out first to see how it goes.

What video editors do you use in your schools? With Windows Movie Maker being long-EOL and the school moving to Windows 11, Intune, & M365 A3 a year ago, we tried using Clipchamp, but the teachers have had lots of difficulty with using it for the Year 6 ICT lessons compared with Movie Maker (from the old Windows Live Essentials bundle that we used on Windows 10) as it relies so much on OneDrive for storage and the projects aren't traditional files but exist only within the Clipchamp app. Needs to still be simple and easy-to-use like Movie Maker (so that rules out Resolve, for example), and ideally free too.

Syncing worked for us, (at the very least, students moved up to their new classes), but CPOMS connects directly to Arbor, so you could be right that it's an Xporter issue. Though the handful of services we have that still use Xporter rather than Wonde do seem to be working fine from what I've seen.

"My apologies, I'm sorry for deleting the entire database and the backups. I shouldn't have done that."

How are you deploying this? Manually, GPO, Intune?

With it being an x86 Mac, there won't be an AI accelerator, but I do wonder if, with modern computers on both x86 and ARM having NPUs, if in the future a local model combined with something like this might be useful once they're powerful enough to run a smaller LLM without relying on the GPU. Might still have to worry about API tokens in regard to web searches, I suppose.

Enterprise and Education are identical in support dates, are you getting mixed up between Pro Education and Education? The 3 years of support, according to the Windows 11 Release Information page, is for "Enterprise, Education, IoT Enterprise, and Enterprise multi-session", when the 2 year support is for "Home, Pro, Pro Education, and Pro for Workstations" The step-up licence on M365 is called Enterprise as it is the same as in E3, I would guess even E3 would step-up a ProEdu to Edu rather than Ent.

Whether it goes to Enterprise or Education depends on what the base licence is. Education is just discounted Enterprise and has all the same policies available. If the device comes with Pro it will step up to Enterprise, if it comes with Pro Education (the discounted version of Pro that OEMs can only sell to schools) it will step up to Education.

https://learn.microsoft.com/en-us/windows/client-management/mdm/passportforwork-csp#devicetenantidpoliciesdisablepostlogonprovisioning

Disabled in the enrollment configuration and also on a default policy that applies to all devices (with the WHfB device group excluded), then a second policy that enables it, targeting the same group, and a third custom policy to disable Post-logon provisioning (as that CSP is not in the Settings Catalog). I'm sure if you used a user group instead, and the User version of the policies rather than the Device version, it might work.

WHfB is bound to the device, they can use their password still on other devices. So far only my machine has WHfB enabled, to test. Haven't done a wider rollout as so many devices are shared.

When you go to enrol or use a passkey on a website, it just asks for your WHfB credentials (e.g. PIN, Face, Fingerprint). Entra will enrol the passkey automatically, so you won't need to manually enrol for any services with SSO.

When I was in Year 9 our school set up a 1:1 system. Students voted to use ASUS Transformers (Android 4.x tablets that docked to a keyboard and trackpad with USB ports). Techy students encouraged others to vote for them over iPads as we still needed Adobe Flash for MyMaths, while still allowing apps & games to be installed from the Play Store. This was before Chromebooks launched and Windows 7 was the latest OS version, and Gmail was separate from the built-in email app. They turned out to be really fragile and most broke within a week, so teachers never really used them much in lessons as so many students just left them broken in the box at home, and were basically forgotten about within 18 months.

Silently move Windows known folders to OneDrive - Enabled Desktop (Device) - True Documents (Device) - True Pictures (Device) - True Show notification to users after folders have been redirected: (Device) - Yes Tenant ID: [our tenant ID] And just the last two again in the User settings, for some reason. (Not sure if that was the RM baseline or a change we made) Silently sign in users to the OneDrive sync app with their Windows credentials - Enabled

Haven't started with it yet, waiting on SLT to pass on info.

Is this in the Autopilot settings?

If they were laptops, it was likely that they were plugged in when Windows Update installed it as a driver update, but when it came time to reboot (during which BitLocker gets paused to avoid triggering a recovery scenario due to the update), they were on battery, so the UEFI didn't install the update and held it off until the next time it was booted while plugged in to the wall (by which time BitLocker had unpaused)

As long as the image and boot media are on the 2011 boot loader, you should be fine, even on machines that are no longer supported by the OEM. They'll then pick up the policies from before and update to 2023 again.