Roberto

Well clearly sync is enabled - or was at some point. You can check this via Azure AD - go to portal.office.com, log in with the same admin account you use for o365 admin, and search for and open Azure AD. In Azure AD, you should see an entry for AD Connect. I can’t remember the exact steps from here and I can’t be bothered to check right now, but it’s fairly easy to find and check the sync health and properties from here. You could also log on to the DCs and see if any of those have AD connect installed - that’s where it typically ends up on small networks. In any case, the message you posted says what it means and means what it says. A sync was set up at some point and in that situation you can only have one source of truth and that is the on-premises AD for hybrid users and objects.

The first guidance I would offer is that Windows Server 2012 goes out of support next year, so now is not a good time to upgrade to that platform (https://cloudblogs.microsoft.com/sqlserver/2021/07/14/know-your-options-for-sql-server-2012-and-windows-server-2012-end-of-support/). I would absolutely start with upgrading AD. The main thing is to understand your network- how many servers do you have? What legacy tech fo you have that may struggle with an upgrade to the domain? What about the domain functional level? Certificate Services are going to need to be treated very carefully but aren’t necessarily difficult per se.

I’m guessing the printer is using basic authentication and that isn’t enabled on your tenant. What do the logs of the user you’re attempting to sign in with say in azure ad?

Are you already looking at cloud anyway? If, for example, you already have an Azure subscription or you're considering setting up an AWS subscription then it might make sense to look at backing up to that cloud service - it arguably makes sense to minimise the amount of overhead and different interfaces you need to grapple with in the long term.

If the user signs into another laptop and another user sign into the questionable laptop, does the issue follow the user or the laptop? That will tell you where to look.

Literally all the answers to all these questions will depend on the precise T&Cs of the specific licence, so I doubt anyone here can give you a definitive answer. Having said that, I would broadly expect such a licence to last for the lifetime of the product, e.g. a ‘perpetual’ licence to use Office 2016 will allow me to use office 2016 for as long as I can get Office 2016 to run, and for it to be supported throughout its published support lifecycle (though support may cost extra). I wouldn’t necessarily expect this licence to use Office 2016 to transfer to other, newer versions of office.

If you wish to use a primary and secondary SMTP address with On-Prem or Hybrid exchange then both/all addresses should be listed. I'm not saying it won't work any other way, but this is the approved/supported method. Don't forget that with on-prem accounts there's no requirement for your UPN to be the same as your email address at all.

Never heard of it, but I'd go as far as to say that whatever they're doing there isn't SSO...

Yes. 100%. Both need to be present. SMTP:[email protected] smtp:[email protected]

I don't know that it's odd, arguably it's a good thing. With no visibility into what you're doing they may be wary of sudden, massive delta changes and I think calling that out is better than finding that you've put every student into the wrong OU and now have all of them registered to teach one another.

Yup, I’m a regular on our CAB, whether representing a change or just attending to give oversight and there’s never less than 30 people on a call. That number isn’t one people have to aspire to to have a CAB, but you do need oversight from potentially affected teams, governance, stakeholder representation, peers, and enough people to avoid conflict of interest or lack of oversight (this is a problem for us sometimes; I can’t peer review my own changes for example, nor could a change owner also be responsible for its governance. The number of required attendees to make it meaningful goes up surprisingly quickly.

Probably not appropriate to a school but we run servicenow and use the change board facility on there. Ultimately, map the path you would like changes to take between raising and approval, stakeholders, requirements for emergency or standard change management, that kind of thing and plan from there.

DHCP for all but switches. With reservations if you need to. It's like a magic self-documenting IP to device database.

Is their old primary smtp still listed in exchange/AD user object proxyaddresses attribute as a secondary smtp address? Assuming yes, that should work, so what does AD connect (server and cloud side) say about syncing that change?

You can create one license group per O365 application/service component(*) and add/remove from license groups as necessary by script So imagine you have groups like this g-o365-exchange g-o365-sharepoint g-o365-planner g-o365-delve g-o365-Teams Etc You can use the license group feature to map each group to the corresponding service component of the A1 o365 license and go nuts. Note that some things require combos of features, e.g. if you create a group like this for Teams Voice & calling plan components, the license group configuration will insist that basic Teams is also allocated by the group as you can’t add teams voice if teams ain’t there (not appropriate to A1 I know but good enough for an example)

Our service desk says all kinds of things to keep the conversation going to the regular callers we get like this, to see if we can get our kit back, or a clue as to how it got there.

Yes, but you'd want to test carefully that some legacy software you depend on isn't tied to this before you turn anything off.

The last bit was my first thought. This smacks of stolen gear. Though it could be returned as faulty, and improperly refurbished.

Schools Broadband must have a service desk?

I think the speed of rebooting a server shouldn’t be a factor; how often should a server need to be restarted in the middle of the day these days? Totally agree on the warranty/firmware thing, very cheeky imo.

We (not in education) are doing it and it made sense for us, to enable our staff to be able to have one app on their laptop or mobile that handled all their internal and external calling needs. We also dial internationally all the time between offices and have preferential rates for doing so with our current system for the occasions where I need to dial someone abroad who isn't an internal teams to teams call. There are benefits but there are also costs to setup and support that you need to be well aware of. This did not make sense for us after running the costs when I did work for a collage for example, because the majority of our calls were from fixed locations (offices/staffrooms) in the building and going to mainly geographically local exchange numbers (parents/home).

If you were a Russian, North Korean, Chinese or Iranian citizen then you wouldn't 'know' that 'your' government were wrong, illegal and oppresive. In fact, as far as you'd know, it would be the likes of us and our goverments that were "wrong, illegal and oppressive". And yes, there are some people who will do anything for money regardless of any other morality too.

Why must it? The installer/uninstaller thing is a convention that legit software vendors choose to follow, not a hard rule that must be enforce by the technology (and even if that was a case, malware writers would then look to subvert this 'hard rule’).

... is this one of those glitches in the matrix that 1990s Keanu Reeves movies warned me about

I have the MX Master 2 mouse and it's great. I'd absolutely replace it with the Master 3 if I had to, but hopefully my '2' has a good few years life left in its legs before it needs replacing at all. I've partnered it with the Logitech G613 keyboard which I like for its' good quality switch feel. As I both touch-type and tend to hammer at the keys I like a traditional mechanical switched keyboard for the responsiveness of the keyboard and the G613 is a very solid bit of kit overall. Weirdly, I also have a Logitech M350 pebble mouse and the small K380 keyboard as my semi-portable "work around the house" kit - I have the receiver for these plugged into the back of my work dock and (oddly, given what I've just been saying about the G613 and how different the K380 is to that) I can type quite well on the K380 too. In my 'go bag' for work I also have a Microsoft bluetooth mobile mouse 3600 tucked away too, so if I end up having to work really remotely in a place where we don't have an established office I can still use a mouse at least - and provided you are comfortable with the small form factor I think this is a surprisingly good, comfortable mouse too. As for 'best' as per the original post - it's all very much horses for courses. The Craft keyboard is a thing of beauty but I don't think it would work for me. I think the G613+MX Master 2 combo is the best for me when it comes to working at a fixed desk, but that's my personal WFH setup and would be expensive to have in an office (let alone a school).