Roberto

ADMT will migrate msds-consistencyGuid. I should have been more explicit in why I suggested it. Sorry. Obviously, objectGuid is uniquely generated each time an AD object is created so this value isn’t going to survive a migration. Assuming you’re now using msds-consistencyguid on the new accounts/directory, you can export the O365 immutableID and UPN (something like get-msoluser | select userprincipalname, immutableID | export-csv o365users.csv should do it from an o365 powershell session) to a file then input the immutableID into msds-consistencyguid. You may need to experiment with converting it to base64, I can’t remember offhand if that’s necessary, but it should work (again with appropriate testing)

There's actually some very good stuff within Teams itself - guides and videos are baked right into the client. I'd have a look at those and ask if a formal training session is truly necessary. If you've customised your Office 365 environment to the extent that these guides are no longer helpful, then any trainer you bring in will have the same difficulty.

Does OWA work? New outlook/mapi profile has the same issue? Test connections? Any issues with them & other o365 services? Tested with the tools at https://testconnectivity.microsoft.com/tests/o365 ?

If they were to leak data then surely they would be terminated and the usual processes followed? You have "usual processes" for non-employees having access to students' PII and potentially leaking it? Cool. How do they differ from the "usual processes" for staff leaking PII? Is it not easier to have a "usual process" to not give people access in the first place. Something something ounce prevention something something pound of cure. They can't just yell "Neh neh I'm not an employee yet" and we would have to shrug and suck up that they fooled us. Well I mean, they could well say "Neh neh I'm not an employee yet" in the sense that your org will still be responsible for the leak (if not more so, you chose to give non-employees access!) and voiding their contract may well be small comfort compared to the bother the school is in... Sorry, I'm being slightly frivolous but do think about whether or not your liabilities and processes for staff leaking data are fit for purpose for non-staff being given to access to data which they subsequently leak.

What’s your current source anchor? If it’s msds-consistencyguid*, you could probably (as in: I’m sure this would work but you need to test first) copy the current user values for that attribute to the new user and it will do a hard match just fine. Though soft match is fine too if you prefer. If it’s objectGUID you can upgrade to msds-consistencyguid in the old domain first, then proceed.

Agree with what’s been said. If the problem is “what devices should staff use” then staff (a representative sample would be fine I guess) need to be part of the solution. Do things with and for your customers, not to them.

Well you clearly need licences for everything you’re using, so if you’re intending to change to being ‘serverless’ but aren’t quite there yet, and your current yearly deal is within days of running out then you need the on prem licences for one more year plus the cloud ones. You’ll need the Edu equivalent of Microsoft 365 E3, which I think is A3 as Psydii suggests. This will include the O365 suite plus extras like Azure AD premium and Intune. You may want to consider if ATP is necessary too. You do need proper advice from a licensing specialist to confirm this.

Did you try what I suggested? What happened? If it doesn’t have an onmicrosoft email address, can you add a secondary email and send to that?

Test sending to the onmicrosoft address. I’d that works, change the primary smtp address to something else. If that now works, change it back to what it was.

It’s disheartening to see things like this. You guys ask for relatively so little and you often don’t get that. I left Edu IT 18 months ago after 20 years at my last employer, for a broad range of reasons, but primarily because I was under-appreciated where I was. I recall a meeting with SLT where the IT director (a teacher) claimed the college didn’t have any ‘O365 knowledge’ on staff despite me having just told the whole of SLT that we already had it working (@norphy and I had got it going years ago) and despite me presenting a strategy for its use to SLT in that very meeting and despite a Microsoft employee tweeting her list of “50 people to follow in the O365 world” with my name appearing in the top 15. This kind of treatment knocked my self-belief hugely. It isn’t an isolated incident either, both in terms of my former employer or the Edu IT sector as a whole. My current employer, in the financial sector, has been the reverse of Edu. It’s funny but the same Edu director questioned if I’d like working in this sector because I was used to the “gentler, more people-focused” Edu sector. Fair point I guess, but since I’ve been here I’ve been given a pay rise and bonus already I’ve placed in a company award scheme that gives out fairly bigly Amazon vouchers. My partner and I have been invited to some very nice events (black tie dinners and the like) I’ve worked on really interesting international projects I’ve been taken out to dinner by divisional CIOs and COOs as thank-yous for getting projects done (one of whom flew in from Australia to do it - I’m sure he had other things to do too, but still they made the effort) When my partner and I ran a marathon to raise charity money, my employer matched what we raised We’re talking about a promotion for me My boss has identified my lack of self confidence, pointed how much they value my ability and committed to helping me fix that issue. I’d go on, but I’ve made my point. Maybe my former director is an egregiously bad example but my experiences aren’t unique based on what I’ve seen here, so If you’re not a teacher (or possibly, even if you are) education is a toxic employer.

Was actually thinking “in their defence, maybe one of the school’s requirements means they’re having to do that” but even then... wouldn’t you just tell the school it was their requirements that were forcing the issue if they came back and said “do you really have to wipe pupil’s and parent’s devices? That seems extreme?”. In fairness, my cat would struggle with that because she’s not much of a communicator unless fish for dinner is involved, but other than that I stand by my last post on reflection... For byod, it really is a simple case of create Intune compliance, configuration and app policies, test until you’re happy then tell people to install company portal, and then do something with conditional access to enforce its use.

No. Absolute stuff and nonsense, tosh, total piffle, complete hogwash, utter bunkum on their part. Their claim is bad (as well as incorrect) and they should feel bad. Not in education any longer but I’m managing several thousands of devices worldwide for a global org, byod and corporate, iOS, android and windows, so I’m comfortable in my knowledge vs theirs on this (actually based on their claims, I’m comfortable with my cat’s knowledge of Intune vs theirs...) If the device was being managed via DEP, for example, that would be different, but for byod this simply isn’t the case at all.

obligatory XKCD

Run something like the powershell below on each server? Get-WMIObject Win32_Service | Where-Object {$_.startname -ne "localSystem" }| Where-Object {$_.startname -ne "NT AUTHORITY\LocalService" } |Where-Object {$_.startname -ne "NT AUTHORITY\NetworkService" } |select startname, name Of course this won’t catch everything, if someone app starts under local service but stores your domain admin creds internally for its own use, you may have run with that.

Is your current solution really useless or is it just that it’s not at its best now that the person who knows how to control it has left? This is a process issue: software should be centralised and documented, not held in one person’s memory. Other than that, you will need to produce a proper list of requirements. I did one for my previous employer that we then just updated each time we needed to renew or re-tender for a filtering solution and that served us well, but that was for a 6th form college, so wouldn’t be helpful even if I still had a copy (but if you or anyone else wants a bash, think starting with regulatory/non-functional requirements, then technical requirements). A laundry list of products is no help if you don’t have a proper set of requirements to evaluate them against. I’d second the call to see what your LEA have and hop onto that if it’s suitable. Presumably if you are part of a MAT they’d already have a central solution you could use too?

iPad 4 probably, I think that was the iPad that was EOL'd after 10.3.3. So about 8 years old. I agree with Paul if that's the case, time to think about replacing.

You’d be migrating them to the ‘new’/other tenancy, at which point they wouldn’t be guests, they’d be accounts in the tenant. You would need to set up things do that only one AD Connect server at a time was syncing both domains to Azure AD, multiple AD Connect servers syncing with the same tenant isn’t a supported scenario. This will work fine though, I currently have approx. 150 domains syncing with one tenant at the moment.

Moodle works and downloads just fine. There are over 4000 sites in the UK alone using it and I've just downloaded it now. I'd rather extract my own teeth than manage Moodle personally, but it *does* work.

One that meets the need of the staff, pupils (and potentially, parents) of the school in question, along with the budgetary and governance needs of said school. As that changes from place to place, there isn't a simple answer.

To be honest, I thought that site was a scam when I first clicked the link. Full of errors, omissions and typos and it looks like someone got their 10 year old nephew who is “good with computers, you should see him on his xbox” to do the website design. Shockingly unprofessional... But if the kit’s good and isn’t a front for Crazy Vaclav’s place of computers then fair enough.

Absolute piece of cake to manage tbf, I wasn’t always 100% convinced that it was great value but I think that was at least partly down to some parts of our SLT not wanting to make the effort. And you do need to make an effort to make the most of it. As a landing page for internal users, I’m not sure I wouldn’t just go with sharepoint these days. Probably best not to ask about the public website tho...

A strategy would be helpful yes, but the overall point for me is that to make people use something, make it useful. Can you replace your intranet / VLE (or whatever it’s called now) with SPO sites delivered via Teams? It would be relatively easy to manage O365 group membership based on classroom groups, and make the Team sites a content hub. Can you efficiently deliver support via Teams? Does that make sense? Support articles in the wiki? Workflows to provision easily automated things at staff request? Big Question: Does it make sense to your users to use Teams? If you’re one one site and you’re not already very dynamic about using online resources as an org, this absolutely will be an uphill battle if Senior Leadership don’t care... I have a rule about not caring about other people’s problems more than they do, it does eonders for your mental health!

Why on Earth are you doing that? The on-prem and O365 servers should be exchanging messages directly via the connectors the hybrid process has you set up. You should only be touching your external filtering service when mail leaves or enters your org.

Not my place any more to say what schools are doing obviously but I'd be very uncomfortable with that, when you consider that by default, Zoom allows you to save meetings recordings. I feel like that might be a slight safeguarding issue. Similar concerns in my industry are why we're managing accounts centrally and turning that setting off.

I don't work in education any more but my current industry segment is *very* highly regulated and we're using it cautiously with a very limited scope and a lot of control of settings. Having had a long talk with Zoom and a look at the current product, I think its fair to say they were not taking security as seriously as they could, but are doing much better now. There's a good resource provided by the Indian Govt. IT department referenced in the register article at https://www.theregister.co.uk/2020/04/17/india_government_zoom_ban/ which is aimed at individual users who have to use Zoom rather than at admins, but adapting the referenced settings and some others to a managed domain environment will greatly improve matters. For example, you can ensure that all meetings made by accounts in your domain are logged and visible in an admin dashboard; disable recording of meetings altogether or at least control who can record what; secure accounts via SSO (I already mentioned this) which should help with account sharing; lock down file sharing, chat, etc. Sadly I can't just share my templates on how to adapt and extend them but it is doable. I may be able to blog about this in a month or two which I appreciate doesn't help much today, sorry.