abaxter2

I'm still using the old shared device based activation that uses the A1 plus licence. If the new version of device based activation will not work with an OVS agreement then maybe the shared activation could be on option: https://docs.microsoft.com/en-us/deployoffice/overview-of-shared-computer-activation-for-office-365-proplus Ive not tried the shared activation or know how long it will be supported for, but might be worth looking into.

You will also need the addon license - no license and of course will not activate, on top of hybrid join you also need to create a group in Azure AD / assign the addon license to the group and add the devices you would like to use with device based activation

Hybrid join will sign you into office but will not activate office automatically, how are you currently activating office?

+1 for NetSupport

I have done this by adding a reg preference - have a look at the follow thread: http://www.edugeek.net/forums/windows-10/171184-disable-fast-startup-power-management-option-via-gpo.html

+1 for Netsupport DNA

I have had a support call open with RM for over 6 months with this issue, as I have requested them to whitelist at source, but they cannot seem to do it! Hence why I have set the proxy bypass via GPO, and I can confirm that using dictate does work, you just need to bypass the proxy for the two following urls: officespeech.platform.bing.com websockets.platform.bing.com I did also find in the last couple of days that the dictate in OneNote online via Microsoft Edge also needed: ukc-onenote.officeapps.live.com set to not use the proxy server

@jnfarmer good to hear all gone well

I have mentioned the URL's that need bypassing on a couple of over threads: http://www.edugeek.net/forums/educational-software/203125-dyslexia-voice-text-software-primary-schools.html and http://www.edugeek.net/forums/how-do-you-do/199426-microsoft-word-365-dictation-not-working-school.html But also listing them here: The URL's that I needed to whitelist are: officespeech.platform.bing.com websockets.platform.bing.com These URL's cannot use a proxy server that needs authentication or https inspection, I just added a rule via GPO to not use the proxy server for these URL's. I also found that the dictation that is now built in to Word (Office 365 click to run version) also needs / uses "Office intelligent services" but I found with my devices that use office device based activation, that option to turn this on was not there, so I use the free addon: https://dictate.ms/ this still needs the above URL's whitelisted if you are using a proxy that needs authentication or https inspection, also if you do use the addon use the machine level installation option: https://dictate.ms/FAQ - Scroll down until you see: "Is it possible to do machine level installation instead of user level?" otherwise it will only work for user who installed the addon. Also to note that OneNote also uses the above URL's for its dictation feature.

I found that before I had setup Hybrid Azure AD join, SSO worked fine for browsers but did not show the users OneDrive / SharePoint in Office clients such as "Word" under "Connected Services" but after rolling out Hybrid Azure AD join this was no longer the case and SSO was working for browsers and apps, and did show the users OneDrive and SharePoint under "Connected services" and user could access this data, it also stopped prompting the user to add his or hers account to either this app only or windows. I now only see one entry for each local domain device listed as "Hybrid Azure AD joined" The other + with Hybrid join is the users are also single signed into the Microsoft store - so if you have setup the Microsoft Store for Business / Education you can force via GPO to only show the private store. When setting up "Hybrid Azure AD join" you have the option of only syncing selected OU's, so as a test to see if this meets what you require you could just select a few devices in a test OU, and if it does meet what you require you just go back and select the other OU's. For me I wanted control over what OU's got synced and did not want to hybrid azure AD join my servers for example. In my case "Hybrid Azure AD joined" has worked great and meet all my requirements, but of course this solution might not be what you are after. (EDIT - I should also mention that sso with connected services within office clients will only work on office clients that use modern authentication - some older version will work with a reg hack, and of course I was already using Azure AD connect - sync, to sync my users)

My understanding of this is: What you are seeing is when your are not using / setup "Hybrid Azure AD join", SSO will work for browsers but if a users opens an Office client such as Word / app and signs into get his or hers Onedrive / SharePoint it will then prompt to add his or hers account to either this app only or windows - the default is windows, hence why you will see these entries in Azure AAD - This is what I used to see until I setup Hybrid Azure AD join, while I was setting up Hybrid Azure AD join (out of hours) I removed all the entries that included any local domain pc with the listing of "Connected to Windows" Once the Hybrid join was complete all I see is one listing for each local domain device listed as "Hybrid Azure AD joined"

Dictate is in the Office 365 version (click to run) but is also available for the standard version of office via a free addon: https://dictate.ms/ if you do use this addon use the machine level installation option: https://dictate.ms/FAQ - Scroll down until you see: "Is it possible to do machine level installation instead of user level?" otherwise it will only work for user who installed the addon. A thing to note with dictate in office is if you are using a proxy server that needs authentication or does https inspection, you will need to whitelist the following URL's: officespeech.platform.bing.com websockets.platform.bing.com If running Windows 10 and Office 365 you also have the option of the OneNote windows 10 app, what also has dictate. If using Google chrome you could just use Speechnotes: https://speechnotes.co/

The URL's that I needed to whitelist are: officespeech.platform.bing.com websockets.platform.bing.com These URL's cannot use a proxy server that needs authentication or https inspection, I just added a rule via GPO to not use the proxy server for these URL's. I also found that the dictation that is now built in to Word (Office 365 click to run version) also needs / uses "Office intelligent services" but I found with my devices that use office device based activation, that option to turn this on was not there, so I use the free addon: https://dictate.ms/ this still needs the above URL's whitelisted if you are using a proxy that needs authentication or https inspection, also if you do use the addon use the machine level installation option: https://dictate.ms/FAQ - Scroll down until you see: "Is it possible to do machine level installation instead of user level?" otherwise it will only work for user who installed the addon. Also to note that OneNote also uses the above URL's for its dictation feature.

Yeah works every time for me here - but I have never tried via RDP

Both intune and azure ad p1 are avaible via OVS - I ordered mine this year, and unless anything has changed I believe this is still the case, I did have to keep asking for the quotes via OVS tho!

Yep been an issue for a while :-( http://www.edugeek.net/forums/windows-10/193220-struggling-find-gpo-windows-10-disable-computername-c.html At current it seems the only way to stop this is to remove search Box or Cortana Icon on the taskbar: https://www.tenforums.com/tutorials/2854-hide-show-search-box-cortana-icon-taskbar-windows-10-a.html

Maybe natural reader: https://www.naturalreaders.com/ The desktop version needs to be a paid version to add other languages, but the web version (free) does allow you to chose another language: https://www.naturalreaders.com/online/

By the sound of things it looks like AAD Connect is still pulling the first part of the username: You mentioned the following: "Prior to installing Azure, user accounts are created as [first initial][surname], eg. Joe Bloggs is jbloggs, in AD" So AAD connect will use jbloggs as the username, what will not match your Office 365 accounts as you mentioned the following: "prior to Azure, in O365, user accounts are created as [firstname].[surname]@schoolname.county.sch.uk" You could try changing the AAD connect to use a "Alternate ID" : https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-install-custom#azure-ad-sign-in-configuration Or could look at changing the SMTP address: https://www.codetwo.com/admins-blog/how-to-merge-an-office-365-account-with-an-on-premises-ad-account-after-hybrid-configuration/ (Please do not use the SMTP route on accounts that already in Offfice 365 - do a test first with a test account - just incase it goes wrong)

Have you set the: Win8DpiScaling to value of 1? without this setting it will not force the the change - I set the "LogPixels" via registry item and set the "Win8DpiScaling" via registry wizard values

No probs @gshaw I can confirm that SSO does work in the latest version of Chrome - Chrome is still our default browser :-) Funny enough it was Edge that was having problems with AAD Connect + SSO, but so far in the windows 10 version 1803 SSO now also works with Edge.

We do this via GGP: More info here: (based on windows 8 but works on windows 10) https://www.eightforums.com/threads/dpi-scaling-size-change-for-displays-in-windows-8-1.28310/ https://docs.microsoft.com/en-us/windows-hardware/manufacture/desktop/dpi-related-apis-and-registry-settings#span-idsystemspanspan-idsystemspansystem-wide-scale-factor-in-windows-8-scaling-mode Also more info here: https://www.tenforums.com/tutorials/5990-change-dpi-scaling-level-displays-windows-10-a.html Edited: You will also need to set the "Win8DpiScaling" via a GGP registry wizard value

Yep configured for "Seamless single sign-on" in Azure AD Connect, just not password write-back as at first we wanted users to only be able to set / change passwords on domain joined devices, also when we first started using AAD connect 2 years ago password write-back had a security issue (a year or so ago - that issue has been resolved in the latest versions tho) We use Pass-through Authentication: https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-pta

Hard to say as I did not see any issues with clients on version 1809 - as mentioned I did my hybrid join over the summer what would have been using an older version, and no issues have been reported. It may just be as you did the hybrid join etc today that everything is syncing and updating the client forced the changes - fingers crossed all keeps going well :-)

Great to hear it looks like it is working - I was going to say the only other thing was that I setup the hybrid join over the summer as part of my annual windows 10 rebuild to the latest release, so all devices where fresh with no profiles.