free780

I’ve always struggled with the notion that education should be preparing children/young people for the world of work. Predominantly Microsoft dominate that space. That being said I know people who do use Google Workspace rather than M365 in a non educational job. It’s just a shame that MS make licensing so complex and A5 a real necessity just for the security aspects.

Show them this site. https://status.seesaw.me/ Presumably all the seesaw domains are free from inspection/filtering.

Yes you can do this. SSTP isn’t as secure as IKEv2 but means the user can connect from networks that allow https but not udp 4500. You can tie Conditional Access if using user auth which can secure things further.

I was on Talk Talk for a day due to SSE moving to it. Seems like a lot of proxying going on causing a lot of issues. we found we needed our staff the add the VPN Server address here. https://www.sky.com/help/diagnostics/sky-broadband-shield/cant-use-a-vpn

I've seen this happen to multiple devices at the same time. I've seen it happen to a test laptop. What happens is the route on the VPN Server isn't created so the VPN is connected however there is no route. I can't seem to find anyone else having similar issues. What seem to make things worse is using auto assignment for client IP rather than DHCP. Mainly to do with client affinity to IP addresses which become important for per user firewall rules. I'm looking at moving to using a 3rd party firewall IPSEC VPN. Disconnections can happen due to ISPs/Poor WI-Fi etc.

It’s probably just using the graph API. You can use gmail in Outlook in the same fashion.

Just bumping this post as messages arn't loading for me (as a parent). Is Sims Parent always this slow?

Yep it is a dumpster fire. However a lot of orgs are so invested moving away is painful. I’m sure the line about “taking security very seriously” has been said.

There is a per machine installer however some components need to be auto installed in user context.

I think in Australia they also allow students to have phones. Back to the original question. Microsoft is mainly concerned with business customers and maximising licensing. They recently moved some features to addon licensing for Teams. They’ve done the same with Defender and Intune. I guess it comes back to the argument that education needs to prepare students for the real world. In a lot of workplaces this is not chromeOS. In a lot of cases 1:1 is the norm. Shared devices will exist in call centres etc but with a single purpose. Perhaps it’s not Microsoft that are the problem but budgets not large enough to provide 1:1. There is a school of thought that students are you customers and should the business be providing devices for customers?

In Edge you can view the store here. edge://system/#chrome_root_store I can't see any internal root cert but it is trusted. It must be a compare with the OS store. I'm not worried.

It comes back to the 1:1 issue. If you can do that then a lot of these issues go away. I would actually seat towards SCCM with co-management due to the Intone speed issues. If you have a requirement for win32 Office and/or Adobe then you need to go for Windows and the sync client. Shared devices may need Fslogix to deal with roaming users and the OneDrive Sync client.

Ramesys..

There is a repair script. https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/recovering-from-attack-surface-reduction-rule-shortcut-deletions/ba-p/3716011

US internal flights had to stop. There was an anydesk phishing site that appeared in the last 24 hours. Very few people will have all the details I suspect.

You can add AzureAD as a domain controller for Kerberos auth. This can be used in a hybrid environment. I guess in a pure AAD world you want to eliminate printing or need some connector.

Does your certificate have the ip address in the subject? Usually it’s a fqdn which means your ldap config needs to reflect this. Depending on the implementation the CRL may also need to be queried.

If you look at the files in the web root. You can see things marked SSO. I think it does do SSO in Azure Virtual Desktop. Why on prem is a 2nd class citizen I don’t know. 3rd party solutions claim to provide SSO via SAML some how. MS did add web sign in to mstsc recently.

Theres an idea that mail is more secure when not stored in Exchange Online. You can't place MFA on Exhcnage very easily. Some orgs still only want on prem Exhcnage. Which is fine if you have a lot of staff to patch it and probably IPS and/or a WAF.

You probably need to update the exchange server in line with patch Tuesday. Definitely enable the mitigation service. Only expose http/https to trusted IPs. Rack space have not handled this well.

Run process explorer and check running processes against virus total. Check any scheduled tasks. Check for any new local admins and/or services. You could leave procmon running over night to see what the spooler service is doing overnight.

Germany have been very nervous about cloud. I used a help desk product who went cloud only the German customers were not happy. They insisted on an on prem product. Eventually the company u turned. Is the alternative to Office 365 to be 100% on prem. Have fun patching exchange every month.

Wouldn’t you need to force encryption via an intune compliance policy as a requirement? Does the home SKU have bitlocker?

Good Morning Please check your AzureAD User Settings to prevent users from creating tenants. This setting has appeared and enabled by default on some tenants.

I haven’t used Smoothwall in over 2 years. ForiGate is much better and support are prompt to reply. All firewalls/proxies seem to struggle with user based policies. Trying to accurately track logins and log offs seems to be a dark art. Fortinet has the notion on Internet Services as destinations which self update IPs. This is useful for Office 365 if you don’t proxy the traffic due to the amount of concurrent.