psynegy

Will do! We're just looking at testing the Endpoint app, but need a gateway device before we can do so.

That's pretty much exactly what we want to do, only our site is so weird and "wonderful" that we simply cannot afford the Ruckus AP's, so we're hoping to get away with Unifi, but there's definitely some (significant) gotchas integrating Unifi with CloudPath...

With CloudPath - what AP's are you using? Are you making visitors use CloudPath with installed certs? We find that visitors from the council, or NHS trusts, often have laptops so locked down you can't install anything on them, let alone a CA cert (quite rightly so)!

I'm not 100% sure if that is the same issue we were able to work around or not. We have Toshiba MFDs. Certainly initially, staff logins didn't work, but only because they require MFA if not from a managed/compliant device. What we did during some downtime was checkpointed the papercut VM, then essentially went through the process of doing the migration, made sure it all worked before then either committing to the change, or being able to easily roll it back if we need to figure something else out.

We have this working for the most part. We're a hybrid environment at present. AD joined PaperCut server, we use a win32 package of Print Deploy (now called Enable Printing for some reason) to deploy our "global queues". Separate package to install the printer drivers. Takes a moment or two when they first log in for the printers to install, but that seems to be the best way at the moment. Big change was to switch over PaperCut to sync exclusively with Entra ID, rename all the accounts to email addresses, but add username aliases for AD printing. Was able to get PaperCut to sync our RFID cards from a "custom security attribute" in Entra. This is important, because PaperCut suggest using the extension attributes, but those are readable by all users in Entra!! If you have students/staff logging in to copiers using username/password - there's a bit of a gotcha with Conditional Access, as Microsoft changed something recently that means you can't just exclude an app from MFA being required (because most things that do auth also use the graph app), so you have to revert the behaviour for that app using the Baseline Scope Settings. I think there shouldn't be too much issue moving the PaperCut installation to an Arc'd server - the biggest hurdle there seems to be getting group based permissions to work. I believe there are some workaroun.... "clearly documented and easy to understand solutions" though.

I wouldn't say this matched our reality. We had at least one brief outage and yesterday I was having to wait over a minute for the groups page to load, every, single, time. That's not to say it's not better... but boy was that bar ever low.

They've only given themselves 3 months to do it though - in which time customers will be forced find other ways to satisfy this requirement. If in October they go "it's all solved, for a fee", but all their customers have already found other workarounds, that probably wouldn't be the smartest business decision ever. It was interesting in some of what I was reading that a number of people were actively against the concept of nested groups for security reasons(?)... Not sure I totally understand the reasoning behind that personally, but there we go. "Adding support for nested groups is one of the #1 requests from many orgs. Hopefully they never allow it." Seems very strange to me! That is correct - there are some places in Entra that do not support that method of nesting groups, like App Registration Assignments, where the members of nested groups are ignored. For us, it's actually PaperCut that's the issue - we import groups from Entra ID, but it does not retrieve members of nested groups, so to satisfy a setting targeting KS3, we flatten Y7, Y8, Y9 into a "KS3 - Dynamic" group using memberof feature. It's just a way of making administration far easier. You are a Y7, therefore are in KS3, therefore are a Student, therefore are part of the School - why would we want to manage membership of each level separately when it's so much simpler this way round.

Where have you seen that? I haven't found anything that says they plan to do anything other than remove the functionality...

Just a heads up if you haven't seen the announcement - MS are dropping the memberOf rule operator for dynamic groups in November of this year. Quite frustrating that they've not found a way to properly support nested groups across the suite (application assignment for example), but feel the need to take away the only thing that made it tolerable.

We had recently purchased all new Yealink phones and were getting quotes from suppliers for a possible PBX move - we were told by a certain PBX supplier that we would have to throw all our brand new phones away and replace them with... identical phones - supplied by them (at a much inflated cost). They asked what our renewal was for 3CX - they asked if that price was monthly - it was not monthly. Never heard from them again...

It's certainly something we're talking about as well.

That's a nice solution! I might look to do something similar...!

If you haven't already - I would highly recommend setting up scheduled reports to run in the early hours of each morning that land in a shared mailbox with the blank registers for the day. I have found the best way to do this was have a scheduled report per period (so you can easily print period X) and then also have a report that lists each class by period with the location of the class as that is not included on the blank register report. We then have staff write the location onto the registers by hand before they go out by student runner. Big PITA obviously - but with Bromcom as it stands at the moment - perhaps a necessary evil. Can share more details later(?!) if anyone would like. I think the class/period/location report was a custom one.

Apparently the person that updates the status page doesn't start work until 8:30. Couldn't make it up.

Down here too. Attempting to log a case. Sigh.