psynegy

Will do! We're just looking at testing the Endpoint app, but need a gateway device before we can do so.

That's pretty much exactly what we want to do, only our site is so weird and "wonderful" that we simply cannot afford the Ruckus AP's, so we're hoping to get away with Unifi, but there's definitely some (significant) gotchas integrating Unifi with CloudPath...

With CloudPath - what AP's are you using? Are you making visitors use CloudPath with installed certs? We find that visitors from the council, or NHS trusts, often have laptops so locked down you can't install anything on them, let alone a CA cert (quite rightly so)!

I'm not 100% sure if that is the same issue we were able to work around or not. We have Toshiba MFDs. Certainly initially, staff logins didn't work, but only because they require MFA if not from a managed/compliant device. What we did during some downtime was checkpointed the papercut VM, then essentially went through the process of doing the migration, made sure it all worked before then either committing to the change, or being able to easily roll it back if we need to figure something else out.

We have this working for the most part. We're a hybrid environment at present. AD joined PaperCut server, we use a win32 package of Print Deploy (now called Enable Printing for some reason) to deploy our "global queues". Separate package to install the printer drivers. Takes a moment or two when they first log in for the printers to install, but that seems to be the best way at the moment. Big change was to switch over PaperCut to sync exclusively with Entra ID, rename all the accounts to email addresses, but add username aliases for AD printing. Was able to get PaperCut to sync our RFID cards from a "custom security attribute" in Entra. This is important, because PaperCut suggest using the extension attributes, but those are readable by all users in Entra!! If you have students/staff logging in to copiers using username/password - there's a bit of a gotcha with Conditional Access, as Microsoft changed something recently that means you can't just exclude an app from MFA being required (because most things that do auth also use the graph app), so you have to revert the behaviour for that app using the Baseline Scope Settings. I think there shouldn't be too much issue moving the PaperCut installation to an Arc'd server - the biggest hurdle there seems to be getting group based permissions to work. I believe there are some workaroun.... "clearly documented and easy to understand solutions" though.

I wouldn't say this matched our reality. We had at least one brief outage and yesterday I was having to wait over a minute for the groups page to load, every, single, time. That's not to say it's not better... but boy was that bar ever low.

They've only given themselves 3 months to do it though - in which time customers will be forced find other ways to satisfy this requirement. If in October they go "it's all solved, for a fee", but all their customers have already found other workarounds, that probably wouldn't be the smartest business decision ever. It was interesting in some of what I was reading that a number of people were actively against the concept of nested groups for security reasons(?)... Not sure I totally understand the reasoning behind that personally, but there we go. "Adding support for nested groups is one of the #1 requests from many orgs. Hopefully they never allow it." Seems very strange to me! That is correct - there are some places in Entra that do not support that method of nesting groups, like App Registration Assignments, where the members of nested groups are ignored. For us, it's actually PaperCut that's the issue - we import groups from Entra ID, but it does not retrieve members of nested groups, so to satisfy a setting targeting KS3, we flatten Y7, Y8, Y9 into a "KS3 - Dynamic" group using memberof feature. It's just a way of making administration far easier. You are a Y7, therefore are in KS3, therefore are a Student, therefore are part of the School - why would we want to manage membership of each level separately when it's so much simpler this way round.

Where have you seen that? I haven't found anything that says they plan to do anything other than remove the functionality...

Just a heads up if you haven't seen the announcement - MS are dropping the memberOf rule operator for dynamic groups in November of this year. Quite frustrating that they've not found a way to properly support nested groups across the suite (application assignment for example), but feel the need to take away the only thing that made it tolerable.

We had recently purchased all new Yealink phones and were getting quotes from suppliers for a possible PBX move - we were told by a certain PBX supplier that we would have to throw all our brand new phones away and replace them with... identical phones - supplied by them (at a much inflated cost). They asked what our renewal was for 3CX - they asked if that price was monthly - it was not monthly. Never heard from them again...

It's certainly something we're talking about as well.

That's a nice solution! I might look to do something similar...!

If you haven't already - I would highly recommend setting up scheduled reports to run in the early hours of each morning that land in a shared mailbox with the blank registers for the day. I have found the best way to do this was have a scheduled report per period (so you can easily print period X) and then also have a report that lists each class by period with the location of the class as that is not included on the blank register report. We then have staff write the location onto the registers by hand before they go out by student runner. Big PITA obviously - but with Bromcom as it stands at the moment - perhaps a necessary evil. Can share more details later(?!) if anyone would like. I think the class/period/location report was a custom one.

Apparently the person that updates the status page doesn't start work until 8:30. Couldn't make it up.

Down here too. Attempting to log a case. Sigh.

It's not without a sense of irony that the day after their webinar about performance issues being resolved - we have significant performance issues. Not to mention how hard it was to actually get into said webinar!

It was logged as Idea BRCM-I-5415 on the ideas portal 2 years ago, but they apparently didn't like the idea - so have since deleted it.

Completely agree. Especially the outrageous "low risk" part.

You have time for asset auditing?! 🤯

Full Pearson ActivLearn MIS integration is coming in April apparently. I believe that if your used modules have migrated to ActiveHub already you can use Wonde now... Light at the end of the tunnel...!

Guess again... try the teacher app (for example)... old credentials still work. An enterprising student told me that credentials still work for the student app too - and they can request a password reset email in the portal. They told me the web version shows an error, but does actually provide the login token. I haven't had time to personally verify this, but it seems highly plausible as they had created their own version of the Bromcom student portal because, and I paraphrase: "the original was so terrible". Sadly as there was a significant potential for harvesting credentials, we did have to ask them to limit it to be only for themselves. I would recommend blocking the password reset email in your inbound email rules. We had to have some... protracted conversations... with The Access Group after they emailed all users at 6:30pm instructing them to create a password for their new "Access Workspace" accounts, despite them already being 365 SSO enabled at the time. Sigh. If any other MyMaths customers should choose to email in and ask about SSO - it would be much appreciated. Alternatively... has anyone moved away from MyMaths to another product? Any good alternatives?

We're moving the opposite direction. Getting in an external company with more manpower so it can be done more quickly. Maybe if you're in a MAT with technicians floating around, then sure, but we will not be sorry to see the back of it.

Would love to see this if you're able to share!

DfE standards say that we should have SSO for all "cloud solutions" (which is great!). Meeting digital and technology standards in schools and colleges - Cloud solutions - Guidance - GOV.UK So, I've been contacting a few of our cloud solution providers to find out when they plan to implement SSO... The response has been mixed... MyMaths have said they have no plans for students, but are considering staff... MyConcern are apparently releasing this in April (but we've been asking for 5 years, so not holding our breath here) The standards also require that these systems do not allow users to log in by any other method... Well, I'm not sure I could confidently name a single cloud system that reliably does that... Some companies say "we'll set all your users passwords to nonsense" - that's all well and good except users can just press the "forgotten my password" button on the login page and reset it... Some systems even send welcome emails that ask users to set their password... It's tricky, as obviously you generally need to be able to sign into a system to set up SSO, which requires you to use a password - and what if you ever have an issue with said SSO - how do you get back in without being able to login with a password? The system has to allow you to specify on groups of people which can/cannot use passwords? This all adds some considerable development time for companies. I can see why it often feels like SSO is just thrown in as a "convenience" for users, rather than a "security" measure for securing logins that happens to also be convenient. Has anyone else had similar conversations with suppliers? We basically have a rule of "no SSO, no go" on new purchases now - are others doing the same? Has anyone parted ways with companies that haven't met this requirement?

Make sure you're logging out of MCAS first, it can get very confused if you log in as another person over an existing session.