Search the Community

We're evaluating the possibility of using Chromebooks in areas of the college where users only need a cheap, low powered device to do typing and Internet research. We already have Office 365 for Education, so I've managed to get Azure AD federated with Google Apps for Education, and I can now log in to our test Chromebook using an AD username and password. We've used the Google management tools to push out the Office 365 extensions for Chrome to the Chromebook, but the next hurdle is making it so the SSO works on that as well. When a user clicks on the Office icon currently, they are prompted to log in again with their Office 365 credentials. How do we make it so this just uses the SSO login they already logged in with? The same for OneDrive for Business - we'd like this to automatically be available using the SSO login. I tried searching this forum but couldn't find results that would be specific to this particular issue. Thanks, Dan Jackson (Lead ITServices Technician). Long Road Sixth Form College Cambridge, UK.

I've been investigating an issue with several of our users being unable to use the password reset functionality with their Azure AD/Office 365 accounts. They click on Reset Password, enter their email, click next and nothing happens. I noticed all the accounts affected have Gmail addresses assigned as their recovery email account. Sure enough, any account with a recovery email other than Gmail that I tested works fine. I confirmed Reset Password worked on my own account, then changed the recovery email to a Gmail address and it stopped working. Changed the email back to my original, then back to the Gmail and it started working, repeat the process and it breaks again! I figured we may have a conditional access policy setup that could be breaking something but can’t find anything that would be causing problems. Has anybody else seen this weird behaviour before? Is this a known issue (Google didn't seem to return any results with a few searches)?

Hi I am not sure if it is right forum. I am suppose to write privacy statement for Azure Active directory as we are going to host the teams webnar. Can anyone provide me sample please. Thanks in Advance

Hoping this is a badly worded blog post but do others read this as all school students will need MFA mobile app or FIDO2 usb? If anyone has a decent contact at Microsoft can they reach out and see if I need to be ordering mass FIDO2 keys for September? https://techcommunity.microsoft.com/t5/core-infrastructure-and-security/microsoft-will-require-mfa-for-all-azure-users/bc-p/4141341

Hi All, We currently are setting up a new system running Azure AD and have been having some issues with SSO. if we go to https://myapps.microsoft.com/ourdomain.org it sso's fine but when we go to portal.office.com or any .office.com domain it prompts for username once with give it that it picks up the password and signs in. What are we missing? We have SSO Enabled. We have the the following in our intranet sites autologon.microsoftazuread-sso.com aadg.windows.net.nsatc.net We have the following in trusted sites. *.sharepoint.com *.office.com *.microsoftonline.com We also have the user authentication set to automatically use username and password under each zone setting. Can anyone advice here as we are stumped? Cheers Dan

Good morning everyone, I would like to manage offsite Windows devices. I currently have a single forest On-Prem AD synced to 365 for passwords. I have been looking at Hybird Azure setup to enroll the devices but I'm not sure how I would manage my devices remotely. Is there a way to still use Group Policy or do I need to also use an MDM such as Intune?

Hello everyone We are looking at going with Azure moving forward as we would like to go more cloudy. I just want to know if anyone has gone down this route, we are currently using SIMS and are unlikely to change due to local authority being very tied in and we are not to sure about moving SIMS to Azure just yet unless anyone has had good experiences doing so. We are also wondering what redundancy plans people have in place for example if we host our DC and the internet goes down what can be done?

Hi All, I just wanted to make you aware that you are now able to sign-up for Microsoft Azure $0 Subscription that will allow you to take advantage of the Extra 'Free' Azure AD features such as Cloud Applications or trial Azure Active Directory Premium which gives you extra features to enhance your users experience when using Microsoft Cloud Services. You need to ensure that you have a PAID Subscription in one of the following Cloud Applications: Office 365 Intune CRM Online RMS Online If you do then, you can go ahead and get yourself a $0 subscription which will then give you access to Microsoft Azure Management Portal so that you can Trial Azure Active Directory Premium {90 Days} Utilize Azure AD as Identity Provider for over 1500 Cloud Applications and more I have wrote an article which you can find here: Sign-Up for Microsoft Azure without Using a Credit Card ($0 Subscription) | James Evans - EduTech's Blog which will guide you through the process. If you have any questions, please be sure to reach out to me and I will be more than happy to assist you. Many Thanks, James.

I have moved to managing our ipads to MEM/intune now. What I am trying to get set up is 365 SSO via https://docs.microsoft.com/en-us/mem/intune/configuration/device-features-configure#single-sign-on-app-extension 1) Apple ID is federated from Azure - AppleID is the azure UPN 2) ipads are enrolled from ASM and enrolled into MEM as shared ipads. 3) Microsoft authenticator is installed. 4) users can log in just fine. First login does prompt our 365 login, then apple prompts for a PIN creation for future profile logons. 5) SSO profile is assigned to the ipads. A dynamic group supports this (profile has been successfully applied on ipad according to the "Device Configuration" page of the ipad.) 6) neither browser going to 365 portal nor installed apps SSO at all, they all prompt for an email address and then password. As a supplementary, is there a way to set an app configuration in the MDM to prepopulate 365 apps with the appleID or email of logged in user? Im guessing this will be an XML config.

Amazing Independent School Opportunity in the Surbiton, Surrey Area. Salary up to £32k plus a number of Great benefits. Contact us over the Festive Break for a no obligation chat in confidence. A client of ours, based in Surbiton, is seeking an energetic and experienced Senior IT Engineer to join the IT department, within the Education sector. Working under the IT Manager, this is an opportunity for a Senior IT Engineer to deliver essential 2nd and 3rd line support, whilst playing an important role in the implementation of all technologies across the School. This is a fantastic opportunity for the successful Senior IT Engineer to develop and hone their skills in an education environment that provides exceptional exposure to a wide range of different technologies. Main Duties and Responsibilities Day-to-day administration and support of the organisational endpoints, servers, virtual environments, IT devices and peripherals, LAN and wireless infrastructure across all sites Operating system deployment, software installation and support Ensure the smooth running and security of the network, implementing preventative maintenance techniques where appropriate Provide technical support for all staff Ensure the efficient administration of the telecommunication systems in accordance with technical support requirements and external contracts Provide support to the Systems Manager as required System hardware and software maintenance including general IT infrastructure support Responsible for the repair of hardware or arranging for repair of hardware Maintenance of suitable documentation concerned with the administration of the network Liaise with suppliers of hardware and software Administration of the ServiceDesk Undergo such training as may be required Knowledge and Experience Essential Criteria Knowledge and experience of networking and administration in a Windows Server 2008, 2012 R2 and/or 2016 and Windows 10 environment. Knowledge and experience of Microsoft 365 including Azure Active Directory. Experience of back-up systems (Veeam). Knowledge of the Microsoft range of products. Experience of working within a helpdesk / service desk environment. Desirable Criteria Knowledge of OS and software deployment (SCCM). Experience of telephony systems. Knowledge of educational software packages. Knowledge of Endpoint Manager/Intune. Knowledge of Microsoft RDS. Working Hours: 8.00 to 17.00, Monday to Friday Salary: Up to £30k - £32k depending on experience 25 days annual leave, 10% pension contribution plus use of gym and sports facilities. Apply by sending your cv to [email protected] - Call or email anytime. .................................................. .................. Ravi Patel Managing Director GreatFind Recruitment Tel - 020 3318 2128 Out of hours - 07904 015757 Email - [email protected] For our latest vacancies visit - http://www.greatfindrecruitment.com Follow us on LinkedIn - https://www.linkedin.com/company/greatfind-recruitment/ **APPROVED**

All our Office 365 users have their licenses directly assigned rather than inherited from a group. Is there a PowerShell script I can use to make changes to the ServicePlans in those licenses without actually removing the licenses? As we need to turn on Microsoft Teams and School Data Sync for everyone now. I had a stab at doing it myself but it didn't seem like my efforts worked. Does anyone have any suggestions?

Hello, I'm trying to setup our G Suite so that users are provisioned from our Azure AD. I'm up to the point where I need to authorise Azure AD, I've entered the admin credentials and clicked allow, however it just gets stuck on the redirect page. Anybody dealt with this issue and any advice on how to fix it? [Edit] I figured it could be something being blocked by our web filter, so tried setting it up at home with the same results.

How do you structure the URL for an azure AD custom logon page? For example, when I go to login.microsoftonline.com and enter my email address, it redirects to my customized logon page with my company's logo, etc. but the URL doesn't actually change in the browser. How can I point users directly to my custom logon page?

We have been using O365 with ADFS for two years now. To simplify things, we'd like to move our authentication to Azure AD to rely less on the on-prem infrastructure. We've already started syncing with Azure AD connect and things seem to be working fine. My question is how do we "tell" O365 to use Azure AD login instead of ADFS for a particular domain/user?

We are doing/planning a tenant Migration, and in the old tenant, there are unmanaged devices, what Should be done with those? We know its from students downloading and signing into office products and connecting their email in outlook, and phones. Again they are not managed, No Intune they are just objects in azure AD. We know they may have to sign back in once they are moved over to the tenant. But Should the devices in the OLD tenant be removed before the migration is complete? If they are deleted or disabled does that user get a message? I can find the answer if it was managed but in this case they are not. Thoughts?

Hi Everyone, I have just enabled Entra hybrid join for school devices. I am trying to get the users Azure AD account to auto sign in to the work and school account to enable Edge sync and OneDrive sign on. Could this be down to the MDM scope? I have tried various group policies but can’t seem to get it to SSO. Any advice would be greatly appreciated. Many thanks, Daniel

Couldn't find this online easily so thought I'd post a quick guide to help others. Ran into a situation where I needed security groups via student year and figured I could use the Grade SDS attribute to do it with dynamic security groups in AzureAD/EntraID. You can Use extended attributes in dynamic groups to it was just a case of finding the name and using it in a rule. Some searching found a PowerShell script to pull the attributes back out of Azure so I had an easy reference for the extension names. https://github.com/OfficeDev/O365-EDU-Tools/blob/master/SDS%20Scripts/Get-All_SDS_Attributes.ps1 In the dynamic rule builder, I just added an expression to pick out the year level for each group and made sure the accounts were live: Year1: Rule Syntax: (user.accountEnabled -eq True) -and (user.extension_fe2174665583431c953114ff7268b7b3_Education_Grade -eq "1")

Morning all, I've previously only posted questions here, but I've been working on something for my organisation which may be of use to some of you here, or which could (probably very likely) be improved upon by those of you here who are much better at Powershell than I am. We've long had the issue of clearing up users who have left the organisation. This involves disabling/removing them from the local AD, as well as a host of connected services such as CPOMs and the RM Unify platform. However, the most troublesome platform I've found to completely eliminate a user on is O365 (without going through both the O365 Admin Center ​an​ Exchange Admin and toggling options individually). Because we use RM Unify as our federated service to sync AD users to O365 (which appears to be a one-way sync: it doesn't deactivate users who are removed from AD), we find that gets in the way of deactivating users completely and so I've been looking for Powershell commands that would do the job for me using just the user's UPN, as well as remove/Account-wipe any synced mobile devices. While I've not found any single command or pre-existing script to do what I want, I've combined many different cmdlets together to do the job of deactivating the user, removing any active O365 sessions, completely disabling any potential to reconnect to their account (overkill, I know) and then wiping their exchange account from any synced mobile devices. Now I am hopeless at creating Powershell scripts, but I have no qualms about simply copy/pasting commands from a Notepad file into an active Powershell session connected to both MSolService and AzureAD sessions. I leave the scripting and .ps1 file making to the people who are good at that, but hopefully this may help a few people who have the same issue as me. All in all you just have to replace the user name throughout (a quick Ctrl+H job in Notepad), and then copy/paste their Mobile Device Identity(ies) into the final part of the script before it's run. For someone like me, who may only be deactivating up to 5 users at a time, it's ideal. So here's the 'script'. Hopefully it is of some use to some of you. If anyone has any improvements to make, please let those be known so it can be added. Some of these commands may be considered overkill or do the same job as others, but I'd rather be safe than sorry and - as I said - I'm a proper novice when it comes to Powershell. --------------------------------------------------------------------------------- Set-CASMailbox -Identity "[email protected]" -OWAforDevicesEnabled $false -OWAEnabled $false -ActiveSyncEnabled $false -ActiveSyncAllowedDeviceIDs $null -PopEnabled $False -ImapEnabled $False -MAPIEnabled $False -EWSEnabled $False -EwsAllowOutlook $False -EwsAllowMacOutlook $False -OutlookMobileEnabled $False -UniversalOutlookEnabled $False -SmtpClientAuthenticationDisabled $true Set-Mailbox -Identity [email protected] -HiddenFromAddressListsEnabled $true Get-AzureADUser -SearchString [email protected] | Revoke-AzureADUserAllRefreshToken Set-AzureADUser -ObjectID "[email protected]" -AccountEnabled $false Get-MobileDevice -mailbox "[email protected]" Once you've run the Get-MobileDevice command at the end of the above, you then copy and paste the Identity field (looks something like user\ExchangeActiveSyncDevices\Hx?Outlook?BDF512GV688A8FB7648F197FGE7​) into the following final bit of script. Clear-MobileDevice -Identity [Device.Identity] -AccountOnly Note that I only perform an AccountOnly wipe of their device as many of our staff access O365 emails through their own personal devices rather than school-supplied ones. You can remove the -AccountOnly switch to wipe all data from the device, however. --------------------------------------------------------------------------------- I hope that's of some use to someone else It is certainly making my life easier!