Mixed Office365 and Exchange enviornment?
-
@Dashrender said:
the purchase of my question is more: What is a good way to have a distributed AD authentication scheme for a spread out network of mobile users?
For that, unrelated to Office 365, we use Pertino and it works pretty well and gets better all of the time.
-
With all that in mind, would it better the just not worry about the logon syncing between your inhouse AD and O365, treat them as two separate things with two different logons?
-
@Dashrender said:
With all that in mind, would it better the just not worry about the logon syncing between your inhouse AD and O365, treat them as two separate things with two different logons?
No, just use DirSync instead of ADFS. All of the benefits, none of the risk.
-
@Dashrender said:
@scottalanmiller said:
@Dashrender said:
All that makes me wonder if/when we can have AD in the cloud, either fully or hybrid, and be safe.
That's been available for a while. But the federation limitations remain. There is both traditional AD in the cloud (NTG runs that way) and Azure's cloud AD service. It is that cloud service that is being discussed binding to.
What about doing something crazy like setting up an RODC in Azure or AWS, and put ADFS on that? or skip ADFS altogether and use something like Pertino for logons.
If you're considering this from a DR perspective, a regular DC in a hosted environment would make sense. That way, if your on-premise infrastructure is unavailable, you can carry on as usual. I use AWS for my geographically distributed AD in my test lab, I have a DC on each side of the country.
the purchase of my question is more: What is a good way to have a distributed AD authentication scheme for a spread out network of mobile users? or if not mobile, in a setup where you don't want to pay for an onsite server (though if you're small enough, an on site small HP would be much cheaper in the long run, of course, not as protected as one in the Azure or AWS network)
What are you currently using for VPN?
Azure AD at this point isn't the full AD that you're familiar with. It's a platform to connect applications to. If you want to use Azure and use it for full AD, you'll need to spin up a Windows Server instance on Azure and set it up as a DC.
