Azure Active Directory a replacement for AD?
-
Don't know about that, have not played with it recently. It didn't have GP support yet when we were using it. It's growing fast, though.
-
The mobile clients would have to be VPN connected (to Azure) wouldn't they? Maybe not before log-in because of cached credentials... but still, they aren't always cached.
-
They'd be connected to Azure domain instead of a local one, so they log in to that.
-
@Tim_G said in Azure Active Directory a replacement for AD?:
The mobile clients would have to be VPN connected (to Azure) wouldn't they? Maybe not before log-in because of cached credentials... but still, they aren't always cached.
I don't think so. They join to an Azure domain which is available on the public internet.
-
@Tim_G said in Azure Active Directory a replacement for AD?:
The mobile clients would have to be VPN connected (to Azure) wouldn't they? Maybe not before log-in because of cached credentials... but still, they aren't always cached.
No VPN option even exists for Azure AD.
-
@coliver said in Azure Active Directory a replacement for AD?:
@Tim_G said in Azure Active Directory a replacement for AD?:
The mobile clients would have to be VPN connected (to Azure) wouldn't they? Maybe not before log-in because of cached credentials... but still, they aren't always cached.
I don't think so. They join to an Azure domain which is available on the public internet.
I've tried this with Azure Connect but it was for a VPS running a domain controller. This Azure AD looks promising.
-
@coliver said in Azure Active Directory a replacement for AD?:
@Tim_G said in Azure Active Directory a replacement for AD?:
The mobile clients would have to be VPN connected (to Azure) wouldn't they? Maybe not before log-in because of cached credentials... but still, they aren't always cached.
I don't think so. They join to an Azure domain which is available on the public internet.
Ah I see. That makes perfect sense.
I was thinking SSO from on-prem to Azure, got mixed up.
-
@Tim_G said in Azure Active Directory a replacement for AD?:
@coliver said in Azure Active Directory a replacement for AD?:
@Tim_G said in Azure Active Directory a replacement for AD?:
The mobile clients would have to be VPN connected (to Azure) wouldn't they? Maybe not before log-in because of cached credentials... but still, they aren't always cached.
I don't think so. They join to an Azure domain which is available on the public internet.
Ah I see. That makes perfect sense.
I was thinking SSO from on-prem to Azure, got mixed up.
That is exactly how Microsoft pitched it a couple years ago. I thought maybe Azure AD would sync to my AD and Office 365 then desktops would login with 365 ID. This looks way better.
That is if it works well.
-
@Tim_G said in Azure Active Directory a replacement for AD?:
@coliver said in Azure Active Directory a replacement for AD?:
@Tim_G said in Azure Active Directory a replacement for AD?:
The mobile clients would have to be VPN connected (to Azure) wouldn't they? Maybe not before log-in because of cached credentials... but still, they aren't always cached.
I don't think so. They join to an Azure domain which is available on the public internet.
Ah I see. That makes perfect sense.
I was thinking SSO from on-prem to Azure, got mixed up.
That's AD Federation and still exists, but we've been warning people to run away from that for a long time.
-
@scottalanmiller said in Azure Active Directory a replacement for AD?:
@Tim_G said in Azure Active Directory a replacement for AD?:
@coliver said in Azure Active Directory a replacement for AD?:
@Tim_G said in Azure Active Directory a replacement for AD?:
The mobile clients would have to be VPN connected (to Azure) wouldn't they? Maybe not before log-in because of cached credentials... but still, they aren't always cached.
I don't think so. They join to an Azure domain which is available on the public internet.
Ah I see. That makes perfect sense.
I was thinking SSO from on-prem to Azure, got mixed up.
That's AD Federation and still exists, but we've been warning people to run away from that for a long time.
Why do you warn against ADFS?
-
@JackCPickup said in Azure Active Directory a replacement for AD?:
@scottalanmiller said in Azure Active Directory a replacement for AD?:
@Tim_G said in Azure Active Directory a replacement for AD?:
@coliver said in Azure Active Directory a replacement for AD?:
@Tim_G said in Azure Active Directory a replacement for AD?:
The mobile clients would have to be VPN connected (to Azure) wouldn't they? Maybe not before log-in because of cached credentials... but still, they aren't always cached.
I don't think so. They join to an Azure domain which is available on the public internet.
Ah I see. That makes perfect sense.
I was thinking SSO from on-prem to Azure, got mixed up.
That's AD Federation and still exists, but we've been warning people to run away from that for a long time.
Why do you warn against ADFS?
Risks and cost. It means you have all of the cost of both systems and the cost of keeping them working (which is rather fragile) and risk that they depend on each other and either outage can cause the other to fail. It's an unnecessary coupling that should be avoided when possible. It really doesn't add value, but takes a lot away.
-
@scottalanmiller said in Azure Active Directory a replacement for AD?:
@JackCPickup said in Azure Active Directory a replacement for AD?:
@scottalanmiller said in Azure Active Directory a replacement for AD?:
@Tim_G said in Azure Active Directory a replacement for AD?:
@coliver said in Azure Active Directory a replacement for AD?:
@Tim_G said in Azure Active Directory a replacement for AD?:
The mobile clients would have to be VPN connected (to Azure) wouldn't they? Maybe not before log-in because of cached credentials... but still, they aren't always cached.
I don't think so. They join to an Azure domain which is available on the public internet.
Ah I see. That makes perfect sense.
I was thinking SSO from on-prem to Azure, got mixed up.
That's AD Federation and still exists, but we've been warning people to run away from that for a long time.
Why do you warn against ADFS?
Risks and cost. It means you have all of the cost of both systems and the cost of keeping them working (which is rather fragile) and risk that they depend on each other and either outage can cause the other to fail. It's an unnecessary coupling that should be avoided when possible. It really doesn't add value, but takes a lot away.
Is that just in the context given above? Using it for SSO to an Azure VPS DC, or ADFS altogether?
-
@JackCPickup said in Azure Active Directory a replacement for AD?:
@scottalanmiller said in Azure Active Directory a replacement for AD?:
@JackCPickup said in Azure Active Directory a replacement for AD?:
@scottalanmiller said in Azure Active Directory a replacement for AD?:
@Tim_G said in Azure Active Directory a replacement for AD?:
@coliver said in Azure Active Directory a replacement for AD?:
@Tim_G said in Azure Active Directory a replacement for AD?:
The mobile clients would have to be VPN connected (to Azure) wouldn't they? Maybe not before log-in because of cached credentials... but still, they aren't always cached.
I don't think so. They join to an Azure domain which is available on the public internet.
Ah I see. That makes perfect sense.
I was thinking SSO from on-prem to Azure, got mixed up.
That's AD Federation and still exists, but we've been warning people to run away from that for a long time.
Why do you warn against ADFS?
Risks and cost. It means you have all of the cost of both systems and the cost of keeping them working (which is rather fragile) and risk that they depend on each other and either outage can cause the other to fail. It's an unnecessary coupling that should be avoided when possible. It really doesn't add value, but takes a lot away.
Is that just in the context given above? Using it for SSO to an Azure VPS DC, or ADFS altogether?
ADFS in the context of Azure AD altogether. And I'm not saying not to have AD and Azure AD, just not to federate them. Microsoft has a simpler, safer method for keeping them in sync that doesn't involve federation.
-
@scottalanmiller said in Azure Active Directory a replacement for AD?:
@JackCPickup said in Azure Active Directory a replacement for AD?:
@scottalanmiller said in Azure Active Directory a replacement for AD?:
@Tim_G said in Azure Active Directory a replacement for AD?:
@coliver said in Azure Active Directory a replacement for AD?:
@Tim_G said in Azure Active Directory a replacement for AD?:
The mobile clients would have to be VPN connected (to Azure) wouldn't they? Maybe not before log-in because of cached credentials... but still, they aren't always cached.
I don't think so. They join to an Azure domain which is available on the public internet.
Ah I see. That makes perfect sense.
I was thinking SSO from on-prem to Azure, got mixed up.
That's AD Federation and still exists, but we've been warning people to run away from that for a long time.
Why do you warn against ADFS?
Risks and cost. It means you have all of the cost of both systems and the cost of keeping them working (which is rather fragile) and risk that they depend on each other and either outage can cause the other to fail. It's an unnecessary coupling that should be avoided when possible. It really doesn't add value, but takes a lot away.
Yeah, this is true.
SSO between on-prem AD and Azure AD (Office 365 for example) is great, works great, and is super convenient. (when it works)
But as you said, there's a cost.
When dealing with O365 + On-prem AD, I prefer just the regular User/password/group sync over full SSO + all the infrastructure required for that.
SSO is nice, though.
-
@scottalanmiller said in Azure Active Directory a replacement for AD?:
@JackCPickup said in Azure Active Directory a replacement for AD?:
I think it was more managing group policies still while being able to log into Azure AD from anywhere. Seeing as there wasn't (dunno about now) proper GPOs in a pure Azure AD setup.
This is awesome, I didn't know they were adding GPOs to Azure AD.
-
@Dashrender said in Azure Active Directory a replacement for AD?:
@scottalanmiller said in Azure Active Directory a replacement for AD?:
@JackCPickup said in Azure Active Directory a replacement for AD?:
I think it was more managing group policies still while being able to log into Azure AD from anywhere. Seeing as there wasn't (dunno about now) proper GPOs in a pure Azure AD setup.
This is awesome, I didn't know they were adding GPOs to Azure AD.
They have to, they need to make AD relevant in the modern world. Without GPs in Azure, they were looking at being really left behind.
-
@scottalanmiller said in Azure Active Directory a replacement for AD?:
@Dashrender said in Azure Active Directory a replacement for AD?:
@scottalanmiller said in Azure Active Directory a replacement for AD?:
@JackCPickup said in Azure Active Directory a replacement for AD?:
I think it was more managing group policies still while being able to log into Azure AD from anywhere. Seeing as there wasn't (dunno about now) proper GPOs in a pure Azure AD setup.
This is awesome, I didn't know they were adding GPOs to Azure AD.
They have to, they need to make AD relevant in the modern world. Without GPs in Azure, they were looking at being really left behind.
Now they need to have MDM in there as well.
-
At $9/seat it better do a lot. For around that much you could get a Windows Enterprise license with Intune (or whatever its called now)
The free option would it least be good for controlling logins. The $1 option seems to only add some things like self service password resets.
-
@bigbear said in Azure Active Directory a replacement for AD?:
At $9/seat it better do a lot. For around that much you could get a Windows Enterprise license with Intune (or whatever its called now)
I think it is called Azure AD now
-
@scottalanmiller said in Azure Active Directory a replacement for AD?:
@bigbear said in Azure Active Directory a replacement for AD?:
At $9/seat it better do a lot. For around that much you could get a Windows Enterprise license with Intune (or whatever its called now)
I think it is called Azure AD now
OHHHHHhhhhh - this comes only with an AAD premium account.. yeah that sucks! I thought it was included with the AAD you get as part of O365.
