Integrating Active Directory with Mobile Devices
-
The lack of credentials is actually what sets mobile devices apart from non-mobile (stationary) devices. On traditional desktops and laptops, we have the idea of a person "logging in" and needing to authenticate to prove that they are that person.
Mobile devices, on the other hand, are defined by having the device itself associated with a person and only needing to authenticate to the device. So if the device is logged into, it is that person as it is a single user platform.
Both work fine and can work with network resources, it is just two fundamentally different ways of looking at devices. Once accepts multiple users, one is an extension of one user.
-
@scottalanmiller said:
@Kelly said:
Potentially having only set of credentials to manage.
Do you want to manage the credentials of mobile devices? Right now I don't have to manage that. That would be an additional workload. Mobile devices are assigned to people, not authenticated against central stores today. I'm not saying that that is a bad idea, but is there really a perceived value to that when a device is assigned to a person individually?
Some of this is because MDM and, to an extent, BYOD are in their infancy. Directory and authentication systems are still reactive rather than innovated for the most part. We have so many segregations within typical data and task flow that it isn't realistic or feasible to use authentication against a central store. My original answer was a look to the future. There may be a way and a day where this is useable, and needful. Where we have an experience similar to Corning's glass video. At that point I think a central authentication system would be not just nice, but required.
-
On a completely unrelated note, have y'all considered having the text in a quote show the most recently quoted post instead of the first one?
-
@Kelly said:
On a completely unrelated note, have y'all considered having the text in a quote show the most recently quoted post instead of the first one?
Not ML that gets to make that choice, sadly. It's just how the platform works. It's an issue for the NodeBB developers. We should start a thread about that over an their forums......
-
It seems some of the confusion may come from not understanding that Authentication and Authorization are two separate processes. AD Does authentication your OS uses the authentication to give you authorization.
-
@thecreativeone91 said:
It seems some of the confusion may come from not understanding that Authentication and Authorization are two separate processes. AD Does authentication your OS uses the authentication to give you authorization.
That is often the case. The OS enforces authorization while AD simply does authentication. AD will confirm who you are and the OS decides what you can do.
-
@scottalanmiller said:
@coliver said:
If Microsoft continues to merge their platforms we could see a device with multiple "desktops" for lack of a better term. One would be a personal "desktop" the other would be business. This could allow policies and enforcement to be placed on one side of the phone and not the other. If a person leaves and it is a personal device a disabling the AD account could remove that "desktop" from the phone.
That would be an MDM application feature though, right? Other than putting an interface for that into AD, how would AD be involved?
I guess this is how I see AD's involvement.
-
@Dashrender said:
@scottalanmiller said:
That would be an MDM application feature though, right? Other than putting an interface for that into AD, how would AD be involved?
I guess this is how I see AD's involvement.
You want an interface in AD that isn't tied to the rest of the directory structure? How are you picturing this? Would the devices be in an OU (like "Mobile iOS" and "Mobile Windows")?
I understand why having things all in one place is nice. Since Mac and UNIX machines aren't managed in this way, though, and since the things that you need for MDM generally need interface features not available in AD's management.... is this actually valuable? If we had this today, would it actually do something positive? Maybe it would, I'm just trying to picture this. Beyond technical issues, just purely thinking at an interface level, would it be good?
Having used our own MDM, I can't see wanting it in AD. Maybe most people want a lot less from their mobile management than I do?
-
I guess I want MDM in windows like i have GPs in Windows - I don't want an add-on product for managing corporate resources.
I agree that I can't manage nix or Macs (though I suppose that would be nice), and the desire might be pie in the sky - but yes I want this.
As for logging into the phone with an AD account, part of the on boarding of the device could setup another logon type that more closely resembles what we use today.
I don't don't ever see a phone being a multi-user device, just list most PCs aren't really a multi user device in a business, even though it could be. So I suppose that would be a skipped option.
-
@Dashrender said:
I guess I want MDM in windows like i have GPs in Windows - I don't want an add-on product for managing corporate resources.
But MDMs already have Policy Profiles. which would be the equivalent of GPs. You wouldn't see the GP features by integrating to AD just the authentication services. There is just too much difference in the types of devices and their OS to see that much integration.
-
@thecreativeone91 said:
@Dashrender said:
I guess I want MDM in windows like i have GPs in Windows - I don't want an add-on product for managing corporate resources.
But MDMs already have Policy Profiles. which would be the equivalent of GPs. You wouldn't see the GP features by integrating to AD just the authentication services. There is just too much difference in the types of devices and their OS to see that much integration.
If they can add 1000+ items to GP for Windows 8, why can't they do the same for mobile devices?
-
Currently I manage around 100 PCs and laptops which are assigned to users who use them for e-mail, ERP, CRM, web browsing, the intranet, accessing shared files, messaging and phoning (via the local PBX). They are managed through AD and domain accounts.
I manage around 25 iPhones which are assigned to users who use them for e-mail, ERP, CRM, web browsing, the intranet, accessing shared files, messaging and phoning (via the phone carrier). They are managed through Meraki MDM and Apple accounts.
I'll leave the likes of @scottalanmiller to define the difference between a phone and a PC. I'm not that technical. For me they are all just computers that users do work on. All I know is is that managing computers with AD is tons better than managing computers with Meraki and Apple, added to the fact that having two systems to master and manage is worse than having one.
-
If we define AD fairly narrowly in terms of PCs and servers then you could say that in a post-PC/Cloud world AD is becoming redundant. Maybe in a few years time we won't be running AD at all.
But could AD adapt and become more than what it currently is? Could it develop MDM features that would make third-party MDMs obsolete? Microsoft isn't going that down route, and is developing InTune, but InTune isn't free sadly.
-
Anyway, what I really want for myself is a 5 inch phone running full Windows Pro. Then AD just works.
I'd cope with a 5 inch wifi only "tablet" running Windows Pro, which I'd pair with a $100 mini Android phone. That way, I could leave the "tablet" at home if I know I'm going to be in the mosh pit at an Iggy Pop gig or dancing like a madman in a club at 2am.
-
@Dashrender said:
As for logging into the phone with an AD account, part of the on boarding of the device could setup another logon type that more closely resembles what we use today.
I don't don't ever see a phone being a multi-user device, just list most PCs aren't really a multi user device in a business, even though it could be. So I suppose that would be a skipped option.
So, if I am reading this correctly, basically you want AD to not be AD and do something completely different and THEN integrate with the phones? Like "AD integration" actually means "replace AD?"
I'm still confused. What role would AD play here?
-
@Dashrender said:
If they can add 1000+ items to GP for Windows 8, why can't they do the same for mobile devices?
That's GP, not AD. You can already do this with MDM. Phones are not computers, integrating with AD won't move you in the direction that you desire. If phones had GP, okay, maybe. But then you'd create all kinds of other issues (required VPN connections, for example.)
Basically you want MDM but you want it called AD, is what I am seeing. Why does calling it AD matter?
-
@Carnival-Boy said:
I'll leave the likes of @scottalanmiller to define the difference between a phone and a PC.
It's not me, the OS vendors define that when they create the OS. A mobile platform (like people call a phone) operates a certain way that is very different than how any traditional OS in use today works. They work more like a Commodore 64 than a modern desktop.
-
@Carnival-Boy said:
If we define AD fairly narrowly in terms of PCs and servers then you could say that in a post-PC/Cloud world AD is becoming redundant.
AD is a thing, it's not a concept. It is purely Microsoft's own LDAP server with a Kerberos authentication system layered on top. Nothing more. LDAP provides directory and authentication services, Kerberos helps to secure that. Anything more than that isn't AD.
-
@Carnival-Boy said:
But could AD adapt and become more than what it currently is? Could it develop MDM features that would make third-party MDMs obsolete? Microsoft isn't going that down route, and is developing InTune, but InTune isn't free sadly.
It could only if you allow AD to become something wholly different. Like can a car become a train? Sure, if the company that makes it stops making cars, starts making trains but names the train "car".
AD is a very specific thing, doing anything else would make it something else.
-
@Carnival-Boy said:
. Maybe in a few years time we won't be running AD at all.
Possible but I doubt it. Companies like control. They don't like the complexity that MDM brings. For corporate shared assets, AD and other LDAP products make sense.
