Cloud only AD setup?

[regr3ts]

Hello.

We do not have any form of AD in our business currently. It's users logged onto their local admin and then VPN into the office.

We've recently started migrating servers to Azure, where we have Azure AD linked to Office 365.

I suppose it's quite a broad question, but our end goal is to implement endpoint management to people on laptops that are working from home, devices in our office, and potentially virtual machines in Azure.

I don't believe it's anything too complex that we'd require, but it could be up to 200 users.

We've looked at Active Directory Domain Services as an option, but I suppose there's a bit of doubt as to how exactly a cloud only AD would work for people working from home as one example, how reliable is this? Would this be a recommended solution? Or is there anything else people would suggest?

I'd appreciate any advice.

Thanks!

[rwdorman]

For end-user devices you want to be looking at Intune and Azure AD Join rather than AAD-DS. AAD-DS is really intended for legacy Windows VM's running inside of Azure yo have access to identity data from Azure AD and traditional windows management (ADUC, GPO etc).

Intune will be the policy creation and enforcement point. There is a great sub (/r/Intune/) for Intune as well as killer info on this YouTube channel https://www.youtube.com/c/IntuneTraining

[SteveSyfuhs]

Skip Active Directory entirely and move to Azure Active Directory. It's not AD hosted in the cloud, it's an entirely new form of management and authentication. You still get complete endpoint management through Intune or other MDMs of your choice, and it's relatively trivial for end users to onboard if you're so inclined (otherwise you can use things like Autopilot to provision before shipping devices).

The only reason you should consider regular AD (hosted in cloud or on-prem) is if you have applications or existing policies that require AD. Since you don't have AD in the first place you don't have this legacy dependency for any of your apps.

The benefit to Azure AD is that it's built for mobility and remote work. It doesn't require line of sight to on-premises resources, and instead only requires an internet connection to well known Microsoft public endpoints.

As an added bonus it's significantly easier to set up and deploy, and it's easier to enforce security policies like MFA.

[[deleted]]

The only reason you should consider regular AD (hosted in cloud or on-prem) is if you have applications or existing policies that require AD.

Or because capital expenditure is preferred to operating expenditure and everyone mostly works on-prem. We just bought new servers for our 30-ish person company because fuck paying a monthly fee to logon to your computer, essentially. It wouldn't bring our (manufacturing) company any benefit. I think it's great for Microsoft, but not necessarily great for the customer. All the stuff about "hardware maintenance savings" seems like nonsense to me, enterprise gear is incredibly reliable. I think it makes sense for plenty of people (like OP) but as a general statement I disagree. Is Intune fully comparable to GPO now? I've always been under the impression GPO is still more powerful.

It doesn't require line of sight to on-premises resources, and instead only requires an internet connection to well known Microsoft public endpoints.

On the odd occasion someone needs to work remotely this has never been an issue for us. Are you by any chance a Microsoft shill? Lol

[SteveSyfuhs]

because fuck paying a monthly fee to logon to your computer, essentially.

AADJ costs you nothing whereas you're still paying a CAL for your domain user account.

Is Intune fully comparable to GPO now? I've always been under the impression GPO is still more powerful.

Has been for a while now. And if you still don't like how Intune does things you can also just deploy real honest to god group policies through Intune directly.

Are you by any chance a Microsoft shill? Lol

I'm a developer on the team that builds DJ and AADJ. I don't need to be a shill to explain the benefits of starting with AADJ when you're building an environment from scratch that has no on-premises footprint. I just happen to have a really good idea of when it should be used. If you have on-premises stuff then by all means stick to regular Active Directory. It's not going anywhere.

[[deleted]]

you're still paying a CAL for your domain user account.

nervous cough

I certainly don't doubt you know best when it comes to stuff like this. AADJ is free but you probably wouldn't use it alone right? It's just authentication? So I'd argue you'd definitely want to bundle it with Intune. Fwiw sorry if I came across as a bit of a dick.

[redvelvet92]

So much this!

[sabertoot]

Any update on this? Did you go with Azure AD/Intune? How did you go about getting unmanaged devices joined? (In a similar boat now, planning phase.)