question

HollisFudge-9754 avatar image
0 Votes"
HollisFudge-9754 asked jLight commented

Azure AD with On-Premise Devices

We have remote sites with different domains on each site. We are looking at moving to cloud directory. Our end goal is to simply have an cloud directory that on-premise Windows 10 devices can authenticate against. It does not make sense to have an on-premise servers for those sites as each sites are relatively small and it does not make sense to setup many online servers to serve each site separately. These locations are distinct and separate sites and domains or otherwise we would setup one cloud server with multiple forests/domains. We have had setup Azure AD and users and groups and we try to join the devices to that. I try two different way to login via the on-premise Windows 10 computers. I try "How will this person sign in?" I enter the email address from Azure Ad and it says it looks like this isnt a Microsoft Account. I try the "Create Account:" method and it returns You can't sign up here with a work or school email address. So in my Azure AD, I look at that user email that I am trying to login with and it says the source for this account is Azure Active Directory. So how do I get this user staff@ourdomain.net (for example) to login to this laptop via the Windows login screen? Whats the correct way to achieve what we need to do? Thank you!

azure-ad-authentication
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

jLight avatar image
0 Votes"
jLight answered

I would suggest implementing Windows Autopilot so you don't have to create a Microsoft Account. Make sure to review the requirements.

For your new devices, make sure to contact your supplier, otherwise, you can just generate the HWID before deploying your laptops (manual way - but still saves you a lot of time compared to having on-prem AD, SCCM, and imaging server).

https://docs.microsoft.com/en-us/windows/deployment/windows-autopilot/windows-autopilot

5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

HollisFudge-9754 avatar image
0 Votes"
HollisFudge-9754 answered jLight commented

Thank you for your answer. I am not sure I understand how Autopilot would help our issue as that seems to be device focused not user focused? We are not concerned about the laptops themselves but having the users authenticate on these laptops against Azure AD. I can get one user from our Azure AD tenant to login to the laptop but that account's source is Microsoft Account. The rest of the users show Azure Active Directory and those users are not allowed to login to the laptop neither because it is not a Microsoft Account nor because it is a work/school email address if I try the non-microsoft account login. We basically want cloud-only AD for the windows 10 user login management alone. Theres no need for GPO and other management features. Will autopilot help with this?

Again, appreciate you answering!

· 1
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Yes, Autopilot will solve both issues.

  1. Your users can directly login to the laptop without any on-premise equipment (or having to create a Microsoft Account or Local Account).

  2. Even better solution because you can manage your devices on the cloud (via Intune). Think of resetting password, they reset their password on the laptop and that will sync with their AAD account (again, without anything on-premise).

CapEx vs OpEx… OpEx wins this especially if you guys are really trying to be cloud-only. Finance loves OpEx lol

Give it a shot yourself, no need to use a VM, if you have a spare laptop.. go for it!
https://docs.microsoft.com/en-us/windows/deployment/windows-autopilot/demonstrate-deployment-on-vm


Or just read through this guy's blog to find out a little bit more: https://www.systemcenterdudes.com/microsoft-autopilot-windows-10/






0 Votes 0 ·