4 ms·

Azure. The web panel is a bazillion times better and they know AD... pretty well.

dijit 6y ago
I think this is sarcasm. But genuinely AzureAD is really good. Authentication and Authorization systems are difficult, AD has always been begrudgingly the most well rounded (yes, it has warts) but AzureAD really is nice. I especially like that my local admin can delegate Enterprise Apps to me so I can create SAML/OAUTH2 SSO links between stuff we use without needing the keys to the kingdom. I recently set up Enterprise Federation with GCP and it took less than a day. (compared with many months in my last company which used on-prem AD)
- sargun 6y ago
  Does azure AD actually do active directory yet (LDAP and all)? Or is it still just a name?
  - dijit 6y ago
    All of our windows desktop machines use it as their login controller, but I’m not 100% sure of the implementation- it is likely there needs to be a local login server because from what I remember of Windows it’s using WINS to find a logon server, and that I think must be local.
    - easton 6y ago
      It’s actually a new-ish “credential provider” system for logging into Windows. It’s not just Azure AD either, Gsuite can be used for logging into and managing Windows now. There is no longer a need for a local domain controller either. https://docs.microsoft.com/en-us/windows/win32/secauthn/credential-providers-in-windows https://docs.microsoft.com/en-us/windows/win32/secauthn/cred...
    - sk5t 6y ago
      Oof, WINS is some super antique stuff. The (traditional) process to find and select a domain controller is known as "DC Locator"--or else search for DsGetDc--and is essentially DNS-based. Caveat, I've been out of the Windows/AD game for 7+ years!
  - MrMorden 6y ago
    For systems expecting LDAP and Kerberos you can use either AAD Domain Services (a read-only DCaaS) or an on-premises AD controller.
  - animationwill 6y ago
    It’s definitely not AD and isn’t compatible with many things that you’d expect. They just repurposed the name

I think this is sarcasm. But genuinely AzureAD is really good. Authentication and Authorization systems are difficult, AD has always been begrudgingly the most well rounded (yes, it has warts) but AzureAD really is nice. I especially like that my local admin can delegate Enterprise Apps to me so I can create SAML/OAUTH2 SSO links between stuff we use without needing the keys to the kingdom. I recently set up Enterprise Federation with GCP and it took less than a day. (compared with many months in my last company which used on-prem AD)

sargun 6y ago
Does azure AD actually do active directory yet (LDAP and all)? Or is it still just a name?
- dijit 6y ago
  All of our windows desktop machines use it as their login controller, but I’m not 100% sure of the implementation- it is likely there needs to be a local login server because from what I remember of Windows it’s using WINS to find a logon server, and that I think must be local.
  - easton 6y ago
    It’s actually a new-ish “credential provider” system for logging into Windows. It’s not just Azure AD either, Gsuite can be used for logging into and managing Windows now. There is no longer a need for a local domain controller either. https://docs.microsoft.com/en-us/windows/win32/secauthn/credential-providers-in-windows https://docs.microsoft.com/en-us/windows/win32/secauthn/cred...
  - sk5t 6y ago
    Oof, WINS is some super antique stuff. The (traditional) process to find and select a domain controller is known as "DC Locator"--or else search for DsGetDc--and is essentially DNS-based. Caveat, I've been out of the Windows/AD game for 7+ years!
- MrMorden 6y ago
  For systems expecting LDAP and Kerberos you can use either AAD Domain Services (a read-only DCaaS) or an on-premises AD controller.
- animationwill 6y ago
  It’s definitely not AD and isn’t compatible with many things that you’d expect. They just repurposed the name