5 ms·

Despite the implication of malice that other comments seem to be directing at Microsoft, this just seems like a bit of an oversight (i.e. inexperience) on behal

Despite the implication of malice that other comments seem to be directing at Microsoft, this just seems like a bit of an oversight (i.e. inexperience) on behalf of the school’s IT team. Nonetheless, I would have expected MS to ensure that the process includes clearer guidance for the account owner, and for deliberate decisions to be made by the school to enable this type of action. They did a very good job of providing clear advice to BYOD users during the MDM onboarding process in InTune, and it’s confusing that this didn’t occur in this case.

Brian_K_White 4y ago
Microsoft caring so little about what they do to their users IS malice.
- zamnos 4y ago
  How does that work? Is there some evil villian at Microsoft, twirling his mustache maniacally laughing himself to sleep because Mr Jeff here can't create an Azure app? This is a case for Hanlon's razor.
  - Brian_K_White 4y ago
    For every policy and priority there is one or more humans somewhere who decided them. They aren't sourceless and ineffectable natural phenomenon like the weather. A person somewhere knowingly decided them, and continued to do so in the face of plenty of argument. It doesn't require Ming the Merciless mustaches, it only requires normal differences in priorities. One wonders why one would pretend not to know this.
  - brigandish 4y ago
    If we take the legal definition of malice then it might. I like this definition of malice[1]: > malice is a condition of the mind which shows a heart regardless of social duty and fatally bent on mischief, the existence of which is inferred from acts committed or words spoken. Negligence and recklessness are often considered acts of malice, especially when stemming from wilful blindness. The mischief here is the problem with the account, we (those commenting on this page) have no confidence in Microsoft to improve it (they are fatally bent), as they clearly don't consider it a social duty and are surely wilfully blind to it. Does anyone here think they want to know, let alone care? [1] https://thelawdictionary.org/malice/ https://thelawdictionary.org/malice/
tgv 4y ago
> this just seems like a bit of an oversight (i.e. inexperience) on behalf of the school’s IT team. The school's IT team should never have had the means to do that.
- tacker2000 4y ago
  Yea why would some random schools IT be able to add some random account to their org?? Thats a rights/policy issue that needs to be addressed.
paranoidrobot 4y ago
I agree that its not malice, but its not 'a bit of an oversight'. It's a long time pattern of behavior from Microsoft about their utter lack of any care or thought for how to manage their MS Accounts system.
josephg 4y ago
> this just seems like a bit of an oversight (i.e. inexperience) on behalf of the school’s IT team. No matter how inexperienced they are, it shouldn’t be possible to put an external Microsoft account into this weird state without the account holder’s permission. And the “leave organisation” button shouldn’t leave the account in some weird unrecoverable state. This all reeks of sloppy product design on Microsoft’s part. Is my Microsoft account one bad domain administrator away from being taken from me? That’s unacceptable.
- deleted 4y ago
  [deleted]
zamnos 4y ago
But the schools IT team shouldn't have been able to do this! I don't ascribe malice to them, but if, in the regular course of me doing my every day normal business at my bank, their website ended up with me taking your money out of your account somehow, the blame wouldn't lie with me or you, it would be the bank's fuckup.
xxs 4y ago
>malice that other comments seem to be directing at Microsoft Giving such permissions to a 3rd party could be just a gross incompetence instead of malice. Yet, it should never happen.
- deleted 4y ago
  [deleted]
deleted 4y ago
[deleted]
alerighi 4y ago
Maybe, but it's a behaviour that shouldn't be possible to happen. If I have a personal account it's my account, and should be considered distinct from the account of a school/organization, there shouldn't be the possibility that joining one of them will limit what my account could do. That is a personal account shouldn't even be possibly converted into an AzureAD one: if you want it's another account, with another email and another password. This possibility of mistake should never happen.
nerdile 4y ago
Yes, it's confusing that the UI doesn't highlight that "Jeff's MSA" and "Jeff's MSA at This School" are different accounts when it makes statements about the school owning the account. By adding him, the school set up a "Jeff at This School" account (a unique ID inside their Azure Active Directory) which Jeff can access using his MSA account. They didn't take any ownership over his MSA, but they do control the data for his school account (i.e. anything he creates in their Azure Portal, SharePoint, etc.) And then Jeff is confused about the state of his account. Keep in mind that he's using a developer tool (the Azure portal) and account federation is not a beginner-level feature of Azure AD. There are sharp edges. He just jumped to a lot of conclusions and wow the Fud level on this comments thread is off the charts. I know this because I set up an OAuth2 based web portal for my friends to access my Minecraft server using Azure AD B2C and by god the hardest part was figuring out how to explain the login experience to users, and disable the secondary 2FA requirements for MSA/Gmail users (because I know my friends are smart enough to use 2FA)

Brian_K_White 4y ago

Microsoft caring so little about what they do to their users IS malice.

zamnos 4y ago
How does that work? Is there some evil villian at Microsoft, twirling his mustache maniacally laughing himself to sleep because Mr Jeff here can't create an Azure app? This is a case for Hanlon's razor.
- Brian_K_White 4y ago
  For every policy and priority there is one or more humans somewhere who decided them. They aren't sourceless and ineffectable natural phenomenon like the weather. A person somewhere knowingly decided them, and continued to do so in the face of plenty of argument. It doesn't require Ming the Merciless mustaches, it only requires normal differences in priorities. One wonders why one would pretend not to know this.
- brigandish 4y ago
  If we take the legal definition of malice then it might. I like this definition of malice[1]: > malice is a condition of the mind which shows a heart regardless of social duty and fatally bent on mischief, the existence of which is inferred from acts committed or words spoken. Negligence and recklessness are often considered acts of malice, especially when stemming from wilful blindness. The mischief here is the problem with the account, we (those commenting on this page) have no confidence in Microsoft to improve it (they are fatally bent), as they clearly don't consider it a social duty and are surely wilfully blind to it. Does anyone here think they want to know, let alone care? [1] https://thelawdictionary.org/malice/ https://thelawdictionary.org/malice/

tgv 4y ago

> this just seems like a bit of an oversight (i.e. inexperience) on behalf of the school’s IT team. The school's IT team should never have had the means to do that.

tacker2000 4y ago
Yea why would some random schools IT be able to add some random account to their org?? Thats a rights/policy issue that needs to be addressed.

paranoidrobot 4y ago

I agree that its not malice, but its not 'a bit of an oversight'. It's a long time pattern of behavior from Microsoft about their utter lack of any care or thought for how to manage their MS Accounts system.

josephg 4y ago

> this just seems like a bit of an oversight (i.e. inexperience) on behalf of the school’s IT team. No matter how inexperienced they are, it shouldn’t be possible to put an external Microsoft account into this weird state without the account holder’s permission. And the “leave organisation” button shouldn’t leave the account in some weird unrecoverable state. This all reeks of sloppy product design on Microsoft’s part. Is my Microsoft account one bad domain administrator away from being taken from me? That’s unacceptable.

deleted 4y ago
[deleted]

zamnos 4y ago

But the schools IT team shouldn't have been able to do this! I don't ascribe malice to them, but if, in the regular course of me doing my every day normal business at my bank, their website ended up with me taking your money out of your account somehow, the blame wouldn't lie with me or you, it would be the bank's fuckup.

xxs 4y ago

>malice that other comments seem to be directing at Microsoft Giving such permissions to a 3rd party could be just a gross incompetence instead of malice. Yet, it should never happen.

deleted 4y ago
[deleted]

deleted 4y ago

[deleted]

alerighi 4y ago

Maybe, but it's a behaviour that shouldn't be possible to happen. If I have a personal account it's my account, and should be considered distinct from the account of a school/organization, there shouldn't be the possibility that joining one of them will limit what my account could do. That is a personal account shouldn't even be possibly converted into an AzureAD one: if you want it's another account, with another email and another password. This possibility of mistake should never happen.

nerdile 4y ago

Yes, it's confusing that the UI doesn't highlight that "Jeff's MSA" and "Jeff's MSA at This School" are different accounts when it makes statements about the school owning the account. By adding him, the school set up a "Jeff at This School" account (a unique ID inside their Azure Active Directory) which Jeff can access using his MSA account. They didn't take any ownership over his MSA, but they do control the data for his school account (i.e. anything he creates in their Azure Portal, SharePoint, etc.) And then Jeff is confused about the state of his account. Keep in mind that he's using a developer tool (the Azure portal) and account federation is not a beginner-level feature of Azure AD. There are sharp edges. He just jumped to a lot of conclusions and wow the Fud level on this comments thread is off the charts. I know this because I set up an OAuth2 based web portal for my friends to access my Minecraft server using Azure AD B2C and by god the hardest part was figuring out how to explain the login experience to users, and disable the secondary 2FA requirements for MSA/Gmail users (because I know my friends are smart enough to use 2FA)