3 ms·

And, you can couple all that with Microsoft 365 to enable cloud-first for everything that makes sense. Cloud Active Directory (a.k.a. Entra), Intune and Autopil

And, you can couple all that with Microsoft 365 to enable cloud-first for everything that makes sense. Cloud Active Directory (a.k.a. Entra), Intune and Autopilot for devices that can be shipped directly from Dell and provisioned/set up through a M365 sign in by the end-user. IT never even has to be in the same zipcode as the new laptop or ever remotely connect to it to perform maintenance tasks. Cloud AD also works seamlessly with on-prem AD, allowing things like online, self-service password reset for the domain, and in the reverse direction to use TPM-backed certificates/WebAuthn for securing web apps or anything behind MS-linked SSO. Of course, it also integrates tightly with Azure, so you can do RBAC for any VM/service in Azure, since they automatically get service identities in your AD. That level of integration is so far above anything else on the market that it isn't even a discussion.

smaudet 1y ago
> IT never even has to be in the same zipcode as the new laptop or ever remotely connect to it to perform maintenance tasks. That sounds nice, but that's not exactly a feature specific to AD. All perfectly possible with a couple well placed scripts and some remote logins. > TPM-backed certificates/WebAuthn for securing web apps or anything behind MS-linked SSO Yeah this is the overengineered stuff that is therefore difficult to replicate. Certs and auth predate AD and Azure, the lock-in comes from the overcomplicated SAML style rickety tower of doom that just barely functions...
- briHass 1y ago
  How are you having Dell ship a brand new laptop to a non-technical user and having that machine configured/software installed with a couple of scripts? Autopilot locks Windows OOBE to your Intune instance based on the serial number. The user only has to know their email and a temp password if they're new, or existing login/otp if not. The device can be remotely wiped, and it will start back over at the OOBE (Windows install), ready for the next user. You can't achieve that with scripts. That requires the ubiquity of Windows as an OS (so device manufacturers play ball). You may find that lock in distasteful, but if that's the world you're already in, it's a magical timesaver.
  - smaudet 1y ago
    > How are you having Dell ship a brand new laptop Have the vendor ship your image? Or provide your own bootstrap. Probably something with netboots as well... If your point is there is a heavy vendor presence, yeah, sure. But yes, it is all scriptable. Someone has to provision the device, whether that's you or Dell, that's your choice as the customer, not some inherent superiority of one system over another.
  - xcrunner529 1y ago
    Sure but Apple had that first. With MDM.

smaudet 1y ago

> IT never even has to be in the same zipcode as the new laptop or ever remotely connect to it to perform maintenance tasks. That sounds nice, but that's not exactly a feature specific to AD. All perfectly possible with a couple well placed scripts and some remote logins. > TPM-backed certificates/WebAuthn for securing web apps or anything behind MS-linked SSO Yeah this is the overengineered stuff that is therefore difficult to replicate. Certs and auth predate AD and Azure, the lock-in comes from the overcomplicated SAML style rickety tower of doom that just barely functions...

briHass 1y ago
How are you having Dell ship a brand new laptop to a non-technical user and having that machine configured/software installed with a couple of scripts? Autopilot locks Windows OOBE to your Intune instance based on the serial number. The user only has to know their email and a temp password if they're new, or existing login/otp if not. The device can be remotely wiped, and it will start back over at the OOBE (Windows install), ready for the next user. You can't achieve that with scripts. That requires the ubiquity of Windows as an OS (so device manufacturers play ball). You may find that lock in distasteful, but if that's the world you're already in, it's a magical timesaver.
- smaudet 1y ago
  > How are you having Dell ship a brand new laptop Have the vendor ship your image? Or provide your own bootstrap. Probably something with netboots as well... If your point is there is a heavy vendor presence, yeah, sure. But yes, it is all scriptable. Someone has to provision the device, whether that's you or Dell, that's your choice as the customer, not some inherent superiority of one system over another.
- xcrunner529 1y ago
  Sure but Apple had that first. With MDM.