1. The Blue active directory
Bob Dowling
22 February 2017 1

2. Agenda
Timeline & background
Architecture
AD admin tools
Next

3. Background: timeline to present
2015
30 Sep University signs MS EES deal
01 Oct Technical people asked for a University AD
00 Oct Office 365PP for students
00 Dec Staff added
2016
Q1,2 Blue & Office 365PP
Q2,3 OneDrive
Q3,4 Exchange Online investigations
2017
Q1 UIS migration

4. Background: entitlement
“The University of Cambridge and its associated bodies”
The University of Cambridge and 27/31 Colleges,
plus the Theological Federation,
minus the two University institutions with their own deals,
plus the manually added emeritus professors.

5. Background: entitlement
“The University of Cambridge and its associated bodies”
The University of Cambridge and 29/31 Colleges,
now including the MRC units as they join,
without the Theological Federation, but
plus one Theological Federation institution that wants to rejoin,
minus the two University institutions with their own deals,
but one of those is planning to join with us later,
plus the manually added emeritus professors.

6. Background: staff entitlement flowchart

7. Background: timeline from present
2017
Q2 Early adopter institutions
migrate to Exchange Online
Q2,3 SharePoint Online
Ongoing Other institutions migrating

8. Background: requirements on the AD
Easy:
Minimal requirements
Two groups: staff & students
(One-time complexity in
setting rules for groups.)
Hard:
Exchange objects
Mail domain administration
Need for federated control

9. Architecture: single domain design
DC=blue,DC=cam,DC=ac,DC=uk
OU=Accounts
OU=Groups
OU=People

10. Architecture: domain design
DC=blue,DC=cam,DC=ac,DC=uk *
OU=Accounts
OU=Groups
OU=People
OU=institution
OU=Accounts
OU=Groups
OU=Devices
OU=Servers
CN=inst-blue-admin

11. Architecture: servers
Data out of lookup & password app.
Data centre redundancy.
(Hashed) passwords never leave our servers.

12. Architecture: Active Directory administration tool
Azure
Active
Directory
institutional
administrator
web
Azure AD
Connect
Services
consumed
script or
automated
process
End user
Active Directory
administration
system
Blue Active
Directory
API

13. Architecture: Active Directory administration tool
SQL front end to AD back end
(including us!)
No use of native tools
Powerful logic & rules sets
Supports federated controls
“Freedom within a framework”

14. Opportunities: moving mail domains to Exchange Online
50GB quotas
Shared calendars
Better contact syncing
Increased OneDrive sharing
S/MIME

15. Other opportunities MS EES includes Windows 10 licensing
SharePoint Online
Groups for OneDrive, Forms, SharePoint …
AD for institutions that don’t want to run it
Better University-wide collaborative working

16. Next Detailed design work on AD rules Selection of administration tool
Getting used to Exchange’s quirks
Extended Support only.

17. Questions ?