The only real gotchas are that the users need a publicly valid UPN and you need a real cert for the ADFS web proxy. If they are licensed for 2012R2 ADFS 3 is pretty easy to do SSO with O365. I'm hoping to either federate the service and use a SSO, or train them to reset passwords going forward. users have sealed (well unsealed) envelopes from the past IT team stored in desks with IDs and passwords.
I am really uncomfortable having their passwords "laying around" as it were. I wish I knew the reasoning behind it, like I said, it's a legacy decision made by the departed IT team. I understand expired passwords are a pain with ADFS, but it sounds like you're changing them in 365 not local AD. Not to mention now you know everyone's password (not a position I like to be in), are leaving traces of them laying around in plaintext, etc. That sounds like a recipe for pissing off end users.
Why are you resetting everyone's password to some new value that has to be distributed to them before they can access their account again? Or why did they, I understand you inherited the practice.
0 kommentar(er)
