Half the team runs Linux, and the only real constraint is using Edge for SSO. (Firefox works too - you just have to actually log in like it's 2008.)
Honestly, everything else runs smoother than what my Windows-using teammates are dealing with.
You use Intune to log in and register your device against your Microsoft account, and microsoft-identity-broker is a DBus service that hands out tokens that can be passed to login.microsoft.com (either as a cookie or a special header) which identifies you (skipping the username/password login) and allows you to pass the company device test.
I was able to put together a working ad-hoc extension for Firefox to make the DBus call and pass the header, though I've since come across this extension (haven't tried it myself) which looks like it achieves the same thing (with a lot more features, based on the code size?):
https://github.com/siemens/linux-entra-sso
Edge on Linux seems to have this built in, so if you open any page on login.microsoft.com, you'll see it passing some "x-something" header with a token that it receieved from the identity broker (generated on each page load).
Presumably the Microsoft software running on the Linux machine will report it as non-compliant and prevent you from logging in?
Microsoft is aware that the authentication is coming from a Linux system, so presumably there are different policies involved.
I don't know how these things are administrated, but the Linux Intune software has a notion of "Compliance" that might involve periodically running some program decided by the company. If Intune decides the system is non-compliant, authentication still works, but Microsoft login knows the compliance status, so it might prevent you from accessing certain applications, depending on what the company has configured.
Also in my experience ability to sign in from Linux can be limited to certain groups, so regular Windows users can't just run Linux without some company approval.
Running your own desktop is very different from running at scale. Ever managed to get a package conflict, fail to upgrade the kernel, remove some essential software, "curl | sudo sh" something you shouldn't have or break some configuration? Once every year, month or week? With thousands (and thousands) of installs that is a daily occurence.
Paying Microsoft might feel expensive but is in function affordable. What you are paying compared with what goes into, and have gone into, the ecosystem. I'm unlikely to make this argument in a few sentences. The important part is that even with a decrease in scope you would have to pay more for what you want. Or you would have to offer something else. There just isn't the same talent (or resources) available, but you need more talent.
It is questionable whether open source is compatible with sovereignty. There are definitely reservations if it has worked against big tech, so there should be reservations if it works against a superpower. The most mature distribution for enterprise use is likely Red Hat anyway.
This might just be a very big hurdle if it wasn't for the fact that everything is going the opposite direction. There is about zero political, geopolitical, business or popular will to actually do anything that would make a substantial difference. It might actually be illegal to do so since EU rules enforce competition. And the US would object. Which wouldn't be good news for Maersk and Novo Nordisk. (Carlsberg is not big in the US, probably because of US market regulations. Which is a bit ironic).
May I ask what that SSO solution is? Because it sounds like it might be a Microsoft product.
I’ve seen the name Forgerock pop up occasionally, but I don’t know if that’s just tied to the login component on the web pages. Also, they recommend Mac users stick with Safari, which is puzzling. I mean: if it was a Microsoft product, you’d think they’d lock it down to Edge on Mac too—so that makes me wonder.
Just my thoughts—could be totally off base.
So everything in the backend is still MS? Office 365, Intune, the full stack? That is the point of the comment you are rerplying to.
The "terminals" dont matter that much if the goal is to get rid of MS dependancy and they run Office 365... whats the point.
Munich pulled off a version of this around 2010: announce a bold move to Linux and open source, let Microsoft panic, enjoy the sudden price cuts, and quietly stay put.
Personally, I think cost is just one part of the equation. The real value is being in a position where you’re not locked in—and where Microsoft knows it. That leverage is worth more than any licensing discount.
It is included in Office 365 E3/E5 that also does Intune device management, apps, Defender, the whole shebang. Nobody cares about individual licence costs.
Windows Server? Yea, that costs for sure, but that's not running on laptops.
Why are you stuck on azure AD?
This comes up all the time when we talk about Linux in corporate deployment. As I have only experience in MS word regarding governance, let me ask this:
- Is there really no tools for Linux world that allows managing loads of Linux machines in an easy manner as it is in MS word (applying GPO policies)? A tool that can be easily set up and managed and doesn't have to always resort to scripting?
- If there is, why people are not using them?
I'm kind of aware some things are that allow managing Linux machines via Windows AD GPO, but that depends on MS domain there.
Seems like a ripe for a startup to provide open source tool(s) with, say, paid support for the enterprises.
Nope, there's no unification in configuration formats (yml, ini etc), locations (/var, /etc, /usr, /opt/etc) or registries (dconf, gconf).
Yes, standards exist, but they are rarely followed to the letter.
Everything was more work than it would’ve been under Windows, from endpoint configuration enforcement through to things like authentication and PKI.
You can create fedora-based container images with your specific programs and configs included in the rootfs. The newly created container image will then be used as the rootfs for machines when they upgrade.
If you only want Identity, Policies and Audit trails over several different Linux distributions, FreeIPA is your weapon of choice. It is clicky and requires no scripting. Just like ADS it is a bit of a pain to get into, but easier to run than OpenLDAP ;) If you want OpenID, too, connect FreeIPA and Keycloak, but you will need to dive onto the CLI. For configuration management connect Saltstack, here you have to edit rules files.
I guess this is another one of those "smalltalk people" vs "unix people" talking past eachother because they have shared vocabulary with different implications kind of situations.
Maybe, but as the article states, they already acknowledge the possibility and have a backup plan in place, and, frankly, someone needs to be first.
You could argue that this should not happen on the taxpayers' watch at this department. Yes, maybe some national or EU-level body should actually do the R&D to solve the structural issues around large scale Linux usage so that everyone can benefit. But for now this seems like a reasonable approach for a pretty small organization and a good learning step.
Honestly just use Azure Virtual Desktops.
What? This sounds like there is an observable way of telling that there's different levels of data mining going on in these two spaces, mind sharing the evidence?
> Google Workspace for Education Core Services (like Gmail, Google Calendar, Classroom, and more) have no ads, and student information in Core Services is never used to create profiles for ad targeting, or sold to third parties.[1]
1) https://edu.google.com/intl/ALL_us/our-values/privacy-securi...
Same reason Microsoft used to give all sorts of free licenses to students.
today: got a very long email, wanted to search for our department in it. Outlook: "Search is a deprecated feature".
Despite all the "but you can't extrapolate to a large org from personal experiences"-FUD around, I think for most orgs (especially governments which are generally far behind on processes) it would be easy to switch from a feature-perspective. The problem is the army of employees and contractors who are very happy to defend Microsoft for keeping their non-automated thiefdoms (such is non-cloud AD administration at most places I extrapolate ....). There is hardly anyone there to implement the necessary processes and rather than to send out their underlings to FOSDEM, leadership is happy to get an invite by Microsoft (or a cloud-provider...) to an "innovation-summit" instead.
We just renewed our 365 licenses at my company for one more year. I’ve been mentally sketching out an exit strategy. I inventoried what we use in 365 and Azure, and there’s not a single thing we can’t replace with an alternative we run or a different provider that’s a bit less hostile to third party ecosystems/standards/etc.
No 365, lol and the Win 10 pro license was $5 (electronicsfirst.com)
Libre Office is GREAT. I have not used it in a while. In a couple hours, I had my styles, fonts and goodies all setup.
Making docs and a fairly detailed presentation were a pleasure.
Office is degrading rapidly right now!
"Manage Linux users and client hosts in your realm from one central location with CLI, Web UI or RPC access. Enable Single Sign On authentication for all your systems, services and applications."
"Open Source Identity and Access Management"
"...In fact, Business Insider has learned, Gates has been quietly orchestrating much of Microsoft's AI revolution from behind the scenes. Current and former executives say Gates remains intimately involved in the company's operations — advising on strategy, reviewing products, recruiting high-level executives, and nurturing Microsoft's crucial relationship with Sam Altman, the cofounder and CEO of OpenAI..."
People are just accustomed to pain of working with Word.
The change to LibreOffice is way smaller than MSs switch to Ribbon menus
So when I see critiques of GIMP versus Photoshop, or Linux versus Windows, or LibreOffice versus Microsoft Office, saying "oh, it has fewer features and therefore nobody can take it seriously" it's just reductive, and provides zero useful insight. It's all about the particular needs of the person or organization and how those intersect with the features of the product they're thinking of adopting.
I'm convinced the people who insist on "features" in these products don't actually use them, because if they did they would realize they suck and are a distraction from a poor core product. It's like people in the US who live in downtown apartments and insist on driving massive overpriced pickup trucks to commute to work and get groceries, never hauling or towing or leaving the pavement. They would be better served by commuter vehicles, but all they've ever driven is show trucks and learning new things is scary. If they did attempt to do real work, they would quickly realize the bed can't hold a standard sheet of plywood.
The important thing is that they FEEL like they have capability at their fingertips, even if this is obviously an illusion to people who actually use those capabilities.
I have a direct comparison because the exact same computations were previously implemented in excel and libre office. Both dropped plots from files, had straight-up reference bugs once things got large, and would regularly crash attempting to render dozens of tiled plots in 4k. The idea of using Google sheets for this is laughable.
But too often I think people just think of Word vs Writer but we're talking the Office experience here. Calc is a poor man's version of Excel: I've found it slow with many rows of data and crash-prone (Office is surprisingly solid). Then there is Visio vs Draw. Use Draw for anything complex and you're going to have a really bad time. Us Engineering folk would put together Visio documents all the time and embed them in lengthy technical documents and proposals. Trying to do this in LO is a road to ruin. The Linux folks would either draw diagrams with sticks and boxes or get somebody in Windows to make something decent in Visio.
What we ended up doing was giving a Windows VM with Office on it for those Linux users that needed to produce documents and the like.
and at that point, you might as well just use windows, you aren't getting any advantage out of linux and are spending a bunch of overhead managing it.
For LibreOffice there is still a huge functionality gap in VBA support. This is mission critical in a lot of places.
I'm not to worried about the LibreOffice part.
Anyway, if the government is generating files that require MS office to open, they are essentially creating an undocumented tax, to be paid to a foreign company. This seems… legally questionable (depending on your local laws of course), and wildly stupid.
I suspect that some of the software devs here, especially at small companies, may be insulated from the horror that is government and enterprise computer networks. If that stuff breaks, this will be an improvement for users as long as they can get internet.
I suspect I am looking at this through a mix of optimism and naivite. Or colored by my own experiences.
For sure.
Traditional AD is harder to replace, but OpenShift’s IdP has an AD server mode that is capable of many use-cases; the cases it doesn’t do are GPO, Windows Update forcing, and other stuff no longer relevant on linux.
Are they moving away from Exchange Server? I’d hope so, MTAs are a dime a dozen in linux land. There’s a dozen homegrown alternatives for calendar + mail, from ProtonMail to running Exim + caldav.
The rentier companies may have “extended” the open source backing, but you’re not missing much except marketing.
Over a year after completion, many users still have Excel and we do lots more app virtualization. I will say the biggest hurdle that still remains today, users accepting and adjusting to change. The migration also exposed lots of unknown user-created processes that no longer worked as usual, making it difficult for them to transition.
Overall, most users made the necessary adjustments, did the training provided, and are excelling. There's always that subset that can't, or maybe won't.
It's also file compatibility.
But yes, the big thing is AD. AD has been out since 2000 and was/is the standard. If you have/had AD and Group policy you move to AAD and Intune for cloud. There is no competitor to this. Zero.
Are these Linux machines going to authenticate against the Azure Active Directory, maybe just a local Active Directory, or are the IT department going to run a separate service in parallel? Are they moving away from Exchange Server... probably not, given that it's half of the staff. Are they using Intune, if so what's the replacement strategy where?
My guess is that many of these staff members are going to use webmail and run Windows programs in remote desktop. The investments in the infrastructure isn't high enough, nor have they addressed any of the hard problems and the time frame is rather short. I doubt any significant money and time has been set aside for training.
It is going to end in complete failure, the employees are going to complain about lost productivity and a frustrating work environment. They are setting themselves up for complete failure.
The same is happening in a number of schools, where Linux and LibreOffice is set to replace ChromeBooks for some students. The expectation is that the cost is going to be €2.25M per year, for the next two years, then there will be a cost saving of €4-5M. Again no plans for handling authentication, email, file sharing or provisioning. They'll just force the students out of the relatively protected Google Workspace for Students, into the "real" Google/Gmail ecosystems where they are less protected against data mining.
This will all end badly and it will be because of poor planning. Then the next US president steps in, calms things down and we forget the whole thing in 2 years.