You use Intune to log in and register your device against your Microsoft account, and microsoft-identity-broker is a DBus service that hands out tokens that can be passed to login.microsoft.com (either as a cookie or a special header) which identifies you (skipping the username/password login) and allows you to pass the company device test.
I was able to put together a working ad-hoc extension for Firefox to make the DBus call and pass the header, though I've since come across this extension (haven't tried it myself) which looks like it achieves the same thing (with a lot more features, based on the code size?):
https://github.com/siemens/linux-entra-sso
Edge on Linux seems to have this built in, so if you open any page on login.microsoft.com, you'll see it passing some "x-something" header with a token that it receieved from the identity broker (generated on each page load).
Presumably the Microsoft software running on the Linux machine will report it as non-compliant and prevent you from logging in?
Microsoft is aware that the authentication is coming from a Linux system, so presumably there are different policies involved.
I don't know how these things are administrated, but the Linux Intune software has a notion of "Compliance" that might involve periodically running some program decided by the company. If Intune decides the system is non-compliant, authentication still works, but Microsoft login knows the compliance status, so it might prevent you from accessing certain applications, depending on what the company has configured.
Also in my experience ability to sign in from Linux can be limited to certain groups, so regular Windows users can't just run Linux without some company approval.
Running your own desktop is very different from running at scale. Ever managed to get a package conflict, fail to upgrade the kernel, remove some essential software, "curl | sudo sh" something you shouldn't have or break some configuration? Once every year, month or week? With thousands (and thousands) of installs that is a daily occurence.
Paying Microsoft might feel expensive but is in function affordable. What you are paying compared with what goes into, and have gone into, the ecosystem. I'm unlikely to make this argument in a few sentences. The important part is that even with a decrease in scope you would have to pay more for what you want. Or you would have to offer something else. There just isn't the same talent (or resources) available, but you need more talent.
It is questionable whether open source is compatible with sovereignty. There are definitely reservations if it has worked against big tech, so there should be reservations if it works against a superpower. The most mature distribution for enterprise use is likely Red Hat anyway.
This might just be a very big hurdle if it wasn't for the fact that everything is going the opposite direction. There is about zero political, geopolitical, business or popular will to actually do anything that would make a substantial difference. It might actually be illegal to do so since EU rules enforce competition. And the US would object. Which wouldn't be good news for Maersk and Novo Nordisk. (Carlsberg is not big in the US, probably because of US market regulations. Which is a bit ironic).
May I ask what that SSO solution is? Because it sounds like it might be a Microsoft product.
I’ve seen the name Forgerock pop up occasionally, but I don’t know if that’s just tied to the login component on the web pages. Also, they recommend Mac users stick with Safari, which is puzzling. I mean: if it was a Microsoft product, you’d think they’d lock it down to Edge on Mac too—so that makes me wonder.
Just my thoughts—could be totally off base.
So everything in the backend is still MS? Office 365, Intune, the full stack? That is the point of the comment you are rerplying to.
The "terminals" dont matter that much if the goal is to get rid of MS dependancy and they run Office 365... whats the point.
Munich pulled off a version of this around 2010: announce a bold move to Linux and open source, let Microsoft panic, enjoy the sudden price cuts, and quietly stay put.
Personally, I think cost is just one part of the equation. The real value is being in a position where you’re not locked in—and where Microsoft knows it. That leverage is worth more than any licensing discount.
It is included in Office 365 E3/E5 that also does Intune device management, apps, Defender, the whole shebang. Nobody cares about individual licence costs.
Windows Server? Yea, that costs for sure, but that's not running on laptops.
Half the team runs Linux, and the only real constraint is using Edge for SSO. (Firefox works too - you just have to actually log in like it's 2008.)
Honestly, everything else runs smoother than what my Windows-using teammates are dealing with.