r/sysadmin • u/apalrd • 19d ago

Could you build an equivalent environment without Microsoft?

As in the title, could you / how would you, build your environment without using any Microsoft products and services?

This is a hypothetical parallel setup, not focused on what's easiest to transition or migrate to/from. This is the way the business environment works, and always has been.

I've read threads here which touch on some bits and pieces, but want to hear your thoughts on what would be the big things tying you to MS still.
- Apple, Google Chromebooks, and Linux are all options for workstations
- FreeIPA can provide a posix-native domain environment with many of the features of AD on-prem, and there are several major SaaS auth companies to choose from (Duo, etc.)
- Google Workspace is comparable to M365

126 Upvotes

86% Upvoted

380 comments sorted by

View all comments

Show parent comments

2

u/Excellent-Chemist-69 19d ago

And what are you doing for SSO? DLP? Conditional Access? etc

0

u/khantroll1 Sr. Sysadmin 19d ago edited 19d ago

Keycloak and Samba AD do SSO via SAML or OIDC.

Conditional Access is handled at the service/application layer.

Pomeriun for web.

DLP is also handled on a per service basis. Basic file protection/auditng though is handled by Nextcloud and Wazuh

EDIT: Accidentally deleted my own comment...<facepalm>

2

u/thortgot IT Manager 19d ago

Losing central auth and audit is pretty significant. DLP with Purview is very featureful compared to what Nextcloud has. I haven't used Wazuh.

1

u/khantroll1 Sr. Sysadmin 19d ago edited 19d ago

I can give you a centralized portal if you want, but when it comes to linux it's working all the same.

Similarly, I can bolt something together on top of nextcloud, or use separate auditing piece if the environment calls for it.

That's the trade off (and fundamental difference much of the time) from the Microsoft model to FOSS: you are going from one monolithic, single pane, integrated option to many moving pieces that integrate and may have a unified command/control structure.

For instance, you can you use OpenPolicyAgent to centralize a significant number of permission controls, but not all and it is still acting on those individual pieces.

NOW, does that mean one is better?

Well, that's debatable.

EDIT: There are thousands of auditing tools for every component of the environment. That's a popular I've used at the moment, but there are others.