Comment by briHass | Hacker News Reader

Comment by briHass | Hacker News Reader

Parent Full thread

And, you can couple all that with Microsoft 365 to enable cloud-first for everything that makes sense. Cloud Active Directory (a.k.a. Entra), Intune and Autopilot for devices that can be shipped directly from Dell and provisioned/set up through a M365 sign in by the end-user. IT never even has to be in the same zipcode as the new laptop or ever remotely connect to it to perform maintenance tasks.

Cloud AD also works seamlessly with on-prem AD, allowing things like online, self-service password reset for the domain, and in the reverse direction to use TPM-backed certificates/WebAuthn for securing web apps or anything behind MS-linked SSO. Of course, it also integrates tightly with Azure, so you can do RBAC for any VM/service in Azure, since they automatically get service identities in your AD.

That level of integration is so far above anything else on the market that it isn't even a discussion.

> IT never even has to be in the same zipcode as the new laptop or ever remotely connect to it to perform maintenance tasks.

That sounds nice, but that's not exactly a feature specific to AD.

All perfectly possible with a couple well placed scripts and some remote logins.

> TPM-backed certificates/WebAuthn for securing web apps or anything behind MS-linked SSO

Yeah this is the overengineered stuff that is therefore difficult to replicate. Certs and auth predate AD and Azure, the lock-in comes from the overcomplicated SAML style rickety tower of doom that just barely functions...

How are you having Dell ship a brand new laptop to a non-technical user and having that machine configured/software installed with a couple of scripts?

Autopilot locks Windows OOBE to your Intune instance based on the serial number. The user only has to know their email and a temp password if they're new, or existing login/otp if not. The device can be remotely wiped, and it will start back over at the OOBE (Windows install), ready for the next user.

You can't achieve that with scripts. That requires the ubiquity of Windows as an OS (so device manufacturers play ball). You may find that lock in distasteful, but if that's the world you're already in, it's a magical timesaver.

> How are you having Dell ship a brand new laptop

Have the vendor ship your image?

Or provide your own bootstrap.

Probably something with netboots as well...

If your point is there is a heavy vendor presence, yeah, sure.

But yes, it is all scriptable. Someone has to provision the device, whether that's you or Dell, that's your choice as the customer, not some inherent superiority of one system over another.

Sure but Apple had that first. With MDM.

Reply on news.ycombinator.com