Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

My daughter's school took over my personal Microsoft account

jeffgeerling.com

Post reply on HN
Print view View original

191–200 of 490 posts

Re: My daughter's school took over my personal Microsoft account

#191

Post by mongol »

kl343 wrote: post #106

Firmly agree with other posters that Microsoft's identity services leave a lot to be desired... but Jeff is being a bit sensationalist here. The school did not "take over" his MS account. At some point (likely amidst a mountain of other onboarding tasks for his daughter's enrollment) he would have received an invitation to join the school's Azure AD tenant as a guest/external user. In this case, he chose to join usin…

I was thinking along the same lines. Could it be that all his Azure activities to date has happened under this federated account, and he no longer have the Azure access he is expecting (if in this case, he never signed up for Azure outside of his guest account at the school)

Re: My daughter's school took over my personal Microsoft account

#192

Post by pid-1 »

ly3xqhl8g9 wrote: post #100
ccouzens wrote: post #87

Earlier quoted context omitted.

Or run apps like Teams in a web browser. Web browsers have good isolation techniques like Chrome's profiles and Firefox's containers. Teams is written using web technologies so you're getting the same experience as the app.

The problem is that Windows 11 and above (try very hard to) require a Microsoft account, because these orcas of computing want to remind you with every step that you don't own the device you bought. Hence it's simpler/better to just virtualize everything. Besides, there is a very satisfactory feeling when something doesn't work for whatever reason, you do a quick search and see that apparently you must edit some awfu…

> The problem is that Windows 11 and above (try very hard to) require a Microsoft account, because these orcas of computing want to remind you with every step that you don't own the device you bought. Hence it's simpler/better to just virtualize everything.

During the pandemic, a key security component of our remote work architecture was to use Azure AD Conditional Access to restrict users to login in M365 apps from AD joined laptops + some Inutne compliance rules.

A weird situation was that, for a new laptop, we could not login using a domain account, as it was not joined in our domain. We also could not create a local account to join it. Not sure how IT solved that.

Re: My daughter's school took over my personal Microsoft account

#193

Post by mastazi »

gchadwick wrote: post #26

Auth with MS accounts is a giant mess. When I was a city councillor I had a corporate O365 account from the council (used for council email and virtual meetings over teams) and simply trying to sign out of the thing or switch to another account was always fraught (I've got a personal account that's basically just to associate my windows license with and a work account used for azure access). You'd often end up in a s…

> Auth with MS accounts is a giant mess.

It is indeed a giant mess.

If you go to live.com and click on the hamburger icon at the top, then under 'Apps' click on the "To-Do" app, you will be asked to enter the password for your work account, even though you are on live.com, not on office.com, and you are currently logged in with your personal account.

The only way to get past this is to click "use another account" then log in again with your personal account (even though you are already logged in!!).

This bug has been present for months now.

Re: My daughter's school took over my personal Microsoft account

#194

Post by alentred »

hdjjhhvvhga wrote: post #151
gchadwick wrote: post #26

Auth with MS accounts is a giant mess. When I was a city councillor I had a corporate O365 account from the council (used for council email and virtual meetings over teams) and simply trying to sign out of the thing or switch to another account was always fraught (I've got a personal account that's basically just to associate my windows license with and a work account used for azure access). You'd often end up in a s…

This is obviously done on purpose. In the same way that Google ties users to Android devices when you add a Gmail account, MS takes every opportunity to assign their online account whenever they catch you off guard (installing a local Teams app instead of joining through the browser, signing into Minecraft at your school etc.). At this point you need to go through all the steps of dissociating your account from these…

Although I agree that companies (Microsoft, Google, etc.) deliberately seek to authenticate you across the web, I do not think that the general mess with Microsoft authentication is on purpose.

It looks like generations of implementations (and likely generations of product management and development teams) layering on top of each other, "replacing" the "old" systems only to do the half of it, and integrating with acquired products.

Seen from outside, it just doesn't look like there exists a single team that understands the authentication and permission system end-to-end.

Re: My daughter's school took over my personal Microsoft account

#195

Post by JJJollyjim »

zamnos wrote: post #11
jackjeff wrote: post #7

My rule of thumb is to NEVER use a Microsoft account for anything unless I’m forced to. And then I’ll create a brand new account for each use case. I so regret converting my Minecraft account. The old Mojang stuff was so much more reliable.

> The old Mojang stuff was so much more reliable. In what way? Does the microsoft.com login system go down often?

As a random example, if your Microsoft account is OAuthed to a GitHub login, and you log in through that, the popup browser just takes you back to a Microsoft account settings page instead of handing the OAuth flow back to Minecraft

Re: My daughter's school took over my personal Microsoft account

#196

Post by Dalewyn »

Kwpolska wrote: post #187
neodon wrote: post #108

Am I the only one who uses browser profiles to separate my personal browsing from work or other organizations I'm a part of? When I mention this approach to people they give me a strange look like I'm crazy. In Chrome you just create a new profile for each identity you have. If you're opening random incognito windows or using different browsers all the time to log in with different identities, you should be creating…

I go even further, corporate laptop for work, personal laptop for personal stuff.

A dedicated laptop solely for work is basic CYA and good practice, everyone should do it.

Yes, even if work doesn't provide a laptop for work purposes and you need to furnish your own. Same goes for phones, etc.

It might be expensive to maintain dedicated hardware to cordon off work from everything else, but it's still cheaper than if you hadn't and the inevitable biological waste impacts the aerodynamic wake generator.

Re: My daughter's school took over my personal Microsoft account

#197

Post by pbhjpbhj »

ly3xqhl8g9 wrote: post #100
ccouzens wrote: post #87

Earlier quoted context omitted.

Or run apps like Teams in a web browser. Web browsers have good isolation techniques like Chrome's profiles and Firefox's containers. Teams is written using web technologies so you're getting the same experience as the app.

The problem is that Windows 11 and above (try very hard to) require a Microsoft account, because these orcas of computing want to remind you with every step that you don't own the device you bought. Hence it's simpler/better to just virtualize everything. Besides, there is a very satisfactory feeling when something doesn't work for whatever reason, you do a quick search and see that apparently you must edit some awfu…

Win10 tries pretty hard too, you have to have The Secret Knowledge TM if you just want to use the operating system without sending everything to MS.

Re: My daughter's school took over my personal Microsoft account

#198

Post by ta1243 »

exikyut wrote: post #76
ta1243 wrote: post #72

Earlier quoted context omitted.

Windows is only $5m a year and legal threats if your time is free

Wow, that's only $416k/mo. Which is like, wow, half a mil a month, but... also alarmingly little!~ Apparently the backward compatibility monster is not the size it used to be? Now I understand why Win11's designers used Macs... wow the moat got small

Well depends on the size of the company and how much of the microsoft ecosystem you buy.

Re: My daughter's school took over my personal Microsoft account

#199

Post by j_mo »

lostlogin wrote: post #116
dustedcodes wrote: post #52

Earlier quoted context omitted.

How do organisations justify so many lost hours of a day where employees just struggle with Microsoft’s abysmal software instead of doing real work.

I’m blown away by this. I’ve come back to a full MS stack after years away and it’s grim. Machine shave to be restarted once or more times per day. My personal MacBook is restarted every month or two. I used to moan about Apple’s software quality, but maybe we are actually in Isaac Asimov’s accelerating decline to a dark age.

Not to support Windows, but what are you doing that requires restarts multiple times per day?

I leave my personal Windows 10 desktop running for about a month at a time so I don't have to reopen 5 different windows and arrange them across three screens for uni work every evening. It works fine.

Mind you, if it was a Mac I'd not even have to reopen or arrange them after restarting the machine - they'd still be there. Although my work Mac loves to randomise which display gets which windows and desktop background... And randomly pan all bluetooth audio to the left ear once a week. I guess all OS's have their issues.

Re: My daughter's school took over my personal Microsoft account

#200

Post by Meph504 »

I can say for sure your issue, but I have seen very similar before, and what has likely happened is that your personal email was added as an alternate email in their tenant, sometimes this is for account recovery or MFA.

If you have your daughter login to her school account, and remove your email from her account. Your account will revert to a normal microsoft account.

You will however have very limited access to azure with a personal account, and doing things like registering an app is going to be unlikely unless you have your own tenant, or added to some other tenant.

Post reply on HN