Toynbee Hall: identity moved to the cloud

The client

Toynbee Hall is a charity in east London. It works to tackle poverty and social injustice, and it leads the Debt Free Advice coalition of London charities. Staff use Macs and Microsoft 365.

The challenge

Like many organisations, Toynbee Hall had grown up with a hybrid identity set-up. Staff accounts lived in an on-premises Active Directory. Sign-in to Microsoft 365 went through Active Directory Federation Services (AD FS).

Servers like these need regular patching, monitoring and specialist knowledge. They also add another place where sign-in can fail. Most of the charity’s work already happened in Microsoft 365, so the servers were adding cost and effort without adding much value.

Toynbee Hall wanted a simpler, cloud-only set-up, without disrupting staff.

What we did

A plan everyone could follow

We started with the design. We produced architecture diagrams of the current and target set-up, and a project plan with clear milestones. Everyone involved could see what would change, in what order, and who was responsible.

Moving sign-in to Microsoft Entra ID

We moved sign-in from AD FS to cloud authentication in Microsoft Entra ID. We then moved accounts and devices so they no longer depended on the on-premises directory. Each stage was tested before the next one started, so staff could keep working throughout.

Retiring the old infrastructure

When nothing depended on them any more, we decommissioned the on-premises identity servers. We tracked each milestone and task in our service desk, so the charity has a full record of what was done.

One account on the Mac

We deployed Jamf Connect with Platform SSO on the charity’s Macs. Staff now sign in to their Mac with the same Microsoft Entra ID account they use for Microsoft 365.

Ongoing support

We continue to manage Microsoft Entra ID for Toynbee Hall. We have also reviewed SharePoint permissions, and we monitor Microsoft 365 Backup.

The impact

• Sign-in runs on cloud-only Microsoft Entra ID, with no on-premises identity servers to maintain
• Fewer systems to patch, monitor and secure
• One account for the Mac and for Microsoft 365
• Clear documentation of the new set-up, including architecture diagrams
• A cleaner base for security controls such as conditional access

Planning a similar move?

If most of your work already happens in Microsoft 365 but sign-in still depends on servers you maintain, the same order of work applies: design first, move sign-in, move accounts and devices, then retire the servers. We plan and deliver this as one of our IT projects and migrations. See also how we support charities and non-profits.

Read our guides to moving from Active Directory to Entra ID and Platform SSO with Entra ID. You can also read how we supported the Debt Free Advice coalition.