My colleague just asked me if it would be possible to captures factors related to the costs of doing things "the old way" versus JumpCloud. It's not even close, but I'm writing this thought exercise to illustrate the difference and get my own notes in order. Welcome to my stream of consciousness.
Let's examine what setting up RADIUS services would have entailed at my previous company:
JumpCloud: Click, Click, Click and some copying and pasting of a shared secret
Windows Server: You may want to install the NPS (Network Policy Server) roll on domain controller(s) for performance tuning to have faster authentication and authorization. That's the best case scenario and require fewer steps, other than managing the existing server(s). I'm not sure that I would, which means setting up more servers and managing concurrent authentication between those and the domain controllers. Just be careful that you don't place an excessive load on your DC.
Setting up dedicated servers isn't difficult, but it requires a lot of work and possibly buying additional storage or subscriptions (if needed). There's always known unknowns when you're running a data center. Here's some of what those steps would be:
- Set up at least one new server instance in vSphere, assuming you'd want a cluster to handle the load and not lose application availability when servers are going down for OS and software updates.
- Consider buying more storage (server array and cloud backup site, QNAP)
- Consider whether you'd needed CALs or have Software Assurance (volume licensing)
- Set up NPS, the IP-ranges, etc. that we'd want for RADIUS clients
- Install antivirus, establish the server policy configuration, and monitoring/SIEM
- Run updates and go through cycles of reboots
- Possibly have to export policy/config changes from one NPS server to the next
- Maintain and update the server from then onward
The management and overheard costs of "rolling your own" are just higher than JumpCloud by default. There's lots of variables, checklists for getting it done right, and institutional knowledge/documentation required. Every configuration such as this should be something that new team members or a new MSP can readily be knowledgeable about and not have to "discover" what was done. The old way of doing things was great for "looking busy," but no where near as equally productive or simple.
