[{"_1":2,"_87":-5,"_88":-5},"loaderData",{"_3":4,"_26":27},"root",{"_5":6,"_17":10,"_18":19,"_20":21,"_22":10,"_23":-5,"_24":-5,"_25":10},"user",{"_7":8,"_9":10,"_11":10,"_12":-5,"_13":-5,"_14":15,"_16":-5},"roles",[],"isAuthenticated",false,"isPremium","planName","subscriptionStatus","featureFlags",{},"insightsBudget","isDevelopmentHost","userPreferences",{},"recaptchaSiteKey","6LcvOJcUAAAAAHsB-gPGfGktcRlKpH7OTIU_dMTD","isImpersonating","impersonation","affiliateStatus","isFreedomPortal","routes/v2/article/layout",{"_28":29,"_30":31},"notFound",true,"relatedArticles",[32,75],{"_33":34,"_35":36,"_37":38,"_39":40,"_41":42,"_43":44,"_45":46,"_47":48,"_49":50,"_51":52,"_53":54,"_55":56,"_57":58,"_59":60,"_61":62,"_63":64,"_65":66,"_67":68,"_69":70,"_71":68,"_72":73,"_74":73},"mediaId",6102772,"mediaKeyId","2803387-f9f7436c65c32ac00bc2bebad8e8ad6e","parentId",2803387,"title","Technology Commission backs full domain migration to fix Microsoft 365 rollout","audioSeconds",936,"startMs",87000,"endMs",1023000,"viewUrl","/Search/View?dp=1&key=2803387-f9f7436c65c32ac00bc2bebad8e8ad6e&start=87&end=1023","thumbnailUrl","https://assets.pipeline.soar.com/2803387-f9f7436c65c32ac00bc2bebad8e8ad6e/thumbnail_87000.jpg","articleUrl","/articles/6102772/Franklin-City/Milwaukee-County/Wisconsin/Technology-Commission-backs-full-domain-migration-to-fix-Microsoft-365-rollout","mediaUrl","https://secure.pipeline.soar.com/6102772-d106d6125b41e65cd72c19607bcc7710/orig.mp4?Expires=1773659354&Signature=mhT6ABEnzJbNSvNorkDYd5TYIZ2LsDIS~Sx-ffu24IGknRYR4rGzPgGVFl9dwcYDWvLMTSo4aaJxlTSaaRcjX6hPLKDgy~~mhj-ti2YYolzNKuEPX~jlFhoQTOw38D4JTh8DkYYQ6xYDPM3vYbo3OlgJ3XO3xdddE6e3i64ufTlSuPRpnKaEgrlCfaX5xpDUWWeRPzSD7cumc3u2zthzCxrLjaNIt7NIlxPcaFKfriRzj90YhpLGQ6iqnMJN~k9rvZfijQWKylr3ECdMLxtK5Tkfpqqcssy2U~~jM62y5IWDIz~i~5sWM1oMIGynrd4pahrA5wpq2-Irlo59I99ulg__&Key-Pair-Id=KUT5TJCACFTXG","author","City of Franklin, WI","date","2025-03-28T03:07:13.213Z","article","The Franklin City Technology Commission voted March 26 to pursue a full Active Directory domain migration to address failures in the city's Microsoft 365 rollout and to enable two‑factor authentication.

Commissioners and city IT staff discussed a feasibility study that found the city's internal domain (ci.franklin.wi.us) is unroutable and not supported for production use by Microsoft cloud services. That mismatch caused Microsoft Intune device enrollment and Entra ID (formerly Azure AD) local authentication to fail, preventing the planned YubiKey-based two‑factor authentication rollout.

The study presented three technical options: use Active Directory Federation Services (AD FS), add a secondary user principal name (UPN) suffix and switch accounts to it, or perform a full domain migration to a new routable domain and recreate accounts. Staff recommended the full migration as the most robust long‑term fix, while noting the secondary‑UPN change would be a quicker short‑term workaround.

According to the study, Intune requires properly routable identities to enroll devices and enable Windows Hello for Business. Staff said the Microsoft guidance and a Microsoft security architect confirmed that Intune and related services will not reliably operate with a non‑routable internal domain in production. The city’s consultant work identified missing Intune/MDM registration on affected machines and license‑binding issues that caused enrollment requests to fail when accounts were presented with the ci.franklin.wi.us suffix.

The commission discussed security and cleanup work the migration would require, including standardizing user account naming, reducing legacy shared accounts used by police, fire and treasury staff, and hardening Kerberos/LDAP settings. Staff said the migration would also allow the city to move to newer Windows Server encryption defaults, reduce legacy SMB usage, and make the environment easier to audit for CJIS and other compliance regimes.

Staff proposed issuing an RFP for consultants to do the migration. The proposal presented a consulting estimate of $30,000 for work on the domain conversion and additional costs for licensing and tenant reconfiguration. Staff outlined a schedule: get RFPs to consultants by mid‑April, review proposals in late April, request Common Council approval of the contract on May 6, and target completion of migration work and cloud cutover by August.

Commissioners raised operational impacts: shared accounts and batch workflows used at the Treasury counter, multi‑shift police operations, and transient staffing in high‑volume months (for example, December property tax processing). Staff emphasized these are process and training issues that must be addressed prior to migration; training, internal champions and phased rollouts by department were proposed to reduce disruption.

On a motion for the full domain migration path, the commission voted by voice vote to proceed. Staff will issue an RFP for consulting services, review proposals in late April, and seek Common Council approval for the chosen vendor in May.

Votes at a glance:
- Approval of February 26, 2025 meeting minutes — motion passed (voice vote; transcript records approval but individual votes not named).
- Motion to pursue full Active Directory domain migration (issue RFP and procure consulting support) — approved (voice vote; transcript records approval; individual tallies not recorded).
- Motion to recommend the NIST-based media‑protection policy to Common Council — approved (voice vote; see separate article).
- Motion to recommend the NIST-based physical and environmental security policy to Common Council — approved (voice vote; see separate article).

What happens next: Staff will finalize and issue an RFP for domain‑migration consulting and tenant reconfiguration, collect proposals, and present recommendations to the Technology Commission in late April. The commission will forward a contract recommendation to the Common Council for final approval on May 6. The migration and associated tenant work (Entra ID/Intune configuration, Exchange Online migration) were targeted for completion by August, per the staff timeline.","mediaType","Video","parentTitle","Technology Commission Meeting 3-26-2025 - 6 PM","oneSentenceSummary","The Franklin City Technology Commission voted March 26 to pursue a full Active Directory domain migration to address failures in the city's Microsoft 365 rollout and to enable two‑factor authentication.","taxTitle","Franklin City, Milwaukee County, Wisconsin","taxId",55414,"location","headline","","shortSummary",{"_33":76,"_35":36,"_37":38,"_39":77,"_41":78,"_43":79,"_45":80,"_47":81,"_49":82,"_51":83,"_53":84,"_55":56,"_57":58,"_59":85,"_61":62,"_63":64,"_65":86,"_67":68,"_69":70,"_71":68,"_72":73,"_74":73},6102767,"Technology Commission recommends NIST-based media and physical security policies to Common Council",491,2546000,3037000,"/Search/View?dp=1&key=2803387-f9f7436c65c32ac00bc2bebad8e8ad6e&start=2546&end=3037","https://assets.pipeline.soar.com/2803387-f9f7436c65c32ac00bc2bebad8e8ad6e/thumbnail_2546000.jpg","/articles/6102767/Franklin-City/Milwaukee-County/Wisconsin/Technology-Commission-recommends-NIST-based-media-and-physical-security-policies-to-Common-Council","https://secure.pipeline.soar.com/6102767-13b589b3ef18f0b5b3a779f2cadab4bd/orig.mp4?Expires=1773659354&Signature=Tr0I~-8VJQ9~mdqQWYgZER5yJ2pqwPQyyFcfXsBzsWxhEQgR65gtCTD38pmasYtqqHl~dlNfjB0wNK-ByYxA5iWPUzP9EUAw0gK2DJcdIdV7oWhFNYqyu8krO~MmRUC2n7jzRMDqEt~W2DCxNp~hAabWjtt0xJVg4TRQpRA2XHKG2FCqONWfw~Tz5OiKsVtF17NtRLC9d5wxexteVK7MaYM441thROeRE6doWJ~HpJQtRlKtN9n0zG7P~-zH7RCmJHm88yPGwlxMumNK3ZkurZh6gWPYN6254V1wn1jG2xAS5oj~2Hec~Rpwv-w9nKluieK8gJpJu2NTnHisueArPA__&Key-Pair-Id=KUT5TJCACFTXG","The Franklin City Technology Commission voted March 26 to recommend two NIST‑based security policies — a media‑protection policy and a physical and environmental security policy — to the Common Council for final approval.

Staff said the media‑protection draft incorporated procedural clarifications requested in a prior meeting and that the physical security policy would likely need additional updates once the Johnson Controls door access control project is implemented. Staff emphasized police access to door controls and camera systems during major security events and said the police dispatch center should retain the ability to open or lock doors and revoke badges if an incident requires it.

Commissioners discussed review cadence for the documents and recommended they be reviewed annually or semi‑annually rather than left unchanged for multiple years. Staff also noted that the policies reference CJIS and that compliance work with the Department of Justice auditor has revealed significant outstanding items in the city’s responses to an audit questionnaire.

On motions to recommend both policies “as written,” the commission approved each recommendation by voice vote. Staff said each recommended policy will be placed on a future Common Council agenda; upon council approval, the policies will become official city policy.

A follow‑up audit and policy‑update process was discussed to address gaps the city’s recent CJIS questionnaire revealed. Staff said an auditor’s automated review returned many “denied” items that require manual clarification or additional procedure documentation.","The commission recommended two NIST‑aligned security policies — media protection and physical/environmental security — to the Common Council after minor procedural edits and discussion of door access control integration with police systems.","actionData","errors"]

Article not found

Technology Commission backs full domain migration to fix Microsoft 365 rollout

Technology Commission recommends NIST-based media and physical security policies to Common Council