Today via the Office 365 Blog, http://blogs.office.com/b/microsoft_office_365_blog/archive/2012/01/30/update-on-blackberry-business-cloud-services-for-microsoft-office-365.aspx, Microsoft announces the full availability of the BlackBerry Business Cloud Services! This is a big step to allow companies that still heavily rely on BlackBerry devices used by end-users a way to move to Office 365.

Another big announcement came from the great guys at the Exchange Team Blog, http://blogs.technet.com/b/exchange/archive/2012/01/30/pst-time-to-walk-the-plank.aspx, the release of the PST Capture. This is a tool that will help administrators locate PST files in their environment and migrate the date to an on-premises Exchange 2010 server or Exchange Online. I see this helping out Office 365 Exchange Online by enabling a company to migrate to Office 365 for email quickly doing an export of the primary mailbox to a PST and then only migrating the most recent email during the migration and the importing the PST file to either the primary mailbox or much better, the Exchange Online Archive. I plan to test this new tool out and will be blogging about the experience.

One of the comments I received about my Blog series on Office 365 Hybrid Deployment with Exchange 201 SP2 was to detail the improvements with the SP2 Hybrid wizard and what steps from a Hybrid deployment prior to SP2. So here it goes!

Previous to Exchange 2010 SP2, the process for creating a full Hybrid deployment was best detailed from the Exchange Server Deployment Assistant Site, http://technet.microsoft.com/en-us/exdeploy2010/default.aspx#Index. This site was created by Microsoft to assist with several different Exchange Server deployment options. Choosing Hybrid Deployment you will be prompted for several options. Below I will detail the changes from the checklist that is done automatically with the SP2 Wizard.

Select the Hybrid Deployment option from the above screen

For my environment I choose the Exchange 2010 existing on-premises server option, if you have 2007 or 2003 much of the steps are the same, but they will have a requirement to deploy a Hybrid Exchange 2010 SP1 server

Above I have choose that I want a full Hybrid deployment, except for having email routed through the Hybrid server first

Above, on the left, you can see the high level steps to implement the solution. Also you can download the Checklist as a PDF document. So now I will detail the steps from this deployment scenario that are still required, and the steps that are covered with the Exchange 2010 SP2 Hybrid wizard.

Above are the high level steps for a pre-SP2 Hybrid deployment. I will detail each step below.

All the steps in the Prepare for Deployment Step still need to be completed. These steps ensure you are prepared for the Hybrid deployment.

Again all the steps in the Configure Hybrid Deployment Prerequisites are needed. These steps setup the ADFS environment for Single Sign-On (SSO) and the Directory Synchronization for the on-premises users, group, and contacts to the Office 365 environment.

So here, in the Configure Hybrid Server Services, is where the Exchange 2010 SP2 Hybrid wizard comes into play. The SP2 wizard handles some of these steps. I will now show how the SP2 wizard configures the services for on-premises and Office 365. Adding your Office 365 environment is rather easy to do from the Exchange 2010 SP2 EMC, the steps are provided in the deployment assistant.

So above I have added my Office 365 environment to my EMC. Now I can manage both the on-premises and cloud based mailboxes from the console. Enabling the Mailbox Repication Service Proxy is automated with the SP2 Hybrid wizard. This saves manual steps previously needed to edit the Web.Config file. Configuring the Virtual Directories can be done in several ways. You can have them set when the Exchange 2010 SP2 server is installed by providing the CAS external name, or you can change as the instructions indicate in the Deployment Assistant.

Above shows the Accept domains that were configured by the SP2 Hybrid Wizard. Notice that Service.domain.com is no longer used. Now domain.mail.onmicrosoft.com is used as the relay domain for mail to be sent to the cloud mailboxes. Also the Exchange Delegation.domain.com is not needed for SP2 Hybrid deployment.

You do still need to obtain an SSL Certificate from a public CA. I went with GoDaddy.com as I was able to get a Subject Alternate Name (SAN) certificate with 5 names for $90.

The SP2 Hybrid Wizard modified the default Email Address Policy to add the @domain.mail.onmicrosoft.com address as a secondary address to all mailboxes. As previously mentioned you do need to enable Outlook Anywhere in the on-premises CAS server.

So the next major step is Configure Federation. The Autodiscover DNS requirements have also changed with SP2. You just need to have Autodiscover.domain.com pointing to the Hybrid Servers CAS IP (both internally and externally). You no longer need to enter DNS records for Autodiscover for the relay domain of domain.mail.onmicrosoft.com, this is done automatically.

The next two steps are virtually completely removed when setting up a Hybrid deployment using the SP2 Hybrid Wizard. This is the beauty of the wizard, it configures the delegation and the Organization relationships between the on-premises and cloud based organizations. The only manual step that is needed, which I documented in Part 3, is to add a DNS TXT record for the Domain Proof of Ownership record. The SP2 Hybrid wizard also sets up the OWA redirection for using a single OWA URL to redirect for cloud based users.

The next major step is Configuring Transport. This is also handled completely by the SP2 Hybrid Wizard.

Above are the Send and Receive Connectors configured by the SP2 Hybrid Wizard. These setup TLS for secure mailflow between my on-premises and cloud based mailboxes.

And the SP2 Hybrid Wizard also sets up the FOPE inbound and outbound connectors to utilize TLS.

So this covers what the SP2 Hybrid Wizard handles and the SP1 steps that are still needed for completing a Hybrid Deployment with Office 365. Microsoft has stated it will be updating the Exchange Server Deployment Assistant tool to include the changes to the process with an Exchange 2010 SP2 server. I hope this post was helpful, and shows that Microsoft is really made great strides with Exchange 2010 SP2 to configure a Hybrid Deployment!

So it was a big week for this blog!  Over 500 readers accessed the site this week since I posted my series on Office 365 Hybrid Deployment with Exchange 2010 SP2.  This number represents almost a third of the total amount of hits since I launched this blog in the beginning of December 2011!  Reviewing the search terms that lead user to my blog and seeing the blog post that are being viewed (WordPress provides great statistics) it is obvious that Office 365 Hybrid deployment information is in high demand!  I am hopeful that this information provided here on my blog, and on my mirror blog at http://blogs.catapultsystems.com/smcneill/default.aspx, is helping people.  My goal with this blog is to help the Office 365 community, and with over 500 hits this week I get the feeling I am.  Time will tell.  Please feel free to comment on posts you would like to see, any issues you would like investigated, or any other way I could help you with your Office 365 implementation.

On a personal note, today I took the second of the two Office 365 Microsoft Beta Exams.  These exams are, to my knowledge, in beta until early February and then are scheduled to be released fully in March.  I took the first exam on Monday.  The Monday exam was 70-321, Deploying Office 365.  This was not too bad, and I think I did pretty good.  My only problem was the SharePoint questions, as I am not a SharePoint admin or expert, but know just enough to be dangerous.  The exam today for Office 365 Administration, this was a more difficult test.  I attribute the Administering test being more difficult for me is that as a consultant I primarily do more deployments than day-to-day administration.  Again the SharePoint questions for the Administration test got me, but also not knowing all the Powershell commands (and I pride myself on being a PowerShell power user) specific for Office 365 administration had me guessing a bit.

Well I should find out in 4-8 weeks how I did on the exams, hopefully I passed both, but if not I will now know what to study more on and be ready to re-take the exams to get my Microsoft Certified IT Professional (MCITP) designation for Office 365.

I started writing a new blog post last night to show the results of the Hybrid Wizard in Exchange 2010 SP2 on the on-premises and Office 365 environments.  As I was writing it, it started to take on a life of its own.  I liked the direction it was/is going and might work it into more of a white paper on Office 365, Hybrid Deployment and Administration.  So with that said I still want to do follow-up post to the 3.5 part blog series I did on Office 365 Hybrid Deployment with Exchange 2010 SP2.  What I would like is some feedback from you the reader as to what questions do you have after reading the series?  what is missing, what needs further explaining?  This will help ensure I get the best possible information into the follow-up blog.

Please feel free to comment here or on any of the blogs related to this topic.  I appreciate you taking the time to respond.

Thanks!

Please follow me on Twitter, https://twitter.com/#!/s_mcneill I am at 173 followers and looking to pass the 200 mark today!

Hybrid Deployment

So part 3 of this blog series is all about the benefits of Exchange 2010 SP2 Hybrid wizard. To recap in Part 1 I setup my lab environment, in Part 2 (let’s just forget about Part 1.5) I documents my setting up Single Sign-On (SSO). As I mentioned in one of the previous Parts, sorry long weekend of getting this done and writing about it, I used a great website from Microsoft, http://technet.microsoft.com/en-us/exdeploy2010/default.aspx#Index the Exchange Deployment Assistance site! This is a great resource to help plan and document the steps you need to do for any Exchange Migration, not just a move to the cloud. As of now it has not been updated to include the Exchange 2010 SP2 Hybrid Configuration Wizard, http://technet.microsoft.com/en-us/library/hh529920.aspx, but the great Microsoft team is working on getting it updated to include the steps with SP2 for Exchange 2010.

Seriously using Exchange 2010 SP 2 saves you, the admin, about 45-50 steps of configuration. The wizard that the Exchange and Online teams came up with in SP2 is nothing short of amazing. This shows the dedication by Microsoft to Cloud computing! If you don’t believe me, first setup a Hybrid Deployment with Exchange 2010 SP1 and then use SP2!

Let’s get started, below we follow-up on Part 2 with the Hybrid Configuration Wizard, the instructions below are from the Deployment Assistant site, and from then on I used the http://technet.microsoft.com/en-us/library/hh529920.aspx instructions.

Connect EMC to Office 365

Above are the steps to add the Office 365 Environment to your on-premises Hybrid Exchange 2010 server. Below are the screen shots of me adding my Office 365 admin console to my Hybrid Exchange 2010 SP2 Server.

Give your Office 365 online environment a friendly name and choose the Exchange Online option for Remote PowerShell, Click OK (I choose to not use my default credentials and the next screen shows the credential popup for entering online credentials)

Enter your online credentials. I recommend using credentials that are tied to an online administrator account, and not an account that is federated from your on-premises Active Directory environment.

Once added you will see your On-Premises and the online environment in the Exchange Management Console (EMC)

Now here is the magic of SP2

As mentioned earlier the steps I used for this comes from here: http://technet.microsoft.com/en-us/library/hh529920.aspx

Launching the new Hybrid Configuration Wizard, Click Next

Really not much to it….but this is only the initial setup so more to come, Click Finish

Here is where it gets busy, click on Manage Hybrid Configuration in the right side and read everything and ensure the pre-reqs have been completed before Clicking Next

Enter you on-premises and Office 365 Online credentials (Ensure the Office 365 credentials used are an user that has the Company.onmicrosoft.com UPN and not a federated user from the on-premises AD, this caused me some pain by trying to use an account that was a federated AD user) and Click Next

Add your on-premises domain(s) and Click Next

Here you will be given a Domain Proof of Ownership step that must be completed before you can continue (an depending on your DNS provider, might cause you to have to run this wizard at a later time to allow for DNS replication, but don’t worry you can run and re-run this wizard and it will update your settings). You must create a DNS TXT record to validate you own the domain you are trying to federate with. Complete the DNS entry and then click the Check Box and then….. Click Next

Add your Exchange 2010 SP2 CAS and HUB servers and Click Next

Add the outbound IP (this is very important as it will set the IP(s) or IP range that are allowed to be received from in Forefront Online Protection for Exchange (FOPE) and if the IP(s) are not correct your email flow will suffer!) that your SMTP email and the name of the Certificate for TLS (ensure that this name is a part of your SSL certificate in the next step, again you want email to flow, this is a huge step!) and Click Next

Select the pre-added SSL certificate and choose how you want outgoing mail to be routed and Click Next ( I plan to write another blog on switching the email flow from being delivered on-premises first then to the Office 365 Exchange online)

Review all the information and then….wait for it….Click Manage! (If you have red lines in your screen, be afraid, very afraid! I did this to protect the innocent email and server names)

Verify that both steps completed successfully and then….Go do some testing!

I hope this was helpful, while in my blog it looks very easy, it was not (This is where I say I am a trained professional, and not to try this at home). I ran into numerous errors and issues and had to re-do several steps and fix things. While I wish I could say this can be done in a blink of an eye with the proper info, it is still a very detailed and involved setup. By no means do I think that this should be taken lightly, this is a major move for any company and involves one of the most primary means of communication, email. So if you are a looking to make a leap to the cloud, and I highly recommend it, please PLAN PLAN PLAN and if needed look to get some expert assistance! Catapult Systems, my company, is an excellent company to assist you and YOUR Company with the migration the Office 365. Please reach out to me and Catapult Systems for a chat about your planned migration, and we can help you, ensuring the migration to the cloud is a smooth transition for you and your users!

Office 365 Hybrid Deployment

Continuing my blog series on setting up a Hybrid Office 365 deployment with Exchange 2010 SP2. This part will detail the ADFS and SSO setup.

UAG Setup

So I went with the recommended, actually required, two NIC configuration for UAG, one NIC dedicated to External and one to Internal communications. To properly setup the NICs (in my lab all VMs are in the same VLAN) I had to issue the following commands to set the internal routing using the NIC named ‘Internal’:

Netsh Interface ipv4 add route prefix=10.0.0.0/8 “Internal” nexthop=192.168.100.1 store=persistent

Netsh Interface ipv4 add route prefix=172.16.0.0/12 “Internal” nexthop=192.168.100.1 store=persistent

Netsh Interface ipv4 add route prefix=192.168.0.0/16 “Internal” nexthop=192.168.100.1 store=persistent

The route prefixes indicate internal networks and the Nethop is the gateway.

UAG Getting Started Wizard after Install, http://technet.microsoft.com/en-us/library/dd857324.aspx this will explain how to setup your UAG for your environment.

This is how my lab environment is setup for UAG:

Great detail huh? J

I have renamed the NICs on my UAG server as Internal and External (I know, I am so clever, maybe I should try to patent this!) A note the in my lab the External NIC has the Default Gateway set as 192.168.100.1 and the Internal has no Default Gateway set. The External also is using an External DNS server, 4.2.2.1, and the Internal NIC is pointed to my domain DNS.

So to assist me with the complete setup I used the Exchange Deployment Assistant website, http://technet.microsoft.com/en-us/exdeploy2010/default.aspx#Index. Much of the information in this blog series has come from this great tool that Microsoft has made available. I also setup UAG 2010 to publish Exchange 2010 Web Services, and used this guide about Publishing Exchange 2010 with TMG and UAG, http://www.microsoft.com/download/en/details.aspx?displaylang=en&id=8946

The first step is to install and configure ADFS 2.0

http://onlinehelp.microsoft.com/en-us/office365-enterprises/ff652539.aspx

Create an internal DNS entry for the ADFS Service that will point to the ADFS internal server, like ADFS.Domain.com. FYI I have split DNS setup, which means I have a separate internal and external DNS provider. If you do not have this it will make the implementation a bit more difficult, but can be done. I would recommend that you Bing (hey I’m a Microsoft guy so will not see me use the G word in my blog posts) to find out the differences with a single DNS namespace spared both for internal and external access. The biggest issue you will find is around ADFS for SSO as you will need to probably route all authentication via the ADFS proxy, in my case I am going to utilize Forefront Unified Access Gateway (UAG) for my ADFS proxy. I am also utilizing UAG for publishing the Exchange 2010 on-premises web services, OWA, Outlook Anywhere, ActiveSync, etc.

Create dedicated Service Account for ADFS, Domain account with password never expire, this account does not need any additional privileges within the domain, just a standard domain user.

Obtain a SSL Certificate. My strong recommendation, as the information in the http://onlinehelp.microsoft.com/en-us/office365-enterprises/ff652539.aspx Link will state is to use a Public Certificate Authority, I used GoDaddy.com to obtain my public Unified Communications(UC)/Subject Alternate Name(SAN) certificate.

Launch ADFSSEtup.exe (download from http://www.microsoft.com/download/en/details.aspx?displaylang=en&id=10909)

Click Next ( so you will see Click Next throughout this and future posts, this really means read everything on the page, but no changes from the default settings are needed, so basically just Click Next!)

Be sure to read the entire EULA (and send me a condensed understanding in under 50 words) and then accept and Click Next

Ensure Federation server is selected and Click Next

Click Next

Wait……

Click Finish

Install SP1 Hotfix for ADFS 2.0 (download from http://support.microsoft.com/kb/2607496) standard next next next finish J

After the AD FS 2.0 software installation is complete, click Start, then Administrative Tools, and then AD FS 2.0 Management to open the AD FS 2.0 Management snap-in.

Click on the AD FS 2.0 Federation Server Configuration Wizard link

Click Next

Click Next

Ensure the proper Certificate and Federation Service Name is set and Click Next

Set the Service Account (you remember now, the one I told you that was needed to be created earlier in this blog) and Click Next

Click Next

Wait……

Click Close

Above can be ignored, will be setup later

Verify Configuration

Below verification steps have been taken from: http://onlinehelp.microsoft.com/en-us/office365-enterprises/ff652539.aspx

Procedure 1: To verify that the federation server is operational

1. Log on to a client computer that is located in the same forest as the federation server.
2. Open a browser window. In the address bar, type the federation server’s DNS host name, and then append /adfs/fs/federationserverservice.asmx to it for the new federation server; for example:
3. https://fs1.fabrikam.com/adfs/fs/federationserverservice.asmx
4. Press ENTER, and then complete the next procedure on the federation server computer. If you see the message There is a problem with this website’s security certificate, click Continue to this website.

The expected output is a display of XML with the service description document. If this page appears, IIS on the federation server is operational and serving pages successfully.

Procedure 2: To verify that the federation server is operational

1. Log on to the new federation server as an Administrator.
2. Click Start, point to Administrative Tools, and then click Event Viewer.
3. In the details pane, double-click Applications and Services Logs, double-click AD FS 2.0 Eventing, and then click Admin.
4. In the Event ID column, look for event ID 100. If the federation server is configured properly, you see a new event—in the Application log of Event Viewer—with the event ID 100. This event verifies that the federation server was able to successfully communicate with the Federation Service.

ADFS Proxy, Using UAG

http://technet.microsoft.com/en-us/library/gg274295.aspx this is the site I used to configure ADFS proxy, and really not sure if you can call it proxy as it is more involved than that and more secure, for the internal ADFS service. You can also use the ADFS Proxy role in a DMZ as explained in the help file here: http://onlinehelp.microsoft.com/en-us/office365-enterprises/ff652539.aspx

Create a new Authentication Server, Click……….OK

Create a new UAG Trunk, Click Next

Name the Trunk and apply the public DNS name and External IP address, Click Next

Select the Authentication Provider, Click Next

Select the proper Certificate, Click Next

Click Next

Click Finish

Install the MSOL Powershell Module for Office 365

Download: http://onlinehelp.microsoft.com/en-us/office365-enterprises/ff652560.aspx

Click Next

Accept and Click Next

Change if you want but I recommend….. Click Next

Click Install

Click Finish

Add a domain

Taken from http://onlinehelp.microsoft.com/en-us/office365-enterprises/ff652560.aspx

1. Open the Microsoft Online Services Module.
2. Run $cred=Get-Credential. When the cmdlet prompts you for credentials, type your Office 365 administration account credentials.
3. Run Connect-MsolService -Credential $cred. This cmdlet connects you to Office 365. Creating a context that connects you to Office 365 is required before running any of the additional cmdlets installed by the tool.
4. Run Set-MsolAdfscontext -Computer <AD FS 2.0 primary server>, where <AD FS 2.0 primary server> is the internal FQDN name of the primary AD FS 2.0 server. This cmdlet creates a context that connects you to AD FS 2.0.

1. Run New-MsolFederatedDomain -DomainName <domain>, where <domain> is the domain to be added and enabled for single sign-on. This cmdlet adds the domain.
2. Using the information provided by the results of the New-MsolFederatedDomain cmdlet, contact your domain registrar to create the required DNS record. This verifies that you own the domain. Note that this may take up to 15 minutes to propagate, depending on your registrar. It can take up to 72 hours for changes to propagate through the system. For more information, see Locate my domain name registrar and Verify a domain at any domain name registrar.
3. Run New-MsolFederatedDomain a second time, specifying the same domain name to finalize the process.

The above is what the commands from the steps look like for adding a new domain

The above is what the commands look like for converting a domain

Add a Relying Trust in ADFS for UAG

This is only needed if you are using UAG for the ADFS Proxy http://technet.microsoft.com/en-us/library/gg274305.aspx

Click……Start

I downloaded the UAG Metadata from the UAG Server and then selected the import method, and then I Clicked Next

Name to Relaying party and give some notes and Click Next

Click Next

Click Next at the next screen (sorry missed a screen shot on this one, so shot me!)

Click Close

Click Add Rule…(highlighted button)

Select ‘Pass Through or Filter an Incoming Claim and you guessed it, Click Next

Name the rule and choose the same Claim Type and Click Next

Click Apply

DIR SYNC Install and Setup

Below steps are detailed here to enable Directory Sync in your Office 365 Enviornment, http://onlinehelp.microsoft.com/en-us/office365-enterprises/ff652544.aspx#BKMK_EnableDirectorySynchronization

Enable DirSync from PortalUsersActive Directory Sync Setup Item #3 Activate

Download from the PortalUsersActive Directory Sync Setup link

Choose the appropriate version and download

Click Next

Click Next after accepting and reading the complete EULA!

Change at your own RISK and then Click Next

You’ll wait awhile for this then………… Click Next

Click Finish

You guessed it, Click Next

Enter your Admin Credentials for Office 365 (will blog later about setting this password to not expire, but not tonight!) then Click Next

Enter Credentials for your On-premises AD, the account needs to have Enterprise Admin privileges but can be deleted after the completion of the setup as a new account is created to run the sync, Click Next

Click Next

Waiting…..listen to some music, take a break, walk outside, etc…..

Yep… Click Next

Click Finish

Click Ok

Check the DirSync server to ensure the sync completed successfully

SSO COMPLETED!

Best testing site is https://www.testexchangeconnectivity.com/

Please check back for Part 3 about the SP2 Hybrid Wizard in Exchange 2010!

Sorry to my loyal and dedicated readers, you both know who you are, but I did not get much done tonight!  I finalized the exchange 2010 SP2 install and got my certificate from GoDaddy.com requested and completed.  But ran into some FUN (please notice the caps in fun, as in NOT FUN) with Forefront UAG publishing the basic Exchange Web Services.  So after talking to my laptop, screaming at my laptop, Binging here and there I had to give up for the night!

More to come I promise.  Don’t want to leave you two in the dark!

I am prepping my newly acquired lab servers, Thanks Catapult IT!, to set up an Office 365 Hybrid Deployment.  I am doing this for several reasons:

1. Want to fully understand the new Hybrid Deployment Wizard and setup with Exchange 2010 SP2

2. Use Forefront Unified Access Gateway (UAG) for ADFS and Exchange proxy

3. Prep for the Office 365 Beta Exams

4. My presentation at Office 365 Saturday Redmond, http://o365redmond.sharepoint.com/Pages/default.aspx, is on this topic

5. To blog about the experience and help out the community!

So the lab servers I am configuring up are as follows, all running Server 2008 R2 SP1:

DC1 – Running DC and ADFS

EX1 – Running Exchange 2010 SP2 with MB, Hub and CAS roles

UAG1 – Running UAG (imagine that)

My work tonight is to get all the OS’s installed and patched (done) and get Exchange 2010 SP2 installed and setup.  I also will be getting a UC SAN certificate issued and installed and hopefully get UAG installed and configured.  Not sure how many Blog posts this entire circus will entail, but will be trying to get this up and running by Sunday.  I have my first of two Office 365 Beta exams on Monday afternoon.

My next Blog post I plan on talking about the ADFS and UAG setup and integration.

Not the most visited site on the planet, but in a little less that two months my site have 1,014 hits to date.  Hope to keep growing this by helping out the Office 365 community.