Azure AD Integration Updates

Azure AD integration now provides multiple approaches direct from Microsoft and the ability to write back to on premises AD. The recently update table on MSDN outline the capabilities, http://msdn.microsoft.com/en-us/library/azure/dn798669.aspx. I'm also particularly keen to monitor the Azure Device Registration Service Preview as this will enable very dynamic environments, http://msdn.microsoft.com/en-us/library/azure/dn788908.aspx.

The new and soon to be updated Azure AD Sync Services (AAD Sync) information is available here, http://msdn.microsoft.com/en-us/library/azure/dn790204.aspx.

Happy sync'ing.

 

 

Office 365 First Release - How to enable

Content from: http://office.microsoft.com/en-us/office365-suite-help/office-365-release-programs-HA104204958.aspx

With Office 365, you get product updates – like new email features, more site storage, and new collaboration features – as they become available. You can decide when to receive the updates by opting in to the First Release program or remaining on the Standard Release program.

First Release With this option, you and your users receive a select set of significant service updates as early as one week after the official announcement. Choose this option if you and your employees are comfortable with regular updates to the Office 365 service.

Standard Release With this default option, you and your users receive a select set of significant service updates 3 weeks or more after the official announcement. For at least 3 weeks, you have time to learn about the updates and prepare your employees.

 

Note    The Office 365 updates described in this article apply to the Office 365 suite, SharePoint Online, and Exchange Online. They do not apply to Lync Online, Exchange Online Protection, the latest version of Office and related services.

 

Turn on First Release

By default, all Office 365 accounts are on the Standard Release program. They receive service updates 3 weeks or more after the official announcement. You can remain on this update schedule or turn on First Release by following these steps.

1. Sign in to Office O365.
2. Go to Admin > Service settings > Updates.
3. Turn First Release on or off.

 

ADFS 3 Device Registration SSL SAN required with Workplace Join

I came across an interesting issue when deploying Workplace Join as part of a migration to ADFS 3. ADFS had been tested as working correctly with the Device Registration service initialized and enabled, but I could not register Windows devices.

After running the lab (which used different different host names!) and checking many settings I decided to go back to the beginning (always a good place to start) and review the Device Registration requirements listed on TechNet. Surprise, I had missed something really obvious in my clients choice of a wildcard SSL certificate - something I normally dig my heels in over.

Solution: You must add enterpriseregistration. (i.e. enterpriseregistration.noak.es where dan@noak.es is the UPN) to the certificate used for Device Registration as a SAN for each UPN suffix in use.

Straight from the horse's mouth, "AD FS must be configured with a server SSL certificate that includes the well-known Device Registration server names" and this is followed by an example, "enterpriseregistration.".

Ah, that explains it, but then somewhat confusingly TechNet states:

"You can satisfy this requirement in two ways. You can use a wildcard certificate that covers all of the possible names used at your company or you can add the additional names as subject alternative names."

Important: The first way above is not true, at least for now, either that or the Device Registration service is not implemented as designed with all devices in mind.

Office 365 IE8 support ends 8 April 2014

If you use IE8 with Office 365 it is now time to upgrade or deploy an alternate browser. I see this as a huge step forward, enabling new and the best experience in the browser for users... on any device!

You can deploy a newer version of IE,  best to use IE10 or IE11. The latest version of Chrome, Firefox and Safari (on Mac) supported by the vendor are also designed to work with Office 365.

TechNet: Office 365 System Requirements:
http://technet.microsoft.com/en-us/library/office-365-system-requirements.aspx

Office 365 is designed to work with the current or immediately previous version of Internet Explorer. We recommend that you upgrade to the latest version of Internet Explorer after it is released. Office 365 might continue to work with versions of Internet Explorer other than the current and immediately previous versions for some time after the release of a new version of Internet Explorer, but Office 365 can’t provide any guarantees.

When accessing Office 365 from older versions of Internet Explorer, users may experience known issues and limitations depending on the versions of Internet Explorer, including:

• Internet Explorer 9   Office 365 does not offer code fixes to resolve problems you encounter when using the service with Internet Explorer 9. You should expect the quality of the user experience to diminish over time, and that many new Office 365 experiences might not work at all.
• Internet Explorer 8   The user experience sending and receiving email with Outlook Web App and Internet Explorer 8 might be substantially diminished, especially when used on Windows XP or with low memory devices. Office 365 does not offer code fixes to resolve problems you encounter when using the service with Internet Explorer 8, and new Office 365 experiences might not work at all. You should also expect the quality of the user experience with Internet Explorer 8 to diminish further in the near future. After April 8, 2014, Internet Explorer 8 will only display Outlook Web App Light.

OneDrive for Business - 1 TB quota available

If, unlike me, you are lucky enough to have a large storage pool in SharePoint Online it is now possible to assign 1024 GB / 1 TB  to OneDrive for Business Office 365 users. If you don't buy more storage each E user still gets 25 GB of personal storage and adds 500 MB to the overall pool.

 



OneDrive for business - 1TB quota



This started rolling out a week or so back, keep an eye out for it. I believe the maximum amount of storage which can be purchased per tenant is 25 TB... that is for now I guess.

More information on SharePoint Online and OneDrive for Business limits can be found here.

Exchange Online: Get a Hybrd key

If you have or plan to deploy Exchange Hybrid within your Exchange Server 2003 or 2007 Org obtaining the key just became a lot easier.

http://aka.ms/hybridkey

This wizard drives through validating eligibility to issue Exchange Server 2010 or 2013 keys. This is for Hybrid only, so it is not permitted to host mailboxes.

Enjoy.

Office 365 Servie Descriptions & Package This

These days I work almost exclusively with Office 365 and an essential tool in my bag are the service descriptions. These keep me honest, so as not to get confused or blur the line, and are essential reading for anyone undertaking an Office 365 deployment.
 
With "the new Office 365" Microsoft has shifted away from Word documents to publishing them directly on TechNet. This is great because never again will I have out of date information, but not so great for taking it with me (offline) or including a copy with a business document.
 

Office 365 Service Descriptions on TechNet:  http://technet.microsoft.com/en-us/library/jj819284.aspx

 

The problem comes when I want to read these offline (in bed, on the train) or bundle them in to a report or proposal. Searching on TechNet isn't really that focussed and results can vary.

 

So, how to resolve this? You could print/save to PDF or OneNote, which is ok but I find Pack This on CodePlex particularly useful.

 

"Package This is a GUI tool written in C# for creating help files (.chm and .hxs) from the content obtained from the MSDN Library or the TechNet Library via the MSDN Content Service. You select the content you want from the table of contents, build a help file, and use the content offline. You are making personalized ebooks of MSDN or TechNet content. Both help file formats also give full text search and keyword search."

 
With Package This I can export to CHM or HXS for offline viewing and searching. An XML file can be saved targeting the specific content on TechNet or MSDN for easy updating in the future.

Package This on CodePlex: http://packagethis.codeplex.com/

PST Capture 2.0 Available Now

With PST Capture 2.0 released there are a few useful updates.

Support for Microsoft Exchange Server 2013

Fix profile generation code to use "RPC over HTTP".

The UI is no longer limited to 1000 users when performing an online import.

Fix issue in which online import fails when PST Capture is not installed on Exchange server.

Download the tool:
http://www.microsoft.com/en-us/download/details.aspx?id=36789

KB Article:
http://support.microsoft.com/kb/2815301/en-us?sd=rss&spid=13965

TechNet Guidance/Documentation:
http://technet.microsoft.com/en-us/library/hh781036(EXCHG.141).aspx

Exchange Server 2010 SP3 Released

I was pretty excited to see, among other things, Exchange Server 2010 SP3 has been released in to the wild. At 6am today Laura didn't seem all that interested in hearing about it, so I thought I had better update this blog.

 

So what does this mean?

Well SP3 is a corner stone of any coexistence transition with Exchange 2013 (CU1) or indeed hybrid with coming release (Wave 15) of Exchange Online on 27 February. It is also going to be important for those Public Folder fans out there wanting to move to the modern/new versions which reside within the DAG.

 

As well as coexistence/hybrid the SP contains the usual updates, fixes and enables installation on Windows Server 2012. There are Schema updates to review, but should not present a blocker.

 

Handy links:

 

SP3 download - http://www.microsoft.com/en-us/download/details.aspx?id=36768

Exchange 2010 SP3 - http://technet.microsoft.com/en-us/library/jj965774(v=exchg.141).aspx

Exchange Team blog - http://blogs.technet.com/b/exchange/archive/2013/02/12/released-exchange-server-2010-sp3.aspx

 

Happy testing.

Change AD FS 2.0 Primary Server

I was asked today how to decommission the primary AD FS 2.0 server in a farm, minimising any potential interruption. The solution is simple and like all good things uses PowerShell.

The original AD FS 2.0 server was deployed using the WID and Farm options for Office 365.

• WID is suitable for the majority of deployments (if it is not you will know about it)
• Choosing WID sets the first server deployed to be the primary
• Only the primary server can write configuration changes to the database
• Opting for a Farm provides scope for HA and scale

The AD FS farm had been extended with new highly available nodes load balanced in geographically dispersed data centres. DNS had been updated and the primary server was in effect redundant.

Log on to the new primary server (NEUADFS02) and run PowerShell.

Add-PsSnapin Microsoft.Adfs.PowerShell

Set-AdfsSyncProperties -Role PrimaryComputer

On all other AD FS servers in the farm run the following.

Add-PsSnapin Microsoft.Adfs.Powershell

Set-AdfsSyncProperties -Role SecondaryComputer -PrimaryComputerName NEUADFS02.EXCHANGEGEEK.COM

On a related note, I also identified that TCP/80 should be open between farm members, despite all resources and configuration identifying only TCP/443 as required. This came up when extending the farm across data center boundaries.

Do it “ONCE”–Cloud based SSO from IMGROUP

Microsoft Office 365 provides a couple of great options for managing user accounts, with the most complete solution leveraging an existing on-premise Active Directory to authenticate in to Office 365 services. IMGROUP have built a multi-data centre hosted Single Sign-On (SSO) solution for Office 365 and Windows Azure, lowering the barrier to entry for this type of deployment and accelerating the deployment.

IMGROUP “ONCE” - http://www.imgrouponline.com/services/once

If we choose the route of using on-premise Active Directory to authenticate the organisation first needs to deploy new roles on to servers. Office 365 offers guaranteed high levels of availability, however this is of no comfort should the single AD FS deployed server fail. With this is mind AD FS and AD FS Proxy should be deployed using N+1, with load balancing configured between the servers for each role.

• 2x AD FS 2.0 Server (x64)
• 2x AD FS 2.0 Proxy Server (x64)
• 1x Directory Synchronisation (DirSync) Server (x64)

These are the server roles required in a single site only, to provide site resilience the server count is doubled and additional network hardware is required to provide Live-Live load balancing between locations.

The specs for an AD FS, AD FS Proxy and DirSync server vary depending on size of deployment. The Microsoft recommended minimum hardware requirements for the roles are below, add to this licencing and maintenance (support, backup, monitoring) costs for all servers.

Hardware	Specifications
CPU	Dual Quad Core 2.27GHz CPU (8 cores)*
Memory	4 GB
Disk	70 GB (DirSync)

*DirSync minimum CPU starts at 1.6 GHz

What we have done at IMGROUP is provide these roles as a geographically load balanced Cloud service requiring just a secure Virtual Private Network (VPN) connection to a client site containing an existing Active Directory server(s).

Authentication traffic is routed to the closest data centre to the client device, access is brokered in the usual way for Office 365 SSO and access is granted to the service. In the (much simplified) diagram below AD FS is geographically load balanced between DC1 and DC2, if DC1 should fail all traffic is routed to DC2 until service is restored.

Using the economies of scale Cloud provide we can get this up and running in a short time frame, with a low impact to the existing IT staff workload.

We initially built the solution to support our own dispersed work force in the UK, India and New York. We had SSO in the UK, but if it was unavailable our workers in other time zones cloud not access services until someone in the UK had resolved the issue. From the start we identified this would fit the needs of other organisations and have built the robust solution to cater for large and small deployments.

You can request more information via our web site, http://www.imgrouponline.com/services/once.

We have submitted the solution to Microsoft Pinpoint, http://pinpoint.microsoft.com/en-GB/PartnerDetails.aspx?PartnerId=4295517315.

Feel free to add comments, ask a question or contact me directly about this.

AD RMS on devices

Active Directory Right Management Services (AD RMS) enables the protection of emails and documents within the domain for users and computers.

If you have RMS in place with Exchange Server or Exchange Online, how do your mobile workers gain secure access? Some platforms (Windows Phone) support this out of the box, but it does require a bit of configuration. If you have Apple, Android or even the creaking BlackBerry OS in the mix I have used the following apps fill the gap.

NitroDesk TouchDown 7.3+ for Android
http://www.nitrodesk.com/irm.aspx
http://blogs.technet.com/b/rms/archive/2012/06/29/touchdown.aspx

GigaTrust for Apple iOS and BlackBerry
http://www.gigatrust.com/mobility-platform.shtml
http://www.gigatrust.com/iphone_ipad.shtml
http://www.gigatrust.com/blackberry.shtml

I will write a follow up post covering RMS/IRM for Exchange Server and Exchange Online and how Windows Phone can leverage this in the coming weeks.

Dan

Forefront changes, TMG is no more

Threat Management Gateway and ISA before it provided a pretty simple way to get client connectivity to Exchange mailboxes from the internet. Microsoft have announced changes to the Forefront roadmap, which when you consider the next wave of server products and partner solutions makes sense.

http://blogs.technet.com/b/server-cloud/archive/2012/09/12/important-changes-to-forefront-product-roadmaps.aspx

Discontinued, but supported:

• Forefront Protection 2010 for Exchange Server (FPE)
• Forefront Protection 2010 for SharePoint (FPSP)
• Forefront Security for Office Communications Server (FSOCS)
• Forefront Threat Management Gateway 2010 (TMG)
• Forefront Threat Management Gateway Web Protection Services (TMG WPS)

This kind on makes sense, for example Exchange 2013 comes with a basic level of protection built-in and a lot of organisations will already have a third party mail gateway or service deployed on the “perimeter”. The CAS role has also changed resulting, as Hosters have been doing it for years, in reduced risks in exposing this to the internet (via HLB etc).

Direct Access will play a big part in remote access, the UAG cash cow (heavy on licencing compared to TMG) will also continue as a product.

Azure AD Standalone Tenants

Over of the Windows Azure blog there have been some cool announcements, http://blogs.msdn.com/b/windowsazure/archive/2012/09/12/more-advances-in-the-windows-azure-active-directory-developer-preview.aspx.

I’ve been using https://activedirectory.windowsazure.com for a while now and with the announcement of “standalone tenants” this presents huge possibilities. In hosting circles I have often had discussions for providing “multi-tenant” AD available on demand, but have always come to the conclusion it would require Microsoft to make some key changes.

Check it out now, http://windowsazuire.com.

Windows 8 tip: Browser choice

If you have windows 8 RTM editions you will have recently had to complete the browser choice wizard. This is great until you realise it unpins desktop IE from the taskbar and the Start Screen only provides Windows Store/Modern UI (Metro) IE.

There are 2 simple solutions:

1. Start > type “iexplore.exe” > right click > Pin To Taskbar

2. Open Windows Store style IE > click the spanner/tools option > View on Desktop > right click IE on taskbar > Pin To Task Bar

Anyway, hope that helps some folks out.

Office 365 Outlook Password Notifications

Microsoft have released updates for Outlook 2007 and Outlook 2010 which provide password expiry notifications for non-federated users using a balloon in the system tray. If it is the first logon or the password has expired the user will receive a dialogue prompting them to change the password. In either case the user is directed to the Office 365 portal.

Password expiration notification.

Password has expired notification.

Get the updates for Outlook here:

• 2687351 Description of the Outlook 2010 hotfix package (Outlook-x-none.msp): August 28, 2012
• 2687336 Description of the Outlook 2007 hotfix package (Outlook-x-none.msp): August 28, 2012

For some organisations SSO just isn’t important, combining these Outlook updates with the Set-MSOLPasswordPolicy allows the customisation and enforcement of policy with reduced user training and helpdesk calls.

As always, the Exchange Team have created a great post with videos. http://blogs.technet.com/b/exchange/archive/2012/09/11/office-365-password-expiration-notifications-in-outlook.aspx

There is also a TechNet article explaining it all, http://support.microsoft.com/kb/2745588

Windows 8 Release Preview Upgrade

I wanted to share a few tips I used when upgrading the Windows 8 Release Preview to Windows 8 Enterprise.

Bit Locker

The fist challenge I had is Bit Locker was enabled. Not really a challenge as the upgrade told me how to suspend it, which takes all of 10 seconds.

Host Version

Next I was informed I could not upgrade the Release Preview version I had. I over came this by changing the install files to allow upgrade from a much earlier version, do this at you own risk.

<drive>:\sources\cversion.ini

[HostBuild]
MinClient=8508.0
MinServer=8508.0

Above the RTM upgrade host version was higher than the the current installed version. I lowered this to 8200.0. Remember, do this at your own risk.

Activation

If Windows 8 won’t activate run the following from an elevated command prompt

slmgr.vbs –ipk 0123-4567-89AB-CDEF-GHIJ

Other than these 3, everything else just worked. I really like the very simple guide advising users to push the cursor to the corner of the screen. I think though it should cover a little more and highlight keyboard shortcuts.

Securing Exchange Online BlackBerry Devices with BlackBerry Business Cloud Service and Blocking BlackBerry Internet Service

Using the BlackBerry Business Cloud Service (BBCS) hosted by RIM allows Office 365 administrators to provision and manage BlackBerry device access to mailboxes. A savvy end user might realise the BlackBerry Internet Service (BIS) can also connect to mailboxes, historically this was just over IMAP but now also uses Exchange Web Services (EWS). As a business I would be concerned about unknown and unmanaged devices accessing corporate data.

BlackBerry Business Cloud Service

When the BBCS is enabled in the Office 365 portal a Foreign Principal Object (FPO) is created for RIM and authorized rights by Microsoft to access the tenant mailboxes. BBCS connects to Exchange Online using EWS. The administrator has access to the BlackBerry Administration Service Portal to set policy, create BlackBerry users and manage all BlackBerry devices. The end user gets access to the BlackBerry Web Desktop to configure and manage their own device.

BlackBerry Internet Service

With BIS the end user is in control of setup and device administration, there is no reference the user has even connected a device to Exchange (on-premise or Office 365). Accessing the carrier BIS portal the user enters email address and mailbox password, EWS or IMAP is then used to access the mailbox. Only the end user has the ability to manage or wipe the device.

Restrict Blackberry Internet Services

Using Exchange Online (or on-premise) PowerShell we can restrict EWS by either completely disabling it or by using allow/block lists for known applications. I mentioned an authorised FPO is created for BBCS access to mailboxes, so if we do disable EWS on the mailbox user object it will continue to function. We also need to make sure IMAP and POP are disabled.

Important Note: EWS is used by Outlook and other applications, I would not recommend completely disabling it.

I am going to connect to Exchange Online PowerShell:

$Sess1 = New-PsSession –ConfigurationName microsoft.exchange –ConnectionUri https://ps.outlook.com/powershell -AllowRedirection -Authentication basic -Credential (Get-Credential)
Import-PsSession $Sess1

Using the following PowerShell I am going to leave EWS enabled for Outlook and a custom app agent ID (CustomEWSAppAgentID) which also uses EWS, but everything else will be blocked:

Set-CasMailbox –Identity daniel@exchangegeek.com –EwsEnabled $True –EwsAllowOutlook $True –EwsAllowMacOutlook $True –EwsAllowEntourage $True   –EwsApplicationAccessPolicy: EnforceAllowList –EwsAllowList: {“*CustomEWSAppAgentID*”} -PopEnabled $False -ImapEnabled $False

Replacing Set-CasMailbox with Set-OrganizationConfig the EWS settings can be applied to all tenant mailboxes.

Important Note: I would test on a few mailboxes before applying organisation wide.

If the user is federated BIS will first have to authenticate on the ADFS Proxy so another solution could be to block RIM IP addresses. The IP addresses will be subject to change and can be found at the following locations.

BIS: http://btsc.webapps.blackberry.com/btsc/viewdocument.do?noCount=true&externalId=KB11036&sliceId=2&dialogID=393469&cmd=displayKC&docType=kc&isLoadPublishedVer=&stateId=393480&docTypeID=DT_SUPPORTISSUE_1_1&ViewedDocsListHelper=com.kanisa.apps.common.BaseViewedDocsListHelperImpl

BES: http://btsc.webapps.blackberry.com/btsc/viewdocument.do;jsessionid=6F2286092E14CB90968C3CAB08F486D6?noCount=true&externalId=KB03735&sliceId=2&cmd=displayKC&dialogID=22502&docType=kc&isLoadPublishedVer=&stateId=22508&docTypeID=DT_SUPPORTISSUE_1_1&ViewedDocsListHelper=com.kanisa.apps.common.BaseViewedDocsListHelperImpl

I hope you find this useful, it took me a week to get confirmation that BIS now uses EWS.

Updated - 20/08/12:

If you want to be 100% sure BBCS will not be affected by the EWS Application Policy, use the following.

Set-OrganizationConfig –EwsEnabled $True –EwsAllowOutlook $True –EwsAllowMacOutlook $True –EwsApplicationAccessPolicy: EnforceAllowList –EwsAllowList: {“*BES/*”}

I received confirmation from RIM this week that “BES/<version>” is the application user agent used by BES and BBCS.

Basic Office 365 PowerShell Tip

I'm setting a new PC this week and getting used to a different keyboard, joy. I connect to Office 365 Exchange Online a lot, so the first for me is to run the following.

Using an elevated PowerShell window.

Set-ExecutionPolicy -ExecutionPolicy Unrestricted

Next I register my scripts directory in PS.

$env:path = $env:path + ";C:\Scripts\PowerShell"

Then to create my most used script, I save it as O365Session.ps1.

$O365PSSess1 = New-PSSession -ConfigurationName microsoft.exchange -ConnectionUri https://ps.outlook.com/powershell -Credential (Get-Credential) -Authentication basic -AllowRedirection
Import-PSSession -Session $O365PSSess1

To run I just open a PowerShell session window and type O365Session.ps1.

This post is really just a reminder for me, I hope that if you didn't know about this you have now tried it.

Public Folders – Exchange 2013 Preview and Office 365 Preview

With the release of Exchange 2013 Preview Microsoft did something awesome, which even going back Exchange Server 2007 I thought would never happen. Public folders, in my opinion have been re-elevated in importance. Gone are separate Public Folder databases as the new Public Folder Mailboxes have moved from multi-master to single-master using continuous replication in the DAG alongside other mailboxes on-premise or in the cloud.

Public Folder Mailboxes are now created to store public folder content, the first of which also stores the folder hierarchy. Not only does this simplify HA/DAG deployment, but also makes e-discovery easy. Coupled with Site Mailboxes I see a new chapter of sharing and collaboration opening up in Exchange Server, both can be easily managed using the new Exchange Administration Center (EAC) or EMS.

If you plan to migrate existing public folders you need to consider the following:

• Exchange Server 2010 SP3 is a requirement.
• You need to use the new *PublicFolderMigrationRequest cmdlets, new *OrganizationConfig parameters and PowerShell scripts:
  • Export-PublicFolderStatistics.ps1   This script will create the folder name to folder size mapping.
  • PublicFolderToMailboxMapGenerator.ps1   This script will create the public folder to mailbox mapping file.
• Make sure you have validated Public Folder database backups before you start.
• Use Get-PublicFolder cmdlet to list information about the Public Folder hierarchy for later comparison.

At the time of writing Microsoft have made pre-release information available for Exchange 2013 Preview here, http://technet.microsoft.com/en-us/library/jj150486(v=exchg.150).