Office 365

ADFS 2.0 Update Rollup 2 released

Michael Van Horenbeeck — Fri, 18 May 2012 08:14:36 GMT

A few days back, Microsoft released UR2 for ADFS 2.0.

This Update Rollup mostly contains fixes for some issues but also added full support for the RelayState parameter.

For more information, have a look at the following page: http://support.microsoft.com/kb/2681584

ADFS & Office 365: The implications of a database choice (SQL or WID)

Michael Van Horenbeeck — Tue, 27 Mar 2012 21:12:57 GMT

The configuration database is one of the components that make part of an AD Federation Server deployment. It contains all configuration data regarding the Federation Service and includes information the Federation Services needs to identify certificates, claims etc... One of the decisions related to an AD FS deployment is whether to use SQL or a Windows Internal Database (WID) to store the ADFS configuration database in. Unfortunately, there’s not much documentation available (except for this article on TechNet maybe).

In order for the AD FS service to work you need an active (live) connection to the database. There’s no caching happening, which means that your federation server will stop processing requests as from the moment the connection to the database is lost. This immediately brings up some interesting questions. It means that the availability of your federation service also depends on the availability of your database… In this article, I will try to shed a light on the different options which will, hopefully, help you better understand your options and therefore lead to better decisions.

Note Before continuing I must clarify that I wrote this article, solely with the usage of ADFS in combination with Office 365 in mind. It is very well possible that conclusions or any of the statements below might not entirely apply if other usage scenarios are taken into account.

Database Type

The choice of the database type directly impacts what you can (or cannot) do. In some way, it also dictates how you should setup your federation servers. The table below depicts some of the most important differences between SQL and the Windows Internal Database when used as configuration database store for AD FS:

(AD FS) Feature	Windows Internal Database (WID)	SQL Server
Scalability	Limited to five servers in the farm	No limitation
High Availability	built-in “replication” mechanism	Needs SQL cluster
Adv. features	Not available	SAML artifact resolution & SAML/WS-Federation token replay detection

As you can see, there are only small differences. Obviously, if you need some of the advanced features you’ll only have one option: SQL. On the other hand, ADFS & Office 365 does not use any of these advanced features leaving the WID also as a valid choice.

So, the question one could ask himself is: “What database type do I need to use?”. I’ve come across some articles over the past few months that seem to slightly favor SQL over the WID. The question, in my opinion is rather: “Do I really need to use a SQL database”? The answer depends somewhat on your personal preference but mostly comes down to some parameters that you can use to outweigh one choice against the other. When comparing both options, I usually cannot find a single persuasive argument why choosing SQL server over the Windows Internal Database is justified. Of course, there’s the argument of centralized management, so-called better performance, easier backup etc.

To justify my statement, let’s evaluate some of the claims against the Windows Internal Database.

1. Deployment, Management and High Availability

When using SQL, all your ADFS servers will be connecting to a central database. Essentially this means you only have to manage a single database instance. However; if you want to have some sort of high-availability, you’ll have to defer to clustered SQL servers. This not only leads to more servers, but also to an increased complexity (although I’m sure there are some SQL-guys out there that disagree with me right now). If you’re using a WID, High Availability comes somehow built-in into the product. The first AD FS server that you install will automatically become the “primary” server. Any subsequent AD FS server that you add to the farm will start replicating changes from the primary configuration database. This is an automatic process that polls for changes every 5 minutes:

It goes without saying that it requires a lot less effort setting up and configuring an AD FS farm based on the WID: it happens automatically. Moving from the WID to SQL is supported, but requires you to reconfigure each AD FS server. More information on that process can be found here: http://social.technet.microsoft.com/wiki/contents/articles/948.ad-fs-2-0-migrate-your-ad-fs-configuration-database-to-sql-server.aspx

2. Better performance

The AD FS Design guide cites that SQL could be used to achieve a better performance. The reasoning behind it is that when using the WID, you’re actually using a tiny local SQL database which consumes more resources on the AD FS server and moving this database off the server to a dedicated SQL server will save you some of these resources. Although I do understand the logic behind it, I think we should put it into perspective.

According to the AD FS 2.0 Capacity Planning Sizing Spreadsheet, a single AD FS server can easily service up to multiple thousands of users:

It should be noted that these recommendations were obtained through tests with a dedicated SQL server. However; the same page also describes the following:

It states that the load on the SQL server was – even when the AD FS server(s) were under high pressure – never really very high. From personal test, I have not seen any significant load on the SQL server either. The leads me to conclude that even when an AD FS server is under load, modern servers are more than capable of handling the additional load a WID might put on the AD FS server. I’m currently running some benchmarks to spot noticeable differences in AD FS performance between a WID or SQL; however the results have not been conclusive so far.

3. Backup

This is perhaps the one point where the WID definitely lacks behind SQL. In the event of a failure of your primary federation server, your only option is to restore that “primary” configuration database, reactivating the replication between the different members of the federation server farm. Until the database is back up and running, you will not be able to make any changes to your farm’s configuration. This automatically means that you have to take backups of your primary federation server (system state) at least every time you make a configuration change. Compared to the backup process of SQL (daily full or event incremental) you might have going on, this is definitely an additional effort (and one you cannot allow yourself to ignore!). Furthermore, in case you are using SQL there is no “primary” federation server: a failed server can easily be replaced by adding a new member in the farm.

Conclusion

Despite the limitations and some of the inconveniences that come with the Windows Internal Database, to me it’s the easier and my first choice when deploying an AD FS server farm. I’m not saying that using SQL is a bad idea; I just don’t see the point in the additional effort you need to put in the configuration and management unless you need the advanced features or are required to scale out beyond 5 servers. Unless Microsoft brings out some (better) guidance towards the choice of the database which explicitly explains why you should use SQL over the WID, I’ll stick with the WID.

As always: Please, feel free to comment.

Cheers!

Michael

Office 365 Shared Mailbox Tool

Michael Van Horenbeeck — Tue, 27 Mar 2012 08:48:59 GMT

Yesterday, a handy tool was published on the Office 365 forums which allows you to easily create a shared mailbox using a simple GUI. The tool is entirely based on PowerShell:

The zip file, which you can download from here, contains two files:

StartSharedMailboxTool.bat
SharedMailboxTool.ps1

You use the bat-file to launch the GUI. Upon execution, you will be asked to login into your Office 365 Tenant. The rest is self-explanatory.

If you need more information, have a look at the following pages:

Cheers!

Michael

Microsoft cuts prices on Office 365 subscriptions up to 20%

Ruben Nauwelaers — Thu, 15 Mar 2012 06:56:00 GMT

Yesterday (american time) Microsoft announced on it's office 365 blogs that prices on Office 365 subscriptions are lowered. For some plans the price change is as high as 20% and in effect immediately for new and existing customers.

Quote from the original post:

As we rapidly add customers, the cost to run Office 365 becomes more efficient. This is the beauty of the cloud where we can deliver economies of scale through our worldwide data centers and economies of skill with our engineers, administrators, and support teams operating the service.

With these efficiencies, we're able pass on savings to make it even more affordable for customers of all sizes to move to Office 365. So, I'm thrilled to announce that we're lowering the prices of most of our Office 365 for enterprise plans by up to 20%. These changes are effective today at Office365.com for new and renewing direct customers.

We are also excited to make pricing changes to Office 365 for education. In line with our longstanding commitment to education, we will make our "A2" service plan free to not only students, but also to faculty and staff. A2 includes the core capabilities of Exchange, SharePoint, and Lync and the Office Web Applications. Exchange Online and Lync Online are available today for academic institutions, and we'll launch the full Office 365 for education service starting this summer.

I think this is a great example of how cloud is all about efficiency and that Microsoft is ready to reward it's customers for choosing Office 365!

Video: Use TMG to publish ADFS with a single external IP Address

Michael Van Horenbeeck — Fri, 09 Mar 2012 08:04:09 GMT

A while back, I wrote an article about how to create a home lab for Office 365 in which I also talked about publishing ADFS through a TMG. I created this video to accompanu that article by giving a bit more information on the publishing part and going through the setup step-by-step.

Enjoy!

Migrate from an on-premise Blackberry Enterprise Server to Blackberry Business Cloud Services in Office 365

Michael Van Horenbeeck — Thu, 08 Mar 2012 21:04:43 GMT

Introduction

Today, I “catched” a tweet from someone who was having trouble migrating from an on-premise Blackberry Enterprise Server to Office 365. He pointed out that there was no real documentation on how to actually perform the switch. So, I decided to write a small article describing what’s involved with the switch and what steps you need to take (if any at all).

What to do?

First of all, I would like to point out that moving from an on-premise BES to Office 365 is actually fairly easy. Once you’ve setup the BB Business Cloud Service for your tenant, you will notice that the online administration portal is pretty much the same as the on-premise version. This make sense since the hosted version is no more (actually no less) than the same Blackberry Enterprise Server you are running in your own environment:

Obviously – as is the case with hosted services – the portal has been stripped from any options that might affect the server on which the service is running.

Logically, before you can start moving your users you will have to add them as a blackberry user. I will not go through the steps, as I have already documented that in another article:

http://www.pro-exchange.be/blogs/office365/archive/2011/12/04/blackberry-amp-office-365-a-first-look.aspx

Let’s assume that you’ve already configured a blackberry user. What you have to do next is to set a new activation password. This will allow you to (re)run an Enterprise Activation from your Blackberry Device.

Now all that you have left to do is to take the user’s device, and perform a new Enterprise Activation. There is no real requirement to wipe the device before doing so. Normally, you shouldn’t encounter any problems but occasionally (I only encountered it once) the Enterprise Activation might fail. If that’s the case, you can re-try but in the end (and that’s what I had to do) you’re probably looking at wiping the device and doing an Enterprise Activation afterwards.

If you need help on the Enterprise Activation part or how to wipe a device, have a look at these pages:

So, as promised: that was fairly easy, wasn’t it?

Cheers!

Michael

Relaying with Exchange Online: sometimes an unexpected endeavor

Michael Van Horenbeeck — Wed, 29 Feb 2012 23:31:19 GMT

Introduction

In a regular Exchange on-premise deployment, allowing some devices to relay is relatively simple: you have to manually add the “ms-Exch-SMTP-Accept-Any-Recipient” Extended Right to a receive connector which will then allow any application or device that connects through it to relay externally. Perhaps this is something you would want to do for large all-in-one devices (printer/scanner/copier) or other appliances that e.g. need to send alerting-emails to an external recipient. The connection that the device/appliance/application server/… makes to your Exchange Server is – usually – a plain, simple and unauthenticated SMTP connection on port 25 (no TLS).

For customers who are moving to Exchange Online, this scenario can potentially become a bit of a problem. Sometimes, it is possible that the device you are using to send emails from only offers limited configuration towards SMTP settings. The problem that I experience the most – so far – is the fact that the device cannot either change the port, does not support TLS or does not allow for authentication. Because allowing to relay has always been relatively simple in traditional on-premise deployments, it’s easily forgotten during the planning phase of an Exchange Online implementation. Office 365 (Exchange Online) requires you to make an authenticated connection over port 587 with TLS enabled. This could actually mean that devices which don’t support these options will not be able to relay. Fortunately, there’s a relatively simple solutions for this problem.

IIS to the rescue

Buried within IIS lies a SMTP service. We all know it because - as you might recall - prior to version 2007, Exchange relied on the same service for all SMTP communications. Enabling the SMTP service allows us to configure unauthenticated inbound SMTP connections and create authenticated outbound SMTP connections. Exactly what we were looking for! Since the service is relatively small, the overhead for the server on which you are running it should be fairly minimal. Nonetheless, the actual load largely depends on the amount of emails you are sending through it. So make sure that you think twice before adding the service to one or another server.

In this example, I’ll be installing the SMTP service on a regular Windows Server 2008 R2 and configure it to accept incoming connections on port 25. Afterwards I will configure the service to forward all incoming mails through port 587 to Office 365.

To install the SMTP Server service, run the following cmdlet from PowerShell:

Import-Module ServerManager

Add-WindowsFeature SMTP-Server

At the same time, the prerequisites for the SMTP-Server will also be installed:

Configuring the SMTP Service

Before configuring the service, there are two things that need to be dealt with:

Create a new Exchange Online user which will be used to send emails from
Get the SMTP Server information:

Open Outlook Web App and go to options

Click Accounts, My Accounts and then Settings for POP, IMAP and SMTP access

Write down the SMTP settings from the pop-up window

Now that we’ve completed step 1 and step 2, we can move on to the next steps:

In the IIS Manager, right-click the SMTP Virtual Server and select properties
Navigate to the Delivery Tab, click Outbound Connections, change the TCP port to 587 and confirm.
Click the Outbound Security button. Configure Basic Authentication and enable TLS Encryption.
Enter the Office 365 user’s credentials that you’ve created earlier.
Navigate to the Access Tab, open the authentication settings and verify that anonymous access is enabled
Depending on what devices you want to allow/block, change the Relay settings.
Now, expand the default SMTP Virtual Server, right click Domains and choose New > Domain:
Select Remote and click Next
In the name-field, type “*.com” and click Finish
Open the properties for the domain you just created and check “Allow incoming mail to be relayed to this domain” and
in the Route Domain field, enter the name of the mailbox server we retrieved earlier:
Click the Outbound Security button. Configure Basic Authentication and enable TLS Encryption.
Enter the Office 365 user’s credentials that you’ve created earlier.

That’s it! You’ve now configured your IIS server to accept mails without authentication or TLS and you will forward them to Office 365.

If you need your emails to be sent from different email addresses, you could create multiple Virtual SMTP Servers on the same server. However, you cannot have multiple Virtual SMTP servers listening on port 25 on a single machine at the same time. You therefore need to modify the SMTP for each additional virtual server. Once the SMTP Virtual Server is configured, the exact same configuration steps as above apply to configure it to allow relaying through Office 365.

Right-click the server node, select New > SMTP Virtual Server
Enter a name and click Next
Configure an IP address and click Next
Choose a home directory and click Next
Enter a default domain name and click Finish
Open the properties for the newly created Virtual SMTP server and click advanced on the General tab
Edit the configuration to use another TCP port. e.g. 27
Start the Virtual SMTP Server

Repeat the configuration steps (1-10) as described earlier. Only this time, use a different Office 365 (Exchange Online) account. Once that is done, all that is left is to modify the SMTP TCP port to 27 on all your devices that need to relay through this new virtual SMTP server.

Cheers!

Office 365 Identity Management & Federation session recording available on TN Edge

Michael Van Horenbeeck — Wed, 08 Feb 2012 21:20:52 GMT

The session recording of my webcast on Office 365 Identity Management & Federation is now available on TN Edge.

In this session I talked about Identity Management in Office 365 and went over the different steps from planning to implementing Identity Federation.

The sessions discussed some real-world scenarios in order to answer some common questions like:

What is AD FS and do I need it?
How will my user’s experience this Single Sign On?
Is it secure?
Does Microsoft need a copy of my AD?
…

You can download/view the recording from here.

Blackberry soon to go live (out of beta) in Office 365!

Michael Van Horenbeeck — Thu, 19 Jan 2012 13:47:19 GMT

Earlier this week, RIM announced – through an email to existing customers – that their service would go out of beta somewhere in the next few weeks.
There would be no change in support and the service would remain free. However; existing customers would be required to re-accept new terms and conditions.

At the moment, it’s not clear what changes will be made to the terms and conditions. My best guess is that changes will mostly involve service availability and support.
We’ll have to wait and see…

According to RIM, the move to the “general availability” should have no impact to the service. Nonetheless, I’ve had some customers complaining about intermittent connectivity lately…

To be continued!

Hereunder is the original statement by RIM:

Office 365 Beta Exams: my thoughts (and feelings)

Michael Van Horenbeeck — Wed, 18 Jan 2012 12:46:34 GMT

Hereunder you’ll find some of my thoughts (and feelings) on both Office 365 beta exams that I took earlier today.

I’m a UC guy and mostly busy with Exchange, Lync and Active Directory. Because I have been warned by some colleagues about the difficulty of the exam (http://thecloudmouth.com/2012/01/10/first-impressions-of-the-office-365-beta-exams/), I made sure to go through the SharePoint Online part at least one more time before taking a shot at the exam… And although I have been delivering quite some Office 365-ignite trainings for Microsoft, it did not get me very far…

Honestly said, this was one of the most difficult Microsoft exams that I took to date. But for some reason it doesn’t really surprise me. Not because I’ve been “warned”, but rather because Office 365 is really about more than a single product. It’s about Exchange, about Lync, about SharePoint and about the platform itself and you cannot expect Microsoft to lower their expectations towards certifications, just because more than one product is involved, can you?

I definitely agree with some of comments that I’ve read all over the net: you need at least one year experience with Office 365 in all of its aspects: Exchange, Lync, SharePoint, ADFS, … Just having a theoretical knowledge about it won’t get you there, you’ll need hands-on experience. The depth of some questions is crazy. But perhaps I just say that because I’m not really a SharePoint guy…

I guess that – if luck is on my side – the first exam (“deployment”) will be a PASS. The second one (“managing”) on the other hand, I flunked for sure.

For those out there that still need to take the exam: GOOD LUCK!

If you need some resources on SharePoint Online, I can certainly recommend the following page:

http://office.microsoft.com/en-gb/sharepoint-online-enterprise-help/sharepoint-online-planning-guide-for-office-365-for-enterprises-HA101988931.aspx?WT.mc_id=otc-c-corp-jtc-DPU-MVA_O365LyncSPDeploy

Assigning Application Impersonation permissions in Exchange Online (Office 365)

Michael Van Horenbeeck — Mon, 16 Jan 2012 09:46:10 GMT

Some 3rd-party applications require you to provide them with a user account that has got the permission to impersonate other user accounts. This is also the case whenever you use PowerShell e.g. whenever you try to make some changes to another user’s calendar (EWS).
This article will show you how to configure an account with such rights.

IMPORTANT Remember that you will have to connect to your Exchange Online environment first!

$session = New-PSSession –AllowRedirection –Authentication Basic –ConfigurationName Microsoft.Exchange –ConnectionUri https://ps.outlook.com/powershell –Credential (Get-Credential)

Import-PSSession $session

Granting permissions through Role Based Access Control (RBAC)

just as with Exchange On-Premise, the Application Impersonation permissions are granted through an existing Management Role, cleverly called “ApplicationImpersonation”:

In order to grant the permission, you need to create a new Management Role Assignment which will “bind” the Management Role to an account:

Executing the cmdlet will output a warning. In my experience, this warning can safely be ignored. However; if you experience any issues due to the warning it’s always a good idea to contact MS Online Support. Feel free to keep me posted if you ever encounter an issue.

Note: It is possible that – while executing the cmdlet - you will also get the following error:

This operation is not allowed for the organization with disabled customizations. To enable this operation, you need to execute Enable-OrganizationCustomization task first.

If that is the case, you will need to enable Organization Customization, by running the following cmdlet:

Enable-OrganizationCustomization

Office 365 Integration Module for Windows Small Business Server 2011 Essentials

Johan Delimon — Fri, 13 Jan 2012 11:13:00 GMT

The Office 365 Integration Module feature add-in for Windows SBS 2011 Essentials allows small businesses to seamlessly combine the cloud-based productivity tools of Microsoft Office 365 with Windows SBS 2011 Essentials. Windows SBS 2011 Essentials is a first-server solution designed and priced especially for small businesses that have limited access to professional IT resources. It provides a cost-effective and easy-to-use solution that helps protect data, organize and access business information from virtually anywhere, and support the applications needed to run a business. The joint technologies provide businesses with a simplified, easy-to-manage, and affordable hybrid solution that helps employees work more efficiently and businesses run more smoothly.

The Office 365 Integration Module for Windows SBS 2011 Essentials extends the features of the server Dashboard by providing seamless integration with Office 365 services. When you integrate Office 365 with the server, you can:

Subscribe to Office 365 or configure the server to use an existing subscription
Perform the following Office 365 account management tasks from the Dashboard:
- Create Office 365 accounts
- Assign new or existing Office 365 accounts to network user accounts
- Activate or deactivate Office 365 accounts
- Link your professional Internet domain to Office 365
- View usage status and other information about your Office 365 subscription
- Access your Office 365 management portal from the Office 365 page of the server Dashboard.

You can install and configure the Office 365 Integration Module at any time after installing Windows SBS 2011 Essentials.

More info & Download
http://www.microsoft.com/download/en/details.aspx?id=28566

Office 365 Service Health Dashboard is now tenant-aware!

Michael Van Horenbeeck — Thu, 12 Jan 2012 13:56:07 GMT

The Office 365 Health Dashboard can provide you with a quick overview of the overall service health status in Office 365. Until recently, the dashboard was scoped regionally, which meant that the provided health status was relevant for an entire geographical region.
Now, Microsoft rolled out an update to the Dashboard so that it is tenant-aware. This means that you will only see service status notifications if they are relevant to your tenant. In other words: if a server is impacted that has got nothing to do with your tenant, you won’t see any specific service warnings in the dashboard.

The original announcement can be found here: http://community.office365.com/en-us/b/office_365_technical_blog/archive/2012/01/07/the-office-365-service-health-dashboard-now-supports-per-tenant-service-status.aspx

Mail enable Office 365 SharePoint Library - 3rd Party Tool now in beta

Ruben Nauwelaers — Wed, 11 Jan 2012 15:18:00 GMT

MessageOps released a public beta of their MessageOps SharePoint Bridge - Office 365 Edition

This tool will copy incoming mail in an Office 365 mailbox to a SharePoint Library in Office 365. The tool allows you to create rules based on email addresses and keywords to filter the messages to be copied.

The application is currently in Beta, and free for everyone to try. Once released it will be free to existing MessageOps clients. Non MessageOps clients can purchase the application for a one time fee.

More information and download at the SharePoint Bridge - Office 365 Edition product page.

Source: Twitter (@ivcrieki)

Office 365 certification exams expected in April 2012

Ruben Nauwelaers — Wed, 11 Jan 2012 08:18:00 GMT

Certifications are a great way to verify and document your skills. To help you certify your Office 365 skills, Microsoft will be releasing two exams soon (expected in april 2012)

Exam 70-323: Administering Office 365 intended for IT professionals who administer Microsoft Office 365 in an environment that may include Microsoft Exchange, Microsoft Lync, and/or Microsoft SharePoint - link

Exam 70-321: Deploying Office 365 intended for consultants and IT professionals who plan and implement Office 365. This includes migrations to Office 365 (simple and hybrid deployments) - link

Source: Twitter and http://blogs.technet.com/b/lystavlen/archive/2012/01/11/want-to-get-certified-in-office-365.aspx