1. Exchange Hybrid: Deployment, best practices, and what’s new
4/27/2017 7:59 AM
Cloud Roadshow
Exchange Hybrid: Deployment, best practices, and what’s new
© 2014 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

2. Agenda Why Hybrid Hybrid Prerequisites History of the HCW
4/27/2017 7:59 AM
Agenda
Why Hybrid
Hybrid Prerequisites
History of the HCW
Tour of the new HCW
Improved error handling experience
© 2014 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

3. Why Exchange Hybrid 4/27/2017 7:59 AM
© 2014 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

4. Calendaring & Free/Busy
Microsoft Exchange
4/27/2017
Why Exchange Hybrid?
Address Book
User Experiences
Calendaring & Free/Busy
Messaging
Mail
Migrations
Exchange on-premises
MRS
Mailbox data
Office 365
© 2012 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

5. Hybrid benefits vs. other migration options
Microsoft Ignite 2015
4/27/2017 7:59 AM
Hybrid benefits vs. other migration options
Deployment Complexity
EASY
Really?
Hybrid
Cutover
Staged
DirSync/Identity Management
Hybrid Configuration Wizard, oAuth,MRS, ….
Auto profile updates
Batch Approach
Offboarding
Rich Coexistence
No Additional Servers
Cloud ID’s Only
OST Sync
All at Once…
DirSync needed
No 2010/2013
OST Sync
Batch Approach
Really?
End User Complexity
EASY
© 2015 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

6. Hybrid Prerequisites Have an Office 365 Tenant
4/27/2017 7:59 AM
Hybrid Prerequisites
Have an Office 365 Tenant
Add your domain to the Tenant (Contoso.com)
Ensure you have a third party Certificate on-premises
Ensure Exchange is properly deployed on-premises
Have Directory Synchronization activate and deployed
Ensure that you are running in a supported configuration
© 2014 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

7. Exchange Hybrid Wizard History
4/27/2017
Exchange Hybrid Wizard History 1 2 3 4 5 6
Exchange 2010 SP1
72 pages of documentation
Exchange 2010 SP2
HCW introduced
Exchange 2013
HCW with web-based UI
Exchange 2013
SP1
Exchange 2013
CU5
Exchange 2013
CU10 and 2016
Extremely complex and low adoption
Removed confusing requirements for additional domains: exchangedelegation and service.contoso.com
Greatly simplified transport configuration
Multiple exchange organizations now supported
Supports Exchange
2013 Edge
Native OAUTH and Gallatin Support
Office 365 HCW
© 2012 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

8. Hybrid Configuration Engine
Microsoft Exchange
Hybrid Configuration Engine
4/27/2017
Latest HCW Blob
Exchange Online
Step 1
Download the latest Hybrid Configuration Engine
Organization Level Configuration Objects
(Exchange Federation Trust, Organization Reclationship, Forefront Inbound Connector, & Forefront Outbound Connector)
Step 2
The Hybrid Configuration Engine reads the “desired state” stored on the HybridConfiguration Active Directory object.
Domain Level Configuration Objects
(Accepted Domains & Remote Domains) 1 4
Step 3
The Hybrid Configuration Engine connects via Remote PowerShell to both the on-premises and Exchange Online organizations.
On-Premises Exchange
Organization Level Configuration Objects
(Exchange Federation Trust, Organization Relationship, Availability Address Space, & Send Connector)
Step 4
The Hybrid Configuration Engine discovers topology data and current configuration from the on-premises Exchange organization and the Exchange Online organization. 5
EAC 3 4
Domain Level Configuration Objects
(Accepted Domains, Remote Domains, & Address Policies)
Hybrid Configuration Engine
Desired state
Topology & current configuration state
Execute configuration tasks
Step 5
Based on the desired state, topology data, and current configuration, across both the on-premises Exchange and Exchange Online organizations, the Hybrid Configuration Engine establishes the “difference” and then executes configuration tasks to establish the “desired state.” 5 2
Exchange Server Level Configuration
(Mailbox Replication Service Proxy, Certificate Validation, Exchange Web Service Virtual Directory Validation, & Receive Connector)
© 2012 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

9. What have we been doing Microsoft Office365 4/27/2017
Piloting of HCW changes is controlled
The latest and same version is used by all
What have we been doing
Supported on Exchange 2013 CU10 and 2016
Resolving the common upgrade issues (upgrade from 2010/2013)
Agility with future releases
HCW updates not tied to CU’s any longer
Improvements to OAUTH and Multi Forest
Better Diagnostics built in (HCW and other Troubleshooters)
Stand Alone HCW (New Web Based HCW)
HCW looks and feels familiar
© 2012 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

10. What does the new experience look like?

11. Stand Alone HCW Common Questions
Will I be able to run it on Exchange 2010?
Will I be able to run in on Exchange 2013?
Can I upgrade from Exchange 2010 to newer version?
Can I opt out of the new HCW experience?
Will I need to add any additional URL to my outbound proxy device?
Will running the Stand Alone HCW change any of my settings?

12. Entry Point

13. 4/27/2017
Welcome page
© 2015 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

14. Server detection page The configuration will be done from this server
4/27/2017
Server detection page
The configuration will be done from this server
We check local AD for a list of all Exchange servers and version (this is not a remote call)
1st see if the server we are on is running the latest version
2nd we look to see if a server in site is running the latest version
3rd we cross sight to connect to a random server running the latest version
You can manually override this logic
You can also specify 21v from this page
© 2015 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

15. 4/27/2017
Credential page
We do not force you to enter your on-premises credentials
You then just provide the cloud creds and we connect
© 2015 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

16. “Enable” Federation Trust page

17. Shared namespace page
We then show you a list of domains that are accepted in both on- premises and EXO
This is were you choose your shared domain

18. Domain Proof
We now copy just the string needed, no extra garbage

19. Mail Flow options Then you choose your familiar mail flow options
4/27/2017
Mail Flow options
Then you choose your familiar mail flow options
© 2015 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

20. Send and receive server selection
4/27/2017
Send and receive server selection
© 2015 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

21. Transport Certificate
We then show a list of valid certs..
Third Party Cert
SMTP Service Assigned
Installed properly on Exchange
Not Self Signed

22. Certificate field is empty
Certificate field is empty when running the HCW
Certificate not correctly installed
Required on selected CAS & MBX
CAS are used for Receive Connectors
MBX are used for send Connectors
Both need same cert installed, else HCW won’t show.
Third Party
Proper SAN
Assigned to SMTP Service
Private Key
Certificate requirements not met
Need access to CRL url over 80 from all servers
CRL Blocked

23. Namespace for on-premises

24. Ready to update

25. Scenario / Action Items
On the last page
Feedback
On Every Page
Scenario / Action Items
Error: Time Offset check on the on-premises server to get Federation to succeed
Usability: Scroll bar needed when on accepted domain page
Error: Improve the invalid TXT error experience
Error: Improve Error experience for Hybrid Domains
Error: Add information on certificates to show why it failed
Error: Improve error reporting around Autodiscover issues
Usability: remove server that are considered deleted objects from view in HCW

26. Improved Logging (1 of 2) Application version information
Log File location: %Appdata%\Microsoft\Exchange Hybrid Configuration
Improved Logging (1 of 2)
Application version information
Exchange versions and other information found that will be used by the wizard

27. SMTP certificate information from each server
Improved Logging (2 of 2)
SMTP certificate information from each server
Exchange versions and other information found that will be used by the wizard

28. Better error Handling Link to a Solution Link to log files
Link to open Shell with current credentials

30. Active Monitoring for HCW
2000+ HCW runs every day
Validation against multiple Regions and Datacenters
Detected 2 Incidents over the last year before ANY customers reported the problems
Detected a transient issue with Remote Powershell that are being fixed

31. 4/27/2017 7:59 AM
© 2014 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

32. MRS Enablement delays
The last portion of the legacy HCW enabled MRS Proxy
ERROR:Updating hybrid configuration failed with error 'Subtask Configure execution failed: Configuring organization relationship settings.Execution of the Set-WebServicesVirtualDirectory cmdlet had thrown an exception. This may indicate invalid parameters in your Hybrid Configuration settings. Unable to access the configuration system on the remote server. Make sure that the remote server allows remote configuration
This process ran a cmdlet Get-WebServicesVirtualDirectory
This added hours to the HCW often killing the HCW
This is the longest part of the Hybrid process
We have resolved this issue in the Office 365 HCW using the “- ADPropertiesOnly” switch with Get-WebServicesVirtualDirectory

33. Hybrid Upgrade issues We had issues upgrading Hybrid from 2010 to 2013
The solutions were to perform action like:
- rename Org Relationships
- rename Connectors for Mail flow
- Remove Hybrid configuration objects from ADSIEDIT
None of this was graceful and this is all addressed in the Office 365 HCW

34. Why are the logs so important?
Exchange Online
We use the logs to find our top problems
30% of our failures come from “execution failed: Creating Organization Relationships.”
The point is that we often see customer with Autodiscover configured properly but still fail to complete the HCW… 1
Get-FedInfo does a call to on-prem DNS for Autodiscover.contoso.com 2
If there is no DNS record internally we could fail to complete HCW 3
What if we used External DNS as well? 3
“execution failed: Creating Organization Relationships.”
On-premises 1
Exchange On-Premises