Implementing Microsoft Exchange Online with Microsoft Office 365 Course 10135 Module 13 Implementing Microsoft Exchange Online with Microsoft Office 365 Presentation: 85 minutes After completing this appendix, students will be able to: Describe the features of Microsoft® Exchange Online. Explain how to deploy Exchange Online. Explain how to implement Federated Delegation. Required materials To teach this module, you need the Microsoft Office PowerPoint® file 10135B_13.ppt. Important: We recommend that you use PowerPoint 2002 or a newer version to display the slides for this course. If you use PowerPoint Viewer or an earlier version of PowerPoint, all the features of the slides might not display correctly. Preparation tasks To prepare for this module: Read all of the materials for this module. Practice performing the demonstrations and the lab exercises. Work through the Module Review and Takeaways section, and determine how you will use this section to reinforce student learning and promote knowledge transfer to on-the-job performance. 1

Module Overview Introduction to Exchange Online Deploying Exchange Online Implementing Federated Delegation 2

Lesson 1: Introduction to Exchange Online What Is Office 365? Exchange Online Features Exchange Online User Subscriptions What Is Forefront Online Protection for Exchange? Exchange Online Deployment Scenarios

What Is Office 365? Office 365 is a suite of five Microsoft products that are available in an online version in the cloud Use Exchange email, calendar, and contacts with built-in functionality to help protect against virus and spam Use instant messaging, presence availability, and PC-audio, video conferencing and screen- sharing Create SharePoint sites without the need to set up a datacenter Use Office Professional Plus 2010 client applications Create, view, edit, and share Microsoft Office documents on the web Explain the different components of Microsoft Office 365. Mention that you do not need to subscribe to all services. You can select the services your organization requires. Focus your discussion on Lync® Online, SharePoint® Online, Office Professional Plus, and Office Web Apps because Exchange Online is described in the next topic. Question: What Office 365 services would you use in your company? Why? Answer: The answers may vary, but common scenarios are: You are currently considering Exchange Online to remove local Exchange servers in small branch offices. You might want to consider SharePoint Online for project collaboration between different companies without the need to setup a SharePoint site in the perimeter network. References Office 365 for Enterprise Service Descriptions http://go.microsoft.com/fwlink/?LinkId=207232 Office 365 website http://go.microsoft.com/fwlink/?LinkId=248384

Exchange Online Features Exchange Online provides the following messaging features: Migration and hybrid deployment Provide an overview of Exchange Online features available in Office 365. Mention that most of the Exchange Server 2010 features are available and some features such as the Exchange Control Panel management features are enhanced. Be sure to mention that Exchange Online: Supports only Microsoft Outlook® Web App, Outlook 2007 or newer, Entourage 2008 Exchange Web Services Edition, and Outlook 2011 for Mac. Does not support public folders and custom address lists. Reference Exchange Online Data Sheet http://go.microsoft.com/?linkid=9776008 Compliance and archiving Multiple management tools Enhanced web experience Advanced routing options Forefront Online Protection for Exchange Hosted voicemail with Unified Messaging

Exchange Online User Subscriptions The available Exchange Online user subscriptions are: Exchange Online Kiosk for mailbox size up to 500 MB Mention that the slide focuses on the Office 365 for Enterprise service plan. The Office 365 for small businesses service plan only provides the Exchange Online Kiosk level user subscription, making it the smallest service plan available for Office 365. Reference Exchange Online and Office 365 Feature Comparison http://go.microsoft.com/fwlink/?LinkId=251825 Exchange Online Plan 1 for 25 GB combined primary and archive mailboxes Exchange Online Plan 2 for 25 GB primary mailbox plus unlimited Personal Archives Exchange Online Kiosk is the most basic user subscription and includes only Outlook Web App or POP3 access to the mailbox Exchange Online Plan 2 includes advanced features such as legal hold and voicemail

What Is Forefront Online Protection for Exchange? Forefront Online Protection for Exchange is an antivirus and anti-spam service that is included with Exchange Online or can be purchased separately Describe the core capabilities available with Microsoft Forefront® Online Protection for Exchange. Note that Forefront Online Protection for Exchange is automatically included with an Exchange Online license. References Forefront Online Protection for Exchange Overview http://go.microsoft.com/fwlink/?LinkId=213770 Forefront Online Protection for Exchange Datasheet http://go.microsoft.com/fwlink/?LinkId=213771 Core Product Capability Description Edge Connection analysis (IP-based edge blocks) Reputation analysis Antivirus Protect businesses from receiving email viruses and other malicious code Multiple scan engines and heuristic detection Anti-spam Anti-spam filter can detect all types of spam before it reaches the corporate network Policy Policy rules to regulate email for compliance Forced TLS option for encrypted messages

Exchange Online Deployment Scenarios Choose the type of deployment that best fits your business needs PC PHONE WEB Consistent User Experience On-Premises Cloud Service Describe the available options: Exchange on-premises only, Hybrid Deployment, Exchange Online only. As time permits, you can start a discussion if students are already discussing this topic with their companies. Hybrid Deployment

Lesson 2: Deploying Exchange Online Course 10135B Lesson 2: Deploying Exchange Online Exchange Online Migration Options Migrating to Exchange Online Implementing a Hybrid Deployment What Is the Hybrid Configuration Wizard? Managing a Hybrid Deployment Exchange Online Management Tools 9

Exchange Online Migration Options IMAP Migration Supports wide range of email platforms Email only (no calendar, contacts, or desks) Cutover Exchange Migration Good for fast, direct migrations No server required on-premises Coexistence Staged Exchange Migration Allows staged migrations Hybrid Deployment Enables cross premises free/busy Smooth move- mailbox Automatic redirect of clients IMAP Migration Cutover Staged Hybrid Deployment Exchange 5.5 X Exchange 2000 Exchange 2003 Exchange 2007 Exchange 2010 Notes/Domino GroupWise/ Other IMAP migration Describe the four migration options available for Exchange Online. Be sure to highlight the differences between them. Also mention that the best practice is to use hybrid with migration, which allows you to use the Exchange Management Console and Exchange Management Shell to migrate mailboxes. Question: Which Exchange Online migration option would be suitable for a larger organization with 2000 mailboxes? Answer: Generally, you would either use staged migration or hybrid deployment. The major difference between these methods is that hybrid deployment requires at least Exchange Server 2010 Service Pack 1 (SP1) on-premises. Hybrid deployment is the preferred option. Exchange migration Coexistence with Exchange Rich coexistence with Exchange

Migrating to Exchange Online To migrate to Exchange Online: 1 Connect directory and message routing to Exchange Online This slide outlines the high-level migration process. It does not focus on a specific messaging system but show what you need to consider. Tell the students that as the first step it is always important to import all existing email addresses and ensure that message routing works. After migrating the mailboxes, you must point the Domain Name System Mail Exchanger (DNS MX) record to Exchange Online so that mail will flow to Exchange Online. 2 Migrate the mailboxes Switch the DNS MX record so that it points to Exchange Online 3 Finalize the migration and remove the old Mailbox servers 4

Implementing a Hybrid Deployment To connect Exchange On-Premises to Exchange Online: 1 Configure AD FS Provides centralized user management Provides single-sign-on and security policies These steps describe how to connect Exchange on-premises to Exchange Online. Mention that step 1 is only required if you want to provide single-sign-on (SSO) and centralized user management. You can mention that for step 3, you can run the Hybrid Configuration Wizard or configure the settings manually. However, the recommended way should be to use the wizard. Note: This topic focuses on Exchange Online and not Office 365; otherwise, the licensing topic would require a couple of pages of content to describe all of the available options. Question: Suppose you want to connect your Exchange Server organization to Exchange Online. What options would you configure and why? Answer: The answers will vary according to your organization size or situation, but as a best practice we recommend implementing Active Directory® Federated Services (AD FS), Directory Synchronization, and Federated Delegation together. If you, for example, do not implement AD FS, your users will need a second  login credential to log on to their Exchange Online mailboxes. 2 Implement Active Directory Synchronization Eliminates the need to manage users, groups and contacts in two locations Provides a unified GAL Simplifies user provisioning 3 Run Hybrid Configuration Wizard Enables hybrid deployment features such as mailbox-move, free-busy, MailTips, and so on

What Is the Hybrid Configuration Wizard? Use the Hybrid Configuration Wizard to configure your on-premises Exchange organization and Exchange Online for hybrid deployment The Hybrid Configuration Wizard configures the following: Allows you to enable/disable the following features: This topic is about the Hybrid Configuration Wizard available with Exchange Server 2010 Service Pack 2 (SP2). You should address that the purpose of this wizard is to ease the process to configure a hybrid deployment. Question: Is it required to use the Hybrid Configuration Wizard if you want to configure a hybrid deployment? Answer: No, it’s not a requirement. It’s recommended to use the Hybrid Configuration Wizard if you want to configure your on-premises Exchange to be a hybrid deployment, but you can also manually perform the steps that the wizard performs automatically. Federated Delegation Enable MRS proxy Add <domain>.mail.onmicrosoft.com to accepted domains Configure secure mail flow between premises Free/busy sharing Mailbox moves Message tracking MailTips Online archiving OWA redirection Secure mail

Managing a Hybrid Deployment A hybrid deployment is a complex configuration that needs monitoring to make sure all components work correctly Key areas to consider for a hybrid deployment: Make sure your Directory synchronization tool is reliably running Manage your users, distribution lists and contacts from your on-premises Exchange only Monitor message routing between on-premises and cloud Use monitoring software to monitor your Federated Delegation Regularly run Microsoft Remote Connectivity Analyzer to verify your configuration Monitor your middle-tier components This slide is about managing and monitoring a hybrid deployment to make sure it works correctly. You should mention that a hybrid deployment includes many potential points of failure such as the network, Internet. You need to make sure that all factors are considered in order to manage a hybrid deployment in the right way. Go through all the key areas you should consider in a hybrid deployment. Discuss their relevance and why they are important. Also discuss how you can monitor each area to prevent issues with it. Reference Microsoft Remote Connectivity Analyzer http://go.microsoft.com/fwlink/?LinkId=248382 On-Premises

Exchange Online Management Tools Microsoft Online Services Portal Exchange Control Panel Explain that there are many ways to administer Exchange Online. Exchange Online provides a fourth management tool—the Microsoft Online Services portal—that is not available with Exchange on-premises. Review the advantages and disadvantages of using the different tools. Reference Reference to Available PowerShell Cmdlets in Exchange Online http://go.microsoft.com/fwlink/?LinkId=213772   Exchange Management Console Exchange Management Shell

Lesson 3: Implementing Federated Delegation Course 10135B Lesson 3: Implementing Federated Delegation What Is Federated Delegation? Components Required for Federated Delegation How Federation Delegation Works for Exchange Online Configuring a Federation Trust Configuring Organizational Relationships and Sharing Policies 16

What Is Federated Delegation? Course 10135B What Is Federated Delegation? Federated Delegation uses standard federation technologies to establish trusted relationships between organizations Ask students if they are familiar with AD FS. If they are, mention that Federated Delegation is similar to ADFS in that it uses the same technologies to establish a federation trust, which you can use to establish secure connections between organizations. Federated Delegation differs from AD FS in that with AD FS two organizations establish a federation trust directly with each other, while with Federated Delegation the organizations establish a federation trust with the Microsoft Federation Gateway (MFG), which then acts as a trust broker between the organizations. Emphasize that organizations do not need to manage any user accounts on the MFG. All organizations need to do is establish the federation trust with the MFG. Federated Delegation: Requires Microsoft Federation Gateway as a trust broker Requires each organization to establish and manage its trust Is supported for all messaging clients 17

Components Required for Federated Delegation Course 10135B Components Required for Federated Delegation Federated Delegation requires: Federation trust with Microsoft Federation Gateway Mention that the steps for configuring a federation trust are described later in this section. Stress that you configure organization identifiers on the MFG, and that each organization must configure its organization identifier. The organization identifier can contain more than one domain name, which means that if an organization uses more than one SMTP domain, it can configure a single organization identifier with multiple domain names. Organization identifier that identifies which domains are available for federation Establishment of a organizational relationship with another federated organization to enable sharing of availability information. Sharing relationships that define the organizations with which your users will share data, and the type of data they can share 18

How Federation Delegation Works for Exchange Online Course 10135B How Federation Delegation Works for Exchange Online Microsoft Federation Gateway Use the slide to describe the information flow when an organization’s user invites another organization’s user to a meeting. Make sure that the user understands that Exchange Online is just another Federated Delegation, the same as another Exchange organization. Thus the example here can also be used for other federations. Also, remark that you can share Availability information, MailTips and track messages using delivery reports. Stress that only the Client Access server from Contoso.com needs to send a request to the Microsoft Federation Gateway. The Client Access server obtains a token from the MFG, and uses that token to authenticate the connection to the Adatum.com Client Access server. Both organizations must have a federation trust with the MFG so that the Adatum.com Client Access server will trust the security token. Emphasize that using HTTPS protects all communication across the Internet. Also, only the Exchange Web Services virtual directory on each organization’s Client Access server needs to be Internet accessible to enable the required traffic. Question: In your organization, what connectivity between the MFG and Exchange Online do you need to consider? Answer: You need to ensure that your Client Access servers have connectivity to the Internet−especially through TCP/IP port 443−so that they can communicate to the Microsoft Federation Gateway and to the Exchange Online Client Access server. Contoso.com Exchange Online 3 Client Access Server Client Access Server 4 7 2 Domain Controller 6 1 8 5 Domain Controller Mailbox Server 19

Configuring a Federation Trust Course 10135B Configuring a Federation Trust Before configuring a federation trust: When configuring the federation trust: Obtain a trusted certificate As you discuss this topic, consider opening the Exchange Management Console and showing the New Federation Trust wizard. You cannot actually create the federation trust, but you can show the wizard’s options. Emphasize the importance of meeting the prerequisites. The correct certificate must be installed on the server where you create the federation trust, and the Domain Name System (DNS) records must be configured before the trust is validated. Configure the authoritative domains Configure external DNS records Ensure the server has Internet access Ensure that the server has the certificate installed Provide the certificate thumbprint 20

Configuring Organization Relationships and Sharing Policies Course 10135B Configuring Organization Relationships and Sharing Policies Organization relationships determine the organizations you want to share information with, and what types of information you will share The key here is to understand the differences between an organization relationship and a sharing policy. Explain that an organization relationship is used to share information for everybody in anther organization such as Exchange Online, whereas a sharing policy creates just the allowance so users can share their mailbox information between organizational boarders with each other. As you discuss this topic, consider opening the Exchange Management Console and showing the wizards for creating new organizational relationships and sharing policies. You cannot actually create the objects without federation trust in place, but you can show the wizards’ options. Question: In your organization, what factors should you consider when defining your sharing policy? Answer: Answers will vary depending on the needs of your organization and the size of your organization. You should consider what types of information you want to share and which mailboxes will be able to share information. Depending on your organization’s policies, you may want only a small number of people to share information. Can be configured to allow free/busy, MailTips and message tracking using delivery reports to be shared between two organizations Sharing policies define which users can share information with other organizations, and what types of information those users can share Can be configured to allow calendar sharing including or excluding free/busy and contacts to be shared between users 21

Module Review and Takeaways Course 10135B Module Review and Takeaways Review Questions Common Issues and Troubleshooting Tips Tools Review Questions What Exchange Online Deployment Options do you have? You can use Exchange Online only, Exchange on-premises only and a hybrid deployment that includes a connection between your Exchange on-premises and Exchange online environments. What additional functionality will Forefront Online Protection for Exchange provide to your company? Forefront Online Protection for Exchange is an anti-virus and antispam software that scans your messages and cleans them when it finds some type of malicious software. What functionality does Federated Delegation provide? Exchange Federated Delegation provides you with the functionality to exchange information between two Exchange organizations such as your Exchange on-premises and your Exchange online tenants. You can exchange information such as free/busy information, MailTips, message tracking using delivery reports and more. When planning a hybrid deployment for your organization, what components do you need to consider implementing and what is their purpose? This is a question about the hybrid deployment requirements. You need to configure Active Directory synchronization using the Directory synchronization tool, you can implement Active Directory Federation Services (AD FS) 2.0 for single-sign on. You need to configure Federated Delegation in order to exchange information such as free/busy information or MailTips. To configure Federated Delegation you can also use the Hybrid Configuration Wizard available with Exchange Server 2010 SP2. You created a new mailbox in Office 365 and now your on-premises users complain that they cannot see the new mailbox? What can you do? You can do nothing as there is no way to synchronize your Office 365 mailboxes or accounts to your on- premises environment. Thus you need to delete, and re-create the mailbox in your on-premises AD DS by using the Exchange Management Console or Exchange Management Shell, and then allow directory synchronization to synchronize the mailbox to Office 365. This is the correct way to create the mailboxes. Common Issues related to a hybrid deployment Identify the causes for the following common issues related to a hybrid deployment.   Issue Troubleshooting tip Free/busy information is not available for mailboxes in the cloud when accessing the information of mailboxes that are stored on-premises. Make sure your certificates are working and autodiscover works from the Internet. Use Microsoft Remote Connectivity Analyzer to verify that Office 365 can contact your on-premises autodiscover record correctly. Moving mailbox between Exchange Online and on-premises fails. Make sure your on-premises database has all copies mounted and they are healthy. Especially if one of them is not healthy, the Mailbox Replication Service proxy

Notes Page Over-flow Slide. Do Not Print Slide. See Notes pane. Tools The following tools can be used to monitor and test a hybrid deployment. Tool Use for Where to find it Microsoft Remote Connectivity Analyzer Troubleshooting of your on-premises single-sign-on, Microsoft Exchange ActiveSync®, or Exchange Web Services http://go.microsoft.com/fwlink/ ?LinkId=248382 Test-FederationTrust Make sure the federation trust is working correctly. Exchange Management Shell Start- OnlineCoexistenceSync Start a manual Directory Synchronization to synchronize your AD DS with Office 365 immediately. Microsoft Online Directory Sync Shell 23

Course Evaluation Remind students to complete the course evaluation.