1. Configuring Hybrid Exchange the Easy Way
4/19/2017 5:55 PM
EXL303
Configuring Hybrid Exchange the Easy Way
Ben Appleby
Senior Program Manager
Microsoft Corporation
© 2007 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

2. Session Objectives and Takeaways
TechReady 14
4/19/2017
Session Objectives and Takeaways
Session Objective(s):
Understand how the Hybrid Configuration Engine works
Understand the common pitfalls when configuring hybrid, and how to avoid them
Dependencies are key. You must have your certificates, DNS names, etc. working before you attempt to configure hybrid. Otherwise, it’s going to be harder than necessary.
© 2012 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

3. Agenda Migration options Hybrid overview
The new SP2 deployment process
How does the Hybrid Configuration Wizard work?
Common deployment pitfalls

4. Office 365 Migration Options Choices to fit your organization
IMAP migration
Supports wide range of platforms
only (no calendar, contacts, or tasks)
Cutover Exchange migration (CEM)
Good for fast, cutover migrations
No server required on-premises
Staged Exchange migration (SEM)
Identity federation with on-premises directory
IMAP migration
Cutover migration
Staged migration
Hybrid
Exchange 5.5 X
Exchange 2000
Exchange 2003
Exchange 2007
Exchange 2010
Notes/Domino
GroupWise
Other
Migration
Hybrid deployment
Manage users on-premises and online
Enables cross-premises calendaring, smooth migration, and easy off-boarding
Hybrid
* Additional options available with tools from migration partners

5. How to pick an Exchange migration solution?
Hybrid
Migration Solutions
S-EM
C-EM
, ,000
Organizational Size in Users
<1 Week Weeks Weeks Several Months
Time For Migration including Planning
None Mailflow/GalSync Free/Busy, Archive in Cloud
Features

6. Hybrid Staged Exchange Migration vs Hybrid Feature-set
TechReady11
4/19/2017
Hybrid Staged Exchange Migration vs Hybrid Feature-set
Feature
Staged
Hybrid
Mail routing between on-premises and cloud (recipients on either side) 
Mail routing with shared namespace (if desired) on both sides
Unified GAL
Free/Busy and calendar sharing cross-premises
Mailtips, messaging tracking, and mailbox search work cross-premises
OWA Redirection cross-premise (single OWA URL for both on-premises and cloud)
Exchange Online Archive
Exchange Management Console used to manage cross-prem relationship & mailbox migrations
Native mailbox move supports both onboarding and offboarding
No outlook reconfiguration or OST resync required after mailbox migration
Online Mailbox Move allows users to start logged into their mailbox while it is being moved to the cloud
Secure Mail ensure s cross-premises are encrypted, and the internal auth headers are preserved
Centralized mailflow control, ensures that all routes inbound/outbound via On Premises
© 2010 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

7. Hybrid Feature summary
TechReady11
4/19/2017
Hybrid Feature summary
Makes your on-premises organization and cloud organization work together like a single, seamless organization
Offers near-parity of features/experience on-premises and in the cloud
Seamless interactions between on-premises and cloud mailboxes
Migrations in and out of the cloud transparent to end-user
Features not supported:
Coexistence of mailbox permissions –Permissions are migrated, but do not work when Delegator and Delegate are split between on-prem & cloud
Migration of Send As for non mailbox recipients
Multi-forest – Only single forest source environments
Public Folders
Address Book Policies
© 2010 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

8. with paid Exchange Online subscription
Hybrid Server Roles
2 Required Server Roles:
Office 365 Active Directory Synchronization
Exchange Server 2010 SP1 CAS/Hub*
FREE!
with paid Exchange Online subscription
1 Optional Server Role:
Active Directory Federation Services
Office 365 Directory Sync
Unified Global Address List
Single Sign On
AD FS
Exchange Sharing
Mailbox Move
Secure Transport
Exchange Server 2010 SP1 CAS/Hub
Exchange Server 2010 SP1 CAS/Hub
* Mbx role is required for legacy Public Folder based free/busy support

9. Exchange Deployment Assistant
TechReady13
4/19/2017
Exchange Deployment Assistant
Exchange Deployment Assistant
Currently supports hybrid configuration with:
Exchange Server 2003
Exchange Server 2007
Exchange Server 2010
Guidance provided is for the Hybrid Configuration Wizard with Exchange 2010 SP2
© 2011 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

10. Hybrid Configuration Wizard
4/19/2017 5:55 PM
Hybrid Configuration Wizard
The new SP2 Process
© 2007 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

11. What’s new in Exchange 2010 SP2?
Coexistence Domain – Replaces the requirement for the customer to create a “service.contoso.com” domain
Federation Trust improvements – Removes the requirement to create a “exchangedelegation.contoso.com” domain
SP2 automatically prepends a well know string (“FYDIBOHF25SPDLT”) to the beginning of the account namespace.
Dedicated hybrid management experience
Hybrid Config Wizard
New/Get/Set/Update-HybridConfiguration cmdlets
The wizard & cmdlets will configure the following things for you:
Exchange federation trust
Organization relationships
Remote domains/accepted domains
address policies
Send/Receive connector
Forefront inbound/outbound connectors
MRSProxy
Pre-req checks (i.e. Office365 Active Directory Sync, Exchange certificates, registered custom domains, etc…)
Pre-SP2: Over 50+ manual steps
With SP2: Now only 6 steps, all within the UI

12. SP2 Hybrid Deployment Process
Sign up for Office 365
Register your domains with Office 365
Deploy Office 365 Directory Sync
Install Exchange 2010 SP2 CAS & HUB Servers
Publish the CAS & Hub Servers
(Assign SSL certificate, firewall rules)
Run the Hybrid Wizard
Use the Exchange
Remote Connectivity Analyzer
to verify this stage

13. The new Hybrid Configuration Wizard
New organization level tab that contains a the “Hybrid Configuration Object”
End to end wizard that guides you through each step of configuring hybrid

14. Hybrid Configuration Wizard
4/19/2017 5:55 PM
demo
Hybrid Configuration Wizard
© 2007 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

15. How does the Hybrid Configuration Wizard work?
4/19/2017 5:55 PM
How does the Hybrid Configuration Wizard work?
© 2007 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

16. The Wizard & the Configuration Engine
Update-HybridConfiguration
The Wizard records the information collected from the user via the “Set-HybridConfiguration” cmdlet
All deployment actions are taken by the Hybrid Configuration Engine, which is called by the Update-HybridConfiguration cmdlet

17. Hybrid Configuration Engine
TechReady 14
4/19/2017 5:55 PM
Hybrid Configuration Engine
EXCHANGE ONLINE ORGANIZATION
The Update-HybridConfiguration cmdlet triggers the Hybrid Configuration Engine to start.
Step 1
ON-PREMISES EXCHANGE ORGANIZATION
Exchange Server Level Configuration
(Mailbox Replication Service Proxy, Certificate Validation, Exchange Web Service Virtual Directory Validation, & Receive Connector)
Domain Level Configuration Objects
(Accepted Domains, Remote Domains, & Address Policies)
Organization Level Configuration Objects
(Exchange Federation Trust, Organization Relationship, Availability Address Space, & Send Connector)
Organization Level Configuration Objects
(Exchange Federation Trust, Organization Relationship, Forefront Inbound Connector, & Forefront Outbound Connector)
Domain Level Configuration Objects
(Accepted Domains & Remote Domains)
The Hybrid Configuration Engine reads the “desired state” stored on the HybridConfiguration Active Directory object.
Step 2
The Hybrid Configuration Engine connects via Remote PowerShell to both the on-premises and Exchange Online organizations.
Step 3
INTERNET
The Hybrid Configuration Engine discovers topology data and current configuration from the on- premises Exchange organization and the Exchange Online organization. 4 5
REMOTE POWERSHELL
Step 4
Hybrid Configuration Object 2 5
Desired State
Topology & Current Configuration State
Execute Configuration Tasks
REMOTE POWERSHELL
Based on the desired state, topology data, and current configuration, across both the on- premises Exchange and Exchange Online organizations, the Hybrid Configuration Engine establishes the “difference” and then executes configuration tasks to establish the “desired state.”
Exchange Management Tools 1
Step 5 4
Hybrid Configuration Engine
© 2012 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

18. Organization Relationship Creation
MICROSOFT FEDERATION GATEWAY
PUBLIC DNS
ON-PREMISES EXCHANGE ORGANIZATION
EXCHANGE ONLINE ORGANIZATION
Exchange 2007
Client Access Server
Exchange 2007
Mailbox Server
(3) Then connects to autodiscover via HTTPS with the MFG delegation token
“POST /Autodiscover/Autodiscover.svc/WSSecurity”
Exchange Online
Mailbox Server
(2) It then attempts to find the autodiscover endpoint through DNS
(1) Get-FederationInformation requests a delegation token from the MFG over HTTPS
Exchange 2010
Client Access Server
Exchange Online
Client Access Server
C:\Get-FederationInformation –DomainName “contoso.com”
(4) Client Access Server responds with Federation Trust details:
ApplicationUri: FYDIBOHF25SPDLT.contoso.com
DomainNames: contoso.com
TargetAutodiscoverEpr:
TokenIssuerUris: urn:federation:Microsoft Online
Hybrid Configuration Engine
REMOTE POWERSHELL

19. Hybrid Mail Flow – w/o Centralized Transport
External Recipient”
The Exchange Send Connector” is scoped to the coexistence domain (e.g. “contoso.mail.onmicrosoft.com”
The FOPE Inbound Connector is scoped to the public IP addresses entered in the HCW
ON-PREMISES EXCHANGE ORGANIZATION
ForeFront Online Protection for Exchange
Third Party Security System
Internal Mail Flow
Exchange Hub Transport Server
The FOPE Outbound Connector is scoped to the domains selected in the HCW (e.g. “contoso.com”), and it will deliver to the FQDN entered in the HCW (e.g. “mail.contoso.com”)
The Exchange Receive Connector is scoped to FOPE’s public IP addresses

20. Hybrid Mail Flow – with Centralized Transport
External Recipient”
The FOPE Inbound Connector is scoped to the public IP addresses entered in the HCW
This connector is marked so that all inbound to the tenant must be delivered through it
The Exchange Send Connector” is scoped to the coexistence domain (e.g. “contoso.mail.onmicrosoft.com”
ON-PREMISES EXCHANGE ORGANIZATION
ForeFront Online Protection for Exchange
Third Party Security System
Internal Mail Flow
Exchange Hub Transport Server
The FOPE Outbound Connector is scoped to all domains (e.g. *.*), and it will deliver all outbound to the FQDN entered in the HCW (e.g. “mail.contoso.com”)
The Exchange Receive Connector is scoped to FOPE’s public IP addresses

21. Common Deployment Issues – Publishing CAS
Autodiscover is not published correctly
The external public DNS record for primary smtp domains must resolve to an Exchange Server 2010 SP1+ Client Access Server
The CAS server must have a public SSL certificate bound to it
The certificate must include the autodiscover DNS name within the Subject or SAN
Pre-authentication is used in front of the Client Access Server
If using pre-authentication, the following URLs must be excluded and allow anonymous connections:
/EWS/Exchange.asmx/WSSecurity
/EWS/MRSProxy.svc/WSSecurity
/Autodiscover/Autodiscover.svc/WSSecurity
/autodiscover/autodiscover.svc
SSL Off loading is being used in front of CAS
Enabled in Rollup1 and guidance published to TechNet here

22. Common Deployment Issues – Mail Flow
Third party SMTP security devices in use between Exchange on-premises and ForeFront Online Protection for Exchange
TLS connection between Exchange on-premises and FOPE, for internal mail flow, must initiate/terminate on 2010 SP1+ Hub Transport or Edge Transport
MX record is pointed to FOPE with Centralized Transport Control enabled
This scenario only works if FOPE was already in use prior to creating the Office 365 tenant
Wildcard certificate used for TLS
Rollup1 enables support for wildcard certificates

23. Recap Session Objective(s):
TechReady 14
4/19/2017
Recap
Session Objective(s):
Understand how the Hybrid Configuration Engine works
Understand the common pitfalls when configuring hybrid, and how to avoid them
Dependencies are key. You must have your certificates, DNS names, etc. working before you attempt to configure hybrid. Otherwise, it’s going to be harder than necessary.
© 2012 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

24. Exchange Sessions this week
EXL301 Archiving in the Cloud with Exchange Online Archiving (EOA) – Thursday 08:30 – Hall 10B
EXL306 Best Practices for Virtualizing Microsoft Exchange Server 2010 – Thursday 12:00 – Hall 9B
EXL401 Microsoft Exchange Server 2010 High Availability Deep Dive – Thursday 16:30 – Hall 9A
EXL201 Understanding Microsoft Forefront Online Protection for Exchange – Friday 08:30 – G106
EXL307 Using a load balancer in your Exchange 2010 environment – Friday 13:00 – Hall 9B

25. Track Resources
Exchange Team Blog:
Exchange TechNet Tech Center:
Geek Out with Perry Blog:
MEC Website and Registration:

27. Resources Learning TechNet http://europe.msteched.com
Connect. Share. Discuss.
Microsoft Certification & Training Resources
TechNet
Resources for IT Professionals
Resources for Developers

28. Submit your evals online
4/19/2017 5:55 PM
Evaluations
Submit your evals online
© 2007 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

29. 4/19/2017 5:55 PM
© 2012 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.
© 2009 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

30. 4/19/2017 5:55 PM
© 2009 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.