Exchange Hybrid Integration with Office 365

Before Starting the process of implementing the integration, you must consider using some tools to see if your environment has no issues.

First you must use this tool IdFix check the active directory for any possible issues when installing Dirsync and synchronizing users and their objects to the cloud.

IdFix is used to perform discovery and remediation of identity objects and their attributes in an on-premises Active Directory environment in preparation for migration to Office 365. IdFix is intended for the Active Directory administrators responsible for DirSync with the Office 365 service.

http://community.office365.com/en-us/w/diagnostic_tools/default.aspx?ss=465d14b0-c5fe-4bbf-84d2-c791113732e2#idfixdirsyncerrorremediationtool

1. To prepare Exchange for hybrid configuration with Exchange Online you need to prepare the following steps.

• Add your Primary SMTP domain to Office 365 cloud and verify ownership of the domain.
• Create your online users.
• Install DirSync http://go.microsoft.com/fwlink/?LinkID=278924

http://technet.microsoft.com/en-us/library/jj151800.aspx#BKMK_InstallDirSyncTool

• Install ADFS (Optional) for SSO (To authenticate users from Local AD)

Note about ADFS:

ADFS can be the reason of so much headache and it’s always better to avoid installing it, instead of using ADFS to use the same password for users on a large scale deployments, the Dirsync can Synchronize local Passwords to Azure AD and same password can be used for both users local and online.

1. Create an enterprise admin user account on the domain for DirSync service
2. Installation of Dirsync with Password synchronization: We prepare a separate server for the DirSync tool that is windows 2008 R2 SP1 or 2012 R2 installed and the server

should be domain joined in order to reach Active Directory.

1. The account used with Dirsync should be member of the domain admin. Also you need to have the admin credentials for the tenant that you signed up to on O365.

http://technet.microsoft.com/en-us/library/jj151831.aspx

Next again

Click Next after selecting the proper location

While installing I had an error saying that current user was not member of the Synchronization Engine FIMSyncAdmins group.

I tried uninstall DirSync but it it gives the same error message

The FIMSyncAdmins group is a local group on the server. Your user is not a member of that group locally. Try adding your user to the group.. after adding the user to the required group the installation were completed successfully.

First you need to make sure that your customized (personal) domain is active.

Now we need to enable Dirsync from the portal, next to Active Directory ® Synchronization Click on Set up and activate DirSync.

Now click on Activate

Now after we made sure that our domain is active and we activated Dirsync on Office 365 portal let’s Go back to DirSync server to complete the steps and check if we can start syncing your Active Directory.

Type your enterprise admin user which you have prepared for Dirsync, for my case I’m just going to use the domain admin user since it’s a Lab.

Make sure you Enable Hybrid Deployment since Azure active directory will modify objects in your on-premises AD.

In case you would want to have your On-premises AD password for users synchronized with users on Office 365

then you must tick the option as in the below snapshot.

Here, When I click next I get an error as following:

Error:

The new version of Dirsync doesn’t accept the domain admin account.

Solution:

In order to resolve the problem you have to create a new user account with enterprise admin privileges

Use this account to connect to AD during config.

Here I created the new user and added the required groups.

After using the new account there was no issue with the setup and I could complete the configuration successfully.

Once the configuration finished you will be able to find event ID 611 in the logs.

Now checking Office 365 portal, I can see that users have been synced to the Office 365 portal:

Now let’s go to the Exchange On-Premises server, and before starting the HCW on Exchange on-premises you will have to do three main steps:

1. Make sure Autodiscover is set
2. Make sure WSSecurity is set to true.
3. Make sure that’s MSProxy is set to True.

You need to make sure that Autodiscover URL on autodiscover virtual directory is set for internal and External. To do so first check the current configuration by using the following commands.

Get-autodiscovervirtualdirectory | fl

If the Internal and external Autodiscover urls are not set then set them using the following command line.

Set-AutodiscoverVirtualDirectory -Identity ‘autodiscover(default Web Site)’ Internalurl https://internalfqdn.domain.com/autodiscover/autodiscover.xml

Set-AutodiscoverVirtualDirectory -Identity ‘autodiscover(default Web Site)’ Externalurl https://mail.domain.com.com/autodiscover/autodiscover.xml

From <http://technet.microsoft.com/en-us/library/aa998601(v=exchg.150).aspx>

Now we have to enable the wssecurity and mrsproxy since both of them are not enabled by default in the virtual directory:

You can still check if you need to to make sure that it’s enabled or not by using the following cmdlet

Get-WebServicesVirtualDirectory -Server ExchangeHostName | fl

Now to enable the WebServices use the following cmdlet on Exchange Management shell

To enable the WSSecurity use the following CMDlet

Then use the command “Get-WebServicesVirtualDirectory -Server ExchangeHostName | fl” to see if the values have changed

I need to go to my Local exchange server and start the Hybrid process.

From Under MS Exchange on-premises we click on Organization Configuration after we add our trusted tenant domain to the Exchange server.

Click Next, and enter the credentials for your domain admin and tenant admin.

Click Next, Add enter the verified domain.

Click next, here you will need to press ctrl + C to copy the value and create this value as txt in your public DNS.

Click next once you verified that the value has been published and available on

Select the Mailbox, Client Access, Hub transport.

Here click Next again, below you will need to create a new A Name record in your public DNS that directs to your Inbound connector’s IP under ForeFront Online Protection and the FQDN e.g. “Mail.domain.com” under the outbound connector or place the SMTP gateway’s Public IP if you have it and create an A name in your public DNS that has the same IP .

In the following step, the snapshot shows the certificate which I have associated with my hub transport server however, this certificate is public certificate that’s brought from 3rd party.

Select the certificate and choose how you want to route your mail.

Click Manage, When clicking manage you might get the following error message

Summary: 2 item(s). 1 succeeded, 1 failed.

Elapsed time: 00:03:37

Set-HybridConfiguration

Completed

Exchange Management Shell command completed:

Set-HybridConfiguration -Features ‘MoveMailbox’,’OnlineArchive’,’FreeBusy’,’Mailtips’,’MessageTracking’,’OwaRedirection’,’SecureMail’,’CentralizedTransport’ -Domains ‘cloudimia.com’ -ClientAccessServers ‘EXCH01’ -TransportServers ‘EXCH01’ -ExternalIPAddresses ‘95.0.52.125’ -OnPremisesSmartHost ‘hybrid.cloudimia.com’ -SecureMailCertificateThumbprint ‘E2539EB2BE3BB5FFB56B5EF3BF4CB2017A645717’

Elapsed Time: 00:00:06

Update-HybridConfiguration

Failed

Error:

Updating hybrid configuration failed with error ‘Subtask Configure execution failed: Configure Mail Flow Execution of the Set-HybridMailflow cmdlet had thrown an exception. This may indicate invalid parameters in your Hybrid Configuration settings.

Connector validation failed: RouteAllMessagesViaOnPremises can be set to true only when there is at least one inbound connector of type OnPremises with AssociatedAcceptedDomains set to empty.

at Microsoft.Exchange.Management.Hybrid.RemotePowershellSession.RunCommand(String cmdlet, Dictionary`2 parameters, Boolean ignoreNotFoundErrors)

‘.

Additional troubleshooting information is available in the Update-HybridConfiguration log file located at C:\Program Files\Microsoft\Exchange Server\V14\Logging\Update-HybridConfiguration\HybridConfiguration_2_11_2014_15_9_37_635277281771541111.log.

Exchange Management Shell command attempted:

Update-HybridConfiguration -OnPremisesCredentials ‘System.Management.Automation.PSCredential’ -TenantCredentials ‘System.Management.Automation.PSCredential’

Elapsed Time: 00:03:31

As Microsoft Employee advises it’s better to use the internet instead. So we will go with this option and see what happens.

The general recommendation and default setting is not do this, but to deliver e-mail from Exchange Online to external recipients directly to the Internet instaed.

If it is no requirement, I advise you to skip that option.

From <http://community.office365.com/en-us/forums/156/t/202214.aspx>

And here we are done.

Looking at the Hub Transport, we can see that at remote domains we have new domains added automatically after the Hybrid Configuration.