Certificate configuring for exchange 2013 and office 365 hybrid deployment

Please advise on what digital certificate requirements for hybrid deployment and to configure it.

Hi sphilip,
If you want to deploy AD FS with Single Sign-On(SSO), we need use certificate to establish secure trust between on-premises Exchange 2013 and Office online.
We can use and configure a trusted third-part CA within all on-premises Exchange 2013 Mailbox and Client Access servers to ensure secure mail transport, more details about
Office 365 Hybrid Configuration Certificate Planning, for your reference:
http://blogs.technet.com/b/neiljohn/archive/2011/08/25/office-365-hybrid-configuration-certificate-planning-adfs-exchange-web-services-owa-oa.aspx
Best Regards,
Allen Wang

Similar Messages

What's the difference between SharePoint 2013 and Office 365 Team Sites?

Hi there,
What are the differences between SharePoint 2013 and Office 365 Team Sites?
If I would like to develop a professional corporate website with SharePoint technology (because the company allready uses Office 365), do you recommend using SharePoint 2013 (in the cloud) or Office 365 Team Sites? And why?
Thank you very much!

You cannot make SPO Team Sites anonymous-enabled, therefor they're a moot point for a public website.
While slightly out of date, take a look at this:
http://nikpatel.net/2013/01/17/new-sharepoint-2013-wcm-features-are-not-available-in-sharepoint-online-2013/
http://technet.microsoft.com/en-us/library/sharepoint-online-content-service-description.aspx
Trevor Seward
Follow or contact me at...
&nbsp&nbsp
This post is my own opinion and does not necessarily reflect the opinion or view of Microsoft, its employees, or other MVPs.

How to use Powershell to set delegate for user mailbox in Exchange 2010 and Office 365

Hello,
Can you please tell me if I can set delegate for user mailbox in Exchange 2010 or Office 365 using Powershell?
If I can, then how can I do that? (which Powershell commands for setting the delegate?)
Many thanks, and have a good day!

Hi,
If you wanted to add a delegate to possiblly a large number of users or you do this during mailbox provisioning. So the following script will use
impersonation to access another users mailbox and add a delegate.
$mbtoDelegate = "[email protected]"
$delegatetoAdd = "[email protected]"
$dllpath = "C:\Program Files\Microsoft\Exchange\Web Services\1.0\Microsoft.Exchange.WebServices.dll"
[void][Reflection.Assembly]::LoadFile($dllpath)
$service = new-object Microsoft.Exchange.WebServices.Data.ExchangeService([Microsoft.Exchange.WebServices.Data.ExchangeVersion]::Exchange2007_SP1)
$windowsIdentity = [System.Security.Principal.WindowsIdentity]::GetCurrent()
$sidbind = "LDAP://<SID=" + $windowsIdentity.user.Value.ToString() + ">"
$aceuser = [ADSI]$sidbind
$service.AutodiscoverUrl($aceuser.mail.ToString())
$service.ImpersonatedUserId = new-object Microsoft.Exchange.WebServices.Data.ImpersonatedUserId([Microsoft.Exchange.WebServices.Data.ConnectingIdType]::SmtpAddress,
$mbtoDelegate);
$mbMailbox = new-object Microsoft.Exchange.WebServices.Data.Mailbox($mbtoDelegate)
$dgUser = new-object Microsoft.Exchange.WebServices.Data.DelegateUser($delegatetoAdd)
$dgUser.ViewPrivateItems = $false
$dgUser.ReceiveCopiesOfMeetingMessages = $false
$dgUser.Permissions.CalendarFolderPermissionLevel = [Microsoft.Exchange.WebServices.Data.DelegateFolderPermissionLevel]::Editor
$dgUser.Permissions.InboxFolderPermissionLevel = [Microsoft.Exchange.WebServices.Data.DelegateFolderPermissionLevel]::Reviewer
$dgArray = new-object Microsoft.Exchange.WebServices.Data.DelegateUser[] 1
$dgArray[0] = $dgUser
$service.AddDelegates($mbMailbox, [Microsoft.Exchange.WebServices.Data.MeetingRequestsDeliveryScope]::DelegatesAndMe, $dgArray);
Hope this helps.

Exchange Server 2013 and Office 365 Integration

If we are using Exchange Server 2013 on premise, can we have 2 of our users integrated with Office 365 so that they can utilize their Exchange Server email account with the apps and features of Office 365?

Hi,
You can deploy a hybrid environment using Exchange 2013 CU2 or later version with Office 365.
Could you please tell me what do you mean by "we have 2 of our users integrated with Office 365 so that they can utilize their Exchange Server email account with the apps and features of Office 365"?
Here is my understanding: You create these two mailboxes on Exchange 2013, but you need to allow for redirection from the on-premises OWA environment to the Office 365 OWA. If that is your case, you need to specify a target URL for your organization(for
example, www.outlook.com/contoso.com). If I have misunderstood your concern, please let me know.
For more information, here is an article for your reference.
Plan an Exchange Online hybrid deployment in Office 365
http://technet.microsoft.com/en-us/library/hh852414.aspx
Hope it helps.
Best regards,
Amy Wang
TechNet Community Support

Certificate choices for Exchange 2013, ADFS and WAP

This question has now been 'moved' to Windows Security.
Can you please help me with certificate choices?
We currently have an Exchange 2013 server publishing OWA, EAS, etc. externally with ISA server and a DigiCert certificate on both servers. The certificate has multiple SANs. Everything is good.
We now want to ditch ISA server and use Microsoft’s Web Application Proxy with ADFS services and I’m looking to simplify the certificate requirements.
I read in the ADFS/WAP certificate requirements that the Subject name (CN) and the SAN entry need to be the same. If I changed the current certificate, I'm not sure whether it would break the Exchange certificate requirements.
So, can you tell me if I can switch to a single wildcard certificate and use it for all these services, i.e. Exchange, WAP and ADFS servers?
Thank you in anticipation,
Andy.

Hello,
you may ask this the Security experts in
http://social.technet.microsoft.com/Forums/windowsserver/en-US/home?forum=winserversecurity
Best regards
Meinolf Weber
MVP, MCP, MCTS
Microsoft MVP - Directory Services
My Blog: http://blogs.msmvps.com/MWeber
Disclaimer: This posting is provided AS IS with no warranties or guarantees and confers no rights.
Twitter:

DNS Configuration for Exchange 2013

I have a stand alone server 2012 with AD, DHCP, DNS and Exchange on it and started getting DDoS attacks
I installed a firewall had to change the subnet of the server from 10.0.0.0/24 to 192.168.1.0/24 and after re-configuring the Servers IP, DHCP and DNS found that I had no incoming email. (invalid Security Certificate)
I found that mail traffic was directed to the Router instead of Exchange and being rejected with the routers security certificate. I have since fiddled with the DNS so many times I don't know what is right and wrong
Anyone have any ideas where I have gone wrong what is in the tables that shouldn't be there and what is missing.
email address is user.mail.domain.com
Geotrust SSL Security Certificate is mail.domain.com autodiscover.domain.com server01.domain.com
**Forward lookup for domain.com
Same as parent SOA
[28]server01.domain.com, hostmaster.domain.com
Same as parent NS
server01.domain.com
Same as parent NS
ns1.domain.com
Same as parent NS
ns2.domain.com
Same as parent MX
[10]mail.domain.com
Same as parent MX
[20]mail.domain.com
server01 MX [10]mail.domain.com
Same as parent HostA
192.168.1.10
Same as parent HostA
139.130.XXX.YYY
server01 HostA
192.168.1.10
mail HostA 192.168.1.10
mail HostA 139.130.XXX.YYY
localhost HostA
127.0.0.0
Properties SOA ns1.domain.com 139.130.XXX.YYY
ns2.domain.com 139.130.XXX.YYY
server01.domain.com 192.168.1.10
**Forward lookup for mail.domain.com
Same as parent SOA
[1]server01.domain.com, hostmaster.domain.com
Same as parent NS
server01.domain.com
Same as parent HostA
192.168.1.10
Same as parent HostA
139.130.XXX.YYY
Properties of SOA server01.domain.com
192.168.1.10
**Reverse Lookup
1.168.192.in-addr.arpa
Same as parent SOA
[1]server01.domain.com, hostmaster.domain.com
Same as parent NS
server01.domain.com
Same as parent NS
ns1.domain.com
192.168.1.10 PTR
domain.com
192.168.1.10 PTR
mail.domain.com
OWA and Outlook 2013 work incoming and outgoing from within the subnet, both internal emails and external emails
But users off site can't log in to outlook 2013 and get blocked with OWA by invalid security certificate.
**Testconnectivity.microsoft.com results
autodiscover failed
resolved host domain.com successful with both correct IP addresses returned
Port 443 open
SSL Certificate incorrect it is the routers Certificate not the Geotrust certificate.
**This is the real issue, and I can't figure out why
Thanks Alan

Thanks Luke
Yes you are right , I get alternate WAN and LAN Ip addresses when I flushdns
I suspected I had additional entries ans/or wrong entries in the DNS Zones
i reformatted to show up in columns in the post
I hope you can point out which are wrong
**Forward lookup for domain.com
Same as parent----- SOA----[28]server01.domain.com, hostmaster.domain.com
Same as parent----- NS -----server01.domain.com
Same as parent----- NS -----ns1.domain.com
Same as parent----- NS -----ns2.domain.com
Same as parent----- MX -----[10]mail.domain.com
Same as parent----- MX -----[20]mail.domain.com
server01-------------- MX----- [10]mail.domain.com
Same as parent----- HostA --192.168.1.10
Same as parent----- HostA --139.130.XXX.YYY
server01-------------- HostA --192.168.1.10
mail --------------------HostA-- 192.168.1.10
mail --------------------HostA-- 139.130.XXX.YYY
localhost-------------- HostA --127.0.0.0
Properties SOA --ns1.domain.com 139.130.XXX.YYY
----------------------ns2.domain.com 139.130.XXX.YYY
----------------------server01.domain.com 192.168.1.10
**Forward lookup for mail.domain.com
Same as parent----- SOA------[1]server01.domain.com, hostmaster.domain.com
Same as parent----- NS--------server01.domain.com
Same as parent -----HostA---192.168.1.10
Same as parent -----HostA---139.130.XXX.YYY
Properties of SOA server01.domain.com
192.168.1.10
**Reverse Lookup
1.168.192.in-addr.arpa
Same as parent----- SOA-----[1]server01.domain.com, hostmaster.domain.com
Same as parent----- NS-------server01.domain.com
Same as parent----- NS-------ns1.domain.com
192.168.1.10-------- PTR------domain.com
192.168.1.10-------- PTR------mail.domain.com
do I need an autodiscover record?
I setup 2 forward lookup zones domain.com and mail.domain.com
From memory the mail.domain.com was for external access but I don't think that was how it turned out
Thanks

Migrating Exchange 2013 to Office 365 Transient Error

So I setup an Exchange Hybrid Environment in an attempt to migrate mailboxes to Office 365. I'm performing my first test migration and so far it's running, very slow but it's running. I keep seeing this error in the migration job and I'm guessing it's slowing
me down. I'm hoping someone can point me in the right direction as to what's causing this.
1/10/2015 2:28:37 AM [BN1PR05MB357] Transient error DataExportTransientException has occurred. The system will retry (1/60).
1/10/2015 2:29:55 AM [BN1PR05MB357] The Microsoft Exchange Mailbox Replication service 'BN1PR05MB357.namprd05.prod.outlook.com' (15.1.53.16 caps:1FFF) is examining the request.
1/10/2015 2:29:55 AM [BN1PR05MB357] Connected to target mailbox 'client.onmicrosoft.com\b00fdbce-03e6-4d85-ad21-28a8c60055c5 (Primary)', database 'NAMPR05DG023-db142', Mailbox server 'BN1PR05MB357.namprd05.prod.outlook.com' Version 15.1 (Build 53.0).
1/10/2015 2:29:56 AM [BN1PR05MB357] Connected to source mailbox 'client.onmicrosoft.com\b00fdbce-03e6-4d85-ad21-28a8c60055c5 (Primary)', database 'Mailbox Database', Mailbox server 'EX13.client.local' Version 15.0 (Build 995.0), proxy server 'EX13.client.local'
15.0.995.28 caps:017FFFFFCB07FFFF.
1/10/2015 2:29:58 AM [BN1PR05MB357] Request processing continued, stage LoadingMessages.
Vincent Sprague

Do you have any firewall appliance or TMG between Exchange Onpremises and Online? I've seen this issue multiple times with TMG.
http://technet.microsoft.com/en-us/library/dd441028.aspx, with other firewall appliances look for the same kind of configuration.
Also be sure you have enough resources (cores and memory) available.

Certificate errors with Exchange 2013 and Outlook 2013

Hello, I wonder if someone could help.
I've recently set up a network with one Windows 2012 domain controller and one windows 2012 server running Exchange 2013.
Clients run Outlook 2013 and are all one the same Lan. Outlook's setup wizard finds the exchange server automatically and sets up the profile. However if I choose the manual setup and enter the server
name and user name it does not find the server.
When I check the server name in Outlook it shows as
[email protected] rather than the real name of the server: AYCEX01.AYC.local.
When Outlook is opened there is a certificate error saying "The name on the security certificate is invalid or does not match the name of the site." and another error saying "There is
a problem with the server's security certificate. The name on the security certificate is invalid or does not match the name of the target site mail.ardfernyacht.co.uk. Outlook is unable to connect to the proxy server. (Error code 10)
The external address by which users connect to OWA and active sych is mail.ardfernyacht.co.uk. The
certificate which is used is one automatically generated by Exchange.
Any suggestions you may have would be appreciated.
Many thanks,
Ruaridh
Ruaridh Mackintosh

Self sign cert wont work With autodiscover.For that you need 3rd part or from Your own CA.
Please follow this guide to install CA in Your domain:
http://careexchange.in/how-to-install-certificate-authority-on-windows-server-2012/
Please follow this guide to request New cert in Exchange 2013:
http://exchangeserverpro.com/create-ssl-certificate-request-exchange-2013/
Your cert must contain external hostname of Your mail.domain.com
Also configure Your Virtual directories to contain internal and external hostname:
http://blogs.msdn.com/b/mvpawardprogram/archive/2013/03/18/virtual-directories-exchange-2013.aspx
Regarding servername when using autodiscover,it should automatically resolve mailbox guid instead of servername.
Please check if Your DNS is setup With autodiscover.domain.local (which is pointed to Your Exchange server)
Hope this helps!
Please mark as helpful if you find my contribution useful or as an answer if it does answer your question. That will encourage me - and others - to take time out to help you. Thank you! Off2work

Lync 2013 and Office 365 - Desktop Client not showing contact pictures but online and mobile does.

Hello
I have gone so far of opening a support call with Microsoft but they don't know how to fix the problem also so I was wondering if anybody has a fix for me.
We have only about 25 users using Office 365 Mid Size Business - We don't have the AD Intergrated yet - that will be at a later date. So I am not doing any of this thumb photos in AD which I have read about.
So about 15-16 of the machines work fine, We have the Desktop Office 2013 installed , and in Lync everybody can see everybody's contact photo.
We have the rest which works perfect apart from showing the contact photo's - All settings are the same - When these users use the Online Web Lync or iPAD Lync, all photos are displayed....it is just on the desktop.
Like I said Microsoft spent an hour on a workstation and don't know what the fix is - we did all the deletion of the SIP Dir in the c:\users\username\appdata\microsoft\office\15.0\lync - For me , I don't see this as a game changer since all aspects of Lync
work for IM, Conference, Presentation - however I am guessing some of my users want to stare at pictures all day :-)
I would like to know am I the only person getting this?

Hi Andy,
Have you viewed this KB article:
User contact photos in Lync aren't displayed correctly
http://support.microsoft.com/kb/2497721
Kent Huang
TechNet Community Support

Exchange 2010 and Office 365

Haven't been able to find a definitive answer from our friends at Microsoft or Google, so here goes!I have a client (lets call the Client A) with onsite SBS Server (Exchange 2010 SP3) of 50 seats. The client has multiple meeting rooms, defined as resource mailboxes and makes extensive use of free/busy info for booking staff and resources for meetings.That part is all good!Recently, a related organization (who we'll call Client B) moved into the same office with them. The second organization (who has IT support provided by another company) uses Office 365 for their email services and has a completely different domain name etc.Because they are related, Client A has requested that they and Client B integrate their calendars so that staff from clients A & B can see each others free/busy info, invite each other to meetings and staff from...
This topic first appeared in the Spiceworks Community

Hi,
If you wanted to add a delegate to possiblly a large number of users or you do this during mailbox provisioning. So the following script will use
impersonation to access another users mailbox and add a delegate.
$mbtoDelegate = "[email protected]"
$delegatetoAdd = "[email protected]"
$dllpath = "C:\Program Files\Microsoft\Exchange\Web Services\1.0\Microsoft.Exchange.WebServices.dll"
[void][Reflection.Assembly]::LoadFile($dllpath)
$service = new-object Microsoft.Exchange.WebServices.Data.ExchangeService([Microsoft.Exchange.WebServices.Data.ExchangeVersion]::Exchange2007_SP1)
$windowsIdentity = [System.Security.Principal.WindowsIdentity]::GetCurrent()
$sidbind = "LDAP://<SID=" + $windowsIdentity.user.Value.ToString() + ">"
$aceuser = [ADSI]$sidbind
$service.AutodiscoverUrl($aceuser.mail.ToString())
$service.ImpersonatedUserId = new-object Microsoft.Exchange.WebServices.Data.ImpersonatedUserId([Microsoft.Exchange.WebServices.Data.ConnectingIdType]::SmtpAddress,
$mbtoDelegate);
$mbMailbox = new-object Microsoft.Exchange.WebServices.Data.Mailbox($mbtoDelegate)
$dgUser = new-object Microsoft.Exchange.WebServices.Data.DelegateUser($delegatetoAdd)
$dgUser.ViewPrivateItems = $false
$dgUser.ReceiveCopiesOfMeetingMessages = $false
$dgUser.Permissions.CalendarFolderPermissionLevel = [Microsoft.Exchange.WebServices.Data.DelegateFolderPermissionLevel]::Editor
$dgUser.Permissions.InboxFolderPermissionLevel = [Microsoft.Exchange.WebServices.Data.DelegateFolderPermissionLevel]::Reviewer
$dgArray = new-object Microsoft.Exchange.WebServices.Data.DelegateUser[] 1
$dgArray[0] = $dgUser
$service.AddDelegates($mbMailbox, [Microsoft.Exchange.WebServices.Data.MeetingRequestsDeliveryScope]::DelegatesAndMe, $dgArray);
Hope this helps.

Certificate Authority for Exchange 2013

Dear,
I will install exchange 2013, whether to install the Certificate Authority role also?
If it is necessary, to install this CA, is simply combined with ADDS server, Exchange Server or a separate server?
Thanks

Hi,
As all above says, Exchange 2013 can use Self-signed Exchange certificate which is installed automatically after Exchange 2013 installation. But please note that this self-signed certificate would be not trusted for Exchange using.
If your Exchange 2013 is not internet-facing, we can use the self-signed certificate in your internal domain environment. If you want to publish your Exchange 2013 to the internet and send/receive external mails, we need to have a valid and trusted certificate
for Exchange using.
To get trusted certificate, we can deployed an
Enterprise root CA which self-signs its own CA certificate and uses Group Policy to publish that certificate to the Trusted Root Certification Authorities store of all servers and workstations in the domain. Or we can directly buy a third-party certificate
for using.
About where to install the CA, my personal suggestion is to install ADCS (Active Directory Certificate Services) on a standalone server. You can also install it with your DC. About how to install a
Root Certification Authority, please refer to:
http://technet.microsoft.com/en-us/library/cc731183.aspx
Regards,
Winnie Liang
TechNet Community Support

Mixing on-premise and Office 365 Lync deployment - slightly complicated

Hi,
I wonder if anyone could help with a configuration/deployment issue we've got.
The environment has some slight complications so bear with me:
We have a small development environment say called, XYZ.com - unfortunately when it was created the domain was actually called XYZ.com rather than something like XYZ.local. That aside it's a small environment hosting an on-premise Exchange and Lync deployment.
Exchange does not handle email for XYZ.com domain instead it uses a different domain, say for example, XYZtest.com. Lync works fine if I login using the XYZtest.com email address sip.
There is also a separate Office 365 deployment which so happens to also use the XYZ.com which is used by various people dotted around the world as part of the organisation. This has both and Exchange and Lync online service.
My question is - how can I use Lync to login to both my local, on-premise Lync service as well as the Lync Online service? I don't necessarily need the logged in simultaneously - I just need to be able to login to either service.
What DNS config should I be have? (ie. SRV, CNAME records, etc.)
Also the other thing to note is that there is potential for confusion as both the local domain XYZ.com is the same used for the Office 365 one and so need to ensure I can force Lync to keep them seperated.
Any help or suggestion would be much appreciated.
Cheers
E

Yes If you have the latest updates installed for the Lync you can at a time you can login to one Lync setup
for each sip domain wether online or or premise you need the following DNS records
For all clients except for the Lync Windows Store app During DNS lookup, SRV records are queried and returned to the client in the following order:
lyncdiscoverinternal.<domain>   A (host) record for the Autodiscover service on the internal Web services
lyncdiscover.<domain>   A (host) record for the Autodiscover service on the external Web services
_sipinternaltls._tcp.<domain>   SRV (service locator) record for internal TLS connections
_sipinternal._tcp.<domain>   SRV (service locator) record for internal TCP connections (performed only if TCP is allowed)
_sip._tls.<domain>   SRV (service locator) record for external TLS connections
sipinternal.<domain>   A (host) record for the Front End pool or Director, resolvable only on the internal network
sip.<domain>   A (host) record for the Front End pool or Director on the internal network, or the Access Edge service when the client is external
sipexternal.<domain>   A (host) record for the Access Edge service when the client is external
Please remember, if you see a post that helped you please click "Vote As Helpful" and if it answered your question please click "Mark As Answer" Regards Edwin Anthony Joseph

Office 365 hybrid deployment setup

We are currently migratin to Office 365 from ExchaNGE 2003 USING AN Exchange 2010 Hybrid server.
When running the hybrid configuration wizard, we get the following error:
Updating hybrid configuration failed with error 'System.Management.Automation.Remoting.PSRemotingTransportException: Connecting to remote server failed with the following error message : The server certificate on the destination computer (ps.outlook.com:443)
has the following errors:
The SSL certificate could not be checked for revocation. The server used to check for revocation might be unreachable. For more information, see the about_Remote_Troubleshooting Help topic.
We are not using a proxy server and we have no blocks in our firewall. We did a packet capture and the traffic indicates Our exchange server is not accepting the cert sent by ps.outlook.com. Client and server do the SSL handshake and after receiving the
cert, our exchange server closes the session and generates the error.
Any idea on how to resolve this?
Russ

Hi Russ,
This forum focuses on questions and feedback for Microsoft Office client. There is not so much about Office 365 deployment\hosted\plan aspects here, I would suggest you to post in the forum of
Office 365 Community, where you can get more experienced responses:
http://community.office365.com/en-us/f/default.aspx
The reason why we recommend posting appropriately is you will get the most qualified pool of respondents, and other partners who read the forums regularly can either share their knowledge or learn from your interaction with us. Thank you for your understanding.
Regards,
Ethan Hua
TechNet Community Support
It's recommended to download and install
Configuration Analyzer Tool (OffCAT), which is developed by Microsoft Support teams. Once the tool is installed, you can run it at any time to scan for hundreds of known issues in Office
programs.

Affects when migrating from Office 2013 to Office 365

I currently have office 2013, with two email addresses being used in Outlook. I need to download Office 365 which I have already purchased. Will this have any affect on my two Outlook email addresses, and all the emails that are there?

Hi,
The activation and licensing are different between the Office 2013 and Office 365. We can't just
switch activated Office 2013 to Office 365. We can only uninstall Office 2013 and then install Office 365. In theory, we won't lose any emails in the email accounts configured in Office 2013. Just in case, we can back up your Outlook data files
of the two email accounts and then conduct the migration. To back up the data files, please refer:
http://support.microsoft.com/kb/287070/en-us
Hope this helps.
Regards,
Steve Fan
TechNet Community Support

Transport agent for Exchange 2013

Hello!
I write transport agent for Exchange 2013 and I have two questions:
1. How I can determine is AD OU of recipient different from OU of sender?
2. How I can change routing of message from internal to external for such recipient.
Thanks in advance

1. You can't get that information from within a Transport Agent directly so you need to either use LDAP to lookup the sender (which from a performance point of view isn't a wonderful idea) or some form of cache etc.
2. You can use a routing override to do this see
http://blogs.technet.com/b/appssrv/archive/2009/08/26/how-to-control-routing-from-your-own-routing-agent.aspx for an example
Cheers
Glen

Certificate configuring for exchange 2013 and office 365 hybrid deployment

Similar Messages

Maybe you are looking for