<?xml version="1.0" encoding="utf-8"?>
<rss xmlns:atom="http://www.w3.org/2005/Atom" xmlns:sy="http://purl.org/rss/1.0/modules/syndication/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:wfw="http://wellformedweb.org/CommentAPI/" xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
  version="2.0">
  <channel>
    <title>SharePoint, SharePoint Online and Office 365 Hybrid experience</title>
    <atom:link
      href="https://docs.microsoft.com/archive/blogs/beyondsharepoint/feed.xml"
      rel="self"
      type="application/rss+xml" />
    <link>https://docs.microsoft.com/archive/blogs/beyondsharepoint/feed.xml</link>
    <description>Real World shared hybrid experiences from two Microsoft Engineers</description>
    <lastBuildDate>Tue, 28 Aug 2018 13:23:56 GMT</lastBuildDate>
    <language>en-US</language>
    <sy:updatePeriod>hourly</sy:updatePeriod>
    <sy:updateFrequency>1</sy:updateFrequency>
    <item>
      <title>Cloud hybrid search service (CSSA)-FAQ</title>
      <link>https://docs.microsoft.com/archive/blogs/beyondsharepoint/cloud-hybrid-search-service-cssa-faq</link>
      <pubDate>Wed, 06 Dec 2017 03:07:28 GMT</pubDate>
      <dc:creator><![CDATA[Manas-MSFT]]></dc:creator>
      <guid
        isPermaLink="false">http://blogs.technet.microsoft.com/beyondsharepoint/?p=1225</guid>
      <description><![CDATA[Quite frequently we receive questions regarding Cloud hybrid search service application, Hybrid and...]]></description>
      <content:encoded><![CDATA[Quite frequently we receive questions regarding Cloud hybrid search service application, Hybrid and its supportability around various use cases. The goal of this post is to collate and have a home for these questions for ease of reference.

<strong><em>What are the current supported Hybrid features in SharePoint?</em></strong>

Hybrid is not limited to search/Cloud hybrid search service application (CloudSSA) anymore. Below is a consolidated list of Hybrid features along with Microsoft Official reference to configure the same.
<ol>
 	<li><a href="https://support.office.com/en-us/article/Plan-hybrid-OneDrive-for-Business-b140bc4c-f54d-4b5a-9409-a3bece4a9cf9?ui=en-US&amp;rs=en-US&amp;ad=US">Hybrid OneDrive for Business</a>.</li>
 	<li><a href="https://support.office.com/en-us/article/SharePoint-hybrid-sites-and-search-5ff7e56a-7af2-4511-adec-1e043afe244e?ui=en-US&amp;rs=en-US&amp;ad=US">Hybrid Sites Features</a>.</li>
 	<li><a href="https://support.office.com/en-us/article/The-extensible-hybrid-app-launcher-617a7cb5-53da-4128-961a-64a840c0ab91?ui=en-US&amp;rs=en-US&amp;ad=US">Hybrid App Launcher</a>.</li>
 	<li><a href="https://support.office.com/en-us/article/Use-Office-365-SharePoint-Online-as-a-business-to-business-B2B-extranet-solution-7b087413-165a-4e94-8871-4393e0b9c037?ui=en-US&amp;rs=en-US&amp;ad=US">Hybrid Extranet Business-to-Business sites</a>.</li>
 	<li><a href="https://support.office.com/en-us/article/SharePoint-Hybrid-Auditing-in-Preview-3a379540-f72b-406f-866a-d6121715ec8c?ui=en-US&amp;rs=en-US&amp;ad=US">Hybrid Auditing</a> (Works only in SharePoint 2016).</li>
 	<li><a href="https://support.office.com/en-us/article/Plan-hybrid-SharePoint-taxonomy-and-hybrid-content-types-71ae4d00-da98-407b-bee2-8d9972e1875c?ui=en-US&amp;rs=en-US&amp;ad=US">Hybrid Taxonomy and Content Types</a><u>.</u></li>
 	<li><a href="https://support.office.com/en-us/article/Hybrid-self-service-site-creation-f8849a20-7cb7-44e6-bfd6-4c6415ae7785?ui=en-US&amp;rs=en-US&amp;ad=US">Hybrid self-service site creation</a>. (Hybrid self-service site creation is available in SharePoint Server 2013 with the March 2017 PU. November 2017 CU adds this to 2016)</li>
 	<li><a href="https://support.office.com/en-us/article/Plan-cloud-hybrid-search-for-SharePoint-33926857-302c-424f-ba78-03286cf5ac30">Hybrid Search [Query federation]</a></li>
 	<li><a href="https://support.office.com/en-us/article/Plan-cloud-hybrid-search-for-SharePoint-33926857-302c-424f-ba78-03286cf5ac30">Cloud Hybrid search(CloudSSA)</a>.</li>
 	<li><u> </u><a href="https://technet.microsoft.com/en-us/library/dn197239.aspx">Business connectivity services</a></li>
</ol>
<em> </em><em><strong>Is there an automated wizard which can help configure Hybrid in my environment?</strong> </em>

Yes, you can leverage the Hybrid picker in SharePoint Online admin center for hybrid configurations. This wizard automates certain configuration steps required to connect on-premises SharePoint Server environment with SharePoint Online in Office 365. You can read more about the Hybrid picker <a href="https://technet.microsoft.com/en-us/library/mt844711(v=office.16).aspx">here</a>.

<em><strong>Can I leverage SharePoint Hybrid picker to perform a clean-up of Hybrid environment or deactivate the Hybrid features that was activated by picker?</strong> </em>

The picker automates certain configuration steps to configure Hybrid between On-premises SharePoint Server with SharePoint Online. This is not designed to undo the changes once the wizard completes. Example, Hybrid Picker creates a Server-to-Server (S2S)/OAuth trust between the SharePoint Online and SharePoint On-premises farm. Once this is configured, rerunning the wizard does not clean up the trust. You can refer to the official guidance <a href="https://technet.microsoft.com/library/mt844711(v=office.16).aspx?ui=en-US&amp;rs=en-US&amp;ad=US">here</a> that mentions about the s“<em>Note that the hybrid picker does not uninstall features. If you run the hybrid picker and deselect a feature that you previously installed, it will remain installed.</em>”

<strong><em>I plan to configure cloud hybrid search with high availability (HA)topologies. Is there a script available to configure the same?   </em></strong>

If you plan to configure cloud hybrid search with HA topologies in either SharePoint 2013/2016 you can configure it with hybrid picker. Hybrid picker has automated  certain configuration steps needed to connect your on-premises SharePoint Server environment with SharePoint Online in Office 365 for cloud hybrid search. (<a href="https://technet.microsoft.com/en-us/library/dn720906(v=office.16).aspx">Learn more</a>)

<em><strong>What is hybrid federated search and how is it different from cloud hybrid search? </strong> </em>

Hybrid federated search and Cloud hybrid search are the two Hybrid experiences that a search administrator can choose while configuring hybrid search with Office365.

With hybrid federated search solution for SharePoint, the results are federated from your search index in SharePoint Server 2013/2016 as well as index in Office 365. SharePoint on-premise crawls on-premises content and SharePoint Online crawls SharePoint Online corpus. Post hybrid configurations, when authenticated users submit a query in a search center, a real time query would be fired against both indexes and authorized users will get search results from the Office 365 search index as well as from the SharePoint On-premises 2013/2016 search index. However, the results are separate and distinct from one another often displayed in separate search verticals or result blocks.

Cloud hybrid search service application for SharePoint 2013/2016 is a crawl-based solution. All crawled content, including on-premises content, is processed by Office365 search engine and resides in search index in Office 365. When authenticated users submits a query in SharePoint Online search center, they get search results from Office 365 search index, thus see items both from on-premises and Office 365 content. If you want to get the same experience in on-premises SharePoint 2013/2016 search center, you need to configure a remote result source in the on-premises farm to fetch results from Office365 index.

<strong><em>What are the supported topologies in Hybrid federated search?</em></strong>

There are three topology types for Hybrid federated search.

Hybrid infrastructure setup (server to server (S2S) authentication), is a must for any of the below scenarios to work.

Outbound: In an outbound scenario a remote result source will only be configured in the on-premise SharePoint 2013/2016 farm. Outbound can be defined as the ability to only query from the on-premise farm to SharePoint Online search(SPO) farm. Results will be displayed in the on-premise search center in separate search verticals (one for SPO results, another for SharePoint on premise). If outbound is configured, then querying from SharePoint Online (SPO)search center will not return any search results from the on-premises SharePoint 2013/2016 farm.

Inbound: In an inbound scenario a remote result source will only be configured in the SharePoint Online search(SPO) center. Inbound can be defined as the ability to query only from SPO farm to on-premise farm. Results will be displayed in the SPO search center in separate search verticals (one for SPO results, another for SharePoint on premise). There are additional certificate and reverse proxy requirements in addition to the outbound configurations mentioned above. The blog here <a href="https://blogs.msdn.microsoft.com/spses/2014/01/05/office-365-configure-inbound-hybrid-search-with-directory-synchronization-password-sync-part2/">outlines</a> the requirement.

Two way: A combination of the above two (outbound and inbound) is a two way hybrid federated search. Two way is typically the desired state of hybrid federated search deployment in an organization, where result sources are created in both SharePoint Online as well as SharePoint 2013/2016 farm. When queried from either of the search centers, users see a set of search verticals with results from SharePoint Online and another from on-premise SharePoint 2013/2016 farm.

<em> </em><strong><em>What are the some of the tested and documented reverse proxies for Hybrid?</em></strong>

In Hybrid federated search, the reverse proxy must be able to:
<ul>
 	<li>Support client certificate authentication with a wildcard or SAN certificate.</li>
 	<li>Support pass-through authentication for OAuth 2.0.</li>
 	<li>Accept unsolicited inbound traffic on TCP port 443 (HTTPS).</li>
 	<li>Bind a wildcard or SAN SSL certificate to a published endpoint.</li>
 	<li>Relay traffic to an on-premises SharePoint Server 2013 or 2016 farm or load balancer without rewriting any packet headers.</li>
</ul>
<em> </em>As described in <a href="https://technet.microsoft.com/en-us/library/dn607304.aspx">this</a> article below is a list of tested reverse proxy solution.
<table>
<tbody>
<tr>
<td width="342"><u>Supported reverse proxy devices</u></td>
<td width="390"><u>Configuration article</u></td>
</tr>
<tr>
<td width="342">Windows Server 2012 R2 with Web Application Proxy (WA-P)</td>
<td width="390"><a href="https://technet.microsoft.com/en-us/library/dn551377.aspx">Configure Web Application Proxy for a hybrid environment</a></td>
</tr>
<tr>
<td width="342">Forefront Threat Management Gateway (TMG) 2010</td>
<td width="390"><a href="https://technet.microsoft.com/en-us/library/dn197170.aspx">Configure Forefront TMG for a hybrid environment</a></td>
</tr>
<tr>
<td width="342">F5 BIG-IP</td>
<td width="390"><a href="https://devcentral.f5.com/articles/enabling-sharepoint-2013-hybrid-search-with-the-big-ip">Enabling SharePoint 2013 Hybrid Search with the BIG-IP</a></td>
</tr>
<tr>
<td width="342">Citrix NetScaler</td>
<td width="390"><a href="https://www.citrix.com/content/dam/citrix/en_us/documents/products-solutions/deployment-guide-netscaler-office-365-en.pdf">Citrix NetScaler and Microsoft SharePoint 2013 Hybrid Deployment Guide</a></td>
</tr>
</tbody>
</table>
<strong><em>When should I deploy cloud hybrid search or hybrid federated search?  Are there any recommendations ?</em></strong>

Recommendation is to choose Cloud hybrid search for these benefits as per <a href="https://technet.microsoft.com/library/mt844713(v=office.16).aspx?ui=en-US&amp;rs=en-US&amp;ad=US">TechNet</a> guidelines.
<ul>
 	<li>Your users get unified search results, search relevance ranking, and refiners even if your organization has a hybrid deployment with content both on-premises and in Office 365.</li>
 	<li>Your users automatically get the newest SharePoint Online search experience without your organization having to update your existing SharePoint servers.</li>
 	<li>Your users can use cloud capabilities such as Office Delve also for your on-premises content.</li>
 	<li>You no longer have to worry about the size of your search index, because your search index is in Office 365. This means that the footprint of your SharePoint Server 2013/2016 search farm is smaller, and your total cost of ownership for search is lower.</li>
 	<li>You don't need to upgrade any of your existing installations of SharePoint to have enterprise search in the cloud because SharePoint Server 2013/2016 supports crawling of existing SharePoint Server 2007, SharePoint Server 2010 and SharePoint Server 2013 content farms.</li>
 	<li>You no longer have to migrate your search farm to a newer version of SharePoint because this happens automatically in Office 365.</li>
</ul>
If you have some on-premises content that’s highly sensitive and shouldn’t be indexed outside your on-premises network, then hybrid federated search may be the way to go. Note: Authenticated user queries will be routed in real time to two separate indices (SharePoint Online index and SharePoint on-premise) and results will be displayed in separate search verticals.

<strong><em>Can Hybrid Search results be displayed in a SharePoint 2010 search center?</em></strong>

Out of box there is no way to configure Server to Server authentication in SharePoint 2010 environment. Cloud hybrid search service application can only be installed in SharePoint 2013/2016 environment. Recommendation is ideally to upgrade the SharePoint 2010 farm to SharePoint 2013 and or SharePoint 2016 following the upgrade guidelines. However, if there is a business requirement to remain on SharePoint 2010 then there is a workaround through which you will be able to display results. You need to publish search service application from SharePoint 2013 and consume from SharePoint 2010 farm. Whichever hybrid search model you deploy, cloud hybrid search service application or federated hybrid search, consuming the same from SharePoint 2010 farm will show authenticated users search results from Office365. Note: - The search center site in SharePoint 2010 must be Enterprise search center.

<em> </em><strong><em>What are supported topologies while publishing consuming Cloud hybrid search service application?</em></strong>

Publishing/consuming of Cloud search service application follows the exact same support matrix as any other service application within SharePoint. The following table lists the supported options.
<table>
<tbody>
<tr>
<td width="312"><strong>Published CloudSSA version</strong></td>
<td width="312"><strong>Can be consumed by</strong></td>
</tr>
<tr>
<td width="312">SharePoint Server 2016</td>
<td width="312">SharePoint Server 2016</td>
</tr>
<tr>
<td width="312">SharePoint Server 2016</td>
<td width="312">SharePoint Server 2013</td>
</tr>
<tr>
<td width="312">SharePoint Server 2013</td>
<td width="312">SharePoint Server 2013</td>
</tr>
<tr>
<td width="312">SharePoint Server 2013</td>
<td width="312">SharePoint Server 2010</td>
</tr>
</tbody>
</table>
<strong><em>What is user rehydration and why does it play a key role in hybrid setup with Office365</em></strong>

Server-to-server authentication (S2S) allows servers (ex. SharePoint 2013/2016) to access and request resources from one another on behalf of users. This is a key requirement for Hybrid search to work. Example, in a Cloud hybrid search service farm when a user queries for an item in a SharePoint 2013 search center, the query needs to be routed to SharePoint Online farm (as the index is in SPO farm). The user identity needs to be re-hydrated and then an ACL match has to happen and only after that a set of results that the user has permission to would be returned in search results. To do so it’s a must that the below tasks can be accomplished.

Resolve the request to a specific SharePoint user.

Determine the set of role claims that are associated with the user, a process known as rehydrating the user’s identity.

When a request is made to obtain a resource from another server (ex. SharePoint 2013/2016) the claims from the incoming security token is leveraged to resolve it to a specific SharePoint user. By default, SharePoint Server 2013 uses the built-in User Profile service application to resolve the identity. A match of the set of claims is done against some user attributes for locating the corresponding user profile. The match is performed against one of the below attributes

Windows Security Identifier (SID).

Simple Mail Transfer Protocol (SMTP) address.

User principal name (UPN).

Session Initiation Protocol (SIP) address.

Therefore, its recommended that at least one of these user attributes must be current in user profiles both in SharePoint On-premises as well as in SharePoint Online.

<strong><em>What are List of attributes that are synced by the Azure Active Directory Sync tool</em></strong>

The article <a href="https://social.technet.microsoft.com/wiki/contents/articles/19901.dirsync-list-of-attributes-that-are-synced-by-the-azure-active-directory-sync-tool.aspx">here</a> has the list of attributes that are synchronized out of the box by the Azure Active Directory Sync tool.

<em> </em><em><strong>Search service application in my On premises SharePoint 2013/2016 farm is partitioned, can I configure hybrid query federation?</strong> </em>

Office 365 doesn't support incoming Hybrid Search queries when the on-premises Search Service Application Proxy is deployed in partitioned mode. Outbound search fails when the Search Service Application or the proxy is partitioned. This is because the search query passes a partionID (tenantID) to the search query processor which fails because this is a GUID and therefore unique. The unique partitionID will not be found in the O365 search index and so no search query can be scoped to that ID. Security trimming will not allow results from one ID to be passed to another ID. Search admins need to fix/rebuild their Service Application to be fully supported. <a target="_blank" href="https://support.microsoft.com/en-in/help/2989740/sharepoint-online-content-isn-t-displayed-in-a-sharepoint-on-premises" rel="noopener">KB article describes</a> the errors and some workarounds.

<em> </em><strong><em>What content sources can you crawl using Cloud hybrid search service application?</em></strong>

All SharePoint 2013/SharePoint 2016 content sources are supported.

<em> </em><strong><em>My SharePoint topology consists of multiple SharePoint farms i.e Content farm, Service Farm. What is the preferred farm to configure Cloud hybrid search service application?</em></strong>

In a content/service SharePoint scenario, assuming Search is in the service farm, CloudSSA should ideally be configured in the service farm. For implementation details refer to this link. <a href="https://technet.microsoft.com/en-us/library/ff621100(v=office.16).aspx">https://technet.microsoft.com/en-us/library/ff621100(v=office.16).aspx</a>

<em><strong>Is ADFS/Single-sign-on mandatory to configure server to server authentication or Cloud hybrid search service application?</strong>  </em>

ADFS/Single-sign is not a mandatory pre-requisite to configure server to server authentication or Cloud hybrid search service application. Below is an overview of features that needs to be configured between Office 365 and SharePoint Server 2016 /2013 to configure a hybrid environment.
<ol>
 	<li>Sign up for Office 365.</li>
 	<li>Register your domain with Office 365.</li>
 	<li>Synchronize accounts with Office 365.</li>
 	<li>Assign licenses to your users.</li>
 	<li>Create cloud hybrid search service application.</li>
 	<li>Onboard cloud hybrid search service application.</li>
</ol>
<em> </em><strong><em>Can I connect multiple Cloud hybrid search service application (CloudSSA) to same Office365 tenant?</em></strong>

Companies have SharePoint Farms across different geographical locations. Having Cloud search service application across geographical locations and connecting them to the same Office365 tenant is supported.CloudSSA solution provides the ability to crawl and parse on-premises content, process and index it in single Office 365 tenant that these CloudSSA farms are connected to.

However, it is important to note that each CloudSSA farm must only crawl unique content i.e. crawling the same source content from multiple CloudSSA farms connected to the same Office365 tenant <strong>is not supported.</strong> <strong> (Pro Tip: </strong>The name of the content source in SharePoint on-premises is included in the managed property “ContentSource”. If you name the content sources in your different farms uniquely, you can identify the content source by name in queries. If you use the default “Local SharePoint Sites” you will have to find another way to segregate your content. <strong> </strong>

<strong><em>Is it supported to run multiple Cloud hybrid search service applications on the same farm? Or is it supported to host a farm that has both regular search service application as well as Cloud hybrid search service application sharing farm hardware?</em></strong>

Separate farms should be used to host individual Cloud search service application(CSSA) to avoid resource consumption and possible unexpected behaviors. However, it is a supported configuration to operate two search service applications (SSA) on the same farm if only one of the SSAs is a Cloud hybrid search service application. You also need to ensure that the servers in the farm only host components from one SSA. If Cloud hybrid search service application and the regular search service application components do not share hardware between any components, only then its supported that machines in the farm can be used to host both SSA’s.

<em><strong>What are the supported topologies for document collaboration using Exchange Server 2016, Office Online Server (OOS) and SharePoint Server?</strong> </em>

Following are documented and supported topologies:

<a href="https://blogs.technet.microsoft.com/exchange/2016/11/03/configure-rich-document-collaboration-using-exchange-server-2016-office-online-server-oos-and-sharepoint-server-2016/">Exchange On-Premises + SharePoint On-Premises</a>

<a href="https://docs.microsoft.com/en-us/exchange/hybrid-deployment/set-up-document-collaboration">Exchange On-Premises + SharePoint Online</a>

Exchange Online +SharePoint Online.

<strong><em>Can we deploy Cloud hybrid search service application in an environment that has multiple forests?</em></strong>

Cloud hybrid search service application works in an environment that has multiple forests. You need to ensure that the accounts across these forests are synched to Office365. Azure AD Connect sync should take care of this situation. When you have multiple forests, all forests must be reachable by a single Azure AD Connect sync server. You don't have to join the server to a domain. If necessary to reach all forests, you can place the server in a perimeter network. The articles below discuss this configuration.

<a href="https://docs.microsoft.com/en-us/azure/active-directory/connect/active-directory-aadconnect-topologies.">Topologies for Azure AD Connect</a>

<a href="https://support.office.com/en-us/article/Implement-support-for-multiple-forests-73c4a525-f6c4-434c-8409-0121a83ab26b">Implement-support-for-multiple-forests</a>

<em> </em><strong><em>When Cloud hybrid search service application crawls On Premises content, do crawled properties from SharePoint on-premises propagate to SharePoint Online?</em></strong>

Following the crawl of content via Cloud hybrid search service application, crawled properties from SharePoint 2013/2016 on-premises propagate to SharePoint online search schema. The crawled properties in on-premises should be a part of default propset. You also need to ensure that you are looking up the crawl properties in SharePoint Online search schema using the correct account. By correct account I mean an account in on-premises Active directory having rights in SharePoint On Premises as well synched to Office365 Azure AD in your tenant. Example, if you can look up using the content access account of your On premises Cloud hybrid search service application farm, you should definitely see the Crawl Properties in SharePoint Online search schema.

<strong><em>Can Cloud hybrid search service application be onboarded in a farm that has already been configured for provider hosted apps?</em></strong>

This question primarily revolves around the below use cases
<ul>
 	<li>You have a SharePoint 2013 or SharePoint 2016 farm where you plan to implement provider hosted add-ins and/or associate with workflow manager.</li>
 	<li>You have a SharePoint 2013 or SharePoint 2016 farm that already has provider hosted add-ins and/or leverages workflow manager.</li>
</ul>
Hybrid features/Cloud search service application (CSSA) can be implemented on same SharePoint farm as mentioned above. When you try to establish a S2S trust via the CSSA onboarding script or Hybrid picker, the authentication realm of the on premises Farm is updated to match the Office 365 tenant context id. Within the script we set it using Set-SPAuthenticationRealm. Once the authentication realm is changed, existing SharePoint Add-ins fail to authenticate; users will get a HTTP 401 when they are redirected to the add-ins. You can read more about the problem as well and fix in our post <a href="https://blogs.technet.microsoft.com/beyondsharepoint/2016/09/15/considerations-when-deploying-sharepoint-office365-hybrid-workloads-in-a-farm-utilizing-provider-hosted-add-ins-or-workflow-manager/">here</a>. Note: If you configure Hybrid using Hybrid picker from SharePoint tenant admin then the wizard take<span style="text-decoration: line-through">s</span> care of the fix.

<strong><em>What are the out of box Cloud hybrid search service application crawl limits, also can I request additional index quota for my tenant?  </em></strong>

The maximum number of on-premises items crawled by Cloud hybrid search service that can be indexed in Office 365 is 20 million. For each 1 TB of storage space a tenant has in Office 365, one can index 1 million items of on-premises content in tenant’s search index. Once the limit on how many items can indexed is reached, the on-premises farm hosting Cloud search service application will start seeing errors while crawling new items. Below is a snippet of the error from ULS logs from a SharePoint 2016 farm.

<em>mssearch.exe (0x5304) 0x97D0 SharePoint Server Search Crawler:Azure Plugin a9sz7 Verbose AzureServiceProxy::SubmitDocuments: submit returned : Forbidden, docid : 4653596 DocIDString : sts4s://</em>

<em>SharePoint Server Search Crawler:Azure Plugin ayg2m High AzureServiceProxy::SubmitDocuments: submit failed for the document: HTTP status: Forbidden</em>

If Cloud search service application is hosted in a SharePoint 2013 environment the uls tag tracking the error would be <em>amnz2</em> and <em>amoeu</em>.

You need to request an increase in the available quota to fix the issue. To increase the maximum items that can be indexed beyond 20 million you need to contact Microsoft Support. Reference <a href="https://support.office.com/en-us/article/Search-limits-for-SharePoint-Online-7C06E9ED-98B6-4304-A900-14773A8FA32F">here</a>

My Office365 tenant is configured for Hybrid.C<em><strong>an I query for only on-premises items that have been crawled using Cloud hybrid search service application? </strong> </em>

The Hybrid Cloud SSA exposes a new managed property <strong>IsExternalContent</strong>. When crawling on premises content, this property is automatically populated with the value 1. You can leverage the managed property “IsExternalContent” and search for the value 1 for content that is crawled on-premises. The querystring for this example is constructed as follows

http://&lt;searchcenter url&gt;/Pages/results.aspx?k=IsExternalContent:1

You can test for the online content only by stipulating NOT IsExternalContent:1 as follows

<a></a>http://&lt;searchcentre url&gt;/Pages/results.aspx?k=(NOT IsExternalContent:1)

<strong><em>What would be the People crawl experience</em><em> if you are crawling On-premise profile store using Cloud hybrid search service application?</em></strong>

By default, all people in the SharePoint Online SPO User Profile application will be indexed by the SharePoint online search service. If you additionally crawl people using the on-premises cloud search service application, you will generate an additional set of people content items in the Office 365 Search index. Since these would have two different DocID’s both will be returned in search results when queried for a person, one will have url pointing to users mysite in SPO and another pointing to SharePoint On-premises This will be confusing to end users as searching for a person will return multiple results per person.

There are two ways to approach this problem today.
<ul>
 	<li>Make O365 User Profile service the primary source of user information and let office 365 search take care of the indexing and presentation. With this approach, you do not need to crawl people on premises.</li>
 	<li>Crawl the on premises people profile store in addition to O365 crawling the tenant profile store. This will result in the described scenario of duplicate search results for each person, however you can use query transformation to decide which results you want to display. Even providing the ability for end users to choose between the different result sources at query time.</li>
</ul>
To utilise the on premises profile store as the primary people search source you should follow these steps
<ol>
 	<li>Create a new result source or copy the existing people results source</li>
 	<li>Edit the new result source and modify the Query Transformation box to include the Managed Property IsExternalContent as below. {?{searchTerms} ContentClass=urn:content-class:SPSPeople IsExternalcontent:1}</li>
 	<li>Then you can create a new search results page and configure the Core Search Results web part to consume this new search result source.</li>
 	<li>Complete the implementation by adding the new page to the search navigation settings. This will add the new page as a search vertical within the search center, as per the screenshot below.</li>
</ol>
To utilise the Office 365 profile store as the primary people search source you should follow the same steps but using a slightly different query transformation at step two, as follows.

{?{searchTerms} ContentClass=urn:content-class:SPSPeople NOT IsExternalcontent:1}

Note: The difference in the two transform is the insertion of NOT before the managed property to force the exclusion of External content i.e Non O365 People Results.

<em><strong>I only see preview of Office documents in search results if the content resides in SharePoint Online. Office documents that reside in SharePoint On-premises do not show previews. Is this expected?</strong> </em>

To enable previews for on-premises content you need to set up an on-premises Office Web Apps Server and configure SharePoint Server 2013 to use it (or Office Online Server for SharePoint 2016). The guidelines are documented <a href="https://technet.microsoft.com/en-us/library/mt668456.aspx">here</a>. The behavior is a little different with site/webpage previews (aspx). When search from SharePoint Online you will see previews of aspx pages for the pages in SharePoint Online farm and not for the aspx pages from SharePoint On-Premises. Currently the site and web page hover templates check that the result item has the same host name as the current host. This is by design.

<strong><em>Can Perfmon be leveraged to look at crawl statistics for Cloud hybrid search service application? If yes, what are the Perfmon counters?</em></strong>

There are Preform counters that have been introduced for Cloud hybrid search service application. To get a list of all counters you can run the below command in powershell.

((Get-Counter -ListSet "Search Gatherer Azure Plugin - SharePointServerSearch").counter

<strong><em>What is the recommended number of crawl databases for Cloud hybrid search service application? </em></strong>

Use one crawl database for each 20 million items in the content corpus. You can refer to this article for further <a href="https://technet.microsoft.com/en-in/library/dn727118.aspx">details</a>.

<strong><em>I am using Cloud hybrid search service application(CSSA) to crawl content. In my CSSA I see all 6 components of the search topology. Which ones are hosted locally? For example, is there a local index?”</em></strong>

No!! Cloud hybrid search service application is a crawler. The crawl component gets content from your on-premises farm and sends this content to the search index in Office 365. It uses connectors to interact with the content sources and uses the crawl database to store both temporary and historical information about the items it crawls, just like a regular crawl component.

<strong><em>What is pushed by</em> <em>Cloud hybrid search service application </em><em>to Office365 SPO endpoint during a crawl?</em></strong>

Cloud hybrid search service application identifies the document that has changed in SharePoint. Crawler picks up the document and parses it, extracting a structured view of the content and removing unnecessary markup. Crawler sends the encrypted content to the Indexing API associated with the SharePoint Online content farm. Encrypted batch submission happens, which consists of ACLs, keywords, metadata, destination tenant info, etc. The following types of operations can be submitted from the crawler.
<ol>
 	<li>Insert: Creates or overwrites a document’s content and access control list.</li>
 	<li>Security update: Overwrites an existing document’s access control list.</li>
 	<li>Delete: Deletes all content for a document.</li>
</ol>
From cloud hybrid search service application farm’s ULS logs, you can track the submission of items including the crawled properties. To do so you need to enable VerboseEx for [SharePoint Server Search] “Crawler:Azure Plugin” categories.

<strong><em>What size Cloud hybrid search service architecture do I need?</em></strong>

Search architecture for Cloud hybrid search service application consists of search components and databases. Ideally you need to plan the number of crawl components for your topology, which servers to host the components and databases on, and the hardware required for each server. When you set up a Cloud hybrid search service application all components of the search service application are set up and need to be online.

The grey components as shown in this <a href="https://technet.microsoft.com/library/mt844716(v=office.16).aspx?ui=en-US&amp;rs=en-US&amp;ad=US#bkmk_plan_search_architecture">TechNet</a> article are inactive in cloud hybrid search, but they still need to be placed on servers as recommended in the article.
<table>
<tbody>
<tr>
<td width="215">Application Server</td>
<td width="154">Database Server</td>
</tr>
<tr>
<td width="215">Admin</td>
<td width="154">Admin database</td>
</tr>
<tr>
<td width="215">Crawl.</td>
<td width="154">Crawl database</td>
</tr>
<tr>
<td width="215">Content processing component.</td>
<td width="154">Link database</td>
</tr>
<tr>
<td width="215">Analytics</td>
<td width="154">Analytics database</td>
</tr>
<tr>
<td width="215">Index</td>
<td width="154"></td>
</tr>
<tr>
<td width="215">Query Processing component</td>
<td width="154"></td>
</tr>
</tbody>
</table>
Deploying additional crawlers will provide high availability for the crawler function. Adding query processors will also provide high availability when the on-premises farm is configured to send search queries to Office 365. Content processing is performed in the Office 365 service, so there is no requirement for additional content processors on-premises. Regardless of the number of items crawled by the Cloud Search Service Application, there is no requirement for additional index components. The index is stored in the Office 365 search farms, which saves a significant amount of on-premises capacity and capital outlay for large corpora. You must scale the on-premises crawl databases to match the number of items crawled because the Cloud Search Service Application must maintain an up-to-date crawl log of the items crawled. Scaling-out employs the same processes as a regular Search Service Application; follow the steps at <a href="https://technet.microsoft.com/library/jj862356(v=office.15).aspx#Topology_ExampleDefaultSmall">https://technet.microsoft.com/library/jj862356(v=office.15).aspx#Topology_ExampleDefaultSmall</a> . If you need to tune crawling, follow the recommendation in <a href="https://technet.microsoft.com/en-us/library/dn727118(v=office.16).aspx">Redesign enterprise search topology for specific performance requirements in SharePoint 2016</a>. The same guidelines apply for Cloud hybrid search service application.

<strong><em>What are the HA and DR recommendations for Cloud hybrid search service application?</em></strong>

It is recommended that for HA at least two servers are configured in the same SharePoint on-premises farm and each machine hosts all the search roles. Additional servers can be used but if at least two of each component is present the CloudSSA can be considered Highly available.

For disaster recovery a second Cloud hybrid search service application can be built in the Disaster recovery farm. You need to ensure that Cloud hybrid search service application must not crawl the same content as the primary farm unless a failover is initiated. In the event of failover, the disaster recovery farm can immediately serve search results from the same Office 365 search index.

<strong><em>Can users query for items secured with SAML claims if crawled by a Cloud search service application?</em></strong>

Items secured with SAML claims when crawled using Cloud Search Service application will not show up in search results. This is does not work as those identities cannot be interpreted during the ACL mapping process in the Cloud search service application. As of today we do not have a way to map an on premises SAML identity to an Office 365 user which is a core requirement for ACL mapping to work. This is by design.  For such supportability questions a request can be submitted at  <a href="https://sharepoint.uservoice.com/">https://sharepoint.uservoice.com</a> for evaluation.

<strong><em>On premises environment Cloud search service application crawls site collection secured with NT Authority\Authenticated users. How does this translate to ACL mapping in SharePoint Online?</em></strong>

The SIDs/SID claims in incoming ACLs are translated in SPO when a cloud hybrid search service application is used to crawl on-premises content. User security identifiers (SID) are mapped to passport unique ID (PUID). Similarly, group SIDs are mapped to Object IDs. NT AUTHORITY\Authenticated Users and Everyone (<a href="https://support.microsoft.com/en-in/help/243330/well-known-security-identifiers-in-windows-operating-systems">the built-in SIDSs</a> S-1-5-11 and S-1-1-0) are translated to "Everyone except external users" in SPO, i.e. all users in tenant except the external ones that have been invited to share by email. Cloud search service application only support Windows identity that has been synced to AAD. If customer is not using Windows identity and wants to Crawl using Cloud SSA, a workaround can be to add Everyone claim to the source content to ensure that users are able to search for that Content.

<strong><em>Result Type Rules are configured at the site collection. Where do I configure Result Type Rules and Display Templates when using Cloud hybrid search?</em></strong>

The awesome <a href="http://bit.ly/abHybridResultTypes">blog post </a>from our friend MVP Matthew McDermott highlights what to configure &amp; where. Also thank you Matt!! for providing some of your valuable comments for this post.

<strong><em>Can I view Popularity trend reports in SPO for content crawled with Cloud search service application?</em></strong>

Popularity trends works based out of analytics. Usage Analytics reporting isn’t operational under a Cloud search service application as of today.  Usage analysis uses view events created on the farm where the actual content resides. When you configure CloudSSA to crawl content from an on-premises SharePoint farm, the view events are not passed on to the SharePoint Online search farm. The analysis processing happens on SharePoint Online search farm so it will not see the view events and thus will not have the possibility to update the usage reports.

<strong><em>Cloud hybrid search service application is crawling a SharePoint farm that has http:// prefix in the default zone, extranet zone is https://. Query from SharePoint online ends up showing http in the search result is this expected behavior?</em></strong>

Yes, this expected.  Users will see http:// prefix in the search results. As my friend Brian explains it very nicely <a href="https://blogs.msdn.microsoft.com/sharepoint_strategery/2013/02/20/beware-crawling-the-non-default-zone-for-a-sharepoint-2013-web-application/">here</a> , SharePoint 2013, URL-related managed properties including Path, ParentURL and SPSiteUrl all store values relative to the URL that was crawled. The crawler simply passes what it can gather to the Search Content Services in the cloud. SPO search has no knowledge of the AAMs on your on-prem farm and so is unable to correctly set the mappings you would expect to see. Thus its recommended to crawl the Default zone for a SharePoint 2013 Web Application.

<strong><em>Cloud search service application </em><em>is crawling my On-Premises content. Can I remove on-premises items from SPO?</em></strong>

The “urls to remove” option within SharePoint admin center (https://&lt;tenantname&gt;-admin.sharepoint.com/_layouts/15/searchadmin/searchresultremoval.aspx) cannot be leveraged to remove items from SharePoint Online index. If you want to remove specific urls your option is to use the crawl log in the on-premises Cloud search service application server to remove the same.

<strong><em>Can I run Cloud hybrid search Onboarding script when multifactor authentication (MFA)is enabled in my tenant?</em></strong>

Yes, you need to ensure you have the latest version of Azure AD PowerShell. You can download it from <a href="http://connect.microsoft.com/site1164/Downloads/DownloadDetails.aspx?DownloadID=59185">here</a>.

<strong><em>What are the firewall ports and protocols requirement to configure Cloud hybrid search service application?</em></strong>

The articles below outline the complete infrastructure firewall requirement for end to end connectivity with Office365. The first blog below talks about Cloud search service application specific ports and protocols.

<a href="https://blogs.technet.microsoft.com/beyondsharepoint/2016/08/15/ports-and-protocols-requirement-for-the-hybrid-cloud-search-service-application/">Ports and Protocols requirement for the Hybrid Cloud Search Service Application</a>

<a href="https://support.office.com/en-us/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2">Office 365 URLs and IP address ranges</a>

<a href="https://docs.microsoft.com/en-us/azure/active-directory/connect/active-directory-aadconnect-ports">Hybrid Identity Required Ports and Protocols</a>

<strong><em>All Outbound requests in my network are filtered or gets routed via proxy server. Is there any specific requirement Cloud hybrid search service application to work?</em></strong>

You need to ensure that account running the search service (msssearch, noderunner accounts) (for crawl and Query federation scenarios to work) in the Cloud Search Service Application farm have unrestricted outbound internet access. If not, set system level proxy settings for these search service accounts. You can follow the steps documented in our post <a href="https://blogs.technet.microsoft.com/beyondsharepoint/2017/10/17/cloud-search-service-applications-fails-to-crawl-and-throws-403-forbidden-error/">here</a>.

Cloud search service application always communicates with endpoints using port 443. Assuming there are multiple SharePoint servers in a farm that hosts Cloud search service application components ,all SharePoint servers need to communicate to the following sites
<ol>
 	<li>*.sharepoint.com</li>
 	<li><a href="https://accounts.accesscontrol.windows.net/">https://accounts.accesscontrol.windows.net</a></li>
 	<li><a href="https://login.windows.net/common/oauth2/authorize">https://login.windows.net/common/oauth2/authorize</a></li>
 	<li><a href="https://sts.windows.net/*">https://sts.windows.net/*</a></li>
 	<li><a href="https://login.microsoftonline.com/">https://login.microsoftonline.com</a></li>
</ol>
If there are dedicated Search servers in the farm topology they should be able to communicate to the following sites as well.
<ol>
 	<li>https://provisioningapi.microsoftonline.com</li>
 	<li>*.search.production.us.trafficmanager.net</li>
 	<li>*.search.production.emea.trafficmanager.net</li>
 	<li>*.search.production.apac.trafficmanager.net</li>
</ol>
<strong><em>Where can I download Cloud hybrid search service application onboarding script?</em></strong>

The latest version of Windows PowerShell scripts to configure cloud hybrid search for SharePoint can be downloaded <a href="https://www.microsoft.com/en-us/download/details.aspx?id=51490&amp;e6b34bbe-475b-1abd-2c51-b5034bcdd6d2=True">here</a>

<strong><em>Is Cloud hybrid search service application onboarding supported for Government community cloud (GCC) &amp; Office 365 operated by 21Vianet.</em></strong>

<em>Yes, you can refer to our </em><a href="https://blogs.technet.microsoft.com/beyondsharepoint/2017/06/30/announcing-hybrid-search-availability-for-office-365-us-government-communication-and-office-365-operated-by-21vianet/"><em>post</em></a><em> for details.</em>

<strong><em>Is it possible to perform an index reset and cleanup just the content that has been crawled via Cloud hybrid search service application?</em></strong>

Yes, you can follow the steps outlined in this <a href="https://blogs.msdn.microsoft.com/spses/2016/05/18/cloud-search-service-application-removing-items-from-the-office-365-search-index/">blog</a> article.

<strong><em>Is there a forum where I can discuss and ask questions regarding issues with Cloud hybrid search?</em></strong>

Yes, you can submit your questions regarding Cloud search service application at <a href="https://social.technet.microsoft.com/Forums/en-US/home?forum=CloudSSA">TechNet</a> forum.

<strong><em>Hybrid references on TechNet</em></strong>

Below are some links to Hybrid articles at TechNet

<a href="https://technet.microsoft.com/library/mt844712(v=office.16).aspx">Minimum public update levels for SharePoint hybrid features</a> , <a href="https://technet.microsoft.com/library/mt844709(v=office.16).aspx">SharePoint hybrid sites and search</a> , <a href="https://technet.microsoft.com/library/mt844713(v=office.16).aspx">Hybrid search in SharePoint</a> , <a href="https://technet.microsoft.com/library/mt844708(v=office.16).aspx">Learn about cloud hybrid search for SharePoint</a> , <a href="https://technet.microsoft.com/library/mt844710(v=office.16).aspx">Learn about hybrid federated search for SharePoint</a> ,<a href="https://technet.microsoft.com/library/mt844711(v=office.16).aspx">Hybrid picker in the SharePoint Online admin center</a> , <a href="https://technet.microsoft.com/library/mt844714(v=office.16).aspx">Plan hybrid SharePoint taxonomy and hybrid content types</a> , <a href="https://technet.microsoft.com/library/mt844715(v=office.16).aspx">Plan hybrid OneDrive for Business</a> , <a href="https://technet.microsoft.com/library/mt844716(v=office.16).aspx">Plan cloud hybrid search for SharePoint</a> , <a href="https://technet.microsoft.com/library/mt844717(v=office.16).aspx">Plan hybrid profiles</a> , <a href="https://technet.microsoft.com/library/mt844718(v=office.16).aspx">The extensible hybrid app launcher</a> , <a href="https://technet.microsoft.com/library/mt844719(v=office.16).aspx">Hybrid site following</a> , <a href="https://technet.microsoft.com/library/mt844720(v=office.16).aspx">Hybrid self-service site creation</a>, <a href="https://technet.microsoft.com/library/mt844721(v=office.16).aspx">Configure hybrid SharePoint taxonomy and hybrid content types</a>

<strong><em>Are there any eBook available to configure SharePoint Hybrid capabilities?</em></strong>

Yes , you can download eBook on Configuring Microsoft SharePoint Hybrid Capabilities (ISBN 9781509302437) from this <a href="https://blogs.msdn.microsoft.com/microsoft_press/2016/07/06/free-ebook-configuring-microsoft-sharepoint-hybrid-capabilities/"><em>link</em></a><em>.</em>

<em> </em>

If you have questions or suggestions around topics we should add to this article, please leave a comment and Neil and or I will be happy to address them and include in this article.]]></content:encoded>
    </item>
    <item>
      <title>Cloud search service applications fails to crawl and throws 403 forbidden due to outbound network proxy</title>
      <link>https://docs.microsoft.com/archive/blogs/beyondsharepoint/cloud-search-service-applications-fails-to-crawl-and-throws-403-forbidden-error</link>
      <pubDate>Tue, 17 Oct 2017 20:42:46 GMT</pubDate>
      <dc:creator><![CDATA[Manas-MSFT]]></dc:creator>
      <guid
        isPermaLink="false">http://blogs.technet.microsoft.com/beyondsharepoint/?p=1195</guid>
      <description><![CDATA[Recently we received couple of questions around failures while crawling content (Onpremise 2016,...]]></description>
      <content:encoded><![CDATA[Recently we received couple of questions around failures while crawling content (Onpremise 2016, 2013, 2010 farms) from Cloud Search Service Application when there is an Outbound proxy server in the network. All content sources experience errors regarding Azure plugin and fails to successfully submit content.This post is focused around common error and remediation for Cloud Search Service Application (Cloud Hybrid Search, CSSA) proxy settings.

Below are some of the extracts from ULS logs.

<u>Exception details</u>

mssearch.exe (0x29CC) 0x1084 SharePoint Server Search Crawler:Azure Plugin ayg2o High AzureServiceProxy caught Exception: *** System.AggregateException: One or more errors occurred. ---&gt; System.Net.Http.HttpRequestException: An error occurred while sending the request. ---&gt; System.Net.WebException: Unable to connect to the remote server ---&gt; System.Net.Sockets.SocketException: No connection could be made because the target machine actively refused it XX.XX.XX.XXX:443 at System.Net.Sockets.Socket.EndConnect(IAsyncResult asyncResult) at System.Net.ServicePoint.ConnectSocketInternal(Boolean connectFailure, Socket s4, Socket s6, Socket&amp; socket, IPAddress&amp; address, ConnectSocketState state, IAsyncResult asyncResult, Exception&amp; exception)

--- End of inner exception stack trace ---

at System.Net.HttpWebRequest.EndGetRequestStream(IAsyncResult asyncResult, TransportContext&amp; context) at System.Net.Http.HttpClientHandler.GetRequestStreamCallback(IAsyncResult ar) --- End of inner exception stack trace --- --- End of inner exception stack trace --- at System.Threading.Tasks.Task`1.GetResultCore(Boolean waitCompletionNotification) at Microsoft.Office.Server.Search.AzureSearchService.AzureServiceProxy.SubmitDocumentsRequest(HttpClient client, HttpRequestMessage batchRequest, Int32 numDocs) at Microsoft.Office.Server.Search.AzureSearchService.AzureServiceProxy.SubmitDocuments(String azureServiceLocation, String authRealm, String SPOServiceTenantID, String SearchContentService_ContentFarmId, String portalURL, String testId, String farmLabel, String encryptionCert, Boolean allowUnencryptedSubmit, sSubmitDocument[] documents, sDocumentResult[]&amp; results, sAzureRequestInfo&amp; RequestInfo) ---&gt; (Inner Exception #0) System.Net.Http.HttpRequestException: An error occurred while sending the request. ---&gt; System.Net.WebException: Unable to connect to the remote server ---&gt; System.Net.Sockets.SocketException: No connection could be made because the target machine actively refused it XX.XX.XX.XXX:443 at System.Net.Sockets.Socket.EndConnect(IAsyncResult asyncResult) at System.Net.ServicePoint.ConnectSocketInternal(Boolean connectFailure, Socket s4, Socket s6, Socket&amp; socket, IPAddress&amp; address, ConnectSocketState state, IAsyncResult asyncResult, Exception&amp; exception) --- End of inner exception stack trace --- at System.Net.HttpWebRequest.EndGetRequestStream(IAsyncResult asyncResult, TransportContext&amp; context) at System.Net.Http.HttpClientHandler.GetRequestStreamCallback(IAsyncResult ar) --- End of inner exception stack trace ---&lt;--- ***

Or you may see the below exception.

AzureServiceProxy::Getcerts caught AggregateException: Unable to connect to the remote server. AzureServiceProxy::GetCerts: Failed to get encryption certificates from AzureServiceProxy:: GetAzureTenantInfo caught Aggregate Exception: Unable to connect to the remote server, unable to get Service Properties, submit is blocked. AzureServiceProxy caught Exception: *** Microsoft.Office.Server.Search.AzureSearchService.AzureException: AzurePlugin was not able to get Tenant Info from configuration server. AzureServiceProxy::SubmitDocuments: No encryption certificates found and unencrypted submit is not allowed. AzureServiceProxy::GetCerts caught AggregateException: Unable to connect to the remote server AzureServiceProxy::GetCerts: Failed to get encryption certificates from cert server * for realm *, documents will be send unencrypted (if unecrypted submit is allowed)AzureServiceProxy::GetAzureTenantInfo caught AggregateException: Unable to connect to the remote server, unable to get ServiceProperties, submit is blocked AzureServiceProxy caught Exception: *** Microsoft.Office.Server.Search.AzureSearchService.AzureException: AzurePlugin was not able to get Tenant Info from configuration server at Microsoft.Office.Server.Search.AzureSearchService.AzureServiceProxy.GetAzureTenantInfo(String portalURL, String realm, String&amp; returnPropertyValue, String propertyName)at Microsoft.Office.Server.Search.AzureSearchService.AzureServiceProxy.SubmitDocuments(String azureServiceLocation, String authRealm, String SPOServiceTenantID, String SearchContentService_ContentFarmId, String portalURL, String testId, String encryptionCert, Boolean allowUnencryptedSubmit, sSubmitDocument[] documents, sDocumentResult[]&amp; results, sAzureRequestInfo&amp; RequestInfo) **

This typically happens if Cloud Search Service Application farm is on a network that has Outbound proxy server for internet access or no internet access available from the SharePoint crawl servers. To confirm, its recommended to grab a Network trace preferably fiddler trace in context of the account running msssearch15 while crawl is running.

<strong>To fix the issue, perform the following actions</strong>

1.Ensure that servers hosting Sharepoint Cloud Search Service Application farm has access listed in these articles.(<a href="https://blogs.technet.microsoft.com/beyondsharepoint/2016/08/15/ports-and-protocols-requirement-for-the-hybrid-cloud-search-service-application/">Blog</a>, <a href="https://technet.microsoft.com/en-in/library/hh852522.aspx">TechNet</a>). A good test is also to access the urls mentioned in the <a href="https://blogs.technet.microsoft.com/beyondsharepoint/2016/08/15/ports-and-protocols-requirement-for-the-hybrid-cloud-search-service-application/">blog</a> with account running the search service in the farm.
<ol start="2">
 	<li>You also need to ensure that account running the search service (msssearch, noderunner accounts) (for crawl and Query federation scenarios to work) in the Cloud Search Service Application farm have unrestricted outbound internet access. If not, set system level proxy settings for these accounts with netsh. Below are the steps.</li>
 	<li>Make a note of the accounts (account running the search service) either from windows services or taskmanager.</li>
 	<li>Log in to a server in the farm (preferably crawl server) in the Cloud Search Service Application farm. Run the below commands</li>
</ol>
Open Internet explorer and validate proxy server has been set correctly and validate exclusions list if any.

Open a command prompt and type in netsh winhttp show proxy. (Make a note of the output to ensure what has been set currently and if you need to revert.

netsh winhttp import proxy source=ie
<ol>
 	<li>If you cannot log in to the server with the account running search service, you can launch an admin command prompt and manually update the proxy settings. If the command prompt fails to launch with the search service account and correct credentials ensure that the account has log in locally rights on the server.  Below are the steps.</li>
 	<li>Launch a command prompt with the account running the search service account.</li>
 	<li>At the command prompt, type netsh winhttp set proxy proxyservername:portnumber.</li>
</ol>
&nbsp;

Watch out this space for more such hybrid troubleshooting guidelines coming shortly.!!]]></content:encoded>
    </item>
    <item>
      <title>Announcing Hybrid Search availability for Office 365 Government community cloud (GCC); GCC High; Office365 operated by 21Vianet</title>
      <link>https://docs.microsoft.com/archive/blogs/beyondsharepoint/announcing-hybrid-search-availability-for-office-365-us-government-communication-and-office-365-operated-by-21vianet</link>
      <pubDate>Fri, 30 Jun 2017 02:12:52 GMT</pubDate>
      <dc:creator><![CDATA[Manas-MSFT]]></dc:creator>
      <guid
        isPermaLink="false">http://blogs.technet.microsoft.com/beyondsharepoint/?p=1165</guid>
      <description><![CDATA[Hybrid search has been widely adopted by SharePoint Online customers. Hybrid search makes finding...]]></description>
      <content:encoded><![CDATA[Hybrid search has been widely adopted by SharePoint Online customers. Hybrid search makes finding content easy, wherever the content lives be it in On-premises SharePoint or in SharePoint Online. You can read more about the configuration of cloud Search service application <a href="https://blogs.msdn.microsoft.com/spses/2015/09/15/cloud-hybrid-search-service-application/">here</a>. Office365 customers had been leveraging the benefits of this service for some time, however it was not possible to configure cloud Search service application for Office 365 <a href="https://products.office.com/en-us/government/compare-office-365-government-plans">US Government community cloud </a>or in <a href="https://support.office.com/en-us/article/Learn-about-Office-365-operated-by-21Vianet-A8AB5061-3346-4DA0-BB7C-5260822B53AE">Office 365</a> operated by 21Vianet. SharePoint engineering has just enabled this capability which means that the cloud Search service application can now be configured for both <a href="https://products.office.com/en-us/government/compare-office-365-government-plans">US Government community cloud </a>(GCC) Office 365 tenants as well as in Office 365 tenants operated by 21Vianet.

The overall configuration guidelines remain the same as documented in <a href="https://support.office.com/en-us/article/Plan-cloud-hybrid-search-for-SharePoint-33926857-302c-424f-ba78-03286cf5ac30">Office.com</a> or in our <a href="https://blogs.msdn.microsoft.com/spses/2015/09/15/cloud-hybrid-search-service-application/">blog</a> , except that you have to leverage the newest version of the onboarding script, and for US Government tenants the parameter and value “-IsPortalForUSGovernment $true” must be added when running the script (also described in the overall configuration guidelines now). Latest onboarding script can be downloaded from <a href="https://www.microsoft.com/en-us/download/details.aspx?id=51490">https://www.microsoft.com/en-us/download/details.aspx?id=51490</a>.  Please remember to upgrade your Azure Active Directory <a href="https://connect.microsoft.com/site1164/content/content.aspx?ContentID=32016">powershell module</a> which supports modern authentication Active Directory Authentication Library (ADAL) and device management before you execute the script.

Example usage of the scripts:

.\CreateCloudSSA.ps1 -SearchServerName &lt;OnPremSharePointServerName&gt; -SearchServiceAccount &lt;OnPremSharePointAdminAccount&gt; -SearchServiceAppName &lt;CloudSSAName&gt; -DatabaseServerName &lt;OnPremSharePointDatabaseServerName&gt;

<u>#For US Government environment</u>

Import-Module MSOnline

.\OnBoard-CloudHybridSearch.ps1 -PortalUrl &lt;SPOTenantPortalUrl&gt; -CloudSsaId &lt;CloudSSANameCreatd&gt; -IsPortalForUSGovernment $true

<u>#For environments other than US Government</u>

Import-Module MSOnline

.\OnBoard-CloudHybridSearch.ps1 -PortalUrl &lt;SPOTenantPortalUrl&gt; -CloudSsaId &lt;CloudSSAName&gt;

&nbsp;

<strong>*****SharePoint engineering has enabled cloud Search service application configuration capability for <a href="https://technet.microsoft.com/en-us/library/mt774968.aspx">GCC High </a>tenants as well.*****</strong>

This was a functionality that has been requested for quite some time and it’s so amazing to see it going live.]]></content:encoded>
    </item>
    <item>
      <title>Announcing Extended Word breaking capabilities for Search in SharePoint Online</title>
      <link>https://docs.microsoft.com/archive/blogs/beyondsharepoint/search-extended-word-breaking</link>
      <pubDate>Sat, 17 Jun 2017 05:37:45 GMT</pubDate>
      <dc:creator><![CDATA[Manas-MSFT]]></dc:creator>
      <guid
        isPermaLink="false">http://blogs.technet.microsoft.com/beyondsharepoint/?p=985</guid>
      <description><![CDATA[In an endeavor to improve the SharePoint Online search experience, engineering has released two new...]]></description>
      <content:encoded><![CDATA[In an endeavor to improve the SharePoint Online search experience, engineering has released two new managed property settings: <strong>Language Neutral Tokenization</strong> and <strong>Finer Query Tokenization</strong>. These are available as two checkboxes when you create any new managed property, or when you edit a custom managed property. You won’t see these checkboxes when you edit any of the managed properties that come with SharePoint by default.

<strong>What is tokenization</strong>

Tokenization is the process of breaking a stream of text up into words, phrases, symbols, or other meaningful elements called tokens. The token is the smallest element of information one can search for. Tokenization is useful both in linguistics (where it is a form of text segmentation), and to handle specific entities like email addresses, phone numbers, and URLs. A basic strategy for tokenization is to break words on white spaces and replace non-alphanumerical characters, such as punctuation marks, with white space. Breaking on white spaces works fine for a language like English, but not so well for East Asian languages, which don’t use spaces between words. In some languages, removing diacritics changes the meaning of the word. Therefore, search tokenizes according to the language it detects in the content. In certain situations, language dependent tokenization results in fewer matches for a query.

When a search query is processed, the query is fragmented that is broken into smaller parts. SharePoint search by default breaks the indexed content into smaller parts than it does with queries. As of today, if a query contains alphanumerical characters, the coarser tokenization of queries might result in search not finding a match for the query.

Search discovers information by crawling items on your site. The discovered content and metadata are called the properties of the item. The search schema has a list of crawled properties that helps the crawler decide what content and metadata to extract.

Let us look at what these properties are expected to do<strong>.</strong>

<strong>Language Neutral Tokenization</strong>: If you have multilingual content and the managed property contains tags that are based on metadata term sets or other identifiers, using language neutral tokenization for the content of the managed property helps finding a match for the query. Search depends on language when it breaks queries and content into parts (tokenization).

For example, there are few documents in a library that has contents in both English and Chinese. You decide to assign a unique identifier to each of these documents and create a column called “MyDocLibID” and assign a identifier that contains non-alphanumerical characters, such as “ID#161516”. A crawl property will be created automatically. You create a new managed property and map the two to each other, so users can search the “Document identifier” column by querying against the column’s managed property.

Query experience will vary if you decide to keep the default tokenization or if you choose to turn on the Language Neutral Tokenization on the “MyDocLibID” managed property. This is because the identifiers would be tokenized differently based on if the property is enabled or not. If the languages are different, search might not find a match for the query. Turn on language neutral tokenization for the “MyDocLibID” managed property so all identifiers are tokenized the same way. The query is browser locale independent and users would be able to query for MyDocLibID: ID#161516 and lookup the document.

<strong>Finer Query Tokenization</strong>: Consider turning on finer query tokenization for a custom managed property if it contains separators such as dots and dashes. Search tokenizes queries coarser than content. If a managed property "ID" contains the string "1-23-456#7", and you query ID:"1-23", you might not get a partial match because search didn't break the query into small enough parts. By default, search returns partial matches between queries against a managed property and its content. If you want to do a partial match, like “1-23-456”, search might not find a match because queries are tokenized more coarsely than content. If you turn on finer tokenization, it’s more probable that search finds a match for the queries. Consider selecting finer query tokenization if the content of this managed property contains separators such as dots and dashes.

<strong>Configuration Guidelines</strong>

Configuration for search schema can be performed either at single site collection level or at tenant level. Any changes you make on a site collection, only apply to that site collection. There is not a preference on one over the other, however personally I would prefer to turn it on a site collection level since a managed property would ideally be specific to the site. You need to do a re-crawl before the property mapping would work.

<strong><u>Tenant Level Search Schema Configuration</u></strong>
<ol>
 	<li>Browse to a <strong>Document library</strong> within a SharePoint site and create a column from within the document library settings. Choose single line text as the column type. Name the column as</li>
 	<li>Upload a document of different language and add a value to MyDocLibID column example ID#161516.<a href="https://msdnshared.blob.core.windows.net/media/2017/06/DocumentsLib.png"><img width="964" height="152" class="alignnone wp-image-1025 size-full" alt="" src="https://msdnshared.blob.core.windows.net/media/2017/06/DocumentsLib.png" /></a></li>
 	<li>Browse to SharePoint admin center with a <strong>Global administrator</strong> or a <strong>SharePoint administrator </strong>account.</li>
 	<li>Click on <strong>Search</strong> from the left navigation.</li>
 	<li>Within Search Administration, click on <strong>Manage Search Schema</strong>.</li>
 	<li>Click on <strong>Crawled Properties</strong><strong>.</strong><a href="https://msdnshared.blob.core.windows.net/media/2017/06/ManagedProperties.png"><img width="1024" height="74" class="alignnone wp-image-1045 size-large" alt="" src="https://msdnshared.blob.core.windows.net/media/2017/06/ManagedProperties-1024x74.png" /></a></li>
 	<li>Search automatically creates crawled properties for the columns that has been created. Example if you have created a column in your document library called <strong>MyDocLibID, </strong>you can search for the same in the list of<strong> Crawled Properties. </strong>It should return the property name as<strong> ows_MyDocLIbID. </strong>At this stage the property is not mapped to any managed property<strong>.</strong></li>
 	<li><a href="https://msdnshared.blob.core.windows.net/media/2017/06/Ows_.png"><img width="445" height="200" class="alignnone wp-image-1055" alt="" src="https://msdnshared.blob.core.windows.net/media/2017/06/Ows_.png" /></a></li>
 	<li>Next you need to create a managed property and map the crawl property. Click on <strong>Managed Properties </strong>and click<strong> New Managed Property.<a href="https://msdnshared.blob.core.windows.net/media/2017/06/Managed_Prop_Create.png"><img width="300" height="263" class="alignnone size-medium wp-image-1065" alt="" src="https://msdnshared.blob.core.windows.net/media/2017/06/Managed_Prop_Create-300x263.png" /></a></strong></li>
 	<li>In this example, our focus will be only in the two new properties, as rest of property functionality remains the same as of today. Type in a name of the managed property example “MyDocLibID”.</li>
 	<li>          <a href="https://msdnshared.blob.core.windows.net/media/2017/06/Mydoc.png"><img width="300" height="158" class="alignnone size-medium wp-image-1075" alt="" src="https://msdnshared.blob.core.windows.net/media/2017/06/Mydoc-300x158.png" /></a></li>
 	<li>I have made the property Queryable, Retrievable, Safe (as I want to test anonymous user query functionality), Token Normalization.The key properties for this functionality to work is <strong>Language Neutral Tokenization</strong>, &amp; <strong>Finer Query Tokenization. </strong>Select the check boxes next to these properties.</li>
 	<li>  <a href="https://msdnshared.blob.core.windows.net/media/2017/06/Fine.png"><img width="300" height="202" class="alignnone size-medium wp-image-1085" alt="" src="https://msdnshared.blob.core.windows.net/media/2017/06/Fine-300x202.png" /></a></li>
 	<li>Map the managed property to crawl property that was created for the document library, in this case <strong>ows_MyDocLIbID</strong>. Within <strong>Mappings to crawled properties </strong>section click on <strong>Add a Mapping.</strong></li>
</ol>
<a href="https://msdnshared.blob.core.windows.net/media/2017/06/mapping.png"><img width="1024" height="141" class="alignnone wp-image-1095 size-large" alt="" src="https://msdnshared.blob.core.windows.net/media/2017/06/mapping-1024x141.png" /></a>

15.From within <strong>Crawl property selection </strong>search for ows_MyDocLibID and from within the result select the same and click on <strong>OK</strong> to add the mapping.

<a href="https://msdnshared.blob.core.windows.net/media/2017/06/crawled.png"><img width="300" height="241" class="alignnone size-medium wp-image-1096" alt="" src="https://msdnshared.blob.core.windows.net/media/2017/06/crawled-300x241.png" /></a>

16.This completes the configuration. Run a recrawl for all site collection that you want to leverage the property mapping you made.

17. Navigate to a search center and lookup a document that has the associate id. Example https://&lt;tenanturl&gt;.sharepoint.com/_layouts/15/osssearchresults.aspx?u=https%3A%2F%2Ftenanturl%2Esharepoint%2Ecom&amp;k=ID%23161516.

<a href="https://msdnshared.blob.core.windows.net/media/2017/06/Search.png"><img width="500" height="217" class="alignnone wp-image-1107" alt="" src="https://msdnshared.blob.core.windows.net/media/2017/06/Search-300x130.png" /></a>

Search schema can be changed for a specific site collection or the whole tenant. A change on a site collection level schema applies only to that site collection whereas the tenant level schema change applies to all site collections across the tenant. We have already discussed about tenant level schema change, let us now look at a site collection level schema change.

<strong><u>Site Collection Level Search Schema Configuration</u></strong>
<ol>
 	<li>Browse to your site with a site collection administrator.</li>
 	<li>Click <strong>Settings</strong>, and then click <strong>Site settings</strong>.</li>
 	<li>Under <strong>Site Collection Administration</strong>, click <strong>Search Schema.</strong></li>
 	<li><a href="https://msdnshared.blob.core.windows.net/media/2017/06/Site.png"><img width="195" height="198" class="alignnone size-full wp-image-1115" alt="" src="https://msdnshared.blob.core.windows.net/media/2017/06/Site.png" /></a></li>
 	<li>In the <strong>Property Name</strong> column on the <strong>Managed Properties</strong> tab, in the <strong>Filter</strong> box type the <strong>Name</strong> of the <strong>Managed Property</strong><a href="https://msdnshared.blob.core.windows.net/media/2017/06/edit.png"><img width="1024" height="152" class="alignnone wp-image-1125 size-large" alt="" src="https://msdnshared.blob.core.windows.net/media/2017/06/edit-1024x152.png" /></a></li>
 	<li> Optionally you can create a new one by clicking on the <strong>New Managed Property</strong> tab.</li>
 	<li><a href="https://msdnshared.blob.core.windows.net/media/2017/06/New.png"><img width="400" height="202" class="alignnone wp-image-1135" alt="" src="https://msdnshared.blob.core.windows.net/media/2017/06/New-300x152.png" /></a></li>
 	<li>New Managed property creation steps at site collection level are identical to the ones we discussed above for tenant level. Follow the steps below if you are editing an existing custom managed property. From search results in step 4 above click on the managed property, and select<strong> Edit/Map property</strong>.</li>
 	<li>Scroll down to the new settings on the <strong>Edit Managed Property</strong> page, check the two new managed properties (Language Neutral Tokenization, Finer Query Tokenization) to turn on the new capabilities and then click <strong>OK</strong>.</li>
 	<li><a href="https://msdnshared.blob.core.windows.net/media/2017/06/sitelevel.png"><img width="300" height="277" class="alignnone size-medium wp-image-1136" alt="" src="https://msdnshared.blob.core.windows.net/media/2017/06/sitelevel-300x277.png" /></a></li>
 	<li>Now if you look up documents associated with this manage property, you will be able to leverage the enhanced Wordbreaking features mentioned above.</li>
</ol>
Search schema controls what users can search for and how you can present the results to your end users. The two new properties <strong>Language Neutral Tokenization</strong> and <strong>Finer Query Tokenization </strong>would enhance the end user experience while looking up multilingual, special character titled documents, in a much more streamlined manner.]]></content:encoded>
    </item>
    <item>
      <title>Configuring Hybrid Self-Service Site Creation</title>
      <link>https://docs.microsoft.com/archive/blogs/beyondsharepoint/configuring-hybrid-self-service-site-creation</link>
      <pubDate>Mon, 24 Apr 2017 03:15:04 GMT</pubDate>
      <dc:creator><![CDATA[Neil Hodgkinson - MSFT - MCM]]></dc:creator>
      <guid
        isPermaLink="false">http://blogs.technet.microsoft.com/beyondsharepoint/?p=895</guid>
      <description><![CDATA[Deploying and initial configuration of hybrid self-service site creation is done by using the...]]></description>
      <content:encoded><![CDATA[<h2><span><u> </u></span></h2>
Deploying and initial configuration of<span> hybrid self-service site creation is done by using the hybrid picker in the SharePoint Online admin center, </span><span>select at least the “Hybrid Self-Service site creation” , input the web application farm and complete the Hybrid Picker execution. Then, in on premises central admin you will also see a top line banner to indicate that the farm meets the prerequisites for hybrid self service site creation.</span>

Note that the Hybrid Self Service Site Creation feature requires SharePoint Server 2013 March 2017 Public Update and is not yet available for SharePoint Server 2016.

<span> <a href="https://msdnshared.blob.core.windows.net/media/2017/04/banner1.png"><img class="alignleft wp-image-905" alt="banner" src="https://msdnshared.blob.core.windows.net/media/2017/04/banner1.png" width="1077" height="247" /></a></span>
<h3></h3>
<h3></h3>
<h3></h3>
<h3></h3>
<h3></h3>
<h3></h3>
<h3><a></a>To configure hybrid self-service site creation</h3>
<ol>
 	<li>Log on to a server in your SharePoint Server farm as the farm administrator.</li>
 	<li>From your SharePoint Server computer, open a web browser and log on to Office 365 as a global administrator.</li>
 	<li>In the SharePoint Online Admin Center, click configure hybrid.</li>
 	<li>On the hybrid picker page, click Hybrid Picker.</li>
 	<li>Follow the wizard and choose Hybrid self-service site creation when prompted, noting that additional information is required before the feature can be deployed.<u> <a href="https://msdnshared.blob.core.windows.net/media/2017/04/hssc1.png"><img class="wp-image-915 aligncenter" alt="hssc1" src="https://msdnshared.blob.core.windows.net/media/2017/04/hssc1.png" width="514" height="482" /></a>
</u></li>
 	<li>When prompted, choose the web application with which you want to use hybrid self-service site creation.<a href="https://msdnshared.blob.core.windows.net/media/2017/04/hsss2.png"><img class=" wp-image-925 aligncenter" alt="hsss2" src="https://msdnshared.blob.core.windows.net/media/2017/04/hsss2.png" width="517" height="481" /></a></li>
 	<li>When the web application has been provided, the feature selection show as the screen shot below<img class=" wp-image-935 aligncenter" alt="hsss3" src="https://msdnshared.blob.core.windows.net/media/2017/04/hsss3.jpg" width="502" height="465" /></li>
 	<li>When the hybrid picker wizard completes, hybrid self-service site creation will be enabled for the web application that you selected.<u><span> </span></u></li>
</ol>
<h3><a></a><span>Manage hybrid self-service site creation</span><span> in Central Administration</span></h3>
Once you have configured hybrid self-service site creation, you can manage it in the SharePoint Central Administration website.

<a href="https://msdnshared.blob.core.windows.net/media/2017/04/hsss4.png"><img class="wp-image-936 aligncenter" alt="hsss4" src="https://msdnshared.blob.core.windows.net/media/2017/04/hsss4.png" width="954" height="398" /></a>

Note: that while Self Service Site Creation can also be enabled and configured in the Manage Web Applications section of Central Administration (<span style="text-decoration: underline"><span style="color: #3366ff;text-decoration: underline"><a href="http://%3cca/">http://&lt;CA</a> SITE URL&gt;/_admin/WebApplicationList.aspx</span></span>). The Hybrid Self Service Site Creation can only be managed from one place in the User Interface as described below.
<ol>
 	<li>In Central Administration, click <strong>Application Management</strong>.</li>
 	<li>On the Application Management page, under <strong>Site Collections</strong>, click <strong>Configure self-service site creation</strong>.</li>
 	<li>In the <strong>Web Application</strong> section, select the web application where you want to manage hybrid self-service site creation, and then select or clear the <strong>Create Site Collections in SharePoint Online</strong> check box.</li>
 	<li>Click <strong>OK</strong></li>
</ol>
<strong>Note:</strong> While hybrid users of this web application will be redirected to SharePoint Online for self-service site creation, the other settings on this page continue to apply to any on-premises only users.
<h3><span>Manage hybrid self-service site creation with PowerShell</span></h3>
<span>You can manage Hybrid Self Service Site Creation for a web application with PowerShell as follows</span>

<span> </span>
<ol>
 	<li><span><span><span>Get the Web Application Object
<span style="color: #3366ff">$webapp = Get-SPWebApplication <span style="text-decoration: underline"><a href="http://%3cweb/">http://&lt;web</a></span> application url&gt;</span></span></span></span>&nbsp;</li>
 	<li><span><span>To Check the current setting of SelfServiceSiteCreationOnlineEnabled property
<span style="color: #3366ff">$webapp.SelfServiceSiteCreationOnlineEnabled</span>
returns True or False
</span></span><span><span>
</span></span></li>
 	<li><span><span><span>To enable the feature, update the property to True and Validate
<span style="color: #3366ff">$webapp.SelfServiceSiteCreationOnlineEnabled = $true</span>
<span style="color: #3366ff"> $webapp.update()</span>
<span style="color: #3366ff"> $webapp.SelfServiceSiteCreationOnlineEnabled</span>
Will return True</span></span></span>&nbsp;</li>
 	<li><span><span>T</span></span><span><span>o disable the feature update the property to False and Validate
<span style="color: #3366ff">$webapp.SelfServiceSiteCreationOnlineEnabled = $false</span>
<span style="color: #3366ff"> $webapp.update()</span>
<span style="color: #3366ff"> $webapp.SelfServiceSiteCreationOnlineEnabled</span>
Will return False</span></span></li>
</ol>
<h3><a></a><span>Validating Hybrid Self Service Site Creation</span></h3>
<span> To validate the Hybrid Self Service Site Creation feature is operational follow the steps below</span>

<span> </span>
<ol>
 	<li><span>Login to the on premises web application configured for hybrid self service sites above as a hybrid enabled user. This means a user synchronized to Office 365 and enabled for hybrid workloads via an audience as explained above.</span></li>
 	<li><span>Navigate to the url in the Self Service Site Collection Management page, the image above shows <a href="https://sharepoint.nellymo.net/_layouts/scsignup.aspx">https://&lt;On Premises Site url&gt;/_layouts/scsignup.aspx</a></span></li>
 	<li><span><span>A hybrid enabled user will be redirected to O365 Groups Creation page. You may be asked to authenticate and then the following screen is displayed</span></span><a href="https://msdnshared.blob.core.windows.net/media/2017/04/hsss5.png"><img class="aligncenter wp-image-946" alt="hsss5" src="https://msdnshared.blob.core.windows.net/media/2017/04/hsss5.png" width="795" height="636" /></a></li>
 	<li><span>Enter the required settings and then click Next. Also note the TeamSite name and email address are checked for uniqueness</span></li>
 	<li><span><span>Add additional Owners and members if required which the group and site are being created. Click finish when the button is activated</span></span><a href="https://msdnshared.blob.core.windows.net/media/2017/04/hsss6.png"><img class="wp-image-955 aligncenter" alt="hsss6" src="https://msdnshared.blob.core.windows.net/media/2017/04/hsss6.png" width="755" height="565" /></a></li>
 	<li><span>You will be redirected to the new Site Collection in the O365 tenant </span></li>
</ol>
<span><a href="https://msdnshared.blob.core.windows.net/media/2017/04/hsss7.png"><img class="wp-image-965 aligncenter" alt="hsss7" src="https://msdnshared.blob.core.windows.net/media/2017/04/hsss7.png" width="733" height="501" /></a></span>

<span> </span>

You have now successfully enabled and configured Hybrid Self Service Sites Creation for SharePoint Server 2013 and Office 365]]></content:encoded>
    </item>
    <item>
      <title>Restrict disabled users from showing up in SharePoint Online search results</title>
      <link>https://docs.microsoft.com/archive/blogs/beyondsharepoint/restrict-disabled-users-in-search-results</link>
      <pubDate>Fri, 11 Nov 2016 04:42:55 GMT</pubDate>
      <dc:creator><![CDATA[Manas-MSFT]]></dc:creator>
      <guid
        isPermaLink="false">http://blogs.technet.microsoft.com/beyondsharepoint/?p=865</guid>
      <description><![CDATA[An interesting ask came up the other day , “Is there a possibility to restrict disabled users from...]]></description>
      <content:encoded><![CDATA[An interesting ask came up the other day , “Is there a possibility to restrict disabled users from showing up in SharePoint Online search results” Thanks to our friend Sridhar Narra who  shared some great insights to the solution. To achieve these we need to make few changes to On-Premise Active Directory.

1.Set  msExchHideFromAddressLists property of the user that needs to be  hidden from people search or Delve to True or 1.

2.Azure Active Directory Sync should synchronize the changes to Office365 directory services.

3.The change would eventually propagate  all the way up to SharePoint Online (SPO)User Profiles.

4.Once changes are synched to User profiles, incremental crawl should crawl the profiles that were set with SPSHideFromAddressLists property.

5.To verify crawl has updated the index with the above changes, perform the steps below

Browse to search center in SharePoint Online and click on People search vertical. Type below query and you should see the result of the person that you intend to hide, example

<em>https://contoso.sharepoint.com/search/Pages/peopleresults.aspx?k=manas%20biswas</em><em> </em>

To hide profiles with SPSHideFromAddressLists property updated in search index,example

<em>https:// contoso.sharepoint.com/search/Pages/peopleresults.aspx?k=manas%20biswas%20-sps-hidefromaddresslists:1  </em>

6.Finally following steps allow default people search to exclude all profiles with SPS-HideFromAddressLists set.
<ol>
 	<li>Browse to enterprise search people results page example https://contoso.sharepoint.com/search/Pages/peopleresults.aspx</li>
 	<li>Edit Search Results page.</li>
 	<li>Edit People Results Web part.</li>
 	<li>Change query.</li>
 	<li>Change Query Text from {searchboxquery} to {searchboxquery} –“SPS-HideFromAddressLists”:1</li>
 	<li>Apply changes.</li>
 	<li>Check-in changes and publish the page.</li>
</ol>
Now disabled users should no longer show up in search results.]]></content:encoded>
    </item>
    <item>
      <title>Considerations when deploying SharePoint &amp; Office365 Hybrid workloads in a farm utilizing Provider hosted add-ins or workflow manager</title>
      <link>https://docs.microsoft.com/archive/blogs/beyondsharepoint/considerations-when-deploying-sharepoint-office365-hybrid-workloads-in-a-farm-utilizing-provider-hosted-add-ins-or-workflow-manager</link>
      <pubDate>Thu, 15 Sep 2016 03:21:39 GMT</pubDate>
      <dc:creator><![CDATA[Manas-MSFT]]></dc:creator>
      <guid
        isPermaLink="false">http://blogs.technet.microsoft.com/beyondsharepoint/?p=855</guid>
      <description><![CDATA[Updated with Remediation Script and KB Article references - 17th January 2017

This article is...]]></description>
      <content:encoded><![CDATA[<span style="color: #ff0000"><strong>Updated with Remediation Script and KB Article references - 17th January 2017</strong></span>

This article is written with Thanks and accreditation to Nico Martens who first raised this issue and worked with Microsoft to validate his solution, outlined <a href="http://www.sharepointrelated.com/2016/08/11/fixing-apps-configuring-cloud-hybrid-search/">here</a> . The original post highlighted an issue with Cloud Hybrid Search however this affects all Hybrid workloads utilizing a Server to Server (S2S) trust between SharePoint and Office365.

Scenario: We are going to focus on couple of use cases that can lead to this situation. Intention is to implement Hybrid workload on a new or existing SharePoint Farm with either
<ol>
 	<li>You have a SharePoint 2013 or SharePoint 2016 farm where you plan to implement provider hosted add-ins and/or associate with workflow manager.</li>
 	<li>You have a SharePoint 2013 or SharePoint 2016 farm that already has provider hosted add-ins and/or leverages workflow manager.</li>
</ol>
When you try to establish a S2S trust via the Cloud SSA onboarding script or Hybrid picker, the authentication realm of the on premises Farm is updated to match the Office 365 tenant context id. Within the script we set it using Set-SPAuthenticationRealm. Once the authentication realm is changed, existing SharePoint Add-ins fail to authenticate; users will get a HTTP 401 when they are redirected to the add-ins.

The reason for this authentication failure is due to how provider hosted Add-ins are authorized to access SharePoint. SharePoint Add-ins are associated with SPTrustedSecurityTokenIssuers using the IssuerId and on request it tries to get a token from the Secure Token issuer (STS). The token issuers are tied to the authentication realm and once the realm is changed, the SharePoint Add-ins can no longer authenticate successfully. The trustedtokenissuer with the correct IssuerId still exists in the farm but it is associated with the previous authentication realm.

In effect; the RegisteredIssuerName is IssuerId@OldAuthRealmGuid where the oldAuthRealmGuid no longer matches the current AuthRealmGuid. The Add-in fails to authenticate because no matching tokenissuer can be found by the STS. The error message can be seen in ULS and clearly indicate that the token issuer is no longer trusted (because its RealmID doesn’t match the farm anymore) <strong><em> SPApplicationAuthenticationModule: Failed to authenticate request, unknown error. Exception details: System.IdenitytModel.Tokens.SecurityTokenException: The issues of the token is not a trusted issuer.</em></strong>

So, based on our two scenarios listed above, what can we do? Well, the answer depends on which scenario you are trying to solve. Let’s look at them in turn.

<span style="margin: 0px;line-height: 107%;font-family: 'Calibri',sans-serif;font-size: 11pt"><u><span style="color: #000000">Scenario One</span></u></span>

Here you have not yet implemented Hybrid workloads, nor have you implemented Add-ins or workflow manager. In this scenario, the only thing you need to do is ensure you implement the hybrid workloads requiring S2S, before you implement the Provider hosted Add-ins or workflow manager. The Add-ins will then be registered after the SPAuthenticationRealm has been updated to match the Office 365 tenant contextID and as such will always work because the Realm will not change again. Even if additional hybrid workloads are added or reconfigured, the RealmID will remain the same as the Office 365 tenant context ID.

<u>Scenario Two</u>

Here you have an existing set of Add-ins already deployed and these have of course been registered using the RegisteredIssuerName containing the original RealmID of the farm. When you implement Hybrid, the RealmID is changed to match the tenant ID of your Office365 subscription causing add-ins to cease working as explained above. To restore SharePoint add-in functionality, we have to re-register the provider hosted add-ins but using the RegisteredIssuerName containing the new RealmID. After this, you need to reapply the Add-in permissions for each individual Add-in instance, following which the Add-ins will operate successfully once more.

This behavior is by design. When implementing SharePoint Hybrid features you need to carefully consider the additional workloads at play in the farm especially when provider hosted add-ins are being used.

<span><span style="color: #000000;font-family: Calibri">The second aspect of Scenario 2 involves workflow manager. </span></span>
<p style="text-align: left"><span><span style="color: #000000;font-family: Calibri">The Workflow Manager TrustedSecurityTokenIssuer uses a wildcard realm (e.g. “&lt;guid&gt;@*”) instead of a specific realm identifier. This means workflows will keep working even  after changing the SPAuthenticationRealm.</span></span></p>
<u>Remediation process</u>

The authors have developed a solution to repair the PHA instances on a SharePoint Server farm which is based on (with acknowledgement and permission) the sterling work done by Nico Martens on his <a href="http://www.sharepointrelated.com/2016/08/11/fixing-apps-configuring-cloud-hybrid-search/">post</a>.

Additionally, if you deploy the hybrid features after January 8th 2017, this remediation logic is now also built into the hybrid picker from Office 365.  For hybrid search (outbound/inbound query federation or Cloud Hybrid Search Service Application) a manual approach is needed to remediate this scenario. Microsoft have released a KB article with the relevant information <a target="_blank" href="https://support.microsoft.com/en-us/help/4010011/fix-authentication-realm-issue-sharepoint" rel="noopener noreferrer">here </a>and we have now developed a pre-built remediation scrip based of this information for hybrid search based scenarios.

The remediation script is located <a target="_blank" href="https://github.com/SharePoint/PnP-Tools/blob/master/Scripts/SharePoint.Hybrid.CloudSSA.Configuration/AuthenticationRealmFixUp.ps1" rel="noopener noreferrer">here</a>. Download and execute on your farm to remediate the problems with PHAs

For Workflow Manager connection the process is slightly different and involves recreation of the WorkFlow Manager Proxy Connection. The Script to perform this action is <a target="_blank" href="https://github.com/SharePoint/PnP-Tools/blob/master/Scripts/SharePoint.Hybrid.CloudSSA.Configuration/WorkflowManagerfixUp.ps1" rel="noopener noreferrer">here.</a> Download and execute it on the farm to repair the connection.

Workflow manager fix up script along with Cloud Search Service Application and Supporting Scripts for Deployment and Configuration can be downloaded <a href="https://github.com/SharePoint/PnP-Tools/tree/master/Scripts/SharePoint.Hybrid.CloudSSA.Configuration">here</a>.]]></content:encoded>
    </item>
    <item>
      <title>Ports and Protocols requirement for the Hybrid Cloud Search Service Application</title>
      <link>https://docs.microsoft.com/archive/blogs/beyondsharepoint/ports-and-protocols-requirement-for-the-hybrid-cloud-search-service-application</link>
      <pubDate>Mon, 15 Aug 2016 06:37:03 GMT</pubDate>
      <dc:creator><![CDATA[Neil Hodgkinson - MSFT - MCM]]></dc:creator>
      <guid
        isPermaLink="false">http://blogs.technet.microsoft.com/beyondsharepoint/?p=825</guid>
      <description><![CDATA[In response to a number of requests for this information we are posting the Ports and Protocols...]]></description>
      <content:encoded><![CDATA[In response to a number of requests for this information we are posting the Ports and Protocols requirements for the Cloud Search Service Application.

Generally we assume outbound internet access is granted to all network resources but of course this is not always true and rarely true for server based applications in corporate datacenters.

The hybrid cloud search service application has five main connection points required for outbound internet access, all operate on HTTPS on Port 443.

The first url is to the provisioning api which is called only when establishing the configuration and deployment of the Cloud SSA for the first time. This endpoint is accessible via public internet as well as Express Route with Microsoft peering.
<ul>
 	<li>Provisioning: <a href="https://provisioningapi.microsoftonline.com/provisioningwebservice.svc">https://provisioningapi.microsoftonline.com</a></li>
</ul>
The second is the tenant url for connecting to the Office 365 tenancy.This endpoint is accessible via public internet as well as Express Route with Microsoft peering.
<ul>
 	<li>Tenant: <a href="https://contoso.sharepoint.com">https://contoso.sharepoint.com</a></li>
</ul>
The third is the Azure ACS (Azure Access Control Services) endpoint to proxy the S2S trust between the on premises farm and Office 365. This endpoint is accessible only via public internet .
<ul>
 	<li> <a href="https://accounts.accesscontrol.windows.net">https://accounts.accesscontrol.windows.net </a></li>
</ul>
Fourth,  and the less well known requirement.  You need to establish connectivity to the regional Search Content Service (SCS) for pushing the parsed content batches to the Office 365 Search Service. These endpoints are accessible via public internet as well as Express Route with Azure public peering.
<ul>
 	<li>*.search.production.us.trafficmanager.net</li>
 	<li>*.search.production.emea.trafficmanager.net</li>
 	<li>*.search.production.apac.trafficmanager.net</li>
</ul>
You only need to provide access to the SCS endpoints in your region as high availability is provided within the same region just as we do with your content.

The final connection point is only needed when providing outbound hybrid search query federation from the on premises farm to Office 365. In this case you need to allow the servers in the farm that host Query Processing components the ability to connect to the url of your root site in SharePoint Online. Typically this is https://tenantname.sharepoint.com. These endpoints are accessible via public internet as well as Express Route with Azure public peering

Note: For more information regarding the different types of peering mentioned above take a look at this <a href="https://azure.microsoft.com/en-gb/documentation/articles/expressroute-introduction/">article</a>.]]></content:encoded>
    </item>
    <item>
      <title>Hybrid Configuration Wizard</title>
      <link>https://docs.microsoft.com/archive/blogs/beyondsharepoint/hybrid-configuration-wizard</link>
      <pubDate>Fri, 12 Aug 2016 08:20:56 GMT</pubDate>
      <dc:creator><![CDATA[Manas-MSFT]]></dc:creator>
      <guid
        isPermaLink="false">http://blogs.technet.microsoft.com/beyondsharepoint/?p=625</guid>
      <description><![CDATA[As the next part of the Hybrid Blog Series we are introducing a frequently asked for automation...]]></description>
      <content:encoded><![CDATA[<span>As the next part of the Hybrid Blog Series we are introducing a frequently asked for automation script. This script will configure On Premises SharePoint 2013 with Office 365 SharePoint Online to enable hybrid search query federation.</span>
<p style="text-align: left"><em>This script and blog article are for use in configuring an outbound search hybrid experience between SharePoint 2013 Server and SharePoint Online. In preliminary testing this also works with SharePoint 2016.</em></p>
<span>For any feedback, improvements, feature requests or bug fixes please place comments below. </span>
<h4><span><em>Pre Requisites for completing the configuration process</em></span><span> </span></h4>
<ul>
 	<li><span>You need to log in to SharePoint Server with an account that has farm administrator and a local server admin privilege. </span></li>
 	<li><span>The account should also be a local administrator across all SharePoint boxes in the farm.</span></li>
 	<li><span>The script assumes that the Root Site Collection of the SharePoint Web Application either is a search center or has a search center web within it e.g. <a href="http://sharepoint.contoso.com/search"><em>http://sharepoint.contoso.com/search</em></a> . If this is not the case, then additional configuration of result sources and query rule will be required to retrieve search results from SharePoint online. </span></li>
</ul>
<h4><span><em>Executing the Configuration Wizard</em></span><span> </span></h4>
<ol>
 	<li>Extract <strong>hybridwizard.ps1</strong> and the resources files from the downloaded zip archive to a folder named <strong>c:\scripts</strong>. This is a requirement for this version, however in a future release we will include a direct download capability for updated components.</li>
 	<li> You can execute the script from the ISE or from the PowerShell command console</li>
 	<li><span> </span>Open Elevated PowerShell Session or elevated ISE session and execute hybridwizard.ps1.</li>
</ol>
<a href="https://msdnshared.blob.core.windows.net/media/2016/08/Image1.png"><img width="300" height="113" class="alignnone size-medium wp-image-635" alt="Image1" src="https://msdnshared.blob.core.windows.net/media/2016/08/Image1-300x113.png" /></a>

<a href="https://msdnshared.blob.core.windows.net/media/2016/08/Image2.png"><img width="300" height="61" class="alignnone size-medium wp-image-645" alt="Image2" src="https://msdnshared.blob.core.windows.net/media/2016/08/Image2-300x61.png" /></a>

<span>4.</span><span>Expect a short delay while SharePoint Snappin is loaded followed by the mainform loading. If executing the wizard in ISE the form may launch behind the ISE session.</span>

<a href="https://msdnshared.blob.core.windows.net/media/2016/08/Image3.png"><img width="284" height="300" class="alignnone size-medium wp-image-655" alt="Image3" src="https://msdnshared.blob.core.windows.net/media/2016/08/Image3-284x300.png" /></a>

<span>The main screen currently defaults to using a new <strong>self-signed certificate</strong> for configuring the <strong>STS trust</strong>. Optionally you can select the current default <strong>STS certificate</strong>.          </span>

<span>The textbox next to the <strong>New Self Signed Certificate</strong> option will be used as the friendly name for the certificate and as the name for the result source and query rule.</span>

<span>Some options on the form are disabled and will be enabled in a future release of the wizard.</span>

<span> </span><strong>Account Privilege Validation</strong>

<span> 5. </span><span>Click <strong>Start </strong>to proceed. If the logged on user account does not match the local admin criteria mentioned in the prerequisites section, the wizard will exit. First step it is to validate local admin privilege, click <strong>OK to</strong> proceed further.</span>

<a href="https://msdnshared.blob.core.windows.net/media/2016/08/Image4.png"><img width="300" height="113" class="alignnone size-medium wp-image-665" alt="Image4" src="https://msdnshared.blob.core.windows.net/media/2016/08/Image4-300x113.png" /></a>
<h4><span>Service Application Validation</span><span> </span></h4>
<span>6. The wizard will validate that all the required service application and service instances have been deployed and enabled on the farm. If any required service is missing then the wizard will exit. Otherwise you will be presented with a success screen as below, click OK.</span>

<a href="https://msdnshared.blob.core.windows.net/media/2016/08/Image5.png"><img width="300" height="266" class="alignnone size-medium wp-image-675" alt="Image5" src="https://msdnshared.blob.core.windows.net/media/2016/08/Image5-300x266.png" /></a>
<h4><span lang="EN-GB"><span style="color: #323e4f;font-family: Calibri">Installation Progress Status</span></span></h4>
<span>7. Throughout the wizard execution, the progress screen will update with the status and reflect and warnings or information that the admin needs to be aware of. This wizard validates if Microsoft Online PowerShell and </span>Microsoft Online Services Sign-In Assistant<span> is installed in the machine else, these will be added automatically.</span>

<a href="https://msdnshared.blob.core.windows.net/media/2016/08/Image6.png"><img width="300" height="97" class="alignnone size-medium wp-image-685" alt="Image6" src="https://msdnshared.blob.core.windows.net/media/2016/08/Image6-300x97.png" /></a>
<h4><span>Authenticate to Azure AD</span></h4>
<span> 8. </span><span>You will be prompted to supply credentials for your tenant once the baseline requirements are validated. Please ensure that you provide the global admin credentials.</span>

<a href="https://msdnshared.blob.core.windows.net/media/2016/08/Image7.png"><img width="218" height="186" class="alignnone wp-image-695" alt="Image7" src="https://msdnshared.blob.core.windows.net/media/2016/08/Image7.png" /></a>
<h4><span>Self-Signed Certificate Generation</span></h4>
<span> 9. </span><span>Next step is to provide the password for securing the certificate. This certificate is exported from the local certificate store for copying to other farm servers and for conversion and import to Azure ACS. If you executed the script in ISE this will be a popup dialog. If you executed it in a command window, it will be a request in the command window.</span>

<a href="https://msdnshared.blob.core.windows.net/media/2016/08/Image8.png"><img width="300" height="86" class="alignnone size-medium wp-image-705" alt="Image8" src="https://msdnshared.blob.core.windows.net/media/2016/08/Image8-300x86.png" /></a>

<a href="https://msdnshared.blob.core.windows.net/media/2016/08/Image9.png"><img width="300" height="28" class="alignnone size-medium wp-image-715" alt="Image9" src="https://msdnshared.blob.core.windows.net/media/2016/08/Image9-300x28.png" /></a><span></span>

<span>10. Accept the challenge to replace the signing certificate on the local farm. Again this will either be a popup or a command window prompt.</span>

<a href="https://msdnshared.blob.core.windows.net/media/2016/08/Image10.png"><img width="300" height="29" class="alignnone size-medium wp-image-725" alt="Image10" src="https://msdnshared.blob.core.windows.net/media/2016/08/Image10-300x29.png" /></a>

<a href="https://msdnshared.blob.core.windows.net/media/2016/08/Image11.png"><img width="300" height="19" class="alignnone wp-image-735 size-medium" alt="Image11" src="https://msdnshared.blob.core.windows.net/media/2016/08/Image11-300x19.png" /></a><span></span>

<span>11.Progress status updates with the STS trust configuration information.</span>

<a href="https://msdnshared.blob.core.windows.net/media/2016/08/Image12.png"><img width="300" height="92" class="alignnone size-medium wp-image-745" alt="Image12" src="https://msdnshared.blob.core.windows.net/media/2016/08/Image12-300x92.png" /></a>
<h4><span>Hybrid Wizard Completion Confirmation</span></h4>
<span>12. Hybrid Wizard completes, click Exit to leave the wizard</span>

<a href="https://msdnshared.blob.core.windows.net/media/2016/08/Image13.png"><img width="300" height="106" class="alignnone size-medium wp-image-746" alt="Image13" src="https://msdnshared.blob.core.windows.net/media/2016/08/Image13-300x106.png" /></a>

<a href="https://msdnshared.blob.core.windows.net/media/2016/08/Image14.png"><img width="251" height="152" class="alignnone size-full wp-image-755" alt="Image14" src="https://msdnshared.blob.core.windows.net/media/2016/08/Image14.png" /></a>
<h4><span>Hybrid Validation</span></h4>
<span> 13. </span><span>By now the <strong>Result Source</strong> and <strong>Query Rule</strong> have been configured on the root site of the first web application on the farm. Navigate to site settings &gt; site collection settings &gt; manage result sources. You must perform the next steps as a site collection administrator. The user must also have been synchronized to O365 AAD and have access to the O365 tenant root SharePoint site.</span>

<a href="https://msdnshared.blob.core.windows.net/media/2016/08/Image15.png"><img width="300" height="192" class="alignnone size-medium wp-image-765" alt="Image15" src="https://msdnshared.blob.core.windows.net/media/2016/08/Image15-300x192.png" /></a><span></span>

<span>14. Click Test Source and you should get a succeeded if all is deployed correctly. If you get a timed out error message, just try again as this is an expected response on occasion from SPO. If you get an error, then please post a comment.</span>

<a href="https://msdnshared.blob.core.windows.net/media/2016/08/Image16.png"><img width="300" height="185" class="alignnone size-medium wp-image-775" alt="Image16" src="https://msdnshared.blob.core.windows.net/media/2016/08/Image16-300x185.png" /></a><span></span>

<span>15. After testing the result source navigate to the Site Collection Settings &gt; Manage Query Rules page. Select the HybridWizard result source from the first drop down followed by editing the HybridWizard Query Rule.</span>

<a href="https://msdnshared.blob.core.windows.net/media/2016/08/Image17.png"><img width="300" height="149" class="alignnone size-medium wp-image-785" alt="Image17" src="https://msdnshared.blob.core.windows.net/media/2016/08/Image17-300x149.png" /></a>

16. One the Edit Query Rule page click to edit the result block.

<a href="https://msdnshared.blob.core.windows.net/media/2016/08/Image18.png"><img width="300" height="241" class="alignnone size-medium wp-image-786" alt="Image18" src="https://msdnshared.blob.core.windows.net/media/2016/08/Image18-300x241.png" /></a>

17.Within the Edit Result Block page choose Launch Query Builder.

<a href="https://msdnshared.blob.core.windows.net/media/2016/08/Image19.png"><img width="300" height="238" class="alignnone size-medium wp-image-795" alt="Image19" src="https://msdnshared.blob.core.windows.net/media/2016/08/Image19-300x238.png" /></a><span></span>

<span>18.Execute a test query. Note the Asterisk next to the {queryTerms}. Add the * and click Test Query. If everything is working correctly, you should get results from the SPO search service. If you get an error then please post a comment.</span>

<a href="https://msdnshared.blob.core.windows.net/media/2016/08/Image20.png"><img width="300" height="214" class="alignnone size-medium wp-image-805" alt="Image20" src="https://msdnshared.blob.core.windows.net/media/2016/08/Image20-300x214.png" /></a>

<span>Finally navigate to your root site collection search center and issue a search query, perhaps try * to retrieve results for SPO and On-Premises.</span>

<span>We leave the final screenshot to your imagination.</span>

&nbsp;]]></content:encoded>
    </item>
    <item>
      <title>SharePoint Server 2016 : Zero downtime patching walkthrough</title>
      <link>https://docs.microsoft.com/archive/blogs/beyondsharepoint/sharepoint-server-2016-zero-downtime-patching-walkthrough</link>
      <pubDate>Mon, 25 Jul 2016 06:33:18 GMT</pubDate>
      <dc:creator><![CDATA[Neil Hodgkinson - MSFT - MCM]]></dc:creator>
      <guid
        isPermaLink="false">http://blogs.technet.microsoft.com/beyondsharepoint/?p=575</guid>
      <description><![CDATA[Myself, Bob Fox, Karl Reigel recently recorded a video to provide some advice and guidance around...]]></description>
      <content:encoded><![CDATA[Myself, Bob Fox, Karl Reigel recently recorded a video to provide some advice and guidance around Zero Downtime Patching and how it shifts the equation for SharePoint Server Farm admins in SharePoint Server 2016. I am pleased to say that thanks to our awesome reviewers and the great team of content writers at Microsoft we are live as of today

Follow <a target="_blank" href="https://technet.microsoft.com/EN-US/library/mt767550(v=office.16).aspx">Real Zero Down Time.</a> To appreciate this awesome new development and finally what customers have been asking for, forever.]]></content:encoded>
    </item>
  </channel>
</rss>