Figure 1. Magic Quadrant for Unified Communications

Excerpt

Microsoft Lync offers a full suite of UC functionality that Microsoft continues to improve with each release. It integrates with Office applications, Active Directory and Skype. Microsoft has a broad set of additional business applications that will increasingly be leveraged, including Office Graph (which uses machine learning to define the context and connect users with relevant documents, conversations and people) and Cortana (a digital assistant).

The Lync partner ecosystem expanded at a rapid pace; however, more importantly, the partners' skill level and experience in complex deployments that include voice and video also improved significantly year over year. Lync's improved federation capabilities have proven an effective way for groups to collaborate across organizational boundaries. For cloud delivery, Microsoft offers Lync Online as part of the Office 365 suite, as well as in private cloud configurations; in both cases, partners can be leveraged for telephony. However, enterprises should be aware that Lync Online offers only a subset of the on-premises Lync solution, most notably with limited PSTN connectivity.

Enterprises that have a significant number of employees that can benefit from Lync's collaboration model should consider the Lync solution and understand how it might change their business processes and worker productivity. Enterprises considering deploying Lync telephony or video should understand the topology and infrastructure requirements, how they will support branch offices, and (if relevant) how they will deploy and obtain global third-party support. Enterprises with advanced telephony feature requirements should also ensure that the needed functions are supported.

Strengths

• Microsoft Lync continues to make significant gains in the market and is attractive to a broad range of enterprises. In many cases, it is initially deployed for its IM, presence and Web conferencing functionalities, with gradual incremental deployments of telephony and video added as follow-on phased deployments for specifically targeted groups or regions.
• The vendor has significantly improved its go-to-market strategy for Lync during the last year, positioning itself to more adequately address the real-time communications requirements of enterprises over the next several years.
• Microsoft has added video capabilities, including support for Lync room-based video systems and interoperability of standards-based video endpoints.
• Customers report that Lync functions can be readily integrated into business processes and applications, providing new, different and effective ways to perform tasks. Often, these new functions are achieved by deploying Lync enhancements from a growing list of ecosystem partners.

Cautions

• Few IT managers report that they have completely eliminated their PBXs in Lync implementations. Typically, Lync IM/presence and Web conferencing are deployed across the broader employee base, while telephony is deployed only for a subset of employees. Microsoft's stated telephony strategy is to leverage partners for functions like endpoints, gateways and contact center; therefore, enterprises interested in PBX-level capabilities should be prepared to also invest in a number of partner solutions to achieve advanced functionality.
• Gartner clients report users with non-Microsoft endpoints, such as Mac workstations, are not satisfied with the functionality and quality of the Lync UX.
• Gartner clients deploying Lync with in-house staff often report that multiple partners are required to obtain a complete deployment, and that this poses challenges (for example, different partners for telephones, gateways, servers, remote support and network monitoring); additionally, it can lead to release-level incompatibilities. This can also result in difficulty obtaining an accurate total cost for Lync service and support.
• Some enterprises express concern that Microsoft's bundling, combined with proprietary protocols, will leave them locked in a closed circle of choices. Bundling includes Exchange, Lync, SharePoint, Office, Skype and Yammer. While the video interoperability is a good sign, it also serves to emphasize the lack of standards-based capabilities in the other areas, such as standard SIP endpoints and WebRTC.

• UC requirements for Enterprise Voice
• Signaling, Media and call flows in Lync
• PSTN connection options
• Multi-site architecture
• Lync Server features
• Netoworks,Diagnostic Tools and troubleshooting

Microsoft has replaced Exchange Hosted Encryption Service with the Office 365 Message Encryption Service. This article is a succession to my previous blog - Exchange Hosted Encryption - Steps for Configuration and Use.

This article talks about the ways to purchase, configure and use this service. While doing so, I have included screenshots from my lab for reference.

I have used excerpts from TechNet articles and Office 365 team blog to make this a more complete description.

A variety of encryption technologies work together in Office 365 to provide protection for emails at rest and in transit:

• TLS encrypts the tunnel between mail server to help prevent snooping/eavesdropping.
• SSL encrypts the connection between mail clients and Office 365 servers.
• BitLocker encrypts the data on the hard drives in the datacenter so that if someone gets unauthorized access to the machine they can't read it.
• Information Rights Management. Windows Azure Rights Management in Office 365 prevents sensitive information from being printed, forwarded, or copiedby unauthorized people inside the organization.
• S/MIME is an encryption scheme that uses client-side encryption keys, popular for some government B2B scenarios. Read more about the upcoming S/MIME enhancements in Office 365 here.

Office 365 Message Encryption is designed to help you send confidential messages to people outside your company simply and securely, without the administrative overhead required to use S/MIME or similar technologies. It's an outside-the-company companion to Information Rights Management, which is why it's included as part of the Windows Azure Rights Management offering.

Office 365 Message Encryption uses Rights Management Services (RMS) infrastructure with Secure Sockets Layer (SSL) and Transport Layer Security (TLS) encryption. For details, go to Service information for Office 365 Message Encryption.

Why Office 365 Message Encryption?

Deliver confidential business communications with enhanced security, allowing users to send and receive encrypted email as easily as regular email directly from their desktops. Customize the email viewing portal to enhance your organization's brand. Email can be encrypted without complex hardware and software to purchase, configure, or maintain, which helps to minimize capital investment, free up IT resources, and mitigate messaging risks.

Improve security and reliability

Office 365 Message Encryption provides advanced security and reliability to help protect your information.

• Send encrypted email messages to anyone, regardless of the recipient's email address.
• Provide strong, automated encryption with a cost-effective infrastructure.
• Eliminate the need for certificates and use a recipient's email address as the public key.
• Communication through a TLS-enabled network further enhances message security.
• Enhance the security of subsequent email responses by encrypting each message in the thread.

Stay in control

Office 365 Message Encryption helps keep your data safe, while allowing you to maintain control over your environment.

• Easily set up encryption using the single action Exchange transport rules.
• Protect sensitive information and data from leaving your gateway, consistently and automatically.
• Policy-based encryption encrypts messages at the gateway based on policy rules.
• Help manage compliance by leveraging the strong integration with data loss prevention.
• Integrate with existing email infrastructure for minimal up-front capital investment.
• Grow your organization's brand by using custom branding text or disclaimers and a custom logo.

Easy to use and maintain

It's easier than ever to protect your organization's email.

• Easily navigate through the encrypted message with the clean Office 365 interface.
• Encrypted email delivered directly to recipients' inbox and not to a Web service.
• Email decrypted and read with confidence, without installing client software.
• Simplified user management that eliminates the need for certificate maintenance.
• Encryption process is transparent to the sender, who does not need to do anything other than write and send the message as usual.

Try Office 365 Message Encryption. This trial enables you to try Information Rights Management capabilities as well as the capabilities of Office 365 Message Encryption.

How to Buy Office 365 Message Encryption Service?

Office 365 Message Encryption requires the purchase of Microsoft Azure Rights Management, which is available for $2 per user per month. For more details, see Microsoft Azure Rights Management.

Office 365 Message Encryption will be available as part of Windows Azure Rights Management. Office 365 Enterprise E3 and E4 users will get Office 365 Message Encryption at no extra cost. We're including it in Windows Azure Rights Management, which is already part of the E3 and E4 plans. We're also including it in the standalone version of Windows Azure Rights Management, without raising the price of that service. Office 365 Message Encryption is available as an add-on for other Office 365 plans and for standalone plans. For example, Exchange Online Kiosk Plan 1 and Plan 2 customers will be able to add the service to their subscriptions at a cost of $2 per user per month.

Office 365 Message Encryption is also available to Exchange on-premises customers who purchase Windows Azure Rights Management service. Office 365 Message Encryption requires on-premises customers to route email through Exchange Online, either by using Exchange Online Protection for email filtering or by establishing hybrid mail-flow.

Try Office 365 Message Encryption. This trial enables you to try Information Rights Management capabilities as well as the capabilities of Office 365 Message Encryption.

Customers who are currently using Exchange Hosted Encryption (EHE) will be upgraded to Office 365 Message Encryption beginning in the first quarter of 2014. EHE customers can learn more information about the upgrade by visiting the EHE Upgrade Center.

Mail-flow

Office 365 Message Encryption is an online service that's built on Microsoft Azure Rights Management. With Azure Rights Management set up for an organization, administrators can enable message encryption by defining transport rules that determine the conditions for encryption. A rule can require the encryption of all messages addressed to a specific recipient, for example.

When an Exchange Online user sends an email message that matches an encryption rule, the message is sent out with an HTML attachment. A recipient opens the HTML attachment in the email message, recognizes a familiar brand if that's present, and follows the embedded instructions to sign in, open, and read the encrypted message on the Office 365 Message Encryption portal. The sign-in process helps ensure that only intended recipients can view encrypted messages.

The following diagram summarizes the passage of an email message through the encryption process.

1. An Exchange Online user sends a message to the recipient.
2. The message is filtered based on administrator-defined rules that define conditions for encryption.
3. The tenant key for your Office 365 organization is accessed and the message is encrypted.
4. The encrypted message is delivered to the recipient's Inbox.
5. The recipient opens the HTML attachment and connects to the Office 365 encryption portal.
6. The recipient authenticates using a Microsoft account or an Office 365 organizational account.
7. The tenant key for your Office 365 organization is accessed to remove encryption from the message and the user views the unencrypted message.

    

For more information about the keys that help ensure the safe delivery of encrypted messages to designated recipient inboxes, see Service information for Office 365 Message Encryption.

STEP 1: Preparing for Office 365 Message Encryption

Office 365 Message Encryption requires that you have an Exchange Online or Exchange Online Protection (EOP) subscription and that you've set up Azure Rights Management. If your setup meets these requirements, all you need to do to enable Office 365 Message Encryption is define rules that trigger encryption

STEP 1 (a): Activate Azure Rights Management on Office 365 Portal

• If Azure Rights Management is already set up for Exchange Online or Exchange Online Protection, you're ready to define transport rules and start using the Office 365 Message Encryption service, as described in Define rules to encrypt or decrypt email messages.
• If you have Azure Rights Management but it's not set up for Exchange Online or Exchange Online Protection, activate it following the steps described in this topic under Activate Azure Rights Management for Office 365 Message Encryption.
• If you don't have an Azure Rights Management subscription for Exchange Online or Exchange Online Protection, you must purchase a subscription and set up Azure Rights Management in order to use Office 365 Message Encryption. For information purchasing a subscription to Azure Rights Management, see Azure Rights Management. The next section gives you information about activating Azure Rights Management.
• If you're not sure of what your subscription includes, see the Exchange Online service descriptions for Message Policy, Recovery, and Compliance.

   

  Office 365 Message Encryption requires the Azure Rights Management service. Once you have a subscription to this service, you can activate it as described in the following procedure. For more information about this requirement, see Prerequisites for using Office 365 Message Encryption.

In the Office 365 Admin Center, go to 'Service Settings'.

In 'Service Settings', click on the 'Rights Management' tab. When clicked-on for the first time, the portal might take a few moments to set up rights management, before displaying any content.

When it does, click on 'Manage'.

Click to 'activate' rights management.

Confirm

Rights management is activated.

STEP 1 (b): Set up Azure Rights Management – PowerShell based steps. (Two Options)

First, the administrator needs to have the necessary permissions to administer Microsoft Office 365 Message Encryption (OME) and Information Rights Management (IRM) configuration.

And so must be a part of the following role groups under Office 365 portal >> 'Exchange admin center' >> 'permissions' >> 'admin roles'.

1. Compliance Management
2. Organization Management
3. Records Management

Second, install the Rights Management administration module (For Prereqisites - http://technet.microsoft.com/en-us/library/jj585012.aspx)

1. Go to the Microsoft Download Center and download the Azure AD Rights Management Administration Tool, which contains the Azure Rights Management administration module for Windows PowerShell.
2. From the local folder where you downloaded and saved the Rights Management installer file, double-click the executable file that you downloaded for your platform (WindowsAzureADRightsManagementAdministration_x64 or WindowsAzureADRightsManagementAdministration_x86.exe) to start the Windows Azure AD Rights Management Administration Setup Wizard.
3. Complete the wizard.

Windows PowerShell for Azure Rights Management is now installed. To see which cmdlets are available, start Windows PowerShell with the Run as administrator option and type the following: Get-Command -Module aadrm

If you need to set up Azure Rights Management, you have two options:

1. Set up Azure Rights Management for Office 365 Message Encryption, but prevent IRM templates from being available to users by disabling them in Microsoft Outlook Web App and Microsoft Outlook. (For step-by step procedures, see below. Reference: Set up Microsoft Azure Rights Management for Office 365 Message Encryption.)

Or

1. Set up Azure Rights Management for Office 365 Message Encryption and enable IRM templates so they're available to users in OWA and Outlook. (For step-by step procedures, see below. For Reference: Configure IRM to use Microsoft Azure Rights Management.)

Option 1: Set up Microsoft Azure Rights Management for Office 365 Message Encryption

To set up Azure Rights Management for Office 365 Message Encryption, do the following:

1. Use Exchange Online Remote Power Shell to perform the steps in this procedure. For information about connecting to Remote PowerShell, see Connect to Exchange Online Using Remote PowerShell.
2. Configure the Rights Management Services (RMS) online key-sharing location in Exchange Online. Use the RMS key sharing URL corresponding to your location, as shown in this table:

For example, to configure the RMS Online key sharing location for a customer in North America, you would use this URL:

Set-IRMConfiguration -RMSOnlineKeySharingLocation "https://sp-rms.na.aadrm.com/TenantManagement/ServicePartner.svc"

For detailed syntax and parameter information, see Set-IRMConfiguration.

1. Run the following command to import the Trusted Publishing Domain (TPD) from RMS Online:

   Import-RMSTrustedPublishingDomain -RMSOnline -name "RMS Online"

   For detailed syntax and parameter information, see Import-RMSTrustedPublishingDomain.

2. To verify that you successfully configured IRM in Exchange Online to use the Azure Rights Management service, run the Test-IRMConfiguration cmdlet. Among other things, the command checks connectivity with the RMS Online service, downloads the TPD, and checks its validity.
3. Run the following commands to disable IRM templates from being available in OWA and Outlook and then enable IRM for your cloud-based email organization to use IRM for Office 365 Message Encryption:
   1. To disable IRM templates in OWA and Outlook:

Set-IRMConfiguration - ClientAccessServerEnabled $false

1. To enable IRM for Office 365 Message Encryption:

Set-IRMConfiguration -InternalLicensingEnabled $true

For detailed syntax and parameter information, see Set-IRMConfiguration.

1. To verify that you successfully imported the TPD and enabled IRM, use the Test-IRMConfiguration cmdlet to test IRM functionality. For details, see "Example 1" in Test-IRMConfiguration.

Option 2: Configure IRM to Use Microsoft Azure Rights Management

Information Rights Management (IRM) in Exchange Online uses Active Directory Rights Management Services (AD RMS), an information protection technology in Windows Server 2008 and later and Microsoft Azure Rights Management service in Office 365. IRM protection is applied to email by applying an AD RMS rights policy template to an email message. Usage rights are attached to the message itself so that protection occurs online and offline and inside and outside of your organization's firewall.

This topic shows you how to configure IRM to use the Azure Rights Management service. For details about how to accomplish the same task using an on-premises AD RMS server, see Configure IRM to Use an On-Premises AD RMS Server.

To learn more about IRM in Exchange Online, see Information Rights Management in Exchange Online.

• You need to be assigned permissions before you can perform this procedure or procedures. To see what permissions you need, see the"Information Rights Management" entry in the Messaging Policy and Compliance Permissions topic.
• To learn more about Azure Rights Management, see What is Azure Rights Management?
• To learn how to install and configure Windows PowerShell and connect to the service, see Connect to Exchange Online Using Remote PowerShell.
• For information about keyboard shortcuts that may apply to the procedures in this topic, see Keyboard Shortcuts in the Exchange Admin Center.

Step A: Verify in the Office 365 Admin Center - Azure Rights Management must be activated. (Steps for activation as above in Step 1(a))

By default, Azure Rights Management is disabled. To enable IRM features in Exchange Online, you need to activate it by using the Rights Management settings within the Office 365 administrative portal. For more information, see Activating rights management.

Step B: Use the Shell to configure the RMS Online key sharing location in Exchange Online

1. Use Exchange Online Remote Power Shell to perform the steps in this procedure. For information about connecting to Remote PowerShell, see Connect to Exchange Online Using Remote PowerShell.

    

   $UserCredential = Get-Credential

    

   $Session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://outlook.office365.com/powershell-liveid/ -Credential $UserCredential -Authentication Basic –AllowRedirection

    

   Import-PSSession $Session

    

   OR

    

   $UserCredential = Get-Credential

    

   $Session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://ps.outlook.com/powershell/ -Credential $UserCredential -Authentication Basic –AllowRedirection

    

   Import-PSSession $Session

    

   

    

    

    

   (Be sure to disconnect the remote PowerShell session when you're finished. If you close the Windows PowerShell window without disconnecting the session, you could use up all the remote PowerShell sessions available to you, and you'll need to wait for the sessions to expire. To disconnect the remote PowerShell session, run the following command - Remove-PSSession $Session )

1. In the Microsoft datacenters, certain objects are consolidated to save space. When you try to use Windows PowerShell to modify one of these objects for the first time, you may encounter an error message that tells you to run the Enable-OrganizationCustomization cmdlet.

    

   

    

    

2. Configure the Rights Management Services (RMS) online key-sharing location in Exchange Online. Use the RMS key sharing URL corresponding to your location, as shown in this table:

This command configures the RMS Online key sharing location in Exchange Online for a customer located in North America. Replace the RMS Online key sharing location with the correct URL for your location from the above table.

Set-IRMConfiguration -RMSOnlineKeySharingLocation "https://sp-rms.na.aadrm.com/TenantManagement/ServicePartner.svc"

For detailed syntax and parameter information, see Set-IRMConfiguration.

Step C: Use the Shell to import the Trusted Publishing Domain (TPD) from RMS Online

Run the following command to import the TPD from RMS Online.

Import-RMSTrustedPublishingDomain -RMSOnline -name "RMS Online"

For detailed syntax and parameter information, see Import-RMSTrustedPublishingDomain.

How do you know this step worked?

To verify that you have successfully configured IRM in Exchange Online to use Azure Rights Management service, run the Test-IRMConfiguration cmdlet. Among other things, the command checks connectivity with the RMS Online service, downloads the TPD, and checks its validity.

Test-IRMConfiguration -RMSOnline

Step D: Use the Shell to enable IRM in Exchange Online

After you configure the RMS Online key sharing location in Exchange Online and import the RMS Online TPD, run the following command to enable IRM for your cloud-based email organization.

Set-IRMConfiguration -InternalLicensingEnabled $true

For detailed syntax and parameter information, see Set-IRMConfiguration.

How do you know this task worked?

To verify that you have successfully imported the TPD and enabled IRM, do the following:

• Use the Test-IRMConfiguration cmdlet to test IRM functionality. For details, see "Example 1" in Test-IRMConfiguration.
• Compose a new message in Outlook Web App and IRM-protect it by selecting Set permissions from the extended menu ().

STEP 2: Defining rules for Office 365 Message Encryption

Things to know about rules for Office 365 Message Encryption

1. Overview

   Administrators enable Office 365 Message Encryption by creating Exchange transport rules that determine under what conditions email messages should be encrypted. There are also rules for defining conditions where encryption should be removed from messages. Once you've set the encryption action within the rule, any messages that match the rule conditions are encrypted before they're sent out.

   Transport rules are flexible, letting you combine conditions so you can meet specific security requirements in a single rule. For example, you can create a rule to encrypt all messages that contain specified keywords and are addressed to external recipients. Office 365 Message Encryption also encrypts replies from recipients of encrypted email, and you can create a rule that decrypts those replies as a convenience for your email users. That way, users in your organization won't have to sign in to the encryption portal to view replies.

   For more information about how to create Exchange transport rules, see Define rules to encrypt or decrypt email messages.

1. Integrating Office 365 Message Encryption with Data Loss Prevention Policies

   You can add message encryption conditions to DLP policies. DLP policies can be created in Office 365 >> Exchange Admin Center >> Compliance Management >> Data Loss Prevention >> Click on "+" >> Choose 'New DLP policy from template' >> Scroll and Choose a template to create a policy.

   You can use the following article for reference: Create a DLP Policy From a Template

   A DLP policy is a collection of transport rules. By default, DLP policies created from a template will not contain any message encryption action items. If however, you would like to add encryption triggers, browse to Office 365 >> Exchange Admin Center >> mail flow >> rules – You will find rules created corresponding to DLP policies added by the administrator. These rules can be edited to add an additional action items to trigger encryption of messages wherever appropriate.

    

2. Support for Custom Rules (To scan for custom data formats & patterns)

   Out of the box, administrators have access to pre-defined templates for sensitive data like, U.S. Passport Number, U.S. Bank Account Number, U.S. Driver's License Number, U.S. Individual Taxpayer Identification Number (ITIN) etc. These can be added to mail flow rules to scan emails and prevent information leakage.  

   If however, screening emails for information like Date of Birth etc. , is a necessity, customized rules can be made to trigger compliance rules by scanning messages for keywords or specific text patterns.

   The appropriate syntaxes are described in the following articles.

• Understanding Policy Rule Match Options
• Understanding Policy Rule Syntax

Steps to create a rule for Message Encryption

1. From the EAC, go to mail flow > rules > New. If you need help to become familiar with the EAC, see Exchange Admin Center in Exchange Online.

   

    

2. Select + > Create a new rule.

   

    

3. In Name, type a name for the rule, such as Encrypt mail for test.
4. In Apply this rule if select a condition, and enter a value if necessary.

• In Apply this rule if, select a condition
• To view all available conditions, scroll down and select 'More options…' in the 'new rule' console.

  

   

1. To add more conditions, select add condition and select from the list.

   For example, to specify that the previous rule applies only if the recipient is outside your organization:

• Select add condition and then select The recipient is located > Outside the organization.
• Select OK.

1. To enable encryption, in Do the following, select Modify the message security > Apply Office 365 Message Encryption, as shown below, and then select Save. You can select add action if you want to specify another action.

   

    

   For instance, in this case study, my test rule applies Office 365 Message Encryption an email whenever the recipient is located 'Outside the organization'

   

Experience with Office 365 Message Encryption

Sending a test email to my Microsoft email address. As the recipient address is 'outside the organization', Office 365 Message Encryption will be applied to the email.

The recipient will receive an email with a 'message.html' attachment. This email will have the same subject line as the originally sent email.

Double click or open the 'message.html' attachment in a browser – preferably Internet Explorer.

Click on 'View your encrypted message'.    

Use one of the sign in options.

• If the recipient has never received an email from Office 365 Message Encryption service, then an initial sign up process is required to verify the account. Once signed up, the recipient can use the created credentials for any future messages encrypted by Office 365 Message Encryption Service.
• If the recipient's email address belongs to one of Microsoft's services like Office 365, then the same can be used directly to sign in and view the encrypted message.
• If however, the recipient address belongs to a third-party or unsupported service, an associated Microsoft account is created for the recipient as part of the sign up process.

Note that the recipient does not need an Office 365 Message Encryption license to view or reply to the encrypted message. And all subsequent replies to an encrypted message, including attachments, are also encrypted.

The message opens in a captive portal.

The recipient will be able to 'reply', 'reply all' or 'forward' the email.

The recipient can insert an attachment to the reply and it goes out as part of the encrypted message.

Also, the recipient automatically receives a copy of the reply, as an encrypted email, for reference.

The recipient can also add other recipients in 'bcc', set importance levels or message options for sensitivity levels (normal, personal, private & confidential), to the reply.

When the reply is sent, it is delivered as an encrypted message to the first sender.

This is because, in this test organization, currently there is no decryption rule in place.

All subsequent communications are thus encrypted.

Steps for creating a rule to remove Message Encryption (or Decryption).

When your email users send encrypted messages, recipients of those messages can respond with encrypted replies. You can create transport rules to automatically remove encryption from replies so email users in your organization don't have to sign in to the encryption portal to view them. You can use the EAC or Windows PowerShell cmdlets to define those rules.

For example, to create a rule for removing encryption from email replies (for all users inside the organization) by using the EAC

1. From the EAC, go to Mail flow > + > Create a new rule.
2. In Name, type a name for the rule, such as Remove encryption from incoming mail.
3. In Apply this rule if, select the conditions where encryption should be removed from messages, such as The recipient is located > Inside the organization.
4. In Do the following, select Modify the message security > Remove Office 365 Message Encryption.
5. Select Save.

Experience with Message Decryption

Now, when the recipient replies to an encrypted message, the message is decrypted before being delivered to the original sender.

The reply is received decrypted.

Creating Encryption and Decryption rules using PowerShell

To create a rule for encrypting email messages by using PowerShell cmdlets

1. Connect to Office 365 using Remote PowerShell, as described in Connect to Exchange Online using Remote PowerShell.
2. Define a rule with the ApplyOME attribute set to True. For example, to require that all email messages that are addressed to drToniramos@hotmail.com must be encrypted, type:

New-TransportRule "Encrypt rule for test" -SentTo "anshu.man@live.com" -SentToScope "NotInOrganization" -ApplyOME $true

Where:

To create a rule to remove encryption from email replies by using PowerShell cmdlets

1. Connect to Exchange Online using Remote PowerShell.
2. Define a rule with the RemoveOME parameter. For example:

New-transportrule -name "Remove encryption from incoming mail" -SentToScope "InOrganization" -RemoveOME $true

Where:

STEP 3: Customizing encrypted messages with Office 365 Message Encryption

As an Exchange Online or Exchange Online Protection administrator, you can apply your company branding to customize the look of your organization's Office 365 Message Encryption email messages and the contents of the encryption portal. For example, you can customize the introduction and disclaimer text in the email message that accompanies encrypted messages as well as some text that appears on the portal where the recipient views the messages. You can also add a logo to the email message and encrypted message viewing portal.

For more information about how to customize encrypted messages, see Add branding to encrypted messages.

Using Windows PowerShell cmdlets, you can customize the following aspects of the viewing experience for recipients of encrypted email messages:

• Introductory text of the email that contains the encrypted message
• Disclaimer text of the email that contains the encrypted message
• Portal text that will appear in the message viewing portal
• Logo that will appear in the email message and viewing portal

To customize encryption email messages and the encryption portal with your organization's brand

1. Connect to Exchange Online using Remote PowerShell, as described in Connect to Exchange Online Using Remote PowerShell.
2. Use the Set-OMEConfiguration cmdlet as described here: Set-OMEConfiguration or use the following table for guidance.

Encryption customization options

You can customize the cmdlets above to meet your company's requirements.

Now, the recipient receives an email with your company's branding.

In the delivered email, the recipient will be able to view the following customizations along with the attached encrypted 'message.html' file.

• The default text appears above the instructions for viewing encrypted messages
• Disclaimer statement in the email that contains the encrypted message
• Logo

   

When the 'message.html' attachment is opened, the captive portal sports the company logo and a customized text that appears at the top of the console.

Following customizations will be reflected in the encrypted mail viewing portal.

• Text that appears at the top of the portal
• Logo

   

With Office 365 Message Encryption, email messages are encrypted automatically, based on administrator-defined rules. An email that bears an encrypted message arrives in the recipient's Inbox with an attached HTML file that lets the recipient to sign-in to view the encrypted message.

Recipients follow instructions in the message to authenticate by using a Microsoft account or an organizational account. If recipients don't have either account, they're directed to create a Microsoft account that will let them sign in to view the encrypted message. After being authenticated, recipients can view the decrypted message and reply to it with an encrypted message.

For detailed guidance about how to send and view encrypted messages, see Send, view, or reply to encrypted messages.

Technical Details – Office 365 Message Encryption Service

The following table provides technical details for the Office 365 Message Encryption service.

Frequently Asked Questions

Q. My users send encrypted email messages to recipients outside our organization. Is there anything that external recipients have to do differently in order to read and reply to email messages that are encrypted with Office 365 Message Encryption?

Recipients outside your organization who receive encrypted email messages from senders in your organization are asked to create a Microsoft account if they don't have one so they can sign in to view and reply to encrypted messages. For details, see Send, view, or reply to encrypted messages.

Q. Are Office 365 encrypted messages stored in the cloud or on Microsoft servers?

No, the encrypted messages are kept on the recipient's email system, and when the recipient opens the message, it is temporarily posted for viewing on Office 365 servers. The messages are not stored there.

Q. Can I customize encrypted email messages with my brand?

Yes. You can use Windows PowerShell cmdlets to customize the default text that appears at the top of encrypted email messages, the disclaimer text, and the logo that you want to use for the email message and the encryption portal. For details, see Add branding to encrypted messages.

Q. Is there a trial version of Office 365 Message Encryption available?

Office 365 Message Encryption is included with Windows Azure Rights Management. You can sign-up for a 30-day trial of the service from the Office 365 Rights Management trial portal here: Azure Rights Management plan. In order to use the new encryption service, you must meet the following criteria:

• If using Office 365, you must be using the newest version.
• If using on-premises mailboxes, you must be using Exchange Online Protection.
• If you're a Forefront Online Protection for Exchange (FOPE) customer, you must have upgraded to Exchange Online Protection.

Q. I am using Exchange 2013. Will Office 365 Message Encryption be made available to me?

Yes, as long as you are using Exchange Online Protection or have a hybrid deployment in which mail flow is routed through EOP. You can purchase Windows Azure Rights Management and then configure rules to encrypt email using Office 365 Message Encryption.

Q. How can I purchase the Office 365 Message Encryption?

Office 365 Message Encryption will be available as part of Windows Azure Rights Management. Office 365 Enterprise E3 and E4 users already have Windows Azure Rights Management as part of their service, while Office 365 Enterprise E1 and K1, Exchange Online Kiosk, Plan 1 and Plan 2 customers will be able to add the service to their subscriptions at a cost of $2 per user per month.

Enterprise E1 plan subscribers can add Office 365 Message Encryption on a per-user basis by purchasing Windows Azure Rights Management.

On-premises customers can gain access to Office 365 Message Encryption by purchasing Windows Azure Rights Management for their users at a cost of $2 per user per month and purchasing Exchange Online Protection to set up mail-flow through Exchange Online.

Q. Does the service require a license for every user in my organization?

A license is required for every user in the organization who sends encrypted email.

Q. Do external recipients require subscriptions?

No, external recipients do not require a subscription to read or reply to encrypted messages.

Q. Will Office 365 Message Encryption be available in Office 365 Dedicated?

Yes. You must first purchase Exchange Online Protection(EOP) and configure mail flow via EOP. Once that is done, customers can purchase Windows Azure Rights Management and configure rules to encrypt email.

Q. How is Office 365 Message Encryption different than Rights Management Services (RMS)?

RMS provides Information Rights Protection capabilities for an organization's internal emails by providing built-in templates, such as: Do not forward and Company Confidential. Office 365 Message Encryption supports email message encryption for messages that are sent to external recipients as well as internal recipients.

Q. How is Office 365 Message Encryption different than S/MIME?

S/MIME is essentially a client-side encryption technology, and requires complicated certificate management and publishing infrastructure. Office 365 Message Encryption uses transport rules and does not depend on certificate publishing.

Q. How does Office 365 Message Encryption work?

Visit Office 365 Message Encryption.

Q. Can I read the encrypted messages over mobile devices?

Yes. You can view messages on mobile devices, providing that the device HTML viewer allows posting of forms. There is no app to install to view the Office 365 encrypted messages. Instead, the recipient opens the encrypted attachment in the message and then signs in to the web browser on the device to view the encrypted message.

Q. Are replies and forwarded messages encrypted?

Yes. Responses continue to be encrypted throughout the duration of the thread.

Q. Does Office 365 Message Encryption provide localization?

Incoming email and HTML content is localized based on sender email settings. The viewing portal is localized based on recipient's browser settings. However, the actual body (content) of encrypted message isn't localized.

Q. What encryption is used for Office 365 Message Encryption?

Office 365 Message Encryption uses Rights Management Services (RMS) infrastructure with Secure Sockets Layer (SSL) and Transport Layer Security (TLS) encryption. For details, go to Service information for Office 365 Message Encryption.

Q. I am an EHE Subscriber. Where can I learn more about the upgrade to Office 365 Message Encryption?

For more information, visit the EHE Upgrade center website at GetEncryption.com.

References

Office 365 Message Encryption

Set up Microsoft Azure Rights Management for Office 365 Message Encryption

Define rules to encrypt or decrypt email messages

Add branding to encrypted messages

Send, view, or reply to encrypted messages

Service information for Office 365 Message Encryption

Office 365 Message Encryption FAQ

ADFS helps you use single sign-on (SSO) to authenticate users to multiple web applications over the life of a single session. This is accomplished by securely sharing digital identity and rights (Claims) across security and enterprise boundaries. Some of the ADFS uses can be found here.

We can set up a new AD FS 2.0 infrastructure for the purpose of enabling single sign-on (SSO) with Microsoft Office 365. This will help you keep account/password management in-house.

Also, if instead of a full-fledged Single Sign-On experience, a synchronization of passwords between Office 365 and the Active Directory should suffice – then we can leverage the new Directory Synchronization tool with password synchronization.

1.       Instructions for configuring Password Sync

2.       Install or Upgrade the Directory Sync Tool

Single Sign On Roadmap

Single sign-on (SSO) allows you and your users to access Microsoft cloud services with your Active Directory corporate credentials. SSO requires both a security token service (STS) infrastructure and Active Directory synchronization.

You must complete the following steps in order to implement SSO:

1. Step 1: Prepare for single sign-on
2. Step 2: Set up your on-premises security token service
3. Step 3: Set up directory synchronization
4. Step 4: Verify single sign-on

Step 1: Prepare for single sign-on

To prepare, you must make sure your environment meets the requirements for SSO and verify that your Active Directory and Windows Azure Active Directory tenant is set up in a way that is compatible with single sign-on requirements. For more information, see Prepare for single sign-on.

Step 2: Set up your on-premises security token service

After you have prepared your environment for single sign-on, you will need to set up a new on-premises STS infrastructure to provide your local and remote Active Directory users with single sign-on access to the cloud service. If you currently have an STS in your production environment, you can use it for single sign-on deployment rather than setting up a new infrastructure as long as it is supported by Windows Azure AD.

Currently, Windows Azure AD supports either of the following security token services:

• Active Directory Federation Services (AD FS)
  For more information about how to get started with setting up an AD FS STS, follow the steps provided in Checklist: Use AD FS to implement and manage single sign-on.

   

• Shibboleth Identity Provider
  For more information about how to get started with setting up a Shibboleth STS, follow the steps provided in Use Shibboleth Identity Provider to implement single sign-on.

   

• Other third-party identity providers
  For more information about how to get started with setting up third-party identity providers for single sign-on, see Use third-party identity providers to implement single sign-on.

Step 3: Set up directory synchronization

In order for single sign-on to work properly, you must set up Active Directory synchronization as well. This includes preparing for, activating, installing a tool, and verifying directory synchronization. After you have verified directory synchronization, you activate your synced users. Using single sign-on and directory synchronization together ensures that user identities are represented correctly in the cloud service.

For more information about how to get started with setting up directory synchronization, follow the steps provided in Directory synchronization roadmap.

Step 4: Verify single sign-on

After you finish setting up your Active Directory synchronization environment, you now need to verify that your STS is functioning as expected and that single sign-on was set up correctly for your cloud service.

For more information, see either Verify and manage single sign-on with AD FS or Verify single sign-on with Shibboleth, depending on the STS type you are setting up.

Design Guide

• Understanding Key Concepts Before You Deploy AD FS 2.0
• Identifying Your AD FS 2.0 Deployment Goals
• Mapping Your Deployment Ghttp://social.technet.microsoft.com/wiki/contents/articles/1841.adfs-2-0-high-availability-and-high-resiliency-walkthrough.aspxoals to an AD FS 2.0 Design
• Determine Your AD FS 2.0 Deployment Topology
• Planning Your Deployment
• Planning Federation Server Placement
• Planning Federation Server Proxy Placement
• Planning for AD FS 2.0 Server Capacity
• Appendix A: Reviewing AD FS 2.0 Requirements

For more information about how AD FS 2.0 works and how to set up AD FS 2.0 in a test lab, see the following resources:

• AD FS 2.0 Server Product Help
• AD FS 2.0 Step-by-Step and How To Guides

Which AD FS configuration database store should I choose, Windows Internal Database (WID) or SQL?

The AD FS configuration database stores all the configuration data. It contains information that a Federation Service requires to identify partners, certificates, attribute stores, claims, etc. You can store this configuration data in either a Microsoft SQL Server 2005 or newer database or the Windows Internal Database (WID) feature that is included with Windows Server 2008, Windows Server 2008 R2 and Windows Server 2012. Following is a short description of

More info: In a farm with WID as the database, the first server in the farm act as the primary server and host a read/write copy of the database. Secondary servers then replicate inbound the configuration data into their read-only database. They are fully functional federation members and can service the clients just like the Primary server. They are just unable to write any configuration changes to the WID which does not take place every day.

If the Primary Server in the farm is down, what happens?

Another server in the farm can be configured as the primary server. Below is the PowerShell command to run on the secondary server which you want to make primary:

Add-PsSnapin Microsoft.Adfs.PowerShell

Set-AdfsSyncProperties -Role PrimaryComputer

Once the primary federation server is set run the following PowerShell commands on the other secondary federation servers to sync them with the new Primary ServersCommand to run on the other farm member servers:

Add-PsSnapin Microsoft.Adfs.Powershell

Set-AdfsSyncProperties -Role SecondaryComputer -PrimaryComputerName {FQDN of the Primary Federation Server}

For Steps: The Role of the AD FS Configuration Database

Summary - Determining which type of AD FS configuration database to use

AD FS 2.0 uses a database to store configuration and—in some cases—transactional data related to the Federation Service. You can use the AD FS 2.0 software to select either the built-in Windows Internal Database (WID) or Microsoft SQL Server 2005 or newer to store the data in the Federation Service.

For most purposes, the two database types are relatively equivalent. However, there are some differences to be aware of before you begin reading more about the various deployment topologies that you can use with AD FS 2.0. The following table describes the differences in supported features between a WID database and a SQL Server database.

SQL Server considerations

You should consider the following deployment facts if you select SQL Server as the configuration database for your AD FS 2.0 deployment.

• SAML features and their effect on database size and growth. When either the SAML artifact resolution or SAML token replay detection features are enabled, AD FS stores information in the SQL Server configuration database for each AD FS token that is issued. The growth of the SQL Server database as a result of this activity is not considered to be significant, and it depends on the configured token replay retention period. Each artifact record has a size of approximately 30 kilobytes (KB).
• Number of servers required for your deployment. You will need to add at least one additional server (to the total number of servers required to deploy your AD FS 2.0 infrastructure) that will act as a dedicated host of the SQL Server instance. If you plan to use failover clustering or mirroring to provide fault tolerance and scalability for the SQL Server configuration database, a minimum of two SQL servers is required.

How the configuration database type you select may impact hardware resources

The impact to hardware resources on a federation server that is deployed in a farm using WID as opposed to a federation server that is deployed in a farm using the SQL Server database is not significant. However, it is important to consider that when you use WID for the farm, each federation server in that farm must store, manage, and maintain replication changes for its local copy of the AD FS configuration database while also continuing to provide the normal operations that the Federation Service requires.

In comparison, federation servers that are deployed in a farm that uses the SQL Server database do not necessarily contain a local instance of the AD FS configuration database. Therefore, they may make slightly fewer demands on hardware resources.

Verifying that your production environment can support an AD FS 2.0 deployment

In addition to the federation servers that you will deploy, and depending on how your existing production environment is set up, the following additional servers may be required to provide the necessary infrastructure to support your new AD FS 2.0 deployment:

• Active Directory domain controller
• Certification authority (CA)
• Web server to host federation metadata
• Network load balancing (NLB)

From TechNet - Important considerations to help you plan and design which Active Directory Federation Services (AD FS) deployment topology to use in a production environment.

Determine Your AD FS Deployment Topology

AD FS Deployment Topology Considerations

Stand-Alone Federation Server Using WID

Federation Server Farm Using WID

Federation Server Farm Using WID and Proxies

Federation Server Farm Using SQL Server

The Role of the AD FS Configuration Database

Is it possible to move from WID to SQL at some point in the future?

Yes it is supported to move from WID to SQL. Detailed steps are documented here

Supported Versions of SQL: SQL 2008 R2, SQL 2012.

Checklist to setup ADFS

ADFS 2. 0 http://technet.microsoft.com/en-us/library/dd807086(v=ws.10).aspx

I also found a checklist specifically for Windows Server 2012 which is located at http://technet.microsoft.com/en-us/library/dd807086.aspx

More useful resources:

• AD FS 2.0 Step-by-Step and How to Guides: http://technet.microsoft.com/en-us/library/adfs2-step-by-step-guides(WS.10).aspx
• AD FS 2.0 Content Map: http://social.technet.microsoft.com/wiki/contents/articles/2735.ad-fs-2-0-content-map.aspx

What servers do I need to accommodate single sign on (SSO) aka Federated ID?

The following on premises servers are needed to accommodate SSO with Office 365:

• ADFS 2.0 Proxy Servers (2 minimum for redundancy)
• ADFS 2.0 servers (2 minimum for redundancy)
• DirSync Server

Do we require ADFS proxies or can I just deploy an ADFS internal server?

Technically, you can get away with just ADFS servers and no proxy servers for Federated ID, we recommend you deploy ADFS proxies to protect your ADFS servers and to allow for client access restriction capabilities such as denying access to email when off campus or IP filtering.

Is there an order they need to be installed?

Yes, configure ADFS and federated ID first and then Directory Sync Server. You would think it is the other way however things run better when ADFS is configured prior to Dirsync.

Do I need full blown SQL Server with ADFS?

It depends on how you are going to implement ADFS and the total number of ADFS servers deployed. If you require stretched ADFS this requires full blown SQL to accommodate this scenario or if you require more than 5 ADFS servers WID cannot scale beyond that number of ADFS servers.  See here for the differences between WID and SQL with ADFS or here for topology choices for ADFS.

What versions of SQL are supported?

WID, SQL 2008 R2, SQL 2012.

How many ADFS servers do I need for Federated ID?

Each ADFS server scale varies depending on load frequency such as will everyone be logging within a 15 minute interval or spread over an hour. This answer can range from 2 ADFS servers for 15,000 users with high availability with high load or many more users depending on your load frequency.

See the ADFS sizing calculator here to help narrow it down.

Windows Server AD FS high availability configuration

While it is possible to deploy standalone Windows Server AD FS federation services, it is recommended to deploy a farm with at least two nodes for both AD FS STS and proxies for production environments.

See AD FS 2.0 Deployment Topology Considerations in the AD FS 2.0 Design Guide to decide which deployment configuration options best suit your particular needs.

Can I enable geo-redundancy with ADFS?

Yes, it is possible to enable this with SQL mirroring/Replication to an alternate datacenter along with geo-aware load balancers.

What happens if ADFS is unavailable?

ADFS is required to access Office 365 when using Federated ID (SSO). You want to ensure you have redundant ADFS proxies and ADFS servers to reduce any downtime to the cloud.

What type of hardware do I need for ADFS?

Make sure you do not under-spec your ADFS servers as it does require some horsepower to run effectively:

Federation Service Server

· Dual Quad Core 2.27GHz (8 cores)

· 16GB RAM

· Gigabit Network

Federation Service Proxy Server

· Quad Core 2.24GHz (4 cores)

· 4GB RAM

· Gigabit Network

Where can I get more information on deploying ADFS?

There is a good ADFS deployment guide here and a O365 ADFS deployment checklist here.

What is the difference between a single ADFS server versus a farm? Which one is better?

ADFS can be setup as a

• Standalone federation server.
• Farm Federation Server using WID
• Farm Federation Server using SQL

Farm federation server is definitely a better option than a standalone federation server for the obvious reasons – scalability and redundancy. Standalone federation server only support a single server and only store configuration information on a Windows Internal Database (WID). Of course It is easy to setup and its best for lab environment but lacks scalability and redundancy. Moreover, you cannot add more than one server to the Standalone federation server. However, with a farm federation server, you can start a farm with one single ADFS server and add more ADFS servers to the farm at that time or sometime in the future. I often get this question, can a farm federation server using WID function with one server? And the answer is YES! But remember you cannot benefit from load balancing and redundancy since there is only one server in the farm. For more information on Federation Server using WID or SQL please refer to the question of which database to choose.

Certificates' Requirements

Which type of certificates does AD FS require?

Basically you need three types of certificates.

• Service communication certificate
  • AD FS uses this certificate to enable HTTPS which is a requirement for traffic to and from the federation server and federation server proxies ( to secure communication) So it is basically a SSL certificate which needs to be installed on the IIS for each federation server and federation server proxy
• Token signing certificate
  • AD FS uses this certificate to digitally sign outgoing AD FS tokens. This is not used to secure data but in fact it is used to ensure the integrity of the security tokens as they pass between the federation servers and application server via the client computer.
• Token decrypting certificate
  • AD FS 2.0 and above has the ability to encrypt the contents of the AD FS tokens. This is in addition to having these tokens signed by the server's token signing certificate.

Where can I obtain the required certificates from?

There are several options and each have their pros and cons.

• Server communication certificate
  • This certificate must be trusted by the client computers so it is recommended that in a production environment this certificate is obtained from a public CA. Other alternative is to use your enterprise CA (PKI) to issues this cert however, you will need to ensure that this certificate is trusted by all client computers. You may have to use Group Policy to manually push down this certificate. Bear in mind that if the client machines are not joined to the domain, they may not be able to trust your internal certificate which could result in bad user experience such as receiving security alert prompts when they try to access the federated resources. In your test environment, you can easily use a self-signed certificate if you wish as security is usually not of a concern in a lab environment.

• Token Signing Certificate
  • This certificate can be issued via enterprise CA, public CA or by creating a self-signed certificate. The way it is installed depends on how you create the AD FS farm. It is required that all federation servers in the farm use the same token signing certificate. Hence you can install this certificate from the CA on a federation server and export the cert along with the private key to other federation servers in the farm and save the cost involved in obtaining a certificate from the public CA. However, the option that I personally favor is to allow what AD FS 2.x does by default i.e. it creates a self-signed certificates for signing tokens. I like this option because the maintenance is very low. It has a validity of one year after which it must be renewed however, AD FS provides the capability for automatic renewal (Automatic Certificate Rollover) for self-signed certificates before expiry and if the relying party trust is configured for automatic federation metadata, the relying party will automatically sync the new public key.

• Token Decrypting Certificate
  • Similar to Token Signing Certificate AD FS 2.x by default will use another self-signed certificate for the Token decrypting/encrypting certificate and as stated above, it also provides the capability for Automatic Certificate Rollover.

Steps - Use AD FS to implement and manage single sign-on

The following are instructions for administrators of a Microsoft cloud service who want to provide their Active Directory users with single sign-on experience by using Active Directory Federation Services (AD FS) as their preferred security token service (STS). In order to set up your on-premises STS using AD FS, complete the following steps.

Checklist: Use AD FS to implement and manage single sign-on

For more information, see Additional AD FS References.

Steps - Using WID to store the AD FS configuration database

You can create the AD FS configuration database using WID as the store by using either the Fsconfig.exe command-line tool or the AD FS Federation Server Configuration Wizard. When you use either of these tools, you can choose any of the following options to create your federation server topology. Each of these options uses WID for storing the AD FS configuration database:

• Create a stand-alone federation server
• Create the first federation server in a federation server farm
• Add a federation server to a federation server farm

If you select the stand-alone option, WID is used to store a single instance of the AD FS configuration database. This instance cannot be shared across multiple federation servers. It is meant for test lab environments only. For more information about the stand-alone federation server option or how to set one up, see Stand-Alone Federation Server Using WID or Create a Stand-Alone Federation Server.

If you select the first federation server in a federation server farm option, WID is configured for scalability that will permit additional federation servers to be added to the farm at a later time. For more information about deploying a WID farm or how to set one up, see Federation Server Farm Using WID or Create the First Federation Server in a Federation Server Farm

If you select the add a federation server option, WID is configured to replicate configuration database changes to the new federation server at set intervals. For more information about adding a federation server to a WID farm, see Federation Server Farm Using WID or Add a Federation Server to a Federation Server Farm.

Steps - Using SQL Server to store the AD FS configuration database

1. The migration of an AD FS configuration database from WID to an instance of SQL Server is supported. For more information about how to do this, see AD FS: Migrate Your AD FS Configuration Database to SQL Server on the TechNet Wiki site.
2. ADFS 2.0 High Availability and High Resiliency Walkthrough - http://social.technet.microsoft.com/wiki/contents/articles/1841.adfs-2-0-high-availability-and-high-resiliency-walkthrough.aspx

You can create the AD FS configuration database using a single SQL Server database instance as the store by using the Fsconfig.exe command-line tool. Using a SQL Server database as the AD FS configuration database provides the following benefits over WID:

• Administrators can leverage the high availability features of SQL Server
• It provides additional performance increases for high traffic.
• It provides feature support of SAML artifact resolution and SAML/WS-Federation token replay detection (described below).

The term "primary federation server" does not apply when the AD FS configuration database is stored in a SQL database instance because all federation servers can equally read and write to the AD FS configuration database that is using the same clustered SQL Server instance, as shown in the following illustration.

You can use SQL Server to configure two or more servers to work together as a server cluster to ensure that AD FS is made highly available to service incoming client requests. High availability provides a scale-out architecture in which you can increase server capacity by adding additional servers. Single points of failure are mitigated by automatic cluster failover.

You can achieve high availability by using the network load-balancing and failover services that SQL clustering technologies provide. For more information about how to configure SQL Server for high availability, see High Availability Solutions Overview (http://go.microsoft.com/fwlink/?LinkId=179853).

Exchange Online Support team – for any troubleshooting assistance. Please call one of the following numbers - +1 800 426 9400, +1 866 270 6179, +1 800 865 9408 (United States).

Exchange Online Support

With every Microsoft Office 365 Enterprise, Midsize Business, Small Business, Academic, and Government subscription, Microsoft Support provides global technical, pre-sales, billing and, subscription support. Support is available both online through the Office 365 portal, and by telephone for both paid and trial subscriptions. For more information, see Office 365 Support Options. Authorized administrators can use the Office 365 portal to submit service requests online, access support telephone numbers, and view all open and closed service requests. For instructions, see Contact support for technical, pre-sales, billing, and subscription issues.

Please Use the following Articles for reference,

Microsoft Support Components: http://technet.microsoft.com/en-us/library/jj945184.aspx

Office 365 for business—support options: http://office.microsoft.com/en-us/business/office-365-for-businesssupport-options-FX103843554.aspx

Support: http://technet.microsoft.com/en-us/library/jj819269.aspx

Previous blog: Office 365 Single Sign-on with ADFS: Roadmap, Design, Implementation, ADFS High Availability (& the Choice of Configuration-Database-Type for Redundancy) - Steps & FAQs

In this unique offering we will provide technical guidance on common cloud solutions which you, as Microsoft Partner can leverage for your customer requirements. The primary goal of this offering is to assist our Partners in winning deals and achieve successful deployment for customers. These Cloud solutions will give new avenues for you to sell azure subscription and Office 365 licenses.

DAY WISE DELIVERY AGENDA

For Registrations, Contact: Kapil Hudiya, kapilh@microsoft.com

Limited-time offer

Buy a minimum of 150 qualifying Office 365¹ seats between September 2013 and June 2014 and we'll help you accelerate your adoption of Office 365 by investing in Office 365 FastTrack. Step 2 deployment activities with a Cloud Deployment Partner (Silver or Gold in one of the 7 Cloud Competencies) or Microsoft Consulting Services (MCS).

The more seats you buy, the more we invest in your deployment

With the Office 365 Deployment offer, Microsoft will contribute to your successful deployment:

http://office.microsoft.com/en-us/business/move-to-office-365-fast-FX104097280.aspx

Program Requirements

1. Silver or Gold in one of the Required Competency
2. 150 seats Net New Customer deal

*This offer is good on net new Office 365 Enterprise plan or Exchange Online seats and is available to commercial and government customers in all countries where Office 365 is available. Customers must buy a minimum of 150 net new seats during the September 1, 2013 to June 30^th 2014 offer period. This investment is paid directly to the Cloud Deployment Partner

Cloud Deployment Partner: 1. Attain Cloud Accelerate status (150 seats sold via a minimum of 3 customers) 2. Attain a Silver or Gold in 1 of 7 Cloud Competencies listed on the right 3. Complete one Office 365 deployment of more than 150 seats in the last 18 months by June 30^th 2014 

**Yammer stand-alone SKUs or the Deskless Power SKU are not eligible for this offer. Select O365 SKUs (E1, E3, E4, EP1, EP2 or equivalent government "G" SKUs) are included.

Microsoft Partner Network - Technical Presales and Advisory Services

This unique offering is designed specifically for Microsoft Partners to share some of the known issues encountered during O365 migration. This content has been designed in collaboration with Advisory and Support team where we will take a deep dive into the major components, how to proactively take the necessary actions to overcome hurdles and troubleshoot known scenarios. This offering will enable you to deploy and support O365 migration flawlessly and provide a great experience to your end customer.

21^st April 2014

Troubleshoot Client Connectivity

12 PM EST 22^nd April 2014

Troubleshoot Mail-Flow Issues

12 PM EST 23^rd April 2014

Troubleshoot Cutover and Staged Migrations

12 PM EST 24^th April 2014

Troubleshoot Hybrid Deployments and Migrations

12 PM EST 25^th April 2014

Tools and Diagnostics resources to troubleshoot Office 365 services PM EST

Click Here to Register now!!!

The sessions is designed for Consultants, Deployment Engineers, IT Professional and Support Engineers who primarily works on Office 365 Solutions, Migrations and Administration

DAY WISE DELIVERY AGENDA

	Topic	Description (Each Session 90 mins)
DAY 1 21 April 2014	Troubleshoot Client Connectivity	In this session we will cover different scenarios for client connectivity and discuss on the concepts. We will also take a deep dive in troubleshooting various methods (Outlook, Browser and Mobile) of client connectivity.
DAY 2 22 April 2014	Troubleshoot Mail-Flow Issues	In this session we will discuss various scenarios of mail flow. We will also understand how mail flow works in coexistence and what the necessary steps to troubleshoot mail flow issues are.
DAY 3 23 April 2014	Troubleshoot Cutover and Staged Migrations	In this session we will discuss the best practices and how to proactively take necessary steps to avoid the common issues and troubleshoot them that can arise during Cutover and Staged Migrations.
DAY 4 24 April 2014	Troubleshoot Hybrid Deployments and Migrations	We will discuss the best practices and how to proactively take necessary steps to avoid the common issues and troubleshoot them that can arise during Hybrid Deployments and Migrations.
DAY 5 25 April 2014	Tools and Diagnostics resources to troubleshoot Office 365 services	Here we will discuss and explain the various tools that can be used in different stages of troubleshooting Office 365 services. We will also walkthrough each tool in detail for effective usage.

Technical Presales and Advisory Services

  An excerpt from Radicati Group's latest study, "Microsoft Exchange, Office 365, and Outlook Market Analysis, 2013-2017" - Microsoft continues to be the leading vendor in the Email and Collaboration space with its Microsoft Exchange Server and Office 365 solutions. Combined, Microsoft Exchange Server and Microsoft Office 365 currently account for 51% of worldwide mailboxes in the Business Email and Collaboration market. Cloud-based Business mailboxes offered through Microsoft Office 365 and Microsoft Hosting Partners currently account for 15% of worldwide Microsoft Exchange Server mailboxes, while On-Premises mailboxes still represent an 85% market share. ]]> https://docs.microsoft.com/archive/blogs/ucando365talks/exchange-online-protection-reporting-customization-and-support-options-streamlining-for-your-organization-emergency-notes Tue, 25 Feb 2014 13:44:00 GMT https://blogs.technet.microsoft.com/ucando365talks/2014/02/25/exchange-online-protection-reporting-customization-and-support-options-streamlining-for-your-organization-emergency-notes/ Exchange Online Protection provides enterprise-class reliability and protect against spam and malware, while maintaining access to email during and after emergencies. It provides a layer of protection features that are deployed across a global network of data centers, helping you to simplify the administration of your messaging environments.

Reiterating our SLAs.

1. Five financially backed SLAs attest to a high quality of service, including protection from 100% of known viruses and 99% of spam.
2. Globally load-balanced network of data centers helps to ensure a 99.999% network uptime.

However, it is important to understand that while EOP will eliminate unwanted emails – but for a few organizations, with specific requirements, IT administrators can customize EOP policies. And, EOP also learns from end-user reporting and gradually streamlines itself.

So, did you still receive an unwanted email? Here is your Plan of Action.

1. Tweak
   1. Set anti-spam options
      1. Mange your connection filters by adding IP addresses to IP Allow and IP Block lists. Learn more at Configure the Connection Filter Policy and Safe Sender and Blocked Sender Lists FAQ.
      2. Phishing: It's recommended that organizations who are concerned about phishing turn on the SPF record: hard fail and Conditional Sender ID filtering: hard fail options. Learn more at Configure Content Filter Policies and Advanced Spam Filtering Options.
      3. Spoofing: When you set up EOP, you added an SPF (sender policy framework) record for EOP to your DNS records. The SPF record helps prevent spoofing. For more information about how an SPF record prevents spoofing and how you can add your on-premises IP addresses to the SPF record, see Customize an SPF Record to Validate Outbound Email Sent from Your Domain
      4. If you are using the default content filter action, Move message to Junk Email folder, in order to ensure that this action will work with on-premises mailboxes, you must configure two Exchange Transport rules on your on-premises servers to detect spam headers added by EOP. For details, see Ensure that Spam is Routed to Each User's Junk Email Folder.

          

   2. Set Anti-Malware options
      1. Review and fine tune your malware filter settings in the EAC. Learn more at Configure Anti-Malware Policies.

          

   3. Create Transport Rules
      1. Create transport rules (custom filters) to meet business needs.
      2. When you deploy a new rule to production, select one of the test modes first to see the effect of the rules.  Once you are satisfied that the rule is working in the manner intended, change the rule mode to Enforce.
      3. When you deploy new rules, consider adding the additional action of Generate Incident Report to monitor the rule in action.
      4. If you are in a hybrid deployment configuration, with part of your organization on-premises and part in Office 365, you may want to create rules that apply to the entire organization in a seamless manner. You can only do this if you use predicates and actions that are available both on-premises and in Office 365.  While most predicates and actions are available in both deployments, there is a small set that are specific to a particular deployment scenario. Learn more at Transport Rules.

          

          

          

2. Report Microsoft – How?
   1. For Spam
      1. Submitting Spam and Non-Spam Messages to Microsoft for Analysis
         1. Junk Email Reporting Add-in for Microsoft Office Outlook
            1. Install and Uninstall the Junk Email Reporting Add-in for Microsoft Office Outlook
            2. Report Junk Email Messages to Microsoft
            3. Troubleshooting and Support Information
         2. Use Transport Rules to Block Spam Reporting to Microsoft

             

            Summary

            False Negative?

• Use Junk Email Reporting Add-in for Microsoft Office Outlook.
• Send to junk@office365.microsoft.com.

False Positive?

• Release
  • Release a Quarantined Message and Optionally Report it as a False Positive (Administrators).
  • Release a Quarantined Message and Optionally Report it as a False Positive (End Users).
  • If you use the Move message to Junk Email folder action when configuring your content filters (this is the default action), end users can release false positive messages in their Microsoft Outlook or Microsoft OWA Junk Email folder using the Not Junk right-click menu option. In this case, the message is not automatically submitted and must be submitted via email, as described in the following procedure.
• Send to not_junk@office365.microsoft.com.

1. For Malware
   1. False Negative? (submit a sample)

      If you have received malware such as a virus that made it past the filter, please save a copy of the email message with its attached virus, go to the Malware Protection Center and submit a sample using the detailed instructions on that page. When submitting the file, in the Product drop-down list select Other, select the I believe this file contains malware option, and in the Comments field specify Exchange Online Protection. After we receive the sample, we'll investigate and if it's determined that the sample contains malware, we'll take corrective action to prevent the virus from going undetected.

       

   2. False Positive? (submit a sample)

      Similar to submitting malware, go to the Malware Protection Center and submit a sample using the detailed instructions on that page. When submitting the file, in the Product drop-down list select Other, select the I believe this file should not be detected as malware option, and in the Comments field specify Exchange Online Protection. After we receive the sample, we'll investigate and if it's determined that the sample is clean, we'll take corrective action to prevent the file from being detected as malware.

1. Troubleshoot
   1. Troubleshoot general issues and trends by using the reports in the Office 365 admin center or the Excel reporting workbook. Find single point specific data about a message by using the message trace tool. Learn more about reporting at Reporting and Message Trace in Exchange Online Protection. Learn more about the message trace tool at Trace an Email Message and Message Trace FAQ.
   2. Help and Support for EOP

EOP Inbound Filtering Overview

EOP Outbound Filtering Overview

Anti-Spam and Anti-Malware Dig In

Anti-Spam and Anti-Malware Protection

Anti-Spam Protection

Anti-Spam Protection FAQ

Safe Sender and Blocked Sender Lists FAQ

Manage Safe Sender Lists for Bulk Mailers

Configure the Anti-Spam Policies

Configure the Connection Filter Policy

Configure Content Filter Policies

Advanced Spam Filtering Options

Configure End-User Spam Notifications in Exchange Online

Configure the Outbound Spam Policy

Sample Notification When a Sender is Blocked Sending Outbound Spam

Request That a User, Domain, or IP Address Be Removed from a Block List After Sending Outbound Spam

High Risk Delivery Pool for Outbound Messages

Spam Confidence Levels

Submitting Spam and Non-Spam Messages to Microsoft for Analysis

Junk Email Reporting Add-in for Microsoft Office Outlook

Install and Uninstall the Junk Email Reporting Add-in for Microsoft Office Outlook

Report Junk Email Messages to Microsoft

Troubleshooting and Support Information

Use Transport Rules to Block Spam Reporting to Microsoft

Anti-Spam Message Headers

Quarantine

Quarantine FAQ

Manage Quarantined Messages

Release a Quarantined Message and Optionally Report it as a False Positive (Administrators)

Release a Quarantined Message and Optionally Report it as a False Positive (End Users)

Anti-Malware Protection

Anti-Malware Protection FAQ

Configure Anti-Malware Policies

Further Research

Usual Topics

Exchange Online Protection      

Exchange Online Protection Overview

EOP General FAQ

EOP Queued, Deferred, and Bounced Messages FAQ

Set Up Your EOP Service

Set Up Mail Flow Through Exchange Online Protection

Forefront Online Protection for Exchange (FOPE) Transition Center

Before Your Transition

During Your Transition

After Your Transition

Understand how Licensing Works After Your Transition

FOPE to EOP Transition FAQ

Switch to EOP from Google Postini, the Barracuda Spam and Virus Firewall, or Cisco IronPort

Use Inbound and Outbound Connectors to Configure Custom Mail Flow

Test Mail Flow with the Remote Connectivity Analyzer

Inbound and Outbound Connector FAQ

Scenario: Outbound Smart Hosting

Scenario: Regulated Partner with Forced TLS

Scenario: Conditional Mail Routing

Best Practices for Configuring EOP

Exchange Online Protection IP Addresses

Recipient, Domain, and Company Management in EOP

Recipients in EOP

Manage Admin Role Group Permissions in EOP

View or Edit Managed Domains in EOP

Use Directory Based Edge Blocking to Reject Messages Sent to Invalid Recipients

Messaging Policy and Compliance in EOP

Anti-Spam and Anti-Malware Protection

Reporting and Message Trace in Exchange Online Protection

Exchange Admin Center in Exchange Online Protection

PowerShell in Exchange Online Protection

Help and Support for EOP