Configuring an Exchange 2013

Introduction

In part 7 of this multi-part article series revolving around Exchange 2013 hybrid deployment based migrations to the new Office 365 or more precisely Exchange Online, we converted our custom managed domain to a federated domain, so that users will be able to authenticated against Office 365 using their UPN login.
In this part 8, we will continue where we left off in part 7. That is we will install and configure the Windows Azure Active Directory (WAAD Sync tool on our Windows Server 2012 domain-member server and start object synchronization from our on-premises Active Directory to the Office 365 tenant.
Note:The WAAD Sync tool was formerly known as the Directory Synchronization tool (DirSync tool).
Let’s get going...

Activating Active Directory Synchronization

The first preparation step we want to complete before concentrating on installing and configuring the WAAD Sync tool on the respective domain member server in our on-premises environment is to activate directory synchronization for our Office 365 tenant. This can be done by logging on to the Office 365 portal followed by clicking on the “users and groups”. and from here click “Set up” to the right of “Active Directory synchronization” in the top of the page as shown in Figure 1 below.

Figure 1: Users and groups page in the Office 365 portal
Under “Set up and manage Active Directory synchronization”, click on the “activate” button in “step 3”.

Figure 2: Clicking on the activate button
You will now be asked whether you really wish to activate directory synchronization from your on-premises environment to Office 365. Since this is exactly what we want to do, click “activate” once again.

Figure 3: Do we really wish to activate directory synchronization?
Although we just activated directory synchronization, this will not occur instantly. As you can see in Figure 4, we need to wait up to 24 hours before it’s activated.

Figure 4: Activation in progress

Creating the WAAD Sync Service Account

While we wait for directory synchronization to complete, let’s create the service account that should be used for configuring directory synchronization. We should create this account in the Office 365 tenant. To do so, click “users and groups” and then hit the “plus” sign as shown in Figure 5.

Figure 5: Clicking “plus” sign
Enter the name and UPN logon for the account and click “next”.

Figure 6: Naming the account and giving it a UPN logon name
On the “settings” page, make sure to assign the account “Global Administrator” permissions. Also, specify the email address that should be used if there’s a need to someday reset the password for this account.
Click “next”.

Figure 7: Assigning the account Global Administrator permissions
Since the account should not be used to access any Office 365 services, leave all of them unticked and click “next”.

Figure 8: No need for any licenses
Now specify the email address to which the temporary password should be sent and click “create”.

Figure 9: Send results in email
On the “results” page, click “finish”.

Figure 10: Results page
Now log off the portal and log on again using the new accounts credentials.

Figure 11: Logging on to the portal with the new account
You will be asked to specify a new password for the account. Do so and click “save”.

Figure 12: Specifying a new password for the new account
Now you need to decide whether the new account, which can be considered a service account should follow the Office 365 password expiration policy meaning you need to change the password for the account every 90 days or if you rather want to set the password to never expire.
I’ll do the latter.
Since this can’t be done via the Office 365 portal, we need to connect to the Office 365 tenant using Windows PowerShell.
When connected to the Office 365 tenant, we can check the “PasswordNeverExpires” value with the following command:
Get-MsolUser –UserPrincipalName “svc-dirsync@clouduserdk.onmicrosoft.com” | fl

Figure 13: Value of the “PasswordNeverExpires” attribute for the new service account
To change this value to “True”, we can use the following command:
Set-MsolUser –UserPrincipalName “svc-dirsync@clouduserdk.onmicrosoft.com” –PasswordNeverExpires “true”

Figure 14: Changing the password never expires attribute to “true”
Ok let's see whether active directory synchronization has been activated. As you can see in Figure 15, this is the case so we can move on to the next action, which is to install and configure the WAAD Sync tool.

Figure 15: Active directory synchronization is now activated

Installing and Configuring the WAAD Sync Tool

When directory synchronization has been activated, let’s switch back to the server on which we wish to install the WAAD Sync tool. You can download the latest version of the WAAD Sync tool from the Office 365 portal. More specifically under “users and groups” > “Set up” and here click the “download” button under “step 4”.

Figure 16: Downloading the WAAD Sync tool
From there launch the WAAD Sync tool setup wizard. On the “Welcome” page, click “Next”.

Figure 17: WAAD Sync tool setup wizard – Welcome page
Accept the license terms and click “Next”.

Figure 18: Accepting the license terms
On the “Select Installation Folder” page, click “Next”.

Figure 19: Select installation folder page
Let the installation finish. This can take a few minutes.

Figure 20: WAAD Sync tool is being installed
When installation has completed, click “Next”.

Figure 21: Installation complete
On the “Finished” page, make sure “Start Configuration wizard now” is ticked then click “Finish”.

Figure 22: Finish page
The WAAD Sync tool Configuration wizard will now launch. On the “Welcome” page, click “Next”.

Figure 23: WAAD Sync tool Configuration wizard
On the “Windows Azure Active Directory Credentials” page, enter the credentials for the service account we created in the previous section and click “Next”.

Figure 24: Entering the credentials for the WAAD Sync service account
On the “Active Directory Credentials” page, enter the credentials of an account with domain administrator permissions in the on-premises Active Directory.
Note:
This does not need to be a dedicated service account as these credentials aren’t saved.
Click “Next”.

Figure 25: Entering the credentials of a domain administrator
We’re now taken to the Exchange hybrid deployment page. If the DirSync Configuration setup wizard detects Exchange 2010 SP1 (or later) servers in the on-premises Active Directory we will be able to tick “Enable Exchange hybrid deployment”.
Note:
If the setup wizard doesn’t detect any Exchange 2010 SP1 (or later) servers, the tick box will be greyed out. Since we, in this article series, are dealing with an Exchange hybrid deployment based configuration based on Exchange 2013 servers, we wish to tick this option.
When ticking the “Enable Exchange hybrid deployment” box, we allow the WAAD Sync tool to perform write-back from Office 365 to the on-premises Active Directory for specific attributes. This is in order to allow support for features such as archive on-premises mailboxes in the cloud, off-board mailboxes from the cloud to on-premises Exchange servers, have on-premises filtering software take advantage of user made safe and blocked senders in the cloud and UM online voice mail.
With Exchange hybrid deployment enabled, write-back will be performed for the following attributes:

Write-Back   attribute	Exchange   "full fidelity" feature
SafeSendersHash   BlockedSendersHash   SafeRecipientHash	Filtering Coexistence: Writes back on-premises filtering and online safe and blocked sender data from clients.
msExchArchiveStatus	Online Archive: Enables customers to archive mail in Microsoft Online.
ProxyAddresses   (LegacyExchangeDN as X500)	Enable Mailbox: Off-boards an online mailbox back to on-premises Exchange.
msExchUCVoiceMailSettings	Enable Unified Messaging (UM) - Online voice mail: This new attribute is used only for UM-Microsoft Lync Server 2010 or later integration to indicate to Lync Server 2010 or later on-premises that the user has voice mail in online services.

Table 1: Write-back attributes when hybrid deployment is enabled
When you have ticked “Enable Exchange hybrid deployment”, click “Next”.

Figure 26: Ticking enable “Hybrid Deployment”
Now we reach the new “Password Synchronization” page, where we have the option to enable password synchronization from the on-premises Active Directory users to the user objects in the Office 365 tenant. With password synchronization we can achieve SSO as in “same sign-on” not SSO as in “single sign-on”, which is possible with ADFS based federation between the on-premises environment and the Office 365 tenant.
Since we use ADFS based federation in this article series, make sure “Enable Password Sync” is unticked and click “Next”.

Figure 27: Password synchronization page
Wait for the WAAD Sync tool configuration wizard to complete the configuration.

Figure 28: Completing configuration
When configuration has completed, click “Finish”.

Figure 29: Configuration complete
Now make sure “Synchronize directories now" is selected and then click “Finish”. This will initiate the first synchronization from the on-premise Active Directory to the metaverse and the export from the metaverse to the Office 365 tenant.

Figure 30: Finished page
You will receive the warning shown in Figure 31, which includes a link to a TechNet page that explains how you can verify synchronization works properly. Click “OK”.