Tuesday, February 21, 2017

Office 365- Hybrid Configuration with Skype for Business Online-Lync 2013

Recently, one of my customers want to do the pilot for the hybrid deployment of the Skype for Business online, currently, a customer running on Lync 2013 on premises. So just want to share my experience & process to deploy the hybrid environment for Skype for Business.

Hybrid connectivity between Lync 2013 server and Skype for Business online means users of a domain are split between using Lync 2013 server and Skype for Business online. Some of the domain users are homed on-premises, and some users are homed online.

Before moving forward we have to make sure our on-premises is matching requirement, following are:

Skype for Business client support

Before you decide to deploy hybrid deployment you have to check which client support for Skype for Business online. There are some differences in the features supported in Skype for Business clients, as well as the features available in on-premises and online environments. The following clients are supported with Skype for Business Online in a Skype for Business hybrid deployment:

Lync 2010
Lync 2013
Lync Windows Store app
Lync Web App
Lync Mobile
Lync for Mac 2011
Lync Room System
Lync Basic 2013

for more details click here Clients for Skype for Business Online

Topology Requirements

To configure your deployment for the hybrid with Skype for Business Online, you need to have the  Lync Server 2013 deployment with all servers running Lync Server 2013. For more details Lync Server 2013 Reference Topologies for Enterprise Hybrid Deployments

Requirements for Federation Allowed/Blocked Lists

The allowed domains list includes domains that have a partner Edge fully qualified domain name (FQDN) configured, following are the requirement to successfully configure a hybrid deployment:
Domain matching must be the same configuration on on-premises and Office 365 tenant.
The blocked domain list in the on-premises deployment must exactly match the blocked domain list on an online tenant.
The Allowed domains list in the on-premises deployment must exactly match the allowed domains list for your online tenant.
Federation must be enabled for the external communications for the online tenant, which is configured by using the Lync Online Control Panel.
If the partner discovery is enabled on the on-premises deployment, then open federation must be configured for your online tenant if the partner discovery is not enabled, then closed federation must be configured for your online tenant.

DNS Requirement

We have to make sure when we are creating the DNS records for hybrid deployments, all Lync external DNS records should point to the on-premises infrastructure, additionally, we have to ensure the DNS resolution described with following records in on-premises:
_sipfederationtls._tcp.     Edge Server (for all supported SIP domains resolving to Access Edge external IPs)
DNS A records               Internal corporate Network (for Edge Web Conferencing Service FQDN)

Firewall Considerations

Client on corporate network must be able to perform standard Internet DNS lookups, for more Office 365 URLs and IP address ranges

Port and protocol 

TCP 443
TCP 80 and 443
TCP 5061
RTP/TCP 50000-59999

Preparing the Network for a Lync Hybrid Deployment

The network requirements for a Lync hybrid deployment are similar to the requirements for a cloud-only deployment. However, there are several additional firewall port requirements compared to a cloud-only deployment, and there is at least one additional DNS requirement for the hybrid deployment, depending on the configuration. We need to do the Network Assessment before start any configuration, we can use Skype for Business Network Assessment tool. The Skype for Business Network Assessment Tool provides the ability to perform a simple test of network performance to determine how well the network would perform for a Skype for Business Online call.


We have to make sure we have following utilities installed and working smoothly to complete the tasks for configuring the Hybrid.
1. Active Directory Synchronization (AAD Connect).
2. Office 365 tenant with Skype for Business online enabled.
3. ADFS for single sign on.
4. Windows Power Shell for single sign on.
5. Microsoft online Services Sign-in Assistant.
6. Up to date CU for Lync Server on premises.

Following are steps involve

Add your domain and verify ownership
Install and Configure Active Directory synchronization
Install and Configure Active Directory Federation Services (AD FS)
Install and Configure Active Directory Federation Services Proxy (AD FS Proxy)
Configure Single Sign-on (SSO) with ADFS
Configure federation of Lync Server 2013 with Lync Online
Move user to Lync Online and test calls between Lync Online and Lync Onprem

Add your domain and verify ownership

Once you signed up Office 365, you will get the Office 365 Tenant account. From this account, you will add your domain. This will allow Microsoft to host the desired Office 365 services for you and will allow you to use you own domain, rather than the tenant domain account (@domain.onmicrosoft.com) default account.

The process should be quite easy and painless as long as you have access to the Microsoft Online Portal, with a Global Admin account, and access to your public facing DNS.

for step by steps you follow Adding and Verifying a Domain for the NEW Office 365

Install and Configure Active Directory synchronization
Install and Configure Active Directory Federation Services (AD FS)
Install and Configure Active Directory Federation Services Proxy (AD FS Proxy)

Office 365 uses the cloud-based user identity management service Azure Active Directory to manage users. You can also integrate your on-premises Active Directory with Azure AD by synchronizing your on-premises environment with Office 365. Once you set up synchronization you can decide to have their user authentication take place within Azure AD or within your on-premises directory.
For Step-by-Step Guide for AAD Connect Custom installation + Federation with AD FS click here.

Configure Single Sign-on (SSO) with ADFS

Once we complete the ADFS and ADFS Proxy setup, we can now configure SSO between the Onprem AD and O365's Azure AD. First, we have to download and install the Microsoft Azure Active Directory Module for Windows PowerShell on the ADFS computer. Once installed, open the module and run the following PowerShell commands to setup a trusted federation domain:

First, give the credential

$cred = get-Credential

connect online service

Connect-MsolService -Credential $cred

Now time to convert your domain to federated domain

Convert-MsolDomainToFederated -DomainName

time to verify the configuration

Get-MsolFederationProperty -DomainName

Now it's time to test single sign-on connectivity, we can use the Microsoft Connectivity Analyzer Click the Office 365 tab, click Microsoft Single Sign-On, and then click Next. Follow the screen prompts to perform the test.

Configure federation of Lync Server 2013

We must enable the federation to allow communications with Office 365, we can use Power Shell for performing all the steps:

Set-CSAccessEdgeConfiguration -AllowOutsideUser1 -UseDnsSrvRouting -AllowFederatedUses

Confirm the settings with the following command


Nest configure the provider Skype for Business online, first, we have to identify the existing suppliers


Remove the existing provider

Remove-CsHostingprovider -Identity "Skype for Business Online"

Verify again with the command


Now time to add the Skype for Business Online supplier with the following parameters:

New-CSHostingProvider -Identity SkypeforBusinessOnline -ProxyFqdn "fed.online.tech.com" -Enable $true -EnableSharedAddressSpace $true -hostOCSUsers $true -Verification level UseSourceVerification -Is local $false -AutodiscoverUrl https://webdir.online.tech.com/Autodiscover/AutodiscoverService.svc/root

Configuration of Office365

In the Skype Online Administration Center into your Office 365, validate that the federation is enabled in "Organization" – "External Communications".

Configure SharedSipAddressSpace

Before moving users from Lync Onprem to Lync Online, we need to configure the O365 tenant to share the SIP address space with the on-premises deployment. If this is not configured, we may see the following error message

Set-CsTenantFederationConfiguration -SharedSipAddressSpace $true

Move user to Skype for Business and Lync Onprem

Now we can proceed to use the Move-CsUser cmdlet in the Onprem Lync Management Shell: to move the user from Onprem to Online.

Move-CsUser -Identity -Target sipfed.online.tech.com -Credential $cred -HostedMigrationOverrideUrl

After the Move-CsUser command completes successfully with no errors, we can log into O365 Lync admin center to see the user is now homed online.

On the Onprem Lync Control Panel we can see the same user is specified as homed online

Happy Learning!

Thank you!

Sunday, February 5, 2017

Exchange 2016 and Skype for Business Integration-OWA

In Skype for Business IM integration with OWA enable the user to publish the presence and view the presence of the other without having a local Skype for the Business client running. By default, the integration between exchange 2016 and skype for a business server for this feature is not enabled.

In previous Exchange versions, we simply need to edit the web.config file with Exchange certificate thumbprint. Also if Microsoft Exchange Unified Messaging Call Router service and the Microsoft Exchange Unified Messaging service runs on the same box then there was no need to create an application pool for OWA integration. However, these two steps have been replaced with Exchange 2016 because of all roles in the same box. For deep dive Exchange 2016 click here

You can also check Integrating Lync 2013 with Exchange 2013 in my old post.

Exchange 2016 and Skype for Business Integration

Before starting the configuration part we have to make sure Server to Server authentication are working and Exchange Autodiscover services are configured correctly.

Self-signed SSL certificate (Microsoft Exchange Auth Certificate) is installed on the each Exchange servers, this will for the server to server authentication on Exchange side.

We can verify on Exchange Server with Power Shell


In Skype for Business server, we have to request a certificate for SkypeFB web services which can also use for the OAuthTokenIssuer for the server to server communication as long as you use this SSL certificate on all your front end servers.

We can verify with Power Shell command

Get-CsCertificate –Type OAuthTokenIssuer

we can verify the IM presence to open the OWA.

as we can see there is no presence available now, we will verify once our configuration complete.

Configure Auto discover

We need to make sure that Autodiscover services configured/running correctly, if it is not configured correctly integration with Skype for Business will not work.
We can use Power Shell command to verify the configuration 

Get-ClientAccessService | Select-Object Name, AutoDiscoverServiceInternalUri | Format-List

Get-ClientAccessServer -Identity MX1 | Select-Object AutoD*

you can get for other exchange servers also.

Create the DNS Records

We have to create two DNS record before modifying the Exchange configuration, which is mostly autodiscover aware clients will query when attempting to locate an Exchange Server.

Create a new Alias (CNAME) record in the under forward lookup zone, pointing to the Exchange Server FQDN

Second, create the new Service Location (SRV) record using the following parameters pointing this record to the CNAME record.

We can verify DNS records with help of nslookup command

Update the Autodiscover URL

If the AutodiscoverServiceInternalUri has not correct then we must have configured with the following command:

Set-ClientAccessService –Identity MX1 –AutoDiscoverServiceInternalUri https://autodiscover.tech.com/autodiscover/autodiscover.xml

Configure OAuth

OAuth is the server to server authentication mechanism used between the Skype for business and Exchange servers to establish secure communications. During the skype for business server deployment SSL certificate specified the OAuth. We need to make sure that OAuth is configured to the Skype for Business FE servers, we can user Power Shell command to verify the OAuth


Before the integration with Skype for Business partner application we need to know about the Exchange Autodiscover configuration with following Power Shell command:

Get-ClientAccessServer -Identity MX1 | Select-Object AutoDiscoverServiceI*


Now we have to configure the OAuth from SfB front end server

Set-CsOAuthConfiguration -Identity global -ExchangeAutodiscoverUrl https://autodiscover.tech.com/autodiscover/autodiscover.svc

Here is the point we are using .svc not .xml in autodiscover URL.

Now run again Get-CsOAuthConfiguration command for complete details

We are now ready for integration and everything we already configured on both sides.

Configure Exchange 2016 server 

Now in Exchange server side, we need to configure the metadata authentication URL, we can complete the pairing a new partner application will also need to be defined on the Skype for Business side. We need the metadata URL for SfB authentication.

This URL should be identical to the following format, utilizing the SfB Front End server FQDN.


Connect to this URL in a web browser from the Skype for Business Server to validate connectivity, which will give you more details.

Now configure the Configure-EnterprisePartnerAppliation with the following command

.\Configure-EnterprisePartnerApplication.ps1 -AuthMetadataUrl “https://autodiscover.tech.com/autodiscover/metadata/json/1″ -ApplicationType Lync

Once command executes successfully restart the IIS.

Configure Skype for Business 

For complete the pairing we need to configure Skype for Business side also, we need to configure metadata authentication URL of the Exchange server which will be the following format:


We can test this URL on Skype for Business server will give you the more details.
Once you get the all details now time to add the partner application with help of Skype for Business management Shell

New-CsPartnerApplication –Identity Exchange –ApplicationTrustLevel Full –MetadataUrl hrrps://autodiscover.tech.com/autodiscover/metadata/json/1

Test the Connectivity

Now time to validate the configuration partner application relationship has been successfully established with help of the following command:

Test-CsExStorageConnectivity –SipUri sip:dinesh.singh@tech.com –verbose

The test cmdlet returns a successful result of “Test Passed”.

Enabling Skype for Business for OWA

On Exchange Server 2016

First, run the command on Exchange Management Shell


Copy the thumbprint on the notepad which we require in next steps.
From Exchange Management Shell specify the IM server and certificate thumbprint with help of the following command:

New-SettingOverride –Name “OwaOverride” –Component OwaServer –Section IMSettings –Parameters @(“IMServerName=” –Reason “Configure IM” –Server MX1

If you want to make change all Exchange servers, you can remove the MX1 from above cmd.

Now refresh the IM settings on the Exchange servers, you have to do on every Exchange 2016 server which used for Outlook Web App, run following command on Exchange management Shell

Get-ExchangeDiagnosticInfo –Server MBX1 Process Microsoft.Exchange.Directory.TopologyService –ComponentVariantConfiguation –Argument Refresh

Next, we have to Restart outlook web app application pool with help of the following command 


Once complete verify the OWA virtual directory with help of below cmdlet


Now enable IM on Owa with help of the following command:

Get-OwaVirtualDirectory | Set-OwaVirtualDirectory –InstantmessagingEnabled $true –InstantMessagingType OCS

Now you can run the  cmdlet

Get-OwaVirtualDirectory | fl command for checking the two properties “InstantMessagingEnabled-true & InstantMessagingType-ocs”

Now it's time to allow IM on the OWA web policy with using Power Shell command line

Set-OwaMailboxPolicy –identity “default” –InstantMessagingEnabled $True –InstantMessagingType “OCS”

From Skype for business Server

We completed configuration from Exchange side now it’s time to configure on Skype for business server 

First get the site id with help of following command
Get-CsSite | Select-object DisplayName, SiteID

Note down the result 

Now time to configure trusted application pool with help of cmdlet

New-CsTrustedApplicationPool –Identity “mx1.tech.com” –Registrar “fe1.tech.com” –Site “techUSA” –RequiresReplication $False

Once you hit the command and it will ask to confirm then type A and hit enter

Now time to create a trusted application and map it to the pool which we created with help of following cmd

New-CsTrustedApplication –Application OutlookWebApp –trustedApplicationPoolFqdn mx1.tech.com –Port 5199

Finally, we have to need the publish the topology


Now, time to check the IM presence is in OWA is available.

Thank you!

Happy Learning!