Category: Messaging


As we prepare for the migration from on-premises Skype for Business to Skype for Business Online, there are a few important considerations to bear in mind before you take the leap. I will be covering these in a series of posts (hopefully), today I want to share with you a common scenario we will face while preparing for migration.

We are well aware of the pre-requisite for Office 365 that demands an Active Directory synchronised user must have a publically routable User Principal Name (UPN). So critical is this requirement that it is now engrained in every consultant’s mind and increasingly customers are becoming more aware of this without us even mentioning it. However, this can often produce its own unique challenges.

Many organisations set their users up with an ambiguous username, something that does not immediately identify a user by name e.g. a134g@domain.com rather than markv@domain.com. This is to avoid name conflicts and was often used as an additional domain security measure. When a user is synchronised to Office 365 their UPN is used to provision the identity and service addresses for Exchange and Skype for Business. Often the case is that users UPNs do not match their publically available contact information such as their e-mail address. E-mail addresses are usually more personable to each users and contain their true identity e.g markv@domain.com. In order to integrate Skype for Business Online with Exchange properly it is important that the user’s SIP address matches their primary e-mail address i.e. markv@domain.com and not a134g@domain.com.

However, when you perform an AD Sync with Office 365 the user’s Skype for Business Online identity is provisioned using the UPN like so:

On-premises Identity (UPN = a134g@domain.org)

Synchronised Identity in Office 365 Portal also a134g@domain.org

PowerShell output showing primary SIP Address in Skype for Business Online


In order to change this, the solution is to look and edit the on-premises identity, as this is the source of authority for this person’s cloud identity. Specifically, we need to modify an attribute on the user’s Active Directory account called msRTCSIP-PrimaryUserAddress. In order to find this attribute, your on-premises Active Directory domain is required to be prepared for Lync / Skype for Business On-premises. Therefore, you may need to download the on premises software and run AD schema preparation to have this property available. I say may read on.

First change find and change this attribute

Click on edit and enter the desired address in this format: sip:markv@domain.org

Perform directory synchronisation using AADSync and then check the SIP Address of the online identity. You should see that is has changed

Please note that this only works for synchronised identities. Cloud identities must be provisioned with the primary SIP address as the username.

If you have not prepared your Active Directory domain from on-premises Lync / Skype for Business and do not have the msRTCSIP-PriamryUserAddress attribute, there is an alternative method you can use. Instead we can use the ProxyAddresses attribute that is natively part of Active Directory. This attribute is the same on you use for provisioning e-mail addresses to get around the same issue as we have. Open the ProxyAddressess attribute and add a new Proxy Address into the list using the following format: sip:markv@domain.org

Perform a directory synchronisation and test the SIP address has been updated correctly

For a federated domain (AD FS) only:
ex: New-MsolDomain -Name sub.contoso.com -Authentication Federated

=>else use AADConnect wizard

KB article:
https://office365.uservoice.com/forums/273493-office-365-admin/suggestions/31548532-allow-sub-domains-to-have-different-authentication

For a managed (standard, in cloud, non-federated, password sync, cloud only, whatever you’d like to call it) domain
ex: New-MsolDomain -Name sub.contoso.com -Authentication Managed

Reference articles:
https://flamingkeys.com/how-to-add-subdomains-to-office-365-2015-edition/

https://jaapwesselius.com/2015/05/06/manage-domains-in-office-365-using-powershell/

Deprecated article:
https://blogs.technet.microsoft.com/hot/2012/04/26/how-to-use-powershell-to-add-sub-domain-to-office-365-online-portal/

 

Hybrid modern authentication and prerequisites:

https://docs.microsoft.com/en-us/office365/enterprise/hybrid-modern-auth-overview

 

How to configure Exchange server to use HMA:

https://docs.microsoft.com/en-us/office365/enterprise/configure-exchange-server-for-hybrid-modern-authentication

 

 

 

Reference article:

https://docs.microsoft.com/en-us/exchange/recipients-in-exchange-online/delete-or-restore-mailboxes

 

remove-user -identity UPN

wait synchro

disable-mailbox UPN -permanentlydisable -ignorelegalhold

 

Message Header analyzer

How to troubleshoot email message:

https://testconnectivity.microsoft.com/MHA/Pages/mha.aspx

plug-in for outlook: https://appsource.microsoft.com/en-us/product/office/WA104005406

 

 

 

This will simplify the lineup of troubleshooting tools available for Outlook while at the same time provide the same level of Outlook scanning capabilities as OffCAT. In addition, SaRA also offers several enhancements including the ability to identify and fix specific issues with Outlook, Office Setup, OneDrive for Business, and several other Office programs.

https://blogs.technet.microsoft.com/exchange/2018/04/17/offcats-replacement-microsoft-support-and-recovery-assistant-sara/

Which OffCAT features are not found today in SaRA?

The OffCAT team migrated the most frequently used features to SaRA. Here are the features that were not migrated and links to alternative resources (if available).

Note, SaRA does provide scenarios that identify and address issues with the following Office programs:

  • Outlook
  • Office Setup and Activation
  • OneDrive for Business
  • Skype for Business
  • KMS client activation

To troubleshoot KMS activation issues, we recommend these resources:
Troubleshoot volume activation for Office 2016
Troubleshoot volume activation for Office 2013

  • Real-time logging

There is no way by default; only after O365 groups creation using this powershell script:

$UserCredential = Get-Credential

$Session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://outlook.office365.com/powershell-liveid/ -Credential $UserCredential -Authentication Basic -AllowRedirection

Import-PSSession $Session

#Get all Office 365 Groups that have have the Welcome Message enabled

$O365Groups = Get-UnifiedGroup | Where-Object{$_.WelcomeMessageEnabled -eq $true}

#Iterate through the Groups, disabling the Welcome Message

foreach ($group in $O365Groups) {

Write-Host “Disabling Welcome Message on O365 Group: ” -NoNewline;

Write-Host $group.DisplayName -ForegroundColor Cyan

Set-UnifiedGroup $group.Identity -UnifiedGroupWelcomeMessageEnabled:$false

}

#Close the Session

Remove-PSSession $Session

Web resources:

https://practical365.com/exchange-server/hybrid-exchange-office-365/

 

About Office 365 message encryption:

New Office 365 Message Encryption capabilities built on top of Azure Information Protection, your organization can use protected email communication with people inside and outside your organization. The new OME capabilities work with other Office 365 organizations, Outlook.com, Gmail, and other email services

OME How to:

https://support.office.com/en-us/article/office-365-message-encryption-ome-f87cb016-7876-4317-ae3c-9169b311ff8a

 

https://blogs.technet.microsoft.com/undocumentedfeatures/2017/11/17/detecting-outlook-exchange-data-exfiltration/