A W A R D W I N N I N G E X C H A N G E M A N A G E M E N T

Troubleshooting Exchange Hybrid Deployments

Michael Van Horenbeeck

A W A R D W I N N I N G E X C H A N G E M A N A G E M E N T

Michael Van Horenbeeck

• Exchange Server MVP & MCSM• Director of Product Research at

ENow Software• Active in the industry for the

past 13 years• Frequent speaker at

international conferences• Blogs at www.vanhybrid.com• Member of The UC Architects

podcast

A W A R D W I N N I N G E X C H A N G E M A N A G E M E N T

Agenda

• Hybrid deployment – architecture overview• Common issues and misconceptions • Moving mailboxes: the good, the bad and the ugly• Keeping ADFS alive• DirSync• What’s next?• Q&A

A W A R D W I N N I N G E X C H A N G E M A N A G E M E N T

Hybrid DeploymentComponents of a Hybrid deployment (Architecture Overview)

A W A R D W I N N I N G E X C H A N G E M A N A G E M E N T

What is a hybrid deployment?

“Two distinct cross-premises Exchange organizations, combined to ‘act’ as a single organization through a series of customizations in both

environments”

A W A R D W I N N I N G E X C H A N G E M A N A G E M E N T

Hybri

d A

rchit

ect

ure

ACTIVE DIRECTORY

OFFICE 365 TENANT

EXCHANGE ONLINE TENANT

MICROSOFT DATA CENTER INTERNET PERIMETERNETWORK

INTERNAL NETWORK

EXCHANGE ON-PREM ORG.

AZURE AD

ADFSPROXY

ADFS

ACTIVE DIRECTORY

DIRSYNCSERVER

EXCHANGE 2013(CAS)ORGANIZATIONAL RELATIONSHIP /

OAUTH (INTRA-ORG CONNECTOR)

EXCHANGE 2013(MBX)

ONLINE PROTECTION

HYBRID MAIL FLOW

SMTP

EXCHANGE ONLINE

AUTHENTICATION SERVICE

EXTERNAL USER(O365)

SYNC

HTTP(S)

HTTPS

HTTPS

OWA USER(O365)

HTTPS

MAIL FLOW

AUTHENTICATION

SYNCHRONIZATION

APP. ACCESS (HTTP(S))

INTERNAL USER(O365)

EXCHANGE USER

HTTPS

INTERNAL OWA USER(O365)

A W A R D W I N N I N G E X C H A N G E M A N A G E M E N T

Hybrid Building Blocks

Federation DirSync Secure Transport Mailbox Moves

• Free/Busy• Mailtips• Message Tracking• eDiscovery• …

• Unified GAL• X500 (Mailbox

Moves)• Online Archiving

• TLS encryption• Header

Preservation• Cert-based

security• Centralized mail

flow

• Mailbox Replication Service (MRS)

• Online Moves• Fast / Reliable

A W A R D W I N N I N G E X C H A N G E M A N A G E M E N T

Common issues & misconceptions

A W A R D W I N N I N G E X C H A N G E M A N A G E M E N T

DirSync

•Not synchronizing…at all.• Synchronizing but is having issue with a subset of

accounts due to:• Duplicates• Illegal characters (corrupted items etc…)

A W A R D W I N N I N G E X C H A N G E M A N A G E M E N T

How DirSync works

DirSync

SourceAD

MA

TargetWebService

MA

Active Directory

METAVERSE

A W A R D W I N N I N G E X C H A N G E M A N A G E M E N T

DEMO

A W A R D W I N N I N G E X C H A N G E M A N A G E M E N T

Active Directory Federation Services

• Error messages can be cryptic…• Troubleshooting is not easy• You only have “half” of the story• Different authentication flows

•3rd party tooling really needed to help figuring out what happen(s)(ed)

A W A R D W I N N I N G E X C H A N G E M A N A G E M E N T

DEMO

A W A R D W I N N I N G E X C H A N G E M A N A G E M E N T

Troubleshooting AD FS Summary

• Not easy• Use tools like e.g. Fiddler• Enable Debug Logging in Event Viewer• Pair AD FS Proxy w/ ADFS for easier troubleshooting• Understanding different authentication flows is important

A W A R D W I N N I N G E X C H A N G E M A N A G E M E N T

Exchange Federation

•Many components to take a look at•Microsoft Federation Gateway trust• Organization Relationship (local)• Organization Relationship (remote)

•Domain Federation Information•Autodiscover

A W A R D W I N N I N G E X C H A N G E M A N A G E M E N T

How Exchange Federation works

A W A R D W I N N I N G E X C H A N G E M A N A G E M E N T

DEMO

A W A R D W I N N I N G E X C H A N G E M A N A G E M E N T

Avoid TroubleshootingWhy monitoring makes sense in a clouded world…

A W A R D W I N N I N G E X C H A N G E M A N A G E M E N T

What components do I need to monitor?• Directory Synchronization• Identity Federation (if applicable)• Exchange Federation• Certificates• Connectivity

Featured as Messaging and Unified Communications Award Finalist

A W A R D W I N N I N G E X C H A N G E M A N A G E M E N T

About ENow Software

Download Mailscape for Exchange Online Free Trial:bit.ly/Mailscape-Hybrid

A W A R D W I N N I N G E X C H A N G E M A N A G E M E N T

Q&A

Thank you!www.enowsoftware.com