12.3.1.Hybrid exchange settings
If your company plans to use Microsoft 365 together with the existing On-premise Exchange infrastructure or plans to migrate to Microsoft 365, the Email archive is also supporting the Hybrid Exchange environment.
The transition period (moving from on-premise to cloud) can take a lot of time. During this time both on-premise and cloud mailboxes can be archived.
The following configuration changes must be performed to support the Hybrid environment on On-premise Exchange:
- The domain controller settings must point to an On-premise domain controller
- The Use hybrid Exchange environment checkbox must be checked – it allows configuring the connection to the Microsoft 365 of your organization
- The mailboxes should be grouped to groups that are available on the On-premise Exchange
- The Microsoft 365 login provider must be configured
Region: If you are using a German cloud, Germany needs to be picked in this dropdown list.
In case that the predefined settings for O365 and PowerShell don’t match your expectation and/or needs, it is possible to select the Custom option from the Region dropdown list and specify your own values.
PowerShell auth: Pick the proper PowerShell authentication from the dropdown list. Recommended is to use the Basic authentication. It is also possible to select Modern authentication – in that case, the PowerShell authentication will be automatically extended by the necessary parameters (more info in this section).
Max connection count: Specify the maximum number of parallel connections the archive is allowed to use when connecting to Microsoft 365 PowerShell. Microsoft 365 throttling policies are applying for these connections, therefore it is recommended to use the account exclusively for archiving, otherwise the email archive might not receive a free connection from Microsoft 365.
Ignore SSL errors: Use this option only if the connection can’t be established because of SSL errors. The Microsoft 365 certificates should be trusted by default, so there is no other reason to check this option.
Keep connection alive: If it is turned on, then the connection between contentACCESS and the Exchange server is cached, which increases the performance.
Use explicit credentials: If explicit credentials need to be used to connect to the Exchange, check the Use explicit credentials checkbox and enter the applicable User name and Password.
After the checkbox is checked and everything is configured, contentACCESS will be able to connect to both On-premise and Microsoft 365 systems, which are configured separately.
The following configuration changes must be performed to support the Hybrid environment on Hosted Exchange:
- Configure the Hosted Exchange (it is similar to the On-premise Exchange, but only the Basic authentication can be used for the EWS and PowerShell authentication)
- The Use hybrid Exchange environment checkbox must be checked – it allows configuring the connection to the Microsoft 365 of your organization
- Configure the Hosted Exchange login provider if needed (not mandatory). The Hosted Exchange login provider allows your user to log in using the email address and password.
- Configure the Azure login provider. For cloud mailboxes, the Azure login will be created.
The hybrid configuration is now available with the Hosted Exchange. It is highly recommended to use modern authentication for the configuration (although it works with basic as well, due to the Microsoft changes, we suggest using modern authentication).
After the checkbox is checked and everything is configured, contentACCESS will be able to connect to both Hosted Exchange and Microsoft 365 systems, which are configured separately.
Which groups are visible for provisioning?
In hybrid environments, the Email archive is processing only the groups that are available on the on-premise Exchange servers. These groups can contain both on-premise mailboxes and cloud mailboxes. It is recommended to set up an Exchange group (or groups) containing all mailboxes to be archived and provision only the group.
How to distinguish between On-premise and cloud mailboxes in Address book?
The column Server name shows the server that is hosting the mailbox. For cloud mailboxes, the server name will be Office365, on-premise mailboxes will show the name of the on-premise Exchange server.
How logins are created?
In Email archive Provisioning settings (Email archive => Settings => Provisioning settings => User creation options), it is possible to configure what type of login will be associated with the users. For every on-premise and cloud mailbox, a Windows login is created. Microsoft 365 login is created for every Microsoft 365 mailbox, but can be additionally created for on-premise mailboxes.
What to do after a mailbox is moved from On-premise to cloud (also vice-versa)?
If the mailbox is still in the group after the move, only the Email archive Provisioning job needs to be started.
After a mailbox is moved from on-premise to cloud, the mailbox should remain a member of one of the groups configured for provisioning. The next provisioning job will actualize the mailbox information and switch the on-premise mailbox to cloud mailbox type. The same procedure applies when a mailbox is moved from cloud to on-premise.
Steps to take:
- open job’s configuration page
- remove the group from the list of Address book objects to process
- select the group and re-add it to the list
- save the job configuration
How to reconfigure the system after On-premise is turned off?
If you decide to keep only your cloud system running and turn off the On-premise one, the following steps need to be done for your environment to work correctly:
- the Use hybrid Exchange environment checkbox in Email archive => Settings => System settings => Hybrid Exchange settings must get unchecked
- EWS settings under Email archive => Settings => System settings must be rewritten to point to the cloud system
- old server and groups need to be deleted from Email archive Provisioning job configuration and added newly