Connecting Exchange online PowerShell with MFA enabled Admin Account

Introduction

Multi Factor Authentication (MFA) help safeguard application and data access via a range verification methods that includes phone call, text, app verification etc. Microsoft introduced MFA for Office 365 in 2014 that help administrators to secure corporate information in Office 365 by enforcing a second factor authentication. Connecting with Exchange online PowerShell with MFA enabled admin account is not supported with standard PowerShell module.

It’s highly recommended to configure Multi Factor Authentication (MFA) for all users and admin accounts in Office 365.

Connecting Exchange online PowerShell with MFA enabled admin account requires you to download and install Exchange Online Remote PowerShell module that support MFA.

Install MFA Enabled Exchange Online Remote PowerShell Module steps should be performed in Internet Explorer otherwise you will receive an error message that says “Application can’t be started“.

Install MFA Enabled Exchange Online Remote PowerShell Module

To connect exchange online using MFA enabled admin account, you need to install MFA enabled exchange online remote powershell module that can be downloaded from Exchange online admin center in Office 365.

  • Login to Office 365 using global admin credentials.
  • Navigate to Admin > Admin Centers > Exchange.

Connecting Exchange online PowerShell with MFA enabled Admin Account

  • In Exchange Admin Center, Navigate to Hybrid and Click Configure under “The Exchange online PowerShell Module supports multi-factor authentication. “

Connecting Exchange online PowerShell with MFA enabled Admin Account

  • The Wizard will launch application install process, Click on Install.

Connecting Exchange online PowerShell with MFA enabled Admin Account

  • Wait for the application installation process to complete.

Connecting Exchange online PowerShell with MFA enabled Admin Account

  • Once the Installation process is completed, it will launch Exchange Online PowerShell Module that supports MFA.

Connecting Exchange online PowerShell with MFA enabled Admin AccountOnce the process of installing MFA Enabled Exchange online remote PowerShell module, the next step is to connect with Exchange online PowerShell using MFA enabled admin account.

Connecting Exchange online PowerShell with MFA enabled Admin Account

Connecting Exchange online powershell with MFA enabled admin account requires you to perform the following steps.

  • Run the following cmdlets to connect with Exchange Online PowerShell.

C:\> Connect-EXOPSSession -Username <user@domain.onmicrosoft.com>

Connecting Exchange online PowerShell with MFA enabled Admin Account

  • When prompted, Enter your global admin credentials.

Connecting Exchange online PowerShell with MFA enabled Admin Account

  • Once user credentials are verified, you will be redirected towards MFA verification.

I have setup MFA to use verification code from mobile app.

Connecting Exchange online PowerShell with MFA enabled Admin Account

  • Once you verify the multi-factor authentication, Exchange online remote powershell module will start loading the remote session.Connecting Exchange online PowerShell with MFA enabled Admin Account
  • Once the Remote Session is loaded, you can perform tasks related to Exchange online.

Connecting Exchange online PowerShell with MFA enabled Admin AccountConclusion

Multi-Factor Authentication help secure access to corporate environment and it’s highly recommended to set up MFA for all users and admin accounts. In this blog post, we review the process to access Exchange Online PowerShell after the admin account is setup for MFA. Connecting Exchange online PowerShell with MFA enabled admin account will ensure the security of your environment and help administrators perform their day to day tasks using PowerShell.

Step by Step Skype for Business Installation Part 3

Introduction

In first 2 parts of step by step skype for business installation, we have performed the per-requisities and prepared Skype for business standard edition server. We have also defined the topology and publish the topology. In this part, we will Install Skype for business server system and Enable the users for Skype for business to complete the deployment of Skype for Business.

Install Skype for Business Server System

To install Skype for Business server system, perform the following steps.

  • Launch Skype for Business Deployment Wizard and click on Install or Update Skype for Business Server System

  • Click Run to install the local configuration store

  • Select the option to directly retrieve the information from Central Management Server

  • Click Finish to complete the local configuration store installation wizard

  • Click on Setup Skype for Business Server component

 

  • Click Next to start the wizard configuration

  • Make sure you have KB2982006 installed on Windows Server 2012 R2 otherwise you’ll receive below error message.

Prerequisite not satisfied: Before you install Skype for Business Server 2015, you must Install an update for Windows Server 2012 R2. For details about the update, see Microsoft Knowledge Base article 2982006, “IIS crashes occasionally when a request is sent to a default document in Windows 8.1 or Windows Server 2012 R2” at http://go.microsoft.com/fwlink/?LinkId=519376

  • Click Finish to complete the wizard

Request, Install and Assign Certificate

Once we have completed the Setup or Remove Skype for Business Server Component task, the next step is to request, install or assign the certificate.

  • Click Run for Request, Install or Assign Certificate in Skype for Business Deployment Wizard

  • Click on Request to request a certificate from local CA

  • In Request certificate wizard, make sure to setup the Friendly name of the certificate and select your SIP domain

  • Click Next on certificate summary to complete the wizard.

  • Click Next once the cmdlets are executed successfully.

  • Make Sure “Assign this certificate to Skype for Business Server certificate usage” checkbox is selected and click on Finish

  • In Certificate Assignment wizard, Click Next

  • Review the Certificate Assignment summary and click Next to execute the cmdlets

  • Click Finish once the commands are executed successfully

  • Click Close on certificate wizard to Finish the process

 

Start Skype for Business Services

The last step for Skype for Business deployment is to start the services of Skype for Business server using Skype for Business management shell. Run the following cmdlet to start the services.

Start-CsPool -PoolFQDN Skype.msexperttalk.com

This step complete our installation of Skype for Business step by step guide. The next step is to assign users to CsPool and enable the users to start using Skype for Business.

Conclusion

In Part 3 of this step by step blog series of Skype for Business, we have performed the tasks to complete the Skype for Business installation. we have completed the tasks related to certificate request, assignment and start the Skype services to service the end user.

Resources

Step by Step Skype for Business Installation Part 2

Introduction

In Part 1 of this step by step Skype for Business installation blog series, we have performed the Skype for Business preparation, Installed server admin tools, prepared active directory for Skype for business installation. In Step by Step skype for business installation Part 2 of this blog series, we will create network share, DNS records, prepare first skype for business server, create and publish Skype for business topology.

Note: This blog series is not focused on Skype for Business Enterprise Voice deployment.

Create Network Share for Skype for Business

Once the Active Directory preparation is completed for Skype for Business server installation, the next step is to create a network share and grant Full Control, Change, and Read Rights to the local administrator group on the server hosting the network share.

Step by Step Skype for Business Installation Part 2 Step by Step Skype for Business Installation Part 2Create DNS Records for Skype for Business

To create DNS records for Skype for Business server, perform the following steps.

  • Login to your active directory server and load DNS manager
  • Navigate to your domain DNS forward lookup zone. In my case our domain is MsExpertTalk.com
  • Create SRV record with the following values

Step by Step Skype for Business Installation Part 2

Skype.MSExpertTalk.com is the host name of our Skype for Business Front end server hosting the services.

  • Create the A record for Meet, Dialin, Admin, Web, scheduler and LyncDiscoverInternal pointing to your Skype for Business FE / standard server

Step by Step Skype for Business Installation Part 2Once the DNS records are created, the next step is to prepare first standard edition server.

Prepare First Standard Edition Server

Prepare first standard edition server will install SQL Server 2014 express edition, RTC database will be created, Skype for Business server files will be deployed and firewall rule will be created as part of the preparation. Perform the following steps to start the process of first standard edition server preparation of Skype for Business.

  • Login to Skype for Business server with CSAdministrator credentials
  • Launch the Skype for Business Deployment Wizard and click on Prepare First Standard Edition Server

Step by Step Skype for Business Installation Part 2

 

  • Click Next to start the preparation wizard

Step by Step Skype for Business Installation Part 2

  • Click Finish to complete the preparation of standard edition server.

Step by Step Skype for Business Installation Part 2

It’s highly recommended to review the logs to ensure everything is being completed successfully.

Define Skype for Business Topology

Once the standard edition server preparation is completed, the next step is to define your Skype for Business topology. To define the Skype for Business topology, perform the following steps.

  • Launch Skype for Business Topology Builder and select the option of New Topology

Step by Step Skype for Business Installation Part 2

  • In topology builder wizard, define the Primary SIP Domain and click Next

Step by Step Skype for Business Installation Part 2

  • In case you have multiple SIP domains, add additional SIP domains and click Next. If you do not have additional SIP Domains click next without adding any domain name

Step by Step Skype for Business Installation Part 2

  • Define the Site information and click Next

Step by Step Skype for Business Installation Part 2 Step by Step Skype for Business Installation Part 2

  • Click Finish to complete the topology creation, this will open a wizard for Front End configuration

Step by Step Skype for Business Installation Part 2

  • Click Next to start the Front End configuration Wizard

Step by Step Skype for Business Installation

  • Select Standard Edition and define the name of Skype for Business server hostname FQDN

Step by Step Skype for Business Installation

  • Select the Features that you would like to install with your standard edition server

Step by Step Skype for Business Installation

  • Click Next on collocate mediation server role

Step by Step Skype for Business Installation

  • Uncheck the option of Edge Server Role and click Next. We will add the edge server role later on

Step by Step Skype for Business Installation

  • Click Next on SQL store information

Step by Step Skype for Business Installation

  • Define the name of your Share and click Next

Step by Step Skype for Business Installation

  • Specify the External Base URL and click Next

Step by Step Skype for Business Installation

  • Uncheck the Office Web App server pool option and Click Finish

Step by Step Skype for Business Installation

  • In Topology Builder, Select the Topology and Click on Edit properties

Step by Step Skype for Business Installation

  • Navigate to Central Management Server and select the Front End server to install CMSStep by Step Skype for Business Installation

This step will complete the creation of Skype for Business topology. The next step is to publish the topology.

Publish Skype for Business Topology

To publish the Skype for Business topology, perform the following steps.

  • Select the topology in Topology Builder and click on Publish

Step by Step Skype for Business Installation

  • Click Next in topology publish Wizard to start the process

Step by Step Skype for Business Installation

Step by Step Skype for Business Installation

  • Click Finish to complete the topology publish process. Review the logs to ensure there are no errors in topology publishing.

Step by Step Skype for Business Installation

Conclusion

In part 2 of this blog series for Skype for Buiness installation, we have performed the DNS tasks, prepared our first standard edition server for skype for Business installation, defined and publish our skype for business topology. In part 3 of this series we will go through the installation of Skype for Business server system and perform remaining tasks to enable the users for Skype for Business.

Resources

 

 

 

Exchange 2010 to Exchange 2016 Migration – Part 5

Exchange 2010 to Exchange 2016 Migration

Introduction

In this blog series of Exchange 2010 to Exchange 2016 migration, we have worked on Exchange 2010 to 2016 migration planning, installed Exchange 2016 server and in previous article of this blog series, we have performed post installation tasks of Exchange 2016 Server and moved our mail flow and HTTPS traffic to Exchange 2016 server. In this part of the series we will move users mailboxes from Exchange 2010 to Exchange 2016.

We will not be working on decommissioning Exchange 2010 server and we do not have any public folder on Exchange 2010 that requires migration to Exchange 2016 server.

Migration of Mailbox to Exchange 2016 Server

Perform the following steps to migrate mailboxes from Exchange 2010 to Exchange 2016 server.

  • Login to Exchange Administrative Center with admin credentials
  • Navigate to Recipients > Migration
  • Click on icon and move to a different database

  • Under Select the users that you want to move, click Add Add Icon icon to add users or you can upload list of mailboxes using a CSV file

  • In the Select Mailbox window, select the mailboxes you want to move, and then click Add Icon icon to add and then OK.

  • Specify a name for the new mailbox move, Make sure you have selected the option to move both primary and archive mailbox. In case you do not have a archive mailbox you can skip that option.
  • Under Target database, click Browse and select the target database of Exchange 2016 Server.

  • Select the option to automatically start the migration batch to start the batch immediately. You can also unchecked the option and manually start the batch later on.
  • Plan for mailbox migration completion, you can select the option to automatically complete the migration batch. During the finalization phase, the mailbox will be unavailable for a small period of time. If you choose to manually complete the mailbox move, you can decide when the move is finalized and you can plan for batch completion in after hours to avoid end user interruption.

Once the migration is completed, the end user will receive a pop up message that states “Administrator has made a change that requires you to restart outlook client”. Once user restart the outlook client he will be connected with his mailbox on Exchange Server 2016.

Conclusion

In part 5 of this blog series of Exchange 2010 to Exchange 2016 migration, we have performed user mailbox migration to Exchange 2016 database to complete our migration to Exchange Server 2016. Once all mailboxes have been migrated to Exchange 2016 server, you can plan for Exchange Server 2010 decommissioning to remove from your messaging infrastructure.

If you would like to read the other parts of this blog article series, please go to:

Office 365 share free busy between tenants

Introduction

Recently I have seen scenario’s where customer was looking for a way in Office 365 to share free busy between tenants. Nowadays, it seems to be a common ask by customers if its possible for two different organizations hosted on two different Office 365 tenants owned by two different companies to share free busy information with each other like they are used to doing with on premises Exchange.

By default, all office 365 tenants have a federation trust setup with Microsoft federation gateway.

Office 365 has a federation gateway configured with Microsoft Federation Gateway. This allows organizations to setup free busy between tenants by setting up “Organizational Relationship” to allow access and sharing permissions.

Configuring Office 365 share free busy between tenant

Let’s start out with the two domains of msexperttalk.com and msmvpservices.com, and then we will assume they have both been updated to Office 365 tenants. Now, we want to share free busy information between them. Configuring Office 365 share free busy between tenant’s is a two step approach. Each step will set up the relationship from its side.

Part 1 – MSExpertTalk to MSMVPServices

We need to pull the federation information from the Microsoft federation gateway and use that to establish an organizational trust from MSExpertTalk.com to msmvpservices.com. User the following PowerShell cmdlets to connect with Exchange online using Global Admin credentials.

C:\> $Cred = Get-Credential

C:\>$session=new-pssession -ConnectionUri https://ps.outlook.com/powershell -ConfigurationName microsoft.exchange -Credential $Cred -Authentication basic -AllowRedirection

C:\>Import-PSSession  $session -AllowClobber | Out-Null

Office 365 share free busy between tenantsYou can connect with Office 365 PowerShell by using a PowerShell script available at TechNet Gallery. Once you are connected with the MSExpertTalk Office 365 tenant, run the following cmdlet to retrieve the federation information of contoso.com

C:\> Get-FederationInformation -DomainName msmvpservices.com

This step verifies everything is good with MSExpertTalk and the Microsoft federation gateway.

Now we need to establish the organizational relationship.

C:\> Get-FederationInformation-DomainName Msmvpservices.com | New-OrganizationRelationship -Name FreeBusyMSMVP -Enabled $true -FreeBusyAccessEnabled $true -FreeBusyAccessLevel ‘AvailabilityOnly’ -FreeBusyAccessScope $null

After this completes, run Get-OrganizationRelationship to verify.

This will complete your step 1 to configure the free busy sharing from your tenant with msmvpservices.com. Next step is to configure msmvpservices.com to share free busy information with your office 365 tenant.

Part 2 – MSMVPServices to MSExpertTalk

Now we need to pull the federation information from the Microsoft federation gateway and use that to establish an organizational trust from MSMVPServices to MSExpertTalk.

From MSMVPServices.com, we open Powershell and connect to Office 365.

C:\> $userCredential = Get-Credential

C:\> $session=new-pssession -ConnectionUri https://ps.outlook.com/powershell -ConfigurationName microsoft.exchange -Credential $usercredential -Authentication basic -AllowRedirection

C:\> Import-PSSession $session -AllowClobber | Out-Null

C:\> Connect-MsolService -Credential $userCredential

Now that we are connected to the MSMVPSerivces Office 365 tenant, we need to collect the federation information for MSExpertTalk.com

Now, we establish the organizational relationship.

C:\> Get-FederationInformation -DomainName msexperttalk.com | New-OrganizationRelationship -Name MSExpertFreeBusy -Enabled $true -FreeBusyAccessEnabled $true -FreeBusyAccessLevel ‘AvailabilityOnly’ -FreeBusyAccessScope $null

After this completes, run Get-OrganizationRelationship to verify.

Conclusion

With both sides set up, we can log into OWA from either side and set up a meeting with a user in the other domain to check for availability. Since you followed this handy guide, you should see the availability and life is good. Please note that this configuration only enables you to setup free busy sharing between two tenants. It will not allow users to view users in address book from other organization. For users to show up in address book, you need to configure GAL Sync between tenants.

I hope you found this helpful in getting your tenants connected, availability working, and keeping it working as you grow with Office 365.

1 2 3 19