Office365 Enterprise Transition Guide en v2.2
Office365 Enterprise Transition Guide en v2.2
Office365 Enterprise Transition Guide en v2.2
Section 5: Appendices..........................................................................66
Appendix A: Post-Transition Resources..................................................................67
Post Migration Service Testing Activities............................................................67
Validate URLs for Office 365............................................................................... 67
Office 365 SMTP Relay Changes.........................................................................68
Testing Collaboration Services Client Workstations.........................................68
Testing Collaboration Services Exchange Online..............................................68
Testing Collaboration Services SharePoint Online............................................69
Testing Collaboration Services Lync Online......................................................69
Post-Transition Activities..................................................................................... 70
Appendix B: Transition URLs, Ports and IP Addresses for Office 365.....................71
Office 365 Portal................................................................................................. 71
Microsoft Online Services Sign In.......................................................................71
Required Ports.................................................................................................... 72
Appendix C: External Document References.........................................................74
Appendix D: Glossary of Terms.............................................................................. 77
For a detailed timeline including key tasks for each phase, see Section 2, Transition
Phases and Timeline.
Microsoft will schedule the automated transition process for your organization
between now and September 2012. After reading this document and determining your
organizations timeline for pre-transition tasks, please contact your Microsoft
representative to let them know when your organization will be ready for transition.
Important:
Transition Responsibilities
The automated transition from BPOSS to Office 365 is conducted by Microsoft under
our contractual obligations for BPOSS. Under this program, all Microsoft datacenter-
side activities are conducted in partnership with our customers, with the costs of
these transition items included in the service fees. The transition is designed to
provide for minimized production disruption to users and no loss of data or settings.
Where a technical trade off or choice was necessary between creating work for
customers IT departments or introducing impacts on end users, Microsoft has always
chosen to reduce or eliminate the impact on end user service. Of course Microsoft has
also tried to minimize your IT departments work. Most of the work you will need to do
will be based on your internet access, your software versions in use and any points of
customization you have introduced. You will have the most work to do if you have
heavily customized your usage of BPOSS or done things which Microsoft does not
support in BPOSS.
Demarcation of responsibilities between you and Microsoft can be described as
follows:
Microsoft datacenter-side transition work items are Microsofts responsibility
(including our internet connectivity).
Customer-side readiness work items are your responsibility (including your
internet connectivity).
Conversion of your business processes dependent on the service is your
responsibility.
Training of employees to use the new service is your responsibility.
Planning and coordinated execution is a joint responsibility.
Adoption of new Office 365 features is your responsibility after transition has
completed.
Implementation Team
The transition from BPOS to Office 365 is a multi-phase approach that requires close
communication and coordination of activities between your internal teams and
Microsoft Online Services. Depending on the services you have subscribed to with
Microsoft, your Premier Technical Account Manager (TAM) will be your central conduit
for planning and coordination of activities with Microsoft Online. For customers who do
not elect to have the services of a TAM, Microsoft will appoint a Service Transition
Manager (STM) to provide basic help with the communications and high level
activities leading up to the transition window. In either case, its important to
understand whats required of your IT team, so that proper planning and managed
changed activities can be taken into account to ensure a smooth transition
Assumed Knowledge
For the technical areas of the transition to Office 365 from BPOS, this guide assumes
that your organization has personnel with Microsoft Certified Systems Engineer
(MCSE) and Microsoft Certified IT Professional (MCITP) certifications or equivalent
skills. Your personnel should also have experience with Microsoft Exchange Servers,
Microsoft SharePoint Server, Microsoft Office Communications Server 2007 R2 or Lync
Server, the Windows Server operating system, and Active Directory Domain Services.
A detailed list of assumed technical knowledge is provided below.
Knowledge and proficiency in the following Microsoft technology areas:
o Mobile Devices
Knowledge of the customer network topology:
o Active Directory sites, trusts, and topology
o Local Area Networks (LANs) and Wide area Networks (WANs): on-
premises networks and equipment
o Wide area Network connectivity: Internet bandwidth and latency
o Firewall/Browser Proxy technologies
o SSL certificates
Knowledge of the existing messaging systems currently deployed, for example:
o Microsoft Exchange Server-based systems
o Microsoft BPOS Standard based Messaging Environment
o POP3/IMAP4/SMTP-based mail systems
o Lotus Notes Domino
o Novell GroupWise
o Mail Archival systems
o Email encryption
Feedback
Readers are encouraged to submit feedback about this deployment guide to
[email protected]. Your feedback is important to the continued
improvement of this document.
Transition Support
Before starting your BPOS to Office 365 transition project, you should become familiar
with the support options that are available to help you resolve issues that may arise
during the transition. Microsoft has established a support team dedicated to providing
assistance with any transition issues that arise. To contact this support team, see
Contact Technical Support for Microsoft Online Services, at
http://g.microsoftonline.com/0rmcm00en-us/5022.
In addition to planning for transition support from Microsoft, you should work on
developing a plan to manage issues arising within your own organization specifically
related to transition activities. This might be a temporary team dedicated to transition
activities in your existing help desk, or a separate team entirely. You should have an
established a set of contacts and escalation paths within your organization for the
transition process to coordinate and communicate your activities relating to the
transition in order to address any issues as a result of the transition.
In planning for the support integration between your organization and Microsofts help
desk, you should take into consideration the following suggestions:
Limit the interactions between your support organization and Microsoft to a few
key individuals. This will provide a consistent message between your
organization and Microsoft; ensuring calls are monitored and progressed
appropriately, without a duplication of effort. Your users should never call
Microsoft support we cant act on their requests, and the work with Microsoft
should be a technical peer-to-peer dialog.
Document and track any issues as they arise, and develop and approach to
systematically resolve them and track their resolution to completion. Most
issues will be predictable impacts described in this document which you should
plan to resolve locally, and which you can reduce with advance user
communications planning.
Consider executive users and their assistants, and international users. These
and other classes of VIP or business-critical users might need special support
processes.
Customer Responsibilities
Customers transitioning from BPOS to Office 365 are required to assume specific
responsibilities in the transition process. Understanding these responsibilities at the
start of the pre-transition phase is critical to achieving a successful transition and
Upon completion of the transition process, the Office 365 portal will not
permit changes to user properties because the tenant is not yet authoritative
for the user directory. Becoming authoritative can take between 24 and 72
hours (worst case) after transition completes. When you see that you can
make changes to user attributes via the Office 365 tenant portal (not the
BPOSS Microsoft Online Admin Center which will be unavailable after
transition), then your tenant has directory authority and you can re-establish
directory synchronization with the Office 365 environment using the Office
365 version of the Directory Synchronization Tool. For more information about
key work items you must complete before you start the Office 365 Directory
Synchronization Tool, see Deploy Directory Synchronization Tool for Office 365
Post Transition in Section 3.
If you were using DirSync before the transition, you are required to continue
to use the Directory Synchronization Tool in Office 365.
Deploy Lync Online client. Prepare and deploy the Lync Online client for
use by your users during the pre and post-transition phases . In order to
successfully consume the changes in Lync, we recommend that you plan and
address the requirements for deployment of the client portions well in
The decision as to whether to close down access to the email during the
transition weekend is yours, and depends on various factor including:
Your business users ability to function while email is unavailable.
The degree of customization today in BPOSS around identity, email
flow and network access.
The degree of post-transition testing and validation you want to
perform before letting users access your messaging service.
The degree of post-transition configuration and customization you want
to implement before letting users access your messaging service.
Any requirement you have to confirm that a compliance archive is
intact and is still capturing mail and changes, before letting users
conduct business on the service.
Category
Description
Improvements and changes to A full review of the many improvements and changes in this
features used by end-users, email category is beyond the scope of this document. It is critical to
administrators and SharePoint fully study the Office 365 Service Descriptions and to
content administrators. comprehensively evaluate a trial tenant in order to understand
the changes between BPOSS and Office 365. There are changes
This category also includes
that impact the users and administrators in the functions they
business and application
perform already on BPOSS, and there are changes that are new
functionality that works differently
features that users and administrators can take advantage of.
in Office 365 compared to BPOSS.
Some of the key user or administrator impacting changes are:
For example:
SharePoint is upgraded to SharePoint version 2010. Certain
Web Parts and controls are no longer available, and there are
Administrators will use the
UI changes. Pages should be tested to ensure they work and
consolidated Office 365 portal,
render successfully. Any workflows that were in place in
rather than the separate
SharePoint 2007 need to be verified as working in SharePoint
administrative portals in
2010.
BPOSS.
Differences in infrastructure and The key changes in infrastructure and technical requirements,
technical requirements between between BPOSS and Office 365 are:
BPOSS and Office 365 versions.
These items typically concern the Office 2003 is not supported. Outlook 2003 will not work with
IT department and not users Office 365 at all.
directly.
Office Communicator 2007 used with Office Communications
For example:
Online will not work with Lync Online in Office 365.
Outlook 2003 is not supported Internet Explorer 6 with the Microsoft Online Administration
in the Office 365 service. Center, My Company Portal or Outlook Web App is not
supported, and Office 365 will behave erratically if Internet
BPOS S permitted the Explorer 6 is used to access the service.
Active Directory User
Object to have a UPN The remainder of Section 3 in this document is focused on
attribute without a planning areas associated with technical details, requirements or
matching SMTP address. consequences in this category. You should also study the Service
Descriptions closely to find the particular items that might apply
Office 365 does not.
in your environment.
[email protected] [email protected]
[email protected] [email protected]
online.com
[email protected] [email protected]
.com
Note: If you have been working with an Office 365 trial tenant, you will have seen
that login credentials for users that were first created in Office 365 use a different
format (e.g. [email protected]). You do not use this format with your
users coming from BPOSS because their UPN has already been set by BPOSS and
does not change in the transition to Office 365. Note that users transitioning from
BPOSS will have an Office 365 style SMTP alias added to their user profile
([email protected]) as a convenience, but transition does not change
the UPN, logon credentials, or the default SMTP address for the user.
Lync Deployment
In addition to updating the Office and Internet Explorer software, the Office 365
transition will upgrade the instant messaging and Web-conferencing functionality
from Office Communicator Online to Microsoft Lync Online, requiring the use of the
new Microsoft Lync 2010 software client.
Microsoft offers a staged approach to the deployment and usage of Lync as part of
the adoption of Office 365, so that the degree of change is greatly reduced
immediately after transition.
You should plan for two deployment phases for the Microsoft Lync 2010 software,
covering the Microsoft Lync 2010 Client software upgrade and transition phases of
the project.
Lync Client Software Upgrade. Once you have been contacted by
Microsoft regarding your transition date, the new Microsoft Lync 2010 client
software will work with the BPOSS Communicator Online environment. You
must plan for the deployment of the Lync client in advance of the transition
date to avoid multiple changes during the transition weekend, or loss of
access to the IM and presence workload. If you have any third party local
customizations to your Lync client, they must be tested and integrated with
your Lync client before this deployment. (E.g. CUCiMOC).
Live Meeting
As referenced in other sections of this document, the Live Meeting client and service
will continue to work for some time after the transition to Office 365. Microsoft has
indicated that the service will be sunset, so you should still be planning to move
users off the service in an organized approach, so that you do not have to do this
suddenly in the future. The minimum client version supported for Live Meeting after
transition is 8.0.6362.202, and you should ensure your organization meets these
minimum requirements in advance to reduce the impact of inconsistencies with
earlier versions against the service.
There is no specific timeframe for migrating to the latest version of Live Meeting
Client, and user disruption for this update should be minimal. Most IT organizations
probably already have a program in place for keeping the Live Meeting client
software up to date.
Once transition is complete, in order to schedule new meetings within Office Live
Meeting 2007 from within Outlook, you will have to re-install/deploy the Outlook
Plug-In for Live Meeting, as the desktop setup for Office 365 will deactivate this
plug-in, and it will no longer function. All previously scheduled meetings will remain
in effect in the service, and will be available after transition to Office 365.
Your adoption plan for Lync Online should include re-establishing those meetings
into Lync Online Meetings, which is a task that must be conducted by the end-user
meeting organizer for each meeting.
Transitioning to Lync Online includes two related efforts: (1) ramping down your
Office Live Meeting 2007 usage and (2) rolling out the use of Lync Online for Web
Conferencing to your organization.
Key actions that may require the involvement of your project team may include
some or all of the following. The items in italics must be performed by the end-user
conference organizer or conference content owner. Your help desk should plan
accordingly. The other items can be performed centrally by IT assuming the
appropriate remote workstation management software is in place.
Deployment of Office Live Meeting Client 8.0.3.6362.202 or later, ideally
before transition.
Deployment of the Outlook Plug-In for Office Live Meeting 2007 after
transition T-00.
Additional information on the Live Meeting 2007 client and where to download the
appropriate updates can be found at Download the Microsoft Office Live Meeting
client at http://office.microsoft.com/en-us/help/download-the-microsoft-office-live-
meeting-2007-client-HA010173383.aspx
Microsoft has published various articles about Live Meeting-to-Lync transition-
related resources, and the references below should be considered the up-to-date
source of information. However, LiveMeeting can be subscribed to in many different
ways, including directly without a BPOSS subscription. Much of the content below is
written to be generally applicable in various different provisioning scenarios for
LiveMeeting and you should review and consider the content selectively for
applicability in your BPOSS to Office 365 scenario.
Live Meeting-to-Lync Transition Guide
http://technet.microsoft.com/en-us/lync/hh182968
Transition Planning Resources
http://www.microsoft.com/download/en/details.aspx?
displaylang=en&id=26494
Transition Support
http://www.livemeeting.com/ask
For more information, see Use a CNAME record to Enable Outlook to Connect, see
http://help.outlook.com/en-us/140/cc950655.aspx.
Single Sign-On
As part of the functionality improvements in the Office 365 platform, your
organization has the option to implement sign on to the service leveraging
enterprise credentials, also known as Single Sign On (SSO), via the use of Active
Directory Federation Services (AD FS).
Because the implementation of AD FS on your premises is an identity
management project in its own right, detailed guidance for its
implementation is outside the scope of this document. For more information
about post-transition implementation, see the Single Sign On Roadmap at
http://onlinehelp.microsoft.com/en-us/office365-enterprises/hh125004.aspx.
AD FS is typically set up after an organization transitions to Office 365. For
large organizations transitioning from BPOS, this can be confusing for users,
as they will have three different sign-on experiences - one for BPOS, one after
transition to Office 365 while AD FS is being implemented, and one after full
ADFS implementation. As an alternative, there is a process by which
organizations can enable ADFS prior to the transition to Office 365, referred
Service Connectivity
Many Office 365 Internet IP addresses, URLs and fully qualified domain names, in
addition to network ports, are different in Office 365 than in BPOSS. Once you are
running Office 365, these items are also subject to occasional changes as part of
the ongoing enhancements to the Office 365 service. As part of the discovery
process, and leading to the scheduled transition date, all network traffic load-
balancing, firewall configurations, reverse proxies and NAT configurations must be
investigated and tested with Office 365 to ensure expected functionality and
availability of the service both during and after the transition. This testing should be
conducted with your trial Office 365 tenant as described in Office 365 Trial in
Section 1. Any changes you need to implement should be carefully planned to
ensure you do not impact the accessibility of the production BPOSS service during
the pre-transition phase.
You should investigate if your networking services team uses IP addresses in firewall
and proxy configurations. Microsofts recommendation is to use wildcard domain
names in any network access control solution because Microsoft IP addresses are
subject to change without notice both as part of this transition and ongoing in the
production services.
Mobile Devices
Just like BPOSS, Microsoft Office 365 for enterprises provides mobile device-based
access to the service, including email, calendaring, and contact information. As part
of the transition process, at the time the mailbox is moved to Office 365,
ActiveSync, POP3 and IMAP4 mobile devices will lose access to the service as the
server details will change. The timing of when you prefer your users to reconnect
mobile devices is at your discretion, as you may want to wait until IT can apply
policy, which you can only do after transition is complete. Before transition, you will
need to provide communication to your users with information about how they can
reconfigure the devices. The soonest they can do so is after their mailbox transition
has completed, which happens at some point during the transition weekend
between T-0 and T-00. The timing of when a users mailbox is transitioned and the
actions they take to reconnect is discussed in User and Administrator Impact During
the Transition Weekend in Section 2.
If you have a sophisticated mobile device management (MDM) solution in place,
adjustments for mobile devices may be possible centrally, but if not, you should
prepare your users to make these changes.
To avoid mobile devices, and POP or IMAP clients, pulling down all pre-existing mail
to the client/device again, it is recommended to make IP/URL changes to existing
client profiles, rather than recreate new profiles.
You should also prepare the help desk for calls on this topic because the best
communications plan will miss some users, and the most likely people to be missed
Mail-Enabled Applications
If your organization has any line of business applications that require messaging
capabilities, you should spend time during the pre-transition phase, typically before
T-60, given the scale of possible remediation work to your applications, to determine
whether they need to be modified to work with Office 365. In most cases,
applications that are currently consuming the BPOS service will require at most
minor modifications to the mail configuration in order to properly point to the
appropriate SMTP gateway to route mail through the service.
Note that any applications directly accessing Microsoft Exchange Online in Office
365 need to be based on Exchange Web Services (EWS). Applications based on
legacy interfaces or APIs for Exchange Online will not work.
Examples of applications that should have their mail-enabled functionality checked
and confirmed are:
Reports that are automatically generated by a line of business application
and sent via email to an email address or a distribution group.
Applications that use telephony systems including fax solutions.
Applications that interface with MS Exchange and monitor or interfere with
mail flow (e.g. MDM applications or DLP applications)
SR Review
As stated earlier in this documentation, an IT department using BPOSS should
ensure they have documentation of their end-to-end service based on their BPOS-S
tenant, including, among other configuration items, the customizations that have
been implemented by Microsoft on their behalf via SR.
One of the potential areas you should plan for during the transition of service is any
unforeseen scenario where you need to re-apply any Service Requests (SRs) from
BPOSS to Office 365. Most items implemented through the SR mechanism
transition without customer action to Office 365. Those that dont transition have no
impact on service availability in Office 365, or are no longer supported in Office 365.
Time spent in the research and documentation of your customizations is a good
investment in order to smoothly transition to Office 365 with a minimal impact to
your customers if things do not go exactly to plan.
You will need to check which of your BPOSS customizations are meaningful in
Office 365 and confirm they are implemented again after transition, if they are
available and necessary in Office 365. Post transition validation in the T-00 to
T+8hours is a perfect time to do this, if you are prepared in advance.
After collecting the list of SRs, you need to validate them against the Office 365
Service Descriptions in order to ensure applicability with the new service, and to
determine how to configure your environment after the transition. The changes will
most likely fall into the following categories:
Feature decremented and unavailable in Office 365. If you have a
critical need for a feature in this category you will need to plan for a
remediation strategy to provide an equivalent capability in Office 365. Please
X
Service requests (Most are no longer relevant, or
available)
X
Verified domain
X
Security groups
X
Subscription Information
Users
X
Outlook client customizations (e.g. Views)
X
User mailboxes
X
Primary and alternate email addresses
X
Email (Inbox, Sent, Deleted, Draft, Conversational,
Junk, Retention)
X
Outlook Calendar/Meetings
X
Outlook Contacts
X
Outlook Notes
X
Delegate permissions
X
Forwarding
X
Mailbox permissions (Full Control, Send As, Receive
As)
X
POP3 access settings (Enabled/Disabled) (On for
all by default)
X
IMAP access settings (Enabled/Disabled) (On for all
by default)
X
Outlook Web App access setting
(Enabled/Disabled) (On for all by default)
X
ActiveSync access setting (Enabled/Disabled)
Exchange Online
X
Safe senders
X
Blocked senders
X
Distribution groups
X
Organization contacts
X
Conference rooms
X
OCO contacts
Live Meeting
Special requests
X
Security groups
X
Retention policies
X
Disclaimer transport rules
X
ActiveSync policies (on by default for all users)
X
Journaling rules
X
Password Never Expires setting
X
FOPE company settings
X
FOPE domain settings
X
FOPE policy rules
X
FOPE footer rules
X
FOPE users
* As noted within this document, Live Meeting will continue to work after transition, but will only be
available for a limited time. Customers should plan to switch to Lync Online for web conferencing.
After Transition
Note Electing to check the Keep me signed in option will save the credentials
onto the local machine in Credential Manager (CredMan) and if users login to the
BPOS Home Portal and click the Office 365 link, they will be automatically
authenticated in Office 365 and not be prompted for username and password. This
BPOS redirect and login will be available for as long as the BPOS users credentials
are viable. Once the BPOS users password expires, the user will not be able to
login, they will receive a password change dialog box, which will allow the user to
change their password, but not be able to sign into the BPOS Home Portal. At this
point, the user MUST start using the Office 365 links.
After Transition
Note By clicking the Office 365 Portal link, the online administrator will be taken
to the Office 365 Portal and on first login, the user will be taken to the Office 365
login page.
Applications
Sign-in Client
1. Post transition, the end user will need to launch the Sign-in client and enter
the BPOS username/password. This is needed so that the users applications,
such as Outlook, can detect their BPOS mailbox has been moved into Office
365 and take the needed actions for tracking this moved mailbox down and
update the Outlook profiles connection settings.
a. Login will complete, but the Sign-in clients display will show no
services are available.
2. If Outlook is still running over the Transition Weekend, the Outlook client will
provide a prompt indicating that the administrator has made a change that
requires users to restart Outlook.
a. The end user will need to click OK and then restart Outlook.
Internet Explorer
Internet Explorer should be configured to use with Office 365 even if it is not the
default browser. Configuring Internet Explorer allows your PC (not just the browser)
to determine when to release/send authentication credentials when requested from
either an online service, such as Exchange Online or if redirected to an internal
authentication endpoint, such as Active Directory Federation Services (AD FS). To
configure your Internet Explorer, please use the following settings:
Note: This setting should be used when using Active Directory Federation Services
(AD FS), as you will be redirected to your companys URL for authentication. The
below settings will remove the need for you to manually enter your domain
credentials and you will receive a pure Single Sign-On Experience (SSO).
Configure Internet Explorer
1. Launch Internet Explorer
a. Click the Tools Internet Options Security option
b. Click the Local Intranet option and then click Sites and then
Advanced
Using this approach will allow your PC to automatically send your logged on domain
credentials to your ADFS server, so when you access Office 365 Online Services you
will not be prompted for authentication, but instead will be automatically logged
into the services and granted access.
a. Note The old BPOS OWA URL will be retired and should no longer be
used. This can be used for as long as the BPOS credentials are valid.
Once the BPOS users password has expired, redirect and the old BPOS
OWA link will no longer be usable.
2. End users will need to start logging into http://mail.office365.com and will be
redirected to a Windows Live ID credential page. This allows for users to start
using the new Office 365 OWA URL and no longer use the old BPOS OWA URL
Post-Transition Activities
The activities outlined in this section must be conducted after the automated
transition is declared to be complete and successful.
Activity/Task Objectives Required before
Users Access Tenant?
Confirm EHA journal Before production records are Yes, if you need to
is intact and created, you should send test document
journaling is running. emails and confirm they are confirmation that
archived according to journal mail is
compliance rules. This will help flowing and capture
you to demonstrate and evidence the journal
document the integrity of the is intact.
archive and well as conduct a
technical test.
Confirm mail routing FOPE is not changed during Yes, if you need
through DLP and transition. However it would be confirmation that
message hygiene prudent to test the DLP solution your DLP is working
solutions are not is still fully functional. and that mail is
impacted. flowing through it.
Configure Exchange Apply the pre-determined Yes, if you want to
Active Sync policy settings as defined. enforce a policy, e.g.
For up to date information about other IP addresses and URLs associated with Office
365 services, see the following sites:
Microsoft Exchange Online
Required Ports
Protocol /Port Applications
Active Directory Federation Services (federation server role)
Active Directory Federation Services (proxy server role)
Microsoft Online Services Portal
My Company Portal
Microsoft Outlook 2010 and Outlook 2007
Microsoft Entourage 2008 EWS/Outlook 2011 for Mac
Outlook Web App
SharePoint Online
TCP 443 Lync 2010 client (communication to Lync Online from on-
premises
Lync Server)
TCP 25 Mail routing
TCP 587* SMTP relay
TCP 143/993 Simple IMAP4 migration tool
TCP 995** POP3
TCP 80 and 443* Microsoft Online Services Directory Synchronization Tool
Simple Exchange Migration Tool
Simple IMAP Migration Tool
Staged Exchange Migration Tool
Exchange Management Console
Exchange Management Shell
** POP3 access with Exchange Online requires port 995 TCP) and requires SSL. For
details on how to configure POP3 with Exchange Online, see the TechNet article Configure
POP for Exchange Online at http://technet.microsoft.com/en-us/library/ff535990.aspx.
Title Link
Office 365 for Enterprise Service http://www.microsoft.com/download/en/details.aspx?
Descriptions id=13602