Category: Email

Basic Office 365 Encryption Setup

Businesses have been using email, a cloud-based service, for decades. The recent push for compliance and security have given rise to various technology and services to provide encryption for sending / receiving messages especially through email. For most users Office 365 Encryption is the easiest and best way of sending encrypted email. This is done by purchasing licenses / configuring Azure Rights Management either through Enterprise Mobility Suite or Microsoft Azure Rights Management Premium in their Office 365 account. Once licensed the following setup procedure is needed to setup basic email encryption for all users:

Basic Office 365 Encryption Setup

Login to Office 365 portal as Global Administrator and click on the Admin tile.
In the left hand menu select Service Settings > Rights Management then click on the Manage link to the right.
On the Rights Management page click on the Activate button.
Now it is time for the powershell portion, open Windows Azure Active Directory Module for Windows Powershell as Domain Administrator
Type in the following to connect to Exchange Online via Powershell:

Set-ExecutionPolicy RemoteSigned
$creds = Get-Credential
(Enter the Office 365 Administrator credentials then click “OK” button.)
Import-Module MsOnline
Connect-MsolService -Credential $creds
$Session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://ps.outlook.com/powershell/ -Credential $creds -Authentication Basic -AllowRedirection
Import-PSSession $Session
Now type in the following to configure the Rights Management Services (RMS) online key-sharing location in Exchange Online (This is North American companies only – all others see the following Microsoft KB Article.):

Set-IRMConfiguration -RMSOnlineKeySharingLocation “https://sp-rms.na.aadrm.com/TenantManagement/ServicePartner.svc”
Run the following command to import the Trusted Publishing Domain (TPD) from RMS Online:

Import-RMSTrustedPublishingDomain -RMSOnline -name “RMS Online”
To verify that you successfully configured IRM in Exchange Online to use the Azure Rights Management service, run the following:

Test-IRMConfiguration -RMSOnline
Run the following commands to disable IRM templates from being available in OWA and Outlook and then enable IRM for your cloud-based email organization to use IRM for Office 365 Message Encryption:
 
- To disable IRM templates in OWA and Outlook:
  
  Set-IRMConfiguration -ClientAccessServerEnabled $false
- To enable IRM for Office 365 Message Encryption:
  
  Set-IRMConfiguration -InternalLicensingEnabled $true
This completes the powershell portion. Make sure that all users who will be using Encryption have been given a license for the purchased service in the Office 365 portal.
In the Office 365 portal in the left hand menu click on Admin > Exchange.
In the Exchange Admin Center in the right hand side under Mail Flow click on Rules.
Click on the + symbol and choose “Create a New Rule…” option.
Give the Rule a name like “Message Encryption” then click on “More Options…”
Under “Apply this rule if…” select “The subject or body includes…” and add “Encrypt:” as the search term.
Under “Do the following…” select “Modify the message security…” then select “Apply Office 365 Message Encryption”
Leave the other options as default unless otherwise needed and click on Save button.

This then allows users of Outlook or OWA to add the work “Encrypt:” to the subject line of an email and have the message sent as encrypted. The recepient will receive and HTML document that details how to access the contents of the email securely via Microsoft login or one time access code sent to their email. If they are accessing email from their phones then there is an App for that too. If your organization needs any help with compliance of email encryption then don’t hesitate to contact us for support.

Office 365 Azure AD Connect Upgrade

Administrators who have been using the tried and true DirSync utility from Microsoft will be pleasantly surprised by the upgrade / replacement by the Windows Azure AD Connect utility for password sync with Active Directory or Hybrid configurations. Here are the basics on an upgrade for a site with only password sync enabled:

Office 365 Azure AD Connect Upgrade

The way to see if your organization is ready for the upgrade is to check under Admin > Users > Active Users > Active Directory Synchronization > Manage in the Office 365 portal.
Click on the Upgrade link which will redirect to the download site for the Microsoft Azure Active Directory Connect utility.
Download and run the utility as administrator which will bring up the following welcome screen which requires agreement to continue the conversion process.
The tool will then examine the current DirSync setup for your organization.
Once done it will present you with the option to continue with the upgrade.
Enter your organization's Office 365 global administrator credentials.
Enter local domain administrator credentials
Then there is the option to enable hybrid configuration or start a manual first sync. Choose the first sync and continue.
After much labor on the part of the tool it will finish successfully.
Finally a couple notes to make life easier. First is to add a shortcut to the Synchronization Service Manager on the desktop pointing to the following:

%systemdrive%\Program Files\Microsoft Azure AD Sync\UIShell\miisclient.exe
Second is to create a powershell script to start a manual sync as follows:

Set-ExecutionPolicy RemoteSigned
Import-Module ADSync
Start-ADSyncSyncCycle -PolicyType Delta

This will then begin to use the Azure AD Connect utility to run the password sync to Office 365 from local Active Directory domain. If you company needs any help with Office 365, Exchange or Active Directory then don't hesitate to contact us for assistance.

Issues After Office 365 Migration

Keep running into this issue at client sites where an on-premise Microsoft Exchange Server (especially from Microsoft SBS Server) to Office 365 migration has taken place. Client workstations are unable to connect to Office 365 servers via Autodiscover for their migrated email accounts. During Outlook first run it would pre-populate their email correctly but then try to connect to the old email server instead. If the DNS settings for the workstation were changed to non-domain external DNS servers then the email would not pre-populate but the setup would complete successfully. Checked the Autodiscover URL using NSLOOKUP to the Microsoft servers from local domain DNS servers successfully, so felt a little stumpled. Research pointed to the Service Connection Point (SCP) object in Active Directory which can be either deleted from the server or excluded on a per workstation basis, so both will be shown here. Starting with the server first:

Deleting SCP from Server after Office 365 Migration

Login to a server with Active Directory Domain Services installed as administrator
Launch ADSIedit from the Start Menu
Right click on the root of the console and choose “Connect to…”
Under “Select a well know Naming Context” choose Configuration
Navigate down through the tree as follows (these are always listed from the bottom up on other tech sites for some reason):

CN=Autodiscover,CN=Protocols,CN=,CN=Servers,CN=Exchange Administrative Group,CN=Administrative Groups,CN=First Organization,CN=Microsoft Exchange,CN=Services
Delete the entire CN=Autodiscover object if you no longer have any on-premise Exchange Servers
Reboot the workstation to clear the DNS / AD cache and try to connect to Office 365 servers again

Deleting SCP from Workstation after Office 365 Migration

Lauch Regedit from the Start Menu
Navigate to the following key based on your version (16.0 for Office 2016):

HKEY_CURRENT_USER\Software\Microsoft\Office\x.0\Outlook\AutoDiscover
Add a 32-bit DWORD called ExcludeScpLookup with the value of 1 to enable
Next navigate to the following key based on your version (16.0 for Office 2016):

HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\x.0\Outlook\AutoDiscover
Add a 32-bit DWORD called ExcludeScpLookup with the value of 1 to enable
Reboot the workstation to effect the Registry changes and try to connect to Office 365 servers again

If your organization needs any help with troubleshooting issues with Office 365 or with migrating from on-premise Microsoft Exchange Server, then don’t hesitate to contact us for support.

Microsoft Office 365 Troubleshooting Tool

Working on a client who was the victim of their previous IT company over using Microsoft Office 2010 Pro Plus licenses on workstations. This caused them all to have licensing errors and required the client to switch to a Microsoft Open License agreement that they had previously for Office 2010 Standard. After uninstalling and re-installing the software, the Microsoft Outlook 2010 client repeatedly asked for credentials even though they were entered correctly. Stumbled across the Microsoft Support and Recovery Assistant for Office 365 in my Google search for the root cause, so I gave it a try. This tool was child's play to use and within minutes found that Microsoft Outlook 2010 needed Service Pack 2 installed in order to be compatible with Office 365. Installed this patch and the client immediately connected. Thanks for the new tool Office 365 Troubleshooting Tool Microsoft.

Branded Email using Custom Domain Name

There are many reasons your business needs to use a branded email address using a customized domain name. Let’s look at what the top ones are:

Branded Email Establishes Legitimacy

Customers want to trust a companies before they choose to give their business to them. This is the number one reason businesses should use branded email – not only does it give your business a deeper level of branding, but it establishes the business' legitimacy. This is because your email is often the customer’s first impression of you, especially if email or print marketing had an email for contact. It makes your business look professional and can set it apart from the competition. Phishing schemes are a very real concern these days and many of these fake emails come from people trying to pose as a legitimate business. The best way for your customer to know if the email is really from you or a potentially dangerous location, is by the email address' domain name. If the customer can look at the sender address and see your business’ domain, they will feel more confident clicking links or replying back with sensitive information.

Branded Email Builds Your Brand

A business can never have too much company branding. From business cards to bumper stickers to coffee mugs, there are branding opportunities everywhere. This should includes your business email too. Every time your employees send an email, it reinforces your business brand to the customer. It not only reminds the customer that you have a website, but gives them a peek into what your company is all about.

Branded Email Separates Company Departments

Having a branded email allows you to create multiple email addresses or email aliases for different departments and company objectives. This is a huge benefit as yourname@mycompanyname.com may not always the best address to email or your business may not want the customer to directly contact your employees. It helps compartmentalize the work and make sure that the right person / department receives the correct emails. You can create emails like support@mycomanyname.com, info@mycompanyname.com, sales@mycompanyname.com and many others that can point to one or more members of the organization. It also helps the customer, by pointing them to the right email address for the issue they need addressed.

Branded Email Isn’t Expensive

With Office 365’s Hoste Exchange service your business can add as many individual email addresses and email aliases to your company's branded domain on an as needed basis, access email from anywhere across all major platforms, get industry leading anti-malware / anti-spam filtering built in, send email attachments up to 150MB in size and get 50GB of storage per mailbox. Prices start at just $4 per user per month. Microsoft manages the email server and Farmhouse Networking handles the setup / administration of the rest, which making it simple for you to have a professional branded customized business email address.

If you don’t have a branded email address, now is the perfect time to get one. Small businesses often think they don’t need one or can’t afford it, but that is simply not true. Help your business by setting up a branded email today by giving us a call or email to let our Office 365 experts get your business started on the path to better branding.

Office 365 Meeting Rooms

Shared calendars for the use of shared meeting space reservation is becoming a thing of the past. Office 365 has a better type of calendar specifically made for rooms. This guide will show you how to set up these Office 365 Meeting Rooms in Microsoft’s Office 365 admin portal. Login to the Office 365 Portal with an administrator account and do the following:

Setup Office 365 Meeting Rooms

Click on the Meeting Rooms tab on the left of the Office 365 admin center.
Click on the + symbol to begin the creation of the meeting room object.
Fill in the needed information (Name, Email Address and Room Capacity) then click Create.
Now users can access these meeting rooms when creating a new Meeting in Outlook by clicking on the Rooms button and selecting them.
Once selected that room for that date at that time will be marked off on the associated calendar. There are also color coated indicators as to the availability of the meeting rooms on the selected date in the calendar.

The meeting room will also now appear in their Calendar tab of Outlook and can be used similarly to other calendars. If you have any issues setting things up for your site, please feel free to contact our Office 365 experts to guide you through the process.

Change Office 365 Distribution Group Restriction

If an Office 365 Distribution Group is being synced from on-premise Active Directory environment then you cannot receive emails to that group from an external source by default. If you try to change the setting in Office 365 the following error appears:

The action ‘Set-DistributionGroup’, ‘RequireSenderAuthenticationEnabled’, can’t be performed on the object ‘[Your Distribution Group]’ because the object is being synchronized from your on-premises organization. This action should be performed on the object in your on-premises organization.

Office 365 Distribution Group Error

This can be changed using the ADSIEdit tool. Navigate through the Active Directory hierarchy and find the Distribution Group then right click and choose Properties. Scroll down to “msExchRequireAuthToSendTo” and change the setting to FALSE. Run a manual DirSync to effect the changes in Office 365.

Office 365 Distribution Group - ADSI Edit

Google Apps SPF / DKIM setup

A Sender Policy Framework (SPF) record indicates mail servers that are authorized to send mail for a domain. Email recipient servers perform a check with DNS to see if the mail came from an authorized server. If not, then the email is most likely SPAM. SPF DNS records lets the recipient server perform this verification.

A DomainKeys Identified Mail (DKIM) record adds a digital signature to emails your organization sends. Email recipient servers perform a check with DNS for the to see if the DomainKey matches the sender. If so, then the email is considered unmodified and from a legitimate sender. DKIM DNS record lets the recipient server perform this verification.

Configure Google Apps SPF

If you use Google Apps for email, you’ll need access to your DNS provider to add an SPF record. In most cases, you simply login and create a new TXT record with the value of:

v=spf1 include:_spf.google.com ~all

Google provides detailed instructions on how this is done. Be sure to save your changes.

Configure DKIM for Google Apps

You’ll need access to your Google Apps control panel and your DNS records to set DKIM. This is a three step process:

1. Create the DKIM key

a. Login to your Google Apps Control Panel (e.g., http://www.google.com/a/cpanel/yourdomain.com)

b. Navigate to the Gmail App Control Panel

c. Scroll down to “Authenticate email” and click on “Set up email authentication (DKIM)”.

d. Your domain name should be displayed. Click on “Generate new record”. Leave the default selector prefix as “google”. Click “Generate”.

e. Leave this browser window open, and then create a new tab or browser window.

2. Create the DKIM DNS record

a. Login to your DNS provider.

b. Create a new TXT record. The name of the TXT record should be:

google._domainkey

This creates a domain that, fully resolved, looks like: google._domainkey.yourdomain.com.

c. The value for the DNS record will be a very long string of characters, something like:

v=DKIM1; k=rsa; t=y; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCG5in7gQIDAQAB

The actual length of the string will be much longer than that above. I find it simplest to copy-and-paste the information from the Control Panel page displaying the information. Save the DNS record.

3. Start Authenticating

a. Wait 24-hours for your changes to propagate, and for Google’s servers to detect the changes.

b. Login to your Google Apps Control Panel (e.g., http ://www .google .com /a /cpanel /yourdomain .com)

c. Go to the “Advanced tools” tab, then scroll down to “Authenticate email” and click on “Set up email authentication (DKIM)”.

d. Click “Start authentication”.

As always, check Google’s detailed instructions if your setup is more complex.

Verify that SPF & DKIM are configured

Send an email from your Gmail account to check –auth @verifier .port 25.com after you’ve completed the Google Apps SPF and DKIM setup. You’ll receive an email response in a few minutes. If everything is properly configured, you’ll receive a “PASS” for both the Google Apps SPF and DKIM settings. This means your email is now securely being delivered and can be verified as such.

Share Users Office 365 Calendar

The old way to accomplish Exchange calendar sharing between users was to either connect to each individual users workstation to right click and share the calendar to users in the Global Access List (GAL) or to install their profile on your system and do the same. There have been some wonderful advances since the advent of Powershell that allow Office 365 calendar sharing permissions to be set remotely as follows:

How to share Office 365 Calendar via Powershell

1. Make sure the Windows Azure Active Directory Module for Windows PowerShell is installed properly

2. Open Windows Azure Active Directory Module for Windows PowerShell as administrator

3. Type in the following to run signed scripts for Exchange Online:

Set-ExecutionPolicy RemoteSigned

4. Type in the following to enter the administrative credentials for Office 365:

$creds = Get-Credential

5. Enter the Office 365 Administrator credentials then click "OK" button. 6. Type in the following to connect to Office 365 via PowerShell:

Import-Module MsOnline

Connect-MsolService -Credential $creds

7. Type in the following to connect to Exchange Online via Powershell:

$Session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://ps.outlook.com/powershell/ -Credential $creds -Authentication Basic -AllowRedirection

Import-PSSession $Session

8. Type in the following command to change the calendar permissions:

Add-MailboxFolderPermission -Identity sharinguser@domain.com:\calendar -User recipient@domain.com -AccessRights Editor

Once this command has been executed for each individual recipient that will access the sharing users calendar, then you can have them right click to add the shared calendar in their Outlook. For a list of possible Access Rights see this great page by the University of Wisconsin. If your company is using Office 365 Calendar and needs help sharing them, then contact us for assistance.

Create Office 365 Shared Calendars

Often when migrating a client from on-premise Exchange server to the Office 365 platform, the company will have an Exchange pubic folder shared calendar or two that are used for various reasons. Here is the steps for creating the new kind of Office 365 shared calendars:

Creating a Public Folder Mailbox

1. Open the Office 365 portal with an administrative user
2. Open the Admin panel
3. Open the Exchange Admin panel
4. Click on Public Folders, then on the Public Folder Mailboxes
5. Click on the + symbol then give the new Public Folder Mailbox a name and click Save

Creating the Root Public Folder

1. Still in the Public Folders section click on Public Folders at the top
2. Click on the + symbol then give the new Public Folder Mailbox a name and click Save
3. Click on the new Public Folder then on the right hand side click on Manage under Folder permissions
4. Add all administrator users to the Folder Permissions

Creating the Shared Calendar Public Folder

1. Open Outlook on administrative users workstation who will be the "Owner" of the folder
2. Click on Folders at the bottom and expand into the new root Public Folder
3. Right click on the root and choose Add New Folder
4. Give it a name and choose Calendar Items under folder contains then click OK
5. Right click on the new Public Calendar click on Properties then on Permissions tab
6. Add all users who will be accessing the calendar and appropriate permissions for them

Adding the Calendar folder to Outlook

1. Open Outlook on each users workstation
2. Click on Folders at the bottom and expand into the new Public Calendar
3. Right click on the Public Calendar and choose Add to Favorites which then makes it listed under their calendar tab.

If your company is migrating from on-premise Exchange to Office 365 or are in need of an Office 365 Shared Calendars setup, then contact us for assistance.

Category: Email

Basic Office 365 Encryption Setup

Basic Office 365 Encryption Setup

Office 365 Azure AD Connect Upgrade

Office 365 Azure AD Connect Upgrade

Issues After Office 365 Migration

Deleting SCP from Server after Office 365 Migration

Deleting SCP from Workstation after Office 365 Migration

Microsoft Office 365 Troubleshooting Tool

Branded Email using Custom Domain Name

Branded Email Establishes Legitimacy

Branded Email Builds Your Brand

Branded Email Separates Company Departments

Branded Email Isn’t Expensive

Office 365 Meeting Rooms

Setup Office 365 Meeting Rooms

Change Office 365 Distribution Group Restriction

Google Apps SPF / DKIM setup

Configure Google Apps SPF

Configure DKIM for Google Apps

Verify that SPF & DKIM are configured

Share Users Office 365 Calendar

How to share Office 365 Calendar via Powershell

Create Office 365 Shared Calendars

Creating a Public Folder Mailbox

Creating the Root Public Folder

Creating the Shared Calendar Public Folder

Adding the Calendar folder to Outlook

Recent Posts

Archives

Categories

Category: Email

Basic Office 365 Encryption Setup

Office 365 Azure AD Connect Upgrade

Deleting SCP from Server after Office 365 Migration

Deleting SCP from Workstation after Office 365 Migration

Branded Email Establishes Legitimacy

Branded Email Builds Your Brand

Branded Email Separates Company Departments

Branded Email Isn’t Expensive

Setup Office 365 Meeting Rooms

Configure Google Apps SPF

Configure DKIM for Google Apps

Verify that SPF &amp; DKIM are configured

How to share Office 365 Calendar via Powershell

Creating a Public Folder Mailbox

Creating the Root Public Folder

Creating the Shared Calendar Public Folder

Adding the Calendar folder to Outlook

Recent Posts

Archives

Categories

Evaluation Signup

Verify that SPF & DKIM are configured