Exchange MAPI Support for IC

Transcription

1 Exchange MAPI Support for IC Technical Reference Interactive Intelligence Customer Interaction Center (CIC) 2016 R1 Last updated September 4, 2015 (See Change Log for summary of changes) Abstract This document provides procedures for configuring the Microsoft Exchange MAPI-based integration for CIC. Interactive Intelligence, Inc Interactive Way Indianapolis, Indiana Telephone/Fax (317)

2 Copyright and Trademark Information Interactive Intelligence, Interactive Intelligence Customer Interaction Center, Interaction Administrator, Interaction Attendant, Interaction Client, Interaction Designer, Interaction Tracker, Interaction Recorder, Interaction Mobile Office, Interaction Center Platform, Interaction Monitor, Interaction Optimizer, and the Spirograph logo design are registered trademarks of Interactive Intelligence, Inc. Customer Interaction Center, EIC, Interaction Fax Viewer, Interaction Server, ION, Interaction Voic Player, Interactive Update, Interaction Supervisor, Interaction Migrator, and Interaction Screen Recorder are trademarks of Interactive Intelligence, Inc. The foregoing products are Interactive Intelligence, Inc. All rights reserved. Interaction Dialer and Interaction Scripter are registered trademarks of Interactive Intelligence, Inc. The foregoing products are Interactive Intelligence, Inc. All rights reserved. Messaging Interaction Center and MIC are trademarks of Interactive Intelligence, Inc. The foregoing products are Interactive Intelligence, Inc. All rights reserved. Interaction Director is a registered trademark of Interactive Intelligence, Inc. e-faq Knowledge Manager and Interaction Marquee are trademarks of Interactive Intelligence, Inc. The foregoing products are Interactive Intelligence, Inc. All rights reserved. Interaction Conference is a trademark of Interactive Intelligence, Inc. The foregoing products are Interactive Intelligence, Inc. All rights reserved. Interaction SIP Proxy and Interaction EasyScripter are trademarks of Interactive Intelligence, Inc. The foregoing products are Interactive Intelligence, Inc. All rights reserved. Interaction Gateway is a registered trademark of Interactive Intelligence, Inc. Interaction Media Server is a trademark of Interactive Intelligence, Inc. The foregoing products are Interactive Intelligence, Inc. All rights reserved. Interaction Desktop is a trademark of Interactive Intelligence, Inc. The foregoing products are Interactive Intelligence, Inc. All rights reserved. Interaction Process Automation, Deliberately Innovative, Interaction Feedback, and Interaction SIP Station are registered trademarks of Interactive Intelligence, Inc. The foregoing products are Interactive Intelligence, Inc. All rights reserved. Interaction Analyzer is a registered trademark of Interactive Intelligence, Inc. Interaction Web Portal, and IPA are trademarks of Interactive Intelligence, Inc. The foregoing products are Interactive Intelligence, Inc. All rights reserved. Spotability is a trademark of Interactive Intelligence, Inc All rights reserved. Interaction Edge, CaaS Quick Spin, Interactive Intelligence Marketplace, Interaction SIP Bridge, and Interaction Mobilizer are registered trademarks of Interactive Intelligence, Inc. Interactive Intelligence Communications as a Service, and Interactive Intelligence CaaS are trademarks or service marks of Interactive Intelligence, Inc. The foregoing products are Interactive Intelligence, Inc. All rights reserved. Interaction Speech Recognition and Interaction Quality Manager are registered trademarks of Interactive Intelligence, Inc. Bay Bridge Decisions and Interaction Script Builder are trademarks of Interactive Intelligence, Inc. The foregoing products are Interactive Intelligence, Inc. All rights reserved. Interaction Collector is a registered trademark of Interactive Intelligence, Inc. Interaction Decisions is a trademark of Interactive Intelligence, Inc. The foregoing products are Interactive Intelligence, Inc. All rights reserved. Interactive Intelligence Bridge Server and Interaction Connect are trademarks of Interactive Intelligence, Inc. The foregoing products are Interactive Intelligence, Inc. All rights reserved. The verypdf product is verypdf, Inc. All rights reserved. This product includes software licensed under the Common Development and Distribution License (6/24/2009). We hereby agree to indemnify the Initial Developer and every Contributor of the software licensed under the Common Development and Distribution License (6/24/2009) for any liability incurred by the Initial Developer or such Contributor as a result of any such terms we offer. The source code for the included software may be found at A database is incorporated in this software which is derived from a database licensed from Hexasoft Development Sdn. Bhd. ("HDSB"). All software and technologies used by HDSB are the properties of HDSB or its software suppliers and are protected by Malaysian and international copyright laws. No warranty is provided that the Databases are free of defects, or fit for a particular purpose. HDSB shall not be liable for any damages suffered by the Licensee or any third party resulting from use of the Databases. Other brand and/or product names referenced in this document are the trademarks or registered trademarks of their respective companies. DISCLAIMER INTERACTIVE INTELLIGENCE (INTERACTIVE) HAS NO RESPONSIBILITY UNDER WARRANTY, INDEMNIFICATION OR OTHERWISE, FOR MODIFICATION OR CUSTOMIZATION OF ANY INTERACTIVE SOFTWARE BY INTERACTIVE, CUSTOMER OR ANY THIRD PARTY EVEN IF SUCH CUSTOMIZATION AND/OR MODIFICATION IS DONE USING INTERACTIVE TOOLS, TRAINING OR METHODS DOCUMENTED BY INTERACTIVE. Interactive Intelligence, Inc Interactive Way Indianapolis, Indiana Telephone/Fax (317) Exchange MAPI Support for IC Technical Reference 2

3 Table of Contents Introduction... 4 Supported Exchange servers (MAPI)... 4 Mail server and IC Server can be members of the same or different domain... 4 Create an Exchange Distribution Group for IC users... 4 Create an Exchange Distribution Group in Exchange 2007 and Exchange Assign IC administrator account permissions for Exchange... 7 Recommended and minimum Exchange permissions...7 Assign the recommended IC administrator permissions in Exchange 2007 and Exchange Assign the minimum IC administrator permissions in Exchange 2007 and Exchange Troubleshooting: Permission assignments may not take effect immediately Troubleshooting: Send As permission and IC users with domain administrative roles Configure the Outlook client on the IC Server Configure Outlook 2010 on the IC Server Configure CIC for Exchange Exchange calendar access (Interaction Mobile Office) for Exchange 2007 only Requirements Configuration Microsoft Outlook for users Microsoft Outlook on client workstations Microsoft Outlook Web Access Change Log Exchange MAPI Support for IC Technical Reference 3

4 Introduction This document is for the Microsoft Exchange and/or IC administrator responsible for the Exchange MAPI system and for configuring Exchange MAPI. It provides requirement and configuration information for the CIC integration to Exchange using the Exchange MAPI interface. Note: Starting with CIC 2015 R2, the contents of this document were removed from the Mail System chapter in the IC Installation and Configuration Guide and moved to this new, separate document. Supported Exchange servers (MAPI) Mail server and IC Server can be members of the same or different domain Create an Exchange Distribution Group for CIC users Assign IC administrator account permissions for Exchange Configure the Outlook client on the IC Server Configure CIC for MAPI Exchange calendar access (Interaction Mobile Office) for Exchange 2007 only Microsoft Outlook for users Supported Exchange servers (MAPI) CIC supports the following Microsoft Exchange servers for Exchange MAPI: Microsoft Exchange 2010 SP3 RU9 Calendar Access not supported Microsoft Exchange 2007 SP3 RU16 Visit the Interactive Intelligence Product Information site at Requirements.aspx for mail system support updates. Mail server and IC Server can be members of the same or different domain The IC Server can integrate to a single Exchange organization. The IC Server is not required to be a member of the same Active Directory forest as the Exchange organization, as long as a trust relationship has been configured for the IC administrator account. Create an Exchange Distribution Group for IC users Before you begin the IC Server installation, we recommended that you create an Exchange Distribution Group containing the Active Directory accounts of the users who will be configured in CIC. An Exchange Distribution Group is useful for several purposes: Creating IC users: In a new installation, you can use Add Users Assistant in either IC Setup Assistant or Interaction Administrator to add multiple users toc IC. One of the choices in Add Users Assistant is to import users from a mail server Distribution Group. Creating users by this method greatly speeds up the process compared to adding each user individually. Sending Group messages: A Distribution Group can be used to send or voic administrative announcements in Outlook or CIC to all CIC users. For example, you may wish to announce a planned maintenance downtime, remind users of phone use policies, or advertise a newly licensed feature. Assigning Exchange permissions: If you plan to use the minimum set of Exchange permissions necessary, a Distribution Group can greatly assist in assigning these permissions for each user. For more information, see Assign IC administrator account permissions for Exchange. After the initial IC Server installation, remember to keep the Exchange Distribution Group s membership in synch with the list of CIC users in Interaction Administrator. In other words, when a new user is added to CIC, the user must be added to the Exchange Distribution Group as well. If you fail to do so, new users may be left out of group messages or, if you used the Exchange Distribution Group to aid in assigning permissions, new users may be unable to access their voic s. Create an Exchange Distribution Group in Exchange 2007 and Exchange 2010 In Exchange 2007 or Exchange 2010, create the Exchange Distribution Group in the Exchange Management Console. Exchange MAPI Support for IC Technical Reference 4

5 1. Launch the Exchange Management Console on the Exchange server and select Distribution Group under Recipient Configuration. Exchange 2010 Distribution Group 2. Right-click the Distribution Group node and select New Distribution Group. 3. Follow the steps in the New Distribution Group wizard to create a New Group and click Next. New Distribution Group wizard Exchange MAPI Support for IC Technical Reference 5

6 4. Enter account information for the Distribution Group. Enter account information for the Distribution Group For Group type, Distribution is recommended. Type the group Name, for example, ICUsers. 5. After you have completed the New Distribution Group wizard, the ICUsers Group appears in the Distribution Group node. 6. Double-click on the ICUsers Group in the Distribution Group node to open the Properties window, and click the Members tab. 7. Click the Add button. In the Select Recipient screen, select all IC users. Select IC users 8. The IC users are added to the Distribution Group member list. Exchange MAPI Support for IC Technical Reference 6

7 Exchange 2010 Distribution Group member list Assign IC administrator account permissions for Exchange You should have already created an IC administrator account a Windows domain user account with local machine administrator privileges on the IC Server as described in Chapter 3: IC Server. This account is used to install the IC software and to start IC services. The IC administrator account is also used to log in to the Exchange server. From this single login, the mailboxes of all IC users are accessed and all IC generated messages (voic s, faxes, and s) are delivered. Note: For historical and consistency purposes, this section uses the term IC administrator account to refer to the Windows domain user account that starts IC services, acknowledging that the term may be misleading as the same account may or may not also be used to administrator IC accounts in Interaction Administrator. If you plan to use a specific account to run IC services and log in to the Exchange server, make sure to follow the instructions in this section to set the permissions for that account. This section describes two permission models, provides instructions for assigning permissions for your Exchange server version and the chosen permission model, and presents some troubleshooting items. Recommended and minimum Exchange permissions Assign the recommended IC administrator account permissions in Exchange 2007 and Exchange 2010 Assign the minimum IC administrator account permissions in Exchange 2007 and Exchange 2010 Troubleshooting: Permission assignments may not take effect immediately Troubleshooting: Send As permission and IC users with domain administrative roles Recommended and minimum Exchange permissions You can choose from two Exchange permission models recommended and minimum. Use the minimum permissions model only if the recommended permissions are not restrictive enough for your site. Minimum permissions At a minimum, CIC requires two Exchange permissions to be set in order to properly function: Full Mailbox Access : The Full Mailbox Access permission enables the IC administrator account to access IC users mailboxes to retrieve, move, and delete voic s, faxes, s, and mailbox folders. Send As : The Send As permission, set over an Active Directory organizational unit (typically OU=Users ), enables the IC administrator account to send messages on behalf of any user in that organization unit. When IC user A sends a voic to IC user B, it appears as if IC user A sent it, although it is actually sent by the IC administrator account. When IC user B replies to IC user A by selecting to Reply in either Outlook or the TUI, the reply goes directly to IC user A, instead going to the IC service account s mailbox. Both permissions must be granted to the IC administrator account on each IC user s mailbox. At sites with large numbers of CIC users, this can be an administrative burden (requiring mundane and Exchange MAPI Support for IC Technical Reference 7

8 repetitious configuration in Active Directory Users and Computers, or the use of scripting). In addition, it is prone to configuration errors (for example, failing to always remember to add the permissions in Active Directory when adding new users to CIC). For these reasons, most sites may wish to use the recommended (more powerful) set of permissions over the entire Exchange Mailbox Database, instead of individual users. If the recommended permissions are unacceptably high for your situation, use the minimum permissions. Recommended permissions The set of Exchange permissions generally recommended to allow CIC to properly function is: Administrator Information Store : The Administrator Information Store permission, set over an Exchange Mailbox Database, enables the IC administrator account to access the mailbox of any user in that Mailbox Database. CIC uses Administrator Information Store to access those users folders (inbox, sent items, etc.) as well as contacts. Send As : The Send As permission, set over an Active Directory organizational unit (typically OU=Users ), enables the IC administrator account to send messages on behalf of any user in that organization unit. See previous Send As section above. Receive As : The Receive As permission, set over an Exchange Mailbox Database, enables the IC administrator account to access the mailbox of any user in that Mailbox Database. This additional permission is only necessary if your CIC license contains the Interaction Mobile Office feature and you plan to use the Exchange Calendar Access feature in Exchange 2007, which enables users to access their calendars through the TUI. Assign the recommended IC administrator permissions in Exchange 2007 and Exchange 2010 For Exchange 2007 and Exchange 2010, you can grant all three permissions Administer Information Store, Send As, and Receive As (if using calendar integration) to the IC administrator account in the Exchange Management Shell. To assign Administer Information Store and Receive As (if using calendar integration Exchange 2007 only) permissions Run the following Exchange Management Shell command. The parameters in italics will vary, including the Database_Name, which you can determine through Exchange Management Console. You will need to repeat this command for every Mailbox Database that contains mailboxes of IC users. Get-MailboxDatabase Database_Name Add-ADPermission -User domain\ic_administrator_account ExtendedRights ms-exch-store-admin,receive-as For example: Assign Administrator Information Store and Receive As permissions command The parameters in italics will vary, including the Database_Name, which you can determine through Exchange Management Console. Exchange MAPI Support for IC Technical Reference 8

9 Determining the Mailbox Database name You will need to repeat this command for every Mailbox Database that contains mailboxes of IC users. To assign Send As permission Run the following Exchange Management Shell command. The parameters in italics will vary: Add-ADPermission CN=Users,DC=domain,DC=com User domain\ic_administrator_account ExtendedRights Send-As InheritanceType Descendents InheritedObjectType User For example: Assign Send As permission command Assign the minimum IC administrator permissions in Exchange 2007 and Exchange 2010 For some sites, the recommended permissions may be unacceptably high. For example, your Exchange Mailbox Database may have the mailboxes of thousands of users in it, of which only a subset are CIC users. Granting the IC administrator account the ability to access mailboxes of all users in the database may be undesirable or prohibited by the corporate security policy. If that is the case, you have two options: Isolate the IC users: Create a special Exchange Mailbox Database for IC users only. Grant the IC administrator account Administer Information Store permission (and Receive As permission if using calendar integration in Exchange 2007 only) over that database only. Create a special Organizational Unit or Active Directory Group for CIC users only. Grant the IC administrator account Send As permission over that OU or Group only. Bear the administrative burden: Grant Full Mailbox Access and Send As to the IC administrator account for each IC user. You must be careful to grant this to each and every IC user, and remember to always do so when adding new CIC users. The Exchange Management Shell can greatly aid in assigning the permissions if you choose this option. In Exchange 2007 and Exchange 2010, the Full Mailbox Access and Send As permissions can be granted to the IC administrator account on each IC user s mailbox, by using a Distribution Group described in the Creating an Exchange Distribution Group in Exchange 2007 and Exchange 2010 section, and the following Exchange Management Shell script. The parameters in italics will vary. $ICUsers = Get-DistributionGroupMember Distribution_Group_Name Exchange MAPI Support for IC Technical Reference 9

10 $ICUsers ForEach-Object Process { Get-Mailbox $_.Identity Add-MailboxPermission User domain\ic_service_account AccessRights FullAccess,SendAs } Note: The above script will only grant the IC administrator account permissions over the mailboxes of the users who are members of the Distribution Group at the time the script is run. You will have to manually add the permissions or rerun the script, when new users are added to CIC, and manually remove permissions if users are removed from CIC but not from Active Directory. Troubleshooting: Permission assignments may not take effect immediately The changes you make to Exchange permissions may not take effect immediately. Exchange permissions stored in Active Directory will not be replicated to other Active Directory sites until the regular synchronization interval (by default, every 15 minutes). In addition, Microsoft Exchange caches permissions and periodically updates that cache. To clear and reload this cache (and have the permissions take effect immediately if you have only one Active Directory server), you may stop and restart the Microsoft Exchange Information Store service. Troubleshooting: Send As permission and IC users with domain administrative roles If any of your CIC users are members of a built-in domain administrative group (such as Administrators, Domain Administrators, Backup Operators, etc.), they may have their Send As permission removed by Active Directory within an hour after you have added it. Certain built-in domain administrative groups, and consequently members of those groups, have their permissions dictated by a template Active Directory object called AdminSDHolder. For detailed information, see Microsoft Knowledge Base (KB) articles and If any of your CIC users are members of these protected groups, a problem will exhibit itself whenever these users (typically in the IT department) leave a voic for another CIC user. These voic s will appear as having been sent by the IC administrator account instead of the user. Furthermore, warnings will appear in the Application Event Viewer log stating that a message could not be delivered to one or more of the specified recipients, because the transport lacked the necessary permissions to deliver the message on behalf of the sender, as CIC attempts to first deliver the message on behalf of the CIC user. The best solution to this problem is to follow the recommendation from Microsoft and create two separate accounts for your power users: one for ordinary use, including and voic , and one (preferably with no Exchange mailbox) for administrative tasks only. Creating separate accounts is a standard best practice for reasons unrelated to CIC (protecting the administrative account from viruses, for example). If you still choose to add users to CIC who are members of a protected group, you will have to modify the AdminSDHolder object as described in the KB article. If using the recommended permissions model, you will have to employ Method 2 workaround described in KB article If using the minimum permissions model, you will have to run the dsacls.exe utility, as mentioned in KB article , with the parameters below. The parameters in italics will vary. dsacls.exe cn=adminsdholder,cn=system,dc=domain,dc=com /G domain\poweruser:ca;send As You will need to repeat this for every user who is a member of a protected domain group. Configure the Outlook client on the IC Server CIC supports Microsoft Outlook 2010 SP1 and SP2 (32-bit only) on the IC Server. Visit the Interactive Intelligence Product Information site at for mail system support updates. Microsoft recommends applying the latest Outlook service packs for full functionality. Outlook on the IC Server must be configured to access the IC administrator account on the Exchange server. This section describes how to create the account (mail profile for the IC administrator). IC uses this account for sending voic , faxes, etc. to CIC client users. Configure Outlook 2010 on the IC Server Before you begin, make sure that the Exchange server is installed and connected to the IC Server, and the IC administrator account has been assigned the permissions described in the previous section. 1. Log into the IC Server as the IC administrator. 2. Install Outlook 2010 if it is not already installed. We recommend selecting the typical installation, and installing Outlook on the D:\ drive. Exchange MAPI Support for IC Technical Reference 10

11 3. Open the Start menu, select Control Panel, select User Accounts, and then open the Mail control panel. 4. Select Accounts Select Accounts 5. The Account Settings screen opens. Select New. Select New 6. In the Add New Account Auto Account Setup screen, select Manually configure server settings or additional server types and click Next. Exchange MAPI Support for IC Technical Reference 11

12 Select Manually configure server settings or additional server types 7. In the Add New Account Choose Service screen, select Microsoft Exchange Server and click Next. Select Microsoft Exchange Server 8. In the Add New Account Server Settings screen: Enter the Microsoft Exchange Server. Enter the User Name (IC administrator account) and select Check Name to verify. Make sure that Used Cached Exchange Mode is unchecked. Exchange MAPI Support for IC Technical Reference 12

13 Exchange Server settings 9. Click Finish to close the wizard. New account added complete 10. To verify the Outlook installation and mail profile, open Outlook and send an to someone else with an account on the Exchange server. Configure CIC for Exchange After the IC Server software has been installed, configure the Exchange mail provider in IC Setup Assistant as described in Chapter 12: IC Setup Assistant, and/or post-installation in the Interaction Administrator Mail container. IC uses the default Exchange profile on the Exchange server. Other than selecting Exchange as the mail provider, the only additional configuration is the optional Exchange calendar access (Exchange 2007 only). See Exchange calendar access (Interaction Mobile Office) below. Exchange calendar access (Interaction Mobile Office) for Exchange 2007 only Exchange calendar access is an Interaction Mobile Office feature, available if your IC license includes Interaction Mobile Office and supported only for Exchange This feature enables IC users to retrieve a list of appointments set in their Outlook calendar via the telephone user interface (TUI). For information about Interaction Mobile Office, see the Interaction Mobile Office Technical Reference in the CIC Documentation Library. Exchange MAPI Support for IC Technical Reference 13

14 Requirements Make sure you have fulfilled all the Exchange server and Outlook on the IC Server configuration requirements described in this chapter. Supported Exchange servers: The Exchange server that will be running the calendar service must be an Exchange 2007 server with Outlook Web Access enabled. It should not be a front-end Outlook Web Access server used as a proxy to the Exchange server. Note: Exchange 2010 server does not support Exchange calendar access. Assign IC administrator permissions for Exchange: Assign the recommended Exchange permissions: Administrator Store and Send As, plus Receive As, which is specifically required for Exchange calendar access. For more information, see Assign IC administrator permissions for Exchange in this chapter. Secure connections: If plan to use SSL/TLS to ensure secure connections between the IC Server and the Exchange server, an Exchange server certificate must be issued by a certificate authority. The Exchange server certificate, or all certificates in its chain of trust, must be installed in the Windows Certificate Store. For more information, see security in this chapter. Configuration CIC uses the WebDAV API to interface with the Exchange server for the Exchange calendar access feature. WebDAV is an extension of the HTTP protocol. Configure Exchange calendar access in the Exchange Configuration screen, which appears in IC Setup Assistant as part of a new CIC installation or post-installation, in the Interaction Administrator Mail container. Exchange Calendar screen Host: Type the URL of the Exchange server running the calendar service, in the format. If you plan to use SSL/TLS, use format. Note: If the Host is an Exchange 2007 server, point to the Exchange 2007 server acting in the Client Access role. User ID: Type an administrative user account name (IC administrator account) that has "Receive As" rights on the Exchange server. The field should contain the domain and username (domain\username). Password: Type the password for the User ID. Confirm: Confirm the password for the User ID. Microsoft Outlook for users Microsoft Outlook is not required for users: voic and fax can be checked in the CIC client. However, if you want to provide users with the ability to check messages outside of CIC, or to receive any other messages Exchange MAPI Support for IC Technical Reference 14

15 from CIC which are not either voic or fax, install either Microsoft Outlook or Microsoft Outlook Web Access. Microsoft Outlook on client workstations CIC supports the following Microsoft Outlook client versions on user workstations: Microsoft Outlook 2013 Microsoft Outlook 2010 SP1 and SP2 (32-bit and 64-bit) Microsoft Outlook 2007 SP2 Visit the Test Lab site at for the latest service packs certified for use with CIC. Microsoft recommends applying the latest Outlook service packs for full functionality. Microsoft Outlook Web Access Microsoft Outlook Web Access enables users to gain access to their Microsoft Exchange Server mailbox using a Web browser. If you choose to use Outlook Web Access, see the documentation provided by Microsoft on how configure and use Outlook Web Access. Exchange MAPI Support for IC Technical Reference 15

16 Change Log The following changes have been made to this document since it was first published. Change Removed the Exchange MAPI requirements and procedures were removed from Chapter 7: Mail System in the IC Installation and Configuration Guide and moved it to this separate document for CIC 2015 R2 and later. Updated documentation to reflect rebranding and the removal of Interaction Client.NET Edition in CIC 2016 R1. Date 2-Dec Sep-2015 Exchange MAPI Support for IC Technical Reference 16