Skype for Business Hybrid Voice. Cloud Connector Edition. Version 2.0

Transcription

1 Skype for Business Hybrid Voice Cloud Connector Edition Planning, Migration and Configuration Guide Version , Thomas Pött, MVP Office Server (Skype for Business) Version 2.0 contact: via contact from on

2 Index Index... 2 Introduction of Cloud Connector Edition... 5 Generic terms of Office 365 PSTN connectivity... 5 Topology support in Office 365 with Skype for Business... 6 On-Premise without any Office 365 connectivity... 6 On-Premise Skype for Business with Office 365 Cloud PBX connectivity (Federation to Office 365 and Cloud PBX and PSTN CALLING SERVICE)... 6 Office 365 with CCE (Cloud PBX)... 7 Office 365 with PSTN Calling Service (native Calling Plan)... 7 Typical Skype for Business federated On-Premise Installation... 7 Tenant support in Office Cloud Connector Active Directory Forest Cloud Connector (CCE) Topologies Outbound Call Flow Inbound Call Flow CCE SBA in planning: High Availability: Multi-Site deployment CCE Voice Routing with multi-site (generics) CCE Voice Routing on gateways (optional) not yet supported by Microsoft Migration to Cloud PBX with Cloud Connector Edition Greenfield Skype for Business with Enterprise Voice on-premise Target: native Cloud Connector Edition Target: Cloud Connector Edition with Office 365 Calling Plan (Cloud Voice Users) Target: Cloud Connector Edition + Skype for Business partial Enterprise Voice (on-premise) Target: Cloud Connector Edition + Office 365 Calling Plan (Cloud Voice Users) + Skype for Business partial Enterprise Voice (on-premise) Summary: Infrastructure requirements for Cloud Connector Edition Physical infrastructure Logical infrastructure DNS Certificates externally Certificates internally Firewall Port Configuration Configuration Guide for Users, Dial-Plans, Voice Routes and PSTN Usage Connect to Skype for Business Online CCE Site generation and assignment Management Guide for Users... 30

3 Moving a User to Skype for Business Online CCE User to Site assignment Configuration Guide for Dial-Plans Configuration Guide for Voice Routes Appendix Commandlets for Online configuration Dial-in conferencing cmdlets E911 and Location Information Service (LIS) cmdlets Skype Meeting Broadcast cmdlets PSTN calling cmdlets Hybrid PSTN site and user cmdlets Internet Protocol (IP) phone cmdlets Reporting cmdlets Online User cmdlets Reading/ Writing Users Information and Settings... 39

4 Release Notes: The technical level of this document is 400. This article requires knowledge about Skype for Business Server, Office 365, certificate authorities, DNS and general knowledge about Office 365 hybrid configurations. The new feature announced for Skype for Business called Cloud Connector Edition (CCE) was published in the final release version around May This article describes the Planning considerations for simple and complex CCE deployments. It talks about Active Directory synchronization for Hybrid Office 365 installations. CCE will be a downloadable Virtual Machine environment only designed for Microsoft Hyper-V Windows Server 2012 R2. There are no physical PSTN Gateways available from Microsoft. This has to be integrated from 3 rd party vendors. Download the installation files: New with the Version 2.0 of my article is the link to dedicated configuration guides. I will focus this time on AudioCodes and in another document on Sonus Gateways. Also providing a quick look into the AudioCodes Cloud Bond solution too. The Audio Conferencing (ACP) with PSTN Dial-In and Dial-Out option is not reflected in this document. At later time a dedicated guide might follow. Note: This document is not a sizing nor recommendation guide. There are other vendors for suitable gateway on the market which suits this solution too. You should use this document only for your environment planning s purposes and design considerations. In lager environments you should spend some time to evaluate the optimal path of your PSTN deployment. MVP Special Service: I m providing Assessment, Concept or Deployment Reviews for Skype for Business and Lync for On- Premise, Hybrid or Cloud. In case of an inquiry, please contact me directly via the contact form on my BLOG XING ( or LINKEDIN (

5 Introduction of Cloud Connector Edition Since the first release of Microsoft Cloud Connector Edition a lot of changes where introduced, which required me rewriting my last so said Version 1.0 of this article. Aside I like getting now much deeper into the planning and configuration site for Cloud Connector and I hope this finds you well. First look we have is into the changes for the setup, or some may say common setup for a hybrid Skype for Business deployment. The hybrid setup is literally nothing different than a regular onpremise deployment, connected to the Office 365 tenant. We have to deploy the on-premise system as we did in the past, including the dedicated DMZ servers, as there are Edge and Reverse Proxy server. The both environments are than combined, means federated. While next we initiate the hybrid connection as you can read on Microsoft Technet. This is still valid if you have E5 plan and activate the Cloud PBX feature. The Cloud PBX enables the Enterprise Voice features in the cloud which a local PSTN breakout. Generic terms of Office 365 PSTN connectivity With Office 365 either PSTN Calling Plans or the Cloud Connector Edition with local PSTN breakouts are provided. Office 365 including Skype for Business Online (E5 Plan) Microsoft Cloud PBX in Skype for Business Online Microsoft PSTN Calling Plan and Services On-Premise PSTN Microsoft Skype for Business Software (Desktop client, MAC Client, Mobile Clients) Customer provides PSTN from local Telco Operators (ISDN, Analog or SIP Trunk) In the illustration above, the Cloud PBX represents the Office 365 multi-tenant Skype for Business solution activated Enterprise Voice Features. In both described cases, a client is needed to connect to the SfB online environment. Difference in customer provided PSTN breakout and PSTN Calling Service is, that the Media stream and the dialing is provided either by Cloud Connector Edition + local Gateway or the Microsoft own PSTN connection in the cloud. In a CCE scenario, the Media stays within the customer networks, while with PSTN Calling services, Media flows through towards the Office 365 Cloud Services. The Office 365 connectivity can be either via Internet or via Express Route 1. 1 Express Route will be explained further and is a MPSL direct connection to the Microsoft Office 365 Hosting Datacenter

6 Topology support in Office 365 with Skype for Business A frequently asked question is the support for the different topologies. Later in this document I also provide a generic overview about a possible migration path towards one or the other topology. The rudimentary described supported topologies are the ONLY possible setups. There are no possibilities and nor any supported way in combining any of those topologies! On-Premise without any Office 365 connectivity This is typically a solution, where you don t own an Office 365 E Plan. Therefore, you are not entitled using any of the Office 365 features. Same is valid, if you own only an Exchange Online Plan, whereby none of the Skype for Business Online Services are subject to be used. On-Premise Skype for Business with Office 365 Cloud PBX connectivity (Federation to Office 365 and Cloud PBX and PSTN CALLING SERVICE) This is the only scenario, where users are hosted either in Office 365 and some users stay SfB enabled On-Premise. Meaning you have a mixed environment. This is the only mixed scenario, where local PSTN breakouts with your On-Premise Skype for Business enabled users and the other users enabled on Office 365 (which MUST use PSTN Calling Service or the local PSTN breakouts) are combined. It is not possible for Online user to be mixed for PSTN Calling Service and PSTN local breakout on-premise. This is technical limitation due to Voice Routes in the Office 365 environment. Note: A PSTN Calling Service is subject to the regional availability in the country where you required PSTN Calling. USER LOCATION Users enabled with SfB On-Premise Users enabled with SfB Online in Office 365 (either or option) PSTN breakout MUST be On-Premise with local PSTN Gateway PSTN Calling Service in Office 365 -> Calling Plan On-Premise PSTN breakout with local Gateway -> CloudPBX This is also the only scenario, where you can utilize the local Voice Routing and PSTN Usage Records. In other words, if you need a least cost routing or user based voice routing to different PSTN breakouts, this is the only way you can chose. (Comment: at time of writing this article) Advanced Voice Features (e.g. Response Group or Group Call Pickup) In case any user requires Advanced Calling Feature, this user must be enabled for On-Premise Skype for Business. Note: In later updates, Microsoft will successively add more features to the Office 365 environment, making is obsolete running On-Premise installations.

7 Office 365 with CCE (Cloud PBX) If e.g. the PSTN Calling Service isn t available, or you required On-Premise PSTN connectivity (e.g. for Contact Centers) you can move all users into Office 365 and utilize the Cloud PBX feature in combination with Cloud Connector Edition. With CCE you can mix online users with CCE On-Premise Voice PSTN breakout and Microsoft Calling Service. Explicitly, CCE CANNOT be used with Skype for Business On-Premise Topology! Office 365 with PSTN Calling Service (native Calling Plan) If you don t need either advanced calling features or any PSTN On-Premise connectivity, you can move all users into Office 365. Typical Skype for Business federated On-Premise Installation I don t step further into the hybrid configuration, where you have users in the Cloud and On-Premise, neither I have look into the correct licensing, beside, with the E5 plan your users are entitled for Enterprise Voice. On Premise Edge Office 365 including Skype for Business Online (E5 Plan) SIP PBX or Provider Gateway User Skype for Business Reverse Proxy Users Cloud PBX PSTN As we see, we still require the on-premise server s setup and configured as usual. Which leads us to the question of consultancy and integration services. Well in other words here we don t see any changes. The work is still identically as we had this in the past, also with Lync Simplifying a deployment, especially while we are moving towards the cloud is a defined goal. Asking for simplification is: It does not require a full on-premises Skype for Business Server deployment. It is available worldwide. Your users are homed online. You can keep your current PSTN carrier if required. You can purchase PSTN conferencing from Microsoft or from audio conferencing provider (ACP) partners.*

8 (*) Audio Conferencing is available in two possible methods, either you configure your own PSTN conferencing numbers or, you participate in the new Microsoft Cloud offering, where Microsoft provides a PSTN conferencing dial-in bridge. A mixed mode usage is not supported and not possible. How can we archive this? Microsoft and some vendors, e.g. AudioCodes, Sonus, come with perfect solution. The Microsoft answer to the customer requirements is the Cloud Connector Edition for Skype for Business If we identify the required on-premise components keeping PSTN Breakout locally, we see the: Mediation Server Role (SIP to SIP, Codec conversion and connection to the local gateway) Edge Server Role (Access Edge, Media Relay, Media Relay Authentication MRAS, Outbound Routing and CMS replica) Central Management Store (CMS) (File Transfer and on-premise topology hosting for a dedicated CCE site) Domain Controller (Authentication for CCE Domain Servers and CCE Certificate Authority) * (*) IMPORTANT NOTE The AD for the CCE will be fully independent from the on-premise AD and runs in its own forest. There is no connection to the local AD from point of the Cloud Connector. Even if you have multiple CCE sites, each site has its own, fully independent AD forest. Just making this more understandable with AZURE AD. There are no issues with the Azure AD if the CCE AD runs in parallel! The CCD AD is also fully independent from the AZURE AD NOTE: Next important requirement is, the users running Skype for Business 2015 Online in Office 365 and were moved into the Cloud MUST run EXCHANGE ONLINE! Set-CsUser $username -EnterpriseVoiceEnabled $true -HostedVoic $true - OnPremLineURI tel: A good question asked now, why no Reverse Proxy Server. This is explained simply by, there is no internal Web Services present with the Cloud Connector. This allows us further reducing the number of server roles. If those roles can be combined with a simplified deployment, we have reached our goals, as we discussed earlier. Cloud Connector Mediation Edge Domain Controller and CA Central Management Store (CMS)

9 NOTE: Domain name for the internal components of Cloud Connector. This domain should be different from the production domain. The name can be the same across all instances of Cloud Connectors. Now we take a look into the simplified on-premise components based on the Could Connector Edition (CCE) On Premise Office 365 including Skype for Business Online (E5 Plan) User SIP PBX or Provider Gateway Cloud Connector Edition VMs Users Cloud PBX PSTN Also recommended for those straight forward deployment is a virtualization technology, which must be Hyper-V. Hyper-V is required due to the unattended setup of all CCE virtual machines. The blue CCE components are subject to Virtual Machines only. Where we position those VM s can be either on dedicated physical hosts or we might be able to implement them on the SBC, which has Intel infrastructure board integrated. (Running CCE on a hybrid media gateway (SBC), is meant to future release from qualified gateway vendors) NOTE: Neither the users on-premise are not stored on the Could Connector, nor that Online User are replicated to the Cloud Connector. Meaning simple: there are NO users locally on the CCE. A local user CCE database is not present.

10 Tenant support in Office 365 As another point frequently asked is, mostly from companies offering customize services to their end customers if a multi-tenant setup will be possible. There is a clear answer on this topic: NO, Multi-Tenant Setup are not supported with CCE On Premise (Tenant A) On Premise (Tenant B) Office 365 with Azure AD multi-tenant User AD Azure AD Sync (DirSync) User AD Azure AD Sync (DirSync) Shared Cloud Connector CCE AD Cloud Connector Edition VMs PSTN WARING: This scenario is not support and not possible. The external Access Edge DNS name must be UNIQUE across Office 365 tenants With Skype for Business Microsoft called back the multi-tenant pack for hoster s. Therefore, this environment enabling configuration splits is not available any longer and there is no way right now supporting CCE at those scenarios. If you need a model where multiple parties (tenants) are supported, you have to deploy CCE in parallel for each tenant one and run this in the hosters datacenter dedicated.

11 Cloud Connector Active Directory Forest In any hybrid scenario the users are either one- or two way 2 (password sync) synched between On- Premise and Azure AD in Office 365, while in two-way password sync the affected users MUST be administered from the On-Premise AD only! On Premise Office 365 with Azure AD User Azure AD Sync (DirSync) Users AD Next we are having look into the scenario where the an On-Premise Active Directory is present. The standard method in Office 365 is the Azure AD Sync (DirSync) to the cloud. Now with the Cloud Connector installed, the AD Forrest created on the CCE is different and as said independent, totally different forest and is in no relationship with the On-Premise Active Directory (also NO TRUSTS). On Premise Office 365 with Azure AD User Azure AD Sync (DirSync) Users AD CCE AD Cloud Connector Edition VMs All users must be on Exchange Online, incl. UM 2 Azure AD user two-way sync is not supported jet (May 2016)

12 Cloud Connector (CCE) Topologies Outbound Call Flow In written in the last chapter, we discussed the Active Directory topologies. Now we have a look into the Cloud Connector topologies deployment. The topologies include high availability and site based definitions. First we have look into the SIP Signaling and the Media Path at the beginning. The Media Path is defined as the client to Mediation Server or gateway connectivity. User Domain Controller On-Premise/ internal Network Cloud Connector Site Office 365 including Skype for Business Online (E5 Plan) Skype for Business Online With Cloud PBX SIP PBX or Provider Gateway Mediation Edge Users DC and CA CMS PSTN Skype for Business user on internal network MEDIA SIP Signaling Signaling can be seen as functionality of the Cloud PBX feature, therefore we can understand that the path must be from the device to the Cloud PBX (Skype for Business Online) and from there to the Mediation Server component, via the Edge Server. This is identically with any other form of deployments. Not fully visualized is the SIP flow in detail, but as the Access Edge component must be involving all time, the signaling flies from the client internally to the Cloud PBX -> back to Access Edge -> than to the Mediation Server. Media instead was defined as either to the Mediation Server or with Media By-Pass to the gateway directly if we have full on-premise deployment. Now at point of writing this guide, the Media By-Pass feature is not available with the CCE, but might be in later updates implemented. (This is different with the on-premise deployment). The Media (AV) runs from internal client directly to the Mediation Server and for external clients to the Edge AV -> Mediation Server -> PSTN Gateway. Some requirements are subject to consider: - Per PSTN breakout at least one Cloud Connector Edition is required - A single CCE instance can support up to 500 concurrent calls - A maximum number of 4 (3+1) CCE can be deployed per PSTN breakout refers to 3 CCE for scalability and +1 for high availability Note: If the maximum number of PSTN call is higher than 3x500 = 1500, you can deploy another site in parallel to the existing one.

13 Inbound Call Flow The first example provided here is you outgoing calls. If you want to know the incoming call SIP and AV flow, you can simply reverse the description. Where the SIP Signaling will send from the Mediation Server to the Edge, to the Cloud to the user as provide in the next illustration. User Domain Controller On-Premise/ internal network Cloud Connector Site Office 365 including Skype for Business Online (E5 Plan) Skype for Business Online With Cloud PBX SIP PBX or Provider Gateway Mediation Edge Users DC and CA CMS PSTN Skype for Business user on internal network MEDIA SIP Signaling This is a simplified scenario, where only a single CCE site is configured. The configuration for a single site CCE doesn t require any specialized configuration and is working with the default settings in Office 365.

14 CCE SBA in planning: Since the hardware spec s are tremendous, I asked for other options which make the solution having a better RoI, especially for smaller sites and customers. As we remember from OCS/ Lync and SfB, the on-premise solution offers Survival Branch Appliances (SBA), a system design with an embedded SfB Server, integrating the Mediation Server and minimalistic Frontend Server, the Registrar only. It enables customer still making and receiving calls if a WAN failure occurs between the SBA location and the central SfB pool. Authentication for users is handled by User Communication MTLS certificate. If we have deeper look into the CCE, it looks similar, beside we need authentication integrated for servers, which handles the integrated Active Director Domain Controller. Mediation server for Audio transcoding and a smaller dedicated topology database the minimalistic CMS and component for connections to the Office 365 SfB Online tenant, the Access Edge Server. As we see this similarity creates this possibility for SBA CCE. On Premise (SITE LONDON) Office 365 including Skype for Business Online (E5 Plan) User Cloud Connector Edition VMs on Sonus SBA CCE Users Cloud PBX PSTN Right now AudioCodes by today has announced the Mediant 800 and 1000 for those deployment possibly. Same with Sonus 1000 and Both vendors also offer a virtual appliance. Note: Please if you run virtual appliances, SIP best works on dedicated host. If you share resources, please ensure the performance required for SIP can be archived.

15 High Availability: In the same way we must calculate the SLA / availability of single site. You can archive 99.9% availability by running a 2+2 setup. 99.8% is archived by either 1+1 or 3+1, which differs only in the maximum concurrent call volume. Multi-Site deployment If we have multiple sites deployed, the signaling stays the same. We only have the Cloud PBX feature in Office 365, so all initial communication has to go into the cloud first. We will have a look into the both sites MUNICH and LONDON. The both site have different breakouts and here it comes: the setup If the target phone number can t be resolved through internal Reverse Number Lookup (RNL), it is defined as a PSTN call. Therefor the Voice Routes are taken into the loop. The next chapter will explain how Voice Routing with CloudPBX and CCE is working. Which in the first case Munich, a German location, the client than established the Media Path through the Mediation Server component associated with Munich Site. On Premise (SITE MUNICH) CCE Office 365 including Skype for Business Online (E5 Plan) User Mediation Edge SIP PBX or Provider Gateway DC and CA CMS Cloud Connector Edition VMs Users PSTN On Premise (SITE LONDON) Call to: CCE User Mediation Edge DC and CA CMS SIP PBX or Provider Gateway Cloud Connector Edition VMs MEDIA SIP Signaling

16 The next example will explain the call routing via the second Site London. Assuming the another client initiates a call to a UK phone number and it is identified as such. Now signaling has to follow the preferred Access Edge server for the CCE Site identified, which is NOT the initial site in Munich, it is the second site in London. After the Session Initiate (INVITE) the SDN parameters will tell the client that from the Voice Routes chosen Mediation Server component, which is London and the Media Path will be established from the Client -> London Mediation Server -> London Gateway -> PSTN On Premise (SITE MUNICH) CCE Office 365 including Skype for Business Online (E5 Plan) User Mediation Edge SIP PBX or Provider Gateway DC and CA CMS Cloud Connector Edition VMs Users On Premise (SITE LONDON) Call to: CCE User Mediation Edge SIP PBX or Provider Gateway DC and CA CMS Cloud Connector Edition VMs MEDIA SIP Signaling PSTN Note: With on-premise ACP (Audio Conferencing PSTN) it stays similar, only that the conferencing component in the Cloud will connect directly to the on-premise Cloud Connector Mediation Server component, via Edge server. And I remind again, ACP on-premise and cloud conferencing is not possible to be combined.

17 CCE Voice Routing with multi-site (generics) A Cloud Connector Edition with CloudPBX in Office 365 do not support the CSVoiceRoute cmdlet. A least cost routing or destination routing cannot be archived with CCE! So question is how we can archive that different user can use different CCE Sites and have therefore different PSTN breakouts assigned? We step into a simple two site deployment which allows us replicating the principal to lager designs with N-Sites. Important to us is the generic understanding enabling us to go further and deploy environments as your customer requires. I have chosen two locations, one in Germany/ Munich and the other one in UK/ London. Both sites have their own, dedicated PSTN breakout. It will not matter if we connect the PSTN site to the gateways a ISDN/PRI or as a SIP Trunk. Behind the local site gateway is can also be PBX. For best understanding, two users a selected with should be associated with the two given sites. Aside, as Media Bypass is not available, the user can be inside the customer s LAN and the connection to the Mediation Server could be a direct connect if the firewall rules allow this path. In the provided scenario here, the users are positioned on the Internet. PSTN based calls can generally flow in to directions, from PSTN -> CloudPBX user or from the CloudPBX user -> PSTN. The simplest call flow is the incoming call from PSTN -> CloudPBX. Every CCE has its direct connection/ path to the Office 365 Skype for Business online platform. Therefore, every incoming call will be signalized to the CloudPBX directly. There are no other logical or technical considerations. For outgoing calls it is much different. We need to provide a mechanism deciding for destination where the call should route too. In our example either Munich or London. The illustration provides this call flow for outgoing calls. Showing the SIP Signaling and the MEDIA Path. We keep in mind that Signaling starts before the Media. Assuming we have two users, User A and User B. User A is associated with MUNICH User B is associated with LONDON First CCE Site is called GERMANY Second CCE Site is called UK Providing the technical overview about the described CCE Multi-Site deployment and showing the outgoing Call Flow for users associated with different CCE sites. It can be seen as an overlaying illustration from the both drawing before.

18 New-CsHybridPstnSite -Identity GERMANY -EdgeFQDN EDGEDE01.SIPDOMAIN.COM On Premise (SITE MUNICH) CCE Office 365 including Skype for Business Online (E5 Plan) CloudPBX User Mediation Edge EDGEDE01.SIPDOMAIN.COM SIP PBX or Provider Gateway DC and CA CMS Cloud Connector Edition VMs Online Users PSTN New-CsHybridPstnSite -Identity UK -EdgeFQDN EDGEUK01.SIPDOMAIN.COM On Premise (SITE LONDON) User Mediation CCE Edge EDGEUK01.SIPDOMAIN.COM User A /Site Germany Call to: User B /Site UK Call to: DC and CA CMS Set-CsUserPstnSettings - Identity UserA - HybridPSTNSite GERMANY - AllowInternationalCalls $true Set-CsUserPstnSettings - Identity UserB - HybridPSTNSite UK - AllowInternationalCalls $true SIP PBX or Provider Gateway Cloud Connector Edition VMs MEDIA SIP Signaling MEDIA SIP Signaling PSTN Interestingly and not surprising that calls will flow always through the users CCE site associated with. This is because with CloudPBX and CCE no Voice Routes can be defined. A side, incoming calls, regardless how, as long the CCE local setup can recognize this call, will be send to the CloudPBX, which then through RNL knows which user should be addressed. Normalization for this incoming call scenario can be provided on the PSTN/ SIP Trunk gateway. The next chapter will guide us through the CloudPBX site setup and user site assignment.

19 CCE Voice Routing on gateways (optional) not yet supported by Microsoft The following idea is great and simple option and working fine for geographical region with is in close range. In this scenario, the PSTN/ SIP Trunk Gateway behind the CCE will handle the call routing. If you are trying to deploy this idea over far distance location, remember: WARNING: The user making call for and to the far region, saying in this scenario, the user is in Malaysia, his call will flow from client -> CCE -Y local CCE gateway -> far distance gateway. IF you see this round trip, it might easily extend 650ms. So the call experience will be quite bad. On the other hand, for locations in close range it is a suitable and cost effective solution. New-CsHybridPstnSite not required, as the CCE setup stay in its default configuration! On Premise (SITE MUNICH) CCE Office 365 including Skype for Business Online (E5 Plan) CloudPBX User Mediation Edge EDGEDE01.SIPDOMAIN.COM PSTN SIP PBX or Provider Gateway DC and CA CMS Cloud Connector Edition VMs Online Users On Premise (SITE TORONTO) User Users in Toronto can be threated as users from Germany, since Germany provides the SIP Trunk with Canadian number range On Premise (SITE MALAYSIA) User A /Site Germany Call to: User B /Site MALAYSIA Call to: PSTN Set-CsUserPstnSettings no site configuration necessary SIP PBX or Provider Gateway User If in close range possible solution MEDIA SIP Signaling MEDIA SIP Signaling I repeat again, if Malaysia would be replaced by e.g. Austria this solution is really possible and very much cost effective. While a call round trip might be below 100ms in given case.

20 Migration to Cloud PBX with Cloud Connector Edition Migration can be quite tricky. We have multiple scenarios from where we can move towards the CloudPBX with CCE. I try describing the most common scenarios and discuss possible difficulties. Starting with a greenfield setup; the other possible migration scenarios require at least an Office 365 deployment and Skype for Business setups Note: This section of the CCE guide will be continuously updated and we hope seeing a lot of changes coming. Greenfield What does greenfield mean? Assuming you didn t run any LSC, OCS, Lync or Skype for Business software in your on-premise during the past and want to make use of the actual release of Microsoft Unified Communication software. You simply activate an Office 365 tenant and enable the Cloud users for Skype for Business there. Once you have the enabled you start rolling out CCE s into your locations where you have the PSTN breakout and or having PBX systems ready for migration. Most likely in this scenario, you will have a PBX system in place. This can any classic PBX like Avaya, Lucent or others, as well you could operate other UC software, like Cisco CUCM or others. If you want to migrate, here is the scenario First you place an PSTN Gateway in-between your PSTN breakout and your PBX. If you do so with, it will be after the insert fully transparent. This is helpful, because you do not yet have any Office 365 Skype for Business Online user activated for enterprise voice. Well, I assume you have the online Dial Plans and Voice Policies ready The next step will be phone number migration. You configure the identical phone number a user has on the classic PBX now in Office 365. Three migration step s run in parallel: - Configuring the GATEWAY pointing this dedicated number to the CCE (Cloud PBX) - Removing the phone number and user from the PBX and define this number to be directed externally. (From here the gateway can pick up the call from the PBX and direct it to the CCE) - Now activating the Office 365 user for Cloud PBX with same phone number as he was assigned on the classic PBX

21 On Premise (SITE LONDON) User AD Gateway Azure AD Sync (DirSync) CCE Azure AD Connect On-Premise User Sync to Office 365 Office 365 including Skype for Business Online (E5 Plan) Call Routing destination based routing Mediation DC and CA Edge CMS Cloud Connector Edition VMs Users Cloud PBX PSTN Audio Conferencing Provider Microsoft Brigde PSTN Phone Number Migration to Cloud PBX with CCE All users must be on Exchange Online, incl. UM Note: Some PBX are having head number reservation configuration. Meaning, a dedicated number range is reserved by the PBX and call within this range can t be routed outside the PBX. If this is the case, contact your vendor and find a workaround, e.g. shrinking the head number, or define face numbers in the PBX, which are than masked on the gateway. Skype for Business with Enterprise Voice on-premise Simply I have to state: If you need Skype for Business on-premise Voice and can t move to the Cloud PBX + CCE yet, you have to consider a classic SfB hybrid solution utilizing pools, sites and SBA s. Still benefiting from the Meeting Broadcasts and e.g. Microsoft s upcoming ACP for PSTN conferencing. This lets you RoI increase and you might be able in the near future consolidating your on-premise deployment. Target: native Cloud Connector Edition Moving towards native Cloud PBX with CCE s only. Since we can see the not supported setup below, there is only one possible solution. You have to move all SfB users to SfB online first. From here you can deploy the CCE after you have fully decommission the SfB on-premise setup. This is not a scenario you link to offer to larger customer. But Microsoft is working on a solution. And I keep you updating towards this scenario. Target: Cloud Connector Edition with Office 365 Calling Plan (Cloud Voice Users) Not Supported!

22 Target: Cloud Connector Edition + Skype for Business partial Enterprise Voice (on-premise) If a Skype for Business or Lync deployment on-premise is present, you cannot add a CCE into this setup. The only option here is, move all users to the Cloud Office 365, decommission the on-premise SfB system and only than you can start using a Cloud Connector Edition. On Premise full Skype for Business deployment (MUNICH) Edge Office 365 including Skype for Business Online (E5 Plan) SIP PBX or Provider Gateway User Skype for Business Reverse Proxy Users Cloud PBX PSTN CCE (SITE LONDON) CCE PSTN Mediation Edge Not supported! SIP PBX or Provider Gateway DC and CA CMS Cloud Connector Edition VMs NOT SUPPORTED If On-Premise Skype for Business is present Target: Cloud Connector Edition + Office 365 Calling Plan (Cloud Voice Users) + Skype for Business partial Enterprise Voice (on-premise) Not supported!

23 Summary: Write a summary isn t that easy yet. As a result, out of the information above, I can highlight you should dig into the CCE setup soonest. For greenfield customers and for those where one shot migration can be considering, the benefit is huge of utilizing CCE deployments. If a smooth migration is required, where on-premise Skype for Business is present, there is right now no way of coping this task. You have to wait until some later releases Microsoft is coming up with. But again, if an on-premise, classic PBX is present, well please consider the CCE setup. It is a straight forward task for migration and it quite simple moving all users into the Cloud, especially if you only utilize the presence, IM and AV p2p and conferencing services. The enhancement with enterprise voice can be seen a next task in enhancing the services and user experience.

24 Infrastructure requirements for Cloud Connector Edition Physical infrastructure Looking at hardware and the components involved in the Cloud Connector. It will be delivered in setup of Hyper-V Virtual Machines (VM) only. Each VM contains the featured server role from Skype for Business. It is a provide download by Microsoft and will unpack itself, then start pulling the VMs, while once we have started the deployment, an unattended setup will do everything for you, from installing and configuring the VM include the VM Net not to be forgotten the Domain Controller, AD and the Skype for Business components. This are 4 VM s which require a dedicated physical host with a minimum of: - 64 bit dual CPU, six core (12 real core) a 2.5 GHz or higher - 64 GB RAM - 4x 600 GB 10k RPM 128MB Cache SAS 6Gbps Disks in RAID 5-3x 1 Gbps network adapter Recommended are at least 2 PSTN Gateway for redundancy. Azure Express Route between the sites and Office 365 are recommended too, just I personally want to see them mandatory. As you need to ensure high quality and reliable networks. If you run your own ACP, meaning offering your personal conferencing dial-in numbers on your CCE. Audio is send from the Skype for Business Online conferencing MCU down and forth to your CCE. This requires the QoS being integrated in your network including the Office 365 tenant. Note: At point of writing this article it is in consideration of smaller physical servers if you have to support less users and it will be confirmed soon.

25 Logical infrastructure DNS DNS access is required externally for the Access Edge Server and the Media Relay (Audio), Video is not implemented for local breakouts. It must be ensured, the internal CCE servers can resolve internal DNS names and the Access Edge component via external DNS too. Therefor the Access Edge should resolve DNS externally and have a host file for internal DNS resolving (C:\Windows\System32\drivers\hosts) Note: (onmicrosoft.com DNS suffix external tenant is not supported!) External DNS entries for CCE(also used for certificates): Access Edge: e.g. ACCESS.SIPDOMAIN.COM Media Relay: e.g. MEDIA.SIPDOMAIN.COM Cloud Connector Edition Setup (DNS) Mediation CMS HOSTS INTERNET Edge DC and DNS Note: All other DNS records necessary for internal network and external (internet) stay unchanged for Office 365 deployments

26 Certificates externally Note: Wildcard is supported as SN=SIP.SIPDOMAIN, SAN=SIP.SIPDOMAIN.COM + SAN=*.SIPDOMAIN.COM Single CCE Site: Additional to DNS entries, we require public signed SAN Certificate in the form of: SN/ CN ACCESSPOOL.SIPDOMAIN.COM Single CCE SITE either single CCE or Pool ed CCE SAN ACCESSPOOL.SIPDOMAIN.COM SAN SIP.SIPDOMAIN.COM Note: Similar with a well-known on-premise deployment for Edge Servers, the principals are identically. If an Edge Pool is used, you need to address the external Pool Name with HLB or DNS LB, else if it is a single server, you only need the server name. Single CCE Site with multiple SIP Domains: If you have multiple SIP Domain registered with Office 365 SN/ CN ACCESSPOOL.SIPDOMAIN.COM SAN ACCESSPOOL.SIPDOMAIN.COM SAN ACCESSPOOL.SIPDOMAIN-B.COM SAN SIP.SIPDOMAIN.COM 1 st SIP Domain SAN SIP.SIPDOMAIN-B.COM 2 nd SIP Domain SAN ACCESSPOOL.SIPDOMAIN-B.COM Multi-Site CCE with multiple SIP Domains: If you have multiple SIP Domain registered with Office 365 and using multiple CCE Sites. SN/ CN ACCESSPOOL1.SIPDOMAIN.COM SAN SIP.SIPDOMAIN.COM SAN SIP.SIPDOMAIN-B.COM SAN ACCESSPOOL1.SIPDOMAIN.COM 1 st CCE Site SIP Domain 1 SAN ACCESSPOOL2.SIPDOMAIN.COM 2 nd CCE Site SIP Domain 1 SAN ACCESSPOOL1.SIPDOMAIN-B.COM 1 st CCE Site -SIP Domain 2 SAN ACCESSPOOL2.SIPDOMAIN-B.COM 2 nd CCE Site SIP Domain 2

27 Certificates internally As usual, all internal Servers beside the Domain Controller require certificates, which can be either private certificates or externally signed. Generally, a CA is installed with the CCE automated setup and the certificate can be generated based on this CA. The Member Servers are domain joint with the CCE AD Forrest, the Root Certificates are propagated automatically. With the Edge component you have to import the Root Certificate for the internal site of the Edge. CMS (Primary or Backup) VM(s) require default certificate with server FQDN as the subject name. Mediation Server VM(s) require default certificate with Mediation Server Pool FQDN as the subject name. A single certificate can be used across all mediation server VMs, or each VM can use its own certificate as long as all of them have the pool FQDN in the subject name. Edge VM(s) Require internal certificate with Edge Server internal pool FQDN as the subject name. A single certificate can be used across all edge server VMs or each VM can use its own certificate as long as all of them have internal pool FQDN in the subject name. Note: Do not forget importing the Root CA Certificates if you are going to use internal/ private certificates.

28 Firewall Port Configuration 3 Internal firewall Source IP Destination IP Source Port Destination Port Cloud Connector Mediation SBC/PSTN Gateway Any TCP 5060** component SBC/PSTN Gateway Cloud Connector Mediation component Any TCP 5068/ TLS 5067 Cloud Connector Mediation component Internal clients * TCP 50,000-50,019 Cloud Connector Mediation component Internal clients * UDP 50,000-50,019 Internal clients Cloud Connector Mediation component TCP 50,000-50, * Internal clients Cloud Connector Mediation UDP 50, * component 50,019 * This is the default port range on the Mediation component. For optimal call flow, four ports per call are required. ** This port should be configured on the SBC/PSTN gateway; 5060 is an example. You can configure other ports on your SBC/PSTN gateway. External firewall - minimum configuration Source IP Destination IP Source port Destination port Any Cloud Connector Edge External Any TCP 5061 Interface Cloud Connector Edge Any UDP 3478 UDP 3478 External Interface Any Cloud Connector Edge External TCP 50,000- TCP 443 Interface 59,999 Any Cloud Connector Edge External Interface UDP 3478 UDP 3478 Cloud Connector Edge External Interface Any TCP 50,000-59,999 TCP 443 External firewall - recommended configuration Source IP Destination IP Source Port Destination Port Any Cloud Connector Edge Any TCP 5061 External Interface Cloud Connector Edge Any TCP 50,000-59,999 any External Interface Cloud Connector Edge Any UDP 3478; UDP any External Interface 50,000-59,999 Any Cloud Connector Edge External Interface Any TCP 443; TCP 50,000-59,999 Any Cloud Connector Edge External Interface Any UDP 3478; UDP 50,000-59,999 3 Taken from Technet

29 Configuration Guide for Users, Dial-Plans, Voice Routes and PSTN Usage This chapter covers the view for Cloud Connector Edition Setup only! Just aside, don t forget assigning an Office 365 license to the before you enable a user for Skype for Business online. Connect to Skype for Business Online Business Online Connector (Windows PowerShell module) can be download from: the download center. Further information: Configuring your computer for Skype for Business Online management. Import-Module skypeonlineconnector $cred = Get-Credential $Session = New-CsOnlineSession -Credential $cred -Verbose Import-PSSession $session Get-CsTenant Select-Object TenantId

30 CCE Site generation and assignment This chapter follows the logic process by site generation and then user site assignment. Let s start with this configuration. CCE Site creation We must now create e.g. two CCE Sites in Skype for Business online GERMANY and UK. New-CsHybridPstnSite -Identity GERMANY -EdgeFQDN EDGEDE01.SIPDOMAIN.COM New-CsHybridPstnSite -Identity UK -EdgeFQDN EDGEUK01.SIPDOMAIN.COM This is the first step archiving the routing for associated user to the two different CCE Sites. Verifying the CCE Site setting will be archived with: Get-CsHybridPstnSite Management Guide for Users The Set-CsUser command is used for both sites, On-Premise as well as the Skype for Business Online version. For better understanding I highlight how this command will be used for differentiation. But nevertheless, I highly recommend not using a Skype for Business Management Shell delivered with Skype for Business On-Premise configuring Skype for Business Online in Office 365. Rather this, use the standard PowerShell and import the skypeonlineconnector in a standalone setup, so none of the On-Premise cmdlets are visible nor usable. It is important to understand, a user for Skype for Business cannot be simply created. Rather the user must be created either in Office 365 (Azure AD) or needs to be created in your On-Premise AD and then synced to Office 365 (Azure AD). From here you can enable a user for Skype for Business Online, or you can modify his parameter.

31 Moving a User to Skype for Business Online Remind: CCE and SfB On-Premise cannot co-exist. Therefore, this is a task you must do before you decommission SfB On-Premise and install a CCE. Run the following commands from your On-Premise deployment. $creds=get-credential (provide Office 365 admin credentials) Move-CsUser -Identity Hanse the Bayer -Target sipfed.online.lync.com - Credential $creds -HostedMigrationOverrideUrl <URL> The format of the URL: FQDN>/HostedMigration/hostedmigrationService.svc. You can determine the URL to the Hosted Migration Service by viewing the URL for the Skype for Business Online Admin center for your Office 365 tenant account. Note: The URL is case sensitive To determine the Hosted Migration Service URL for your Office 365 tenant 1. Login to your Office 365 tenant as an administrator. 2. Open the Skype for Business admin center. 3. With the Skype for Business admin center displayed, select and copy the URL in the address bar up to lync.com. An example URL looks similar to the following: 4. Replace webdir in the URL with admin, resulting in the following: 5. Append the following string to the URL: /HostedMigration/hostedmigrationService.svc. The resulting URL, which is the value of the HostedMigrationOverrideUrl, should look like the following: e.svc

32 CCE User to Site assignment Next step is associating the both users to their respective CCE Site. Prerequisite: Those users must be enabled for Skype for Business online prior to the Site assigment. With the Set-CsUserPstnSetting cmdlet you can define the CCE Site the user must use for his entire PSTN calls. Or in other words, this you can only make calls via the assigned CCE Site. Set-CsUserPstnSettings -Identity UserA -HybridPSTNSite GERMANY - AllowInternationalCalls $true Set-CsUserPstnSettings -Identity UserB -HybridPSTNSite UK - AllowInternationalCalls $true The option for AllowInternationalCalls enables this user for international call via the assigned location. All other important configuration, e.g. assigning a E.164 phone number require the Online associated Set-CsUser command. Set-CsUser is the only command available for on-premise and cloud configuration. Set-CsUser -Identity UserCanada -HostedVoic $true -OnPremlineURI tel: EnterpriseVoiceEnabled $true

33 Coming to the CsOnlineVoiceUser command, where we can assign a -Telephonnumber, just as side, it is only for users not assigned to any On-Premise PSTN breakout. Set-CsOnlineVoiceUser (You must be enabled for PSTN Calling Service,, else cmdlet fails)

34 Configuration Guide for Dial-Plans Depending on the location, where your tenant is located, several DialPlan will exist. A DialPlan is a default configuration provided within the Office 365 Skype for Business Online environment and cannot be modified or added. You assign a DialPlan e.g. like here while you enabled a user for the E5 CloudPBX plan. The example here is from an US tenant and show you the DialPlan for Indianapolis. Get-CsDialPlan -Identity "IN"

35 Configuration Guide for Voice Routes Generally, Voice Routes are NOT available with Office 365 Skype for Business Online. If you are using CloudPBX with CCE, as describe in the guide, Voice Routes are dedicated routes along with the CCE Site configuration. Users which are assigned to a CloudPBX (Voice Hybrid PSTN Site), have a Voice Route dedicated route to the CCE associated with this site. All calls made by this user are fixed routed to this PSTN site and its gateway. The opposite site, where a call is made to an CloudPBX user can enter the CCE sites where ever this call is received. This in particular is important, if you have still local PBX s configurator and active in your environment.

36 Appendix Commandlets for Online configuration Skype for Business Online hast several cmdlets with the online Module will import. It s Important to understand you have to use different command for PSTN Calling and PSTN Hybrid configuration. One command is not listed under TechNet, the Get-CsOnlineUser, this cmdlet list all Skype for Business enabled online user, but has no equivalent as Set or Delete. This guide focus on the Cloud Connector Edition, therefore, it is relevant to the hybrid configuration and not to PSTN Calling. Dial-in conferencing cmdlets Disable-CsOnlineDialInConferencingUser Enable-CsOnlineDialInConferencingUser Get-CsOnlineDialInConferencingBridge Get-CsOnlineDialInConferencingLanguagesSupported Get-CsOnlineDialInConferencingUser Get-CsOnlineDialInConferencingServiceNumber Set-CsOnlineDialInConferencingBridge Set-CsOnlineDialInConferencingServiceNumber Set-CsOnlineDialInConferencingUser Get-CsOnlineDialinConferencingTenantConfiguration Get-CsOnlineDialInConferencingTenantSettings Set-CsOnlineDialInConferencingTenantSettings Remove-CsOnlineDialInConferencingTenantSettings E911 and Location Information Service (LIS) cmdlets New-CsOnlineLisCivicAddress Get-CsOnlineLisCivicAddress Set-CsOnlineLisCivicAddress Remove-CsOnlineLisCivicAddress Test-CsOnlineLisCivicAddress New-CsOnlineLisLocation Set-CsOnlineLisLocation Get-CsOnlineLisLocation Remove-CsOnlineLisLocation Get-CsOnlineEnhancedEmergencyServiceDisclaimer Set-CsOnlineEnhancedEmergencyServiceDisclaimer Skype Meeting Broadcast cmdlets Get-CsBroadcastMeetingConfiguration Set-CsBroadcastMeetingConfiguration Get-CsBroadcastMeetingPolicy Grant-CsBroadcastMeetingPolicy PSTN calling cmdlets Get-CsOnlineTelephoneNumber

37 Remove-CsOnlineTelephoneNumber Get-CsOnlineTelephoneNumberInventoryAreas Get-CsOnlineTelephoneNumberInventoryCities Get-CsOnlineTelephoneNumberInventoryCountries Get-CsOnlineTelephoneNumberInventoryTypes Get-CsOnlineTelephoneNumberInventoryRegions Search-CsOnlineTelephoneNumberInventory Clear-CsOnlineTelephoneNumberReservation Select-CsOnlineTelephoneNumberInventory Set-CsOnlineVoiceUser Get-CsOnlineVoiceUser Get-CsOnlineDirectoryTenantNumberCities Get-CsOnlineTelephoneNumberAvailableCount Get-CsOnlineTelephoneNumberReservationsInformation Get-CsVoiceRoutingPolicy Grant-CsVoiceRoutingPolicy Set-CsUser Hybrid PSTN site and user cmdlets Get-CsHybridPstnSite Set-CsHybridPstnSite New-CsHybridPstnSite Remove-CsHybridPstnSite Get-CsUserPstnSettings Set-CsUserPstnSettings WARNING BUG in this cmdlet (internal/ external WS URL is cross linked and one is empty) might be corrected upon later bug fixes. Get-CsTenantHybridConfiguration Set-CsTenantHybridConfiguration DESCRIPTION In a hybrid or "split domain" deployment, an organization has some users who have accounts homed on Skype for Business Online while simultaneously having other users who have accounts homed on the on-premises version of Skype for Business Server By default, users homed on Skype for Business Online do not have access to the complete range of capabilities offered by Enterprise Voice; that's because the Skype for Business Server 2015 servers do not have direct access to Skype for Business Online deployment and network configuration information. Among other things, Skype for Business Online users do not have default access to such things as: * Enhanced 9-1-1, the service used for making emergency phone calls. * Call parking, the service that enables users to place a call on hold phone A, then retrieve that call from phone B. * Media bypass, which enables calls to and from the public switched telephone network (PSTN) to bypass the Mediation server, helping to minimize transcoding and network latency. * PSTN conferencing dial-in and dial-out, which enables users to participate in the audio portion of an online conference by using any PSTN telephone or mobile device. * The Response Group application, which provides a way for you to automatically route phone calls to entities such as a help desk or customer support line. By default, Skype for Business Online users cannot function as Response Group agents.

38 Internet Protocol (IP) phone cmdlets Get-CsIPPhonePolicy Set-CsIPPhonePolicy Grant-CsIPPhonePolicy Reporting cmdlets Get-CsUserSession Get-CsActiveUserReport Get-CsP2PSessionReport Get-CsConferenceReport Get-CsP2PAVTimeReport Get-CsAVConferenceTimeReport Get-CsClientDeviceReport Get-CsClientDeviceDetailReport Get-CsUserActivitiesReport Online User cmdlets Get-CsOnlineUser

39 Reading/ Writing Users Information and Settings First I m providing a look into a Skype for Business enabled account. Once we work with Skype for Business Online, the well-known on-premise commands are working. Therefore, Get-CsUser must be replaced with Get-CsOnlineUser for example. Writing user and changing setting, requires you to do this online from the Admin Center. WARNING: The Set-CsUser cmdlet is also included in the set of cmdlets available to Skype for Business Online administrators. However, Set-CsUser cannot currently be used to manage Skype for Business Online, except for setting the AudioVideoDisabled parameter. If you attempt to run the cmdlet with any other parameter, it will fail along with an error message similar to this: Unable to set SipAddress. This parameter is restricted within Remote Tenant PowerShell. RunspaceId : 48be2d0c-e576-4bd2-8b b36b31d7 UserAccountControl : PasswordNotRequired, NormalAccount Id : CountryAbbreviation : DE CountryOrRegionDisplayName : DE CN=f78c85ba-87a0-44f0-aeb b7de4c9,OU=59b603a2-4e54-4ea6-9aa9-47ba33ed9dc3,OU= OCS Tenants,DC=lync1e001,DC=local Company : Westcon Group Germany - UCC Department : Description : {} Fax : HomePhone : IPPhone : City : Bad Wiessee Manager : MobilePhone : OriginatorSid : OtherTelephone : {} Office : PostalCode : PreferredLanguage : en-us Puid : 10033FFF8CF2C01B StateOrProvince : Bayern