MigrationWiz Enterprise Coexistence

Transcription

1 MigrationWiz Enterprise Coexistence

2 Table of Contents Document versions... 3 Overview... 4 Project Flow... 6 Prerequisites... 7 Server Requirements... 7 Certificate requirements... 7 Administrator requirements... 7 Source and Destination systems... 8 Supportability Matrix... 8 Microsoft Azure Active Directory Sync... 8 Configure Microsoft AAD Sync... 9 MigrationWiz SDK Windows Azure Active Directory Module for Windows PowerShell Config.xml file Migration Waves Prerequisites Check list Executing the MigrationWiz Enterprise Coexistence Scripts Scripts execution order and recurrence Phase 1 - MWEC-Phase1-PrepareCoexistence.ps Prepare the On Premises AD Prepare On Premises Exchange Prepare Office Configure MigrationWiz Project Post-Script tests Phase 2 MWEC-Phase2-InitiateBatch.ps On-Premises AD Office

3 MigrationWiz Phase 3 MWEC-Phase3-MonitorPreStage.ps MigrationWiz Phase 4 MWEC-Phase4-FinalSync.ps MigrationWiz Phase 5 MWEC-Phase5-FinalizeBatch.ps MigrationWiz Office On Premises Exchange MigrationWiz Configure Deployment Pro GPO (Manual) Document versions The version of this document should be matched with the version of the scripts. Any changes made on the scripts that trigger a version change should be matched on a new version of this document. Make sure you are looking at the correct version. Date Version Author 8/17/ Antonio Vargas 9/18/ Antonio Vargas 11/08/ Antonio Vargas

4 Overview Too often companies purchase Office 365 as part of a Microsoft EA agreement but do not deploy it. CIOs have hundreds of on-going initiatives and don t want to distract their IT department with yet another initiative, especially if their existing system works today. The traditional Partner strategy to migrate a CAM/CTM customer with On-Premises Exchange to Office 365 is often to deploy hybrid. However, hybrid can be extremely time-consuming and intrusive to get set up, and in some cases, can be very difficult to remove once the migration has been completed. However, if we can simplify and accelerate the process with minimal disruption to the IT organization, this may unblock the move. Once customers are in Office 365, there are a significant number of cloud-based cross-sell/upsell opportunities for the Partner who is now their trusted advisor. What if you could start migrating on Day 2, and migrate the first one hundred users to Office 365 in one to two weeks while maintaining and calendar coexistence? BitTitan has developed a solution to do just that. Once the first one hundred users are onboarded, and the customer sees that the process is painless to the users, the CIO will likely okay the full migration to be completed. Once the full mailbox migration is completed, the Partner can then sell other migration services, such as PST discovery/ migration, and document migration, as well as other added value services. From a Partner s perspective, 95% of the process is completely automated. Once the MigrationWiz Enterprise Coexistence solution is deployed, it will: Configure and calendar coexistence Automatically configure the projects in MigrationWiz Perform a first sync of the mailboxes Monitor the on-going migrations and act on errors Perform a Delta sync of the mailboxes Monitor the Delta sync and maintain appropriate mail flow for mailboxes when they complete Transition the users to Office 365 maintaining mail flow and free busy, as well as using the onpremises password via AADSync Automatically configure Outlook on the desktops to point to Office 365 (using DeploymentPro)

5

6 Project Flow

7 Prerequisites Server Requirements The server requirements to run the MigrationWiz Enterprise Coexistence scripts are: Virtual Machine with Windows Server 2012 and 8GB of RAM (Domain Joined) Microsoft Azure Active Directory Sync MigrationWiz SDK Windows Azure Active Directory Module for Windows PowerShell Windows Management Framework 4.0 (that includes PowerShell 4.0) Microsoft.Net Framework 3.5 Certificate requirements MigrationWiz is a tool that does not require a public certificate to connect to the Source system and move the data, from the On-Premises Exchange to Office 365. However, one of the features of the MigrationWiz Enterprise Coexistence is the free/busy calendar coexistence that does require a public certificate on the On- Premises Exchange to work. With that in mind, and if you choose to take advantage of the free/busy lookups cross premises, a Unified Communications certificate is required on-premises, issued by a Public Certificate Authority on which the Office 365 Exchange Servers trust. The requirement for a Public certificate also applies if you choose to configure an SMTP over TLS mail flow pipe between the Exchange on premises and Office 365. Location Purpose Certificate Names Exchange Service Onpremises Onpremises Free/Busy Lookups Secure SMTP webmail.domain.com (Exchange Webservices external name) Autodiscover.domain.com Mail.domain.com (External name used for mail routing) IIS SMTP Description Certificate to allow free/busy lookups between Office 365 and the On- Premises Exchange Certificate to allow secure SMTP traffic from Office 365 to On-Premises Exchange All the names described above can be on the same UC certificate. Both services are optional, although having the free/busy lookups service is highly recommended, you might choose not to buy or have a public certificate and still use the MigrationWiz Enterprise Coexistence (without free/busy). Administrator requirements The following user permissions are required to successfully run the scripts:

8 System Platform User permissions Local Active Directory Active Directory Domain Administrator Microsoft Exchange on premises Exchange Organization Administrator Office 365 Office 365 Active Directory Global Admin Microsoft Exchange Online Exchange Organization Administrator MigrationWiz MigrationWiz MigrationWiz Account DNS Public DNS provider DNS Admin Source and Destination systems The MigrationWiz Enterprise Coexistence scripts support configuring the following Source systems: Existing Exchange to support mail coexistence only Existing Exchange 2010 SP2 + to support mail and calendar coexistence The scripts use the On-Premises Exchange management shell for several tasks, therefore Exchange 2003 is not supported. Only Exchange systems are supported as Source. The MigrationWiz Enterprise Coexistence scripts support only Exchange Online on Office 365 as Destination system. Supportability Matrix Features Source Destination Mail Flow Coexistence Microsoft Exchange Office 365 Exchange Online Free Busy and Mail Flow Coexistence Microsoft Exchange 2010 SP2+ Office 365 Exchange Online Microsoft Azure Active Directory Sync Using Microsoft Azure Active Directory Sync, as part of the MigrationWiz Enterprise Coexistence process, is mandatory. The AAD Sync tool will not only provide the password sync feature, but also be a requirement for the mail flow and free busy coexistence. Before configuring the AAD Sync Server the consultant needs to make sure that:

9 AAD Sync is installed on the same machine that will be used to run the MigrationWiz Enterprise Coexistence Scripts. Directory Synchronization is active on your Office 365 tenant. The on-premises UPN of your users matches the Office 365 UPN, and you have your Active Directory remediated. (click here for more information on how to prepare for directory synchronization) Make sure you do not run AAD Sync before you configure the tool. If you have run the tool, please contact the BitTitan support. Configure Microsoft AAD Sync Once you install the Microsoft AAD Sync, and before you run it for the first time, you need to configure attribute filtering. Follow the steps below: 1. Install Microsoft AAD Sync 2. Once the installation is finished, make sure you do not have the Synchronize now box selected. 3. Configure attribute filtering on AAD Sync Attribute Filtering Details The attribute filtering on AAD Sync should be configured so that only users with the extensionatributte15 AD attribute set to migrated are synced to Office 365. To achieve that, open the SyncRulesEditor and create the following: Inbound Synchronization Rule: Name: In From AD DoNotSyncFilter Connected System: <Your Local Domain> Connected System Object Type: User Metaverse Object Type: Person Link type: Join Precendence: 90 Scoping Filter: Attribute: extensionattribute15 Operator: NOTEQUAL Value: Migrated

10 Transformations: FlowType: Constant Target Attribute: CloudFiltered Source: True Distribution Group Filtering Once you configure AADSync, you should filter all your distribution groups at least until you run the MigrationWiz Enterprise Coexistence Script 1. Once that is executed, the groups can then be included on the AADSync scope and pushed to Office 365. Contact your BitTitan PTS if you need help filtering the Distribution Groups or syncing them to Office 365 via script. MigrationWiz SDK All the MigrationWiz Enterprise Coexistence scripts should be executed from the MigrationWiz PowerShell. To install the MigrationWiz PowerShell, follow the instructions in the Knowledge Base article How do I install the BitTitan SDK? Windows Azure Active Directory Module for Windows PowerShell It is also mandatory that you install the Windows Azure Active Directory Module for Windows PowerShell. To download the module, click here. Config.xml file Before running the scripts, you need to fill in the config.xml file (which contains all the configurations for the MigrationWiz Enterprise Coexistence scripts) with the following information: <Settings> <ExchangeVersion> <Version>2010 or 2013</Version> </ExchangeVersion> <MigrationWizSettings> <username>migrationwiz Username</username>

11 <password>migrationwiz Password</password> </MigrationWizSettings> <customerdomain>domain.com</customerdomain> <o365settings> <username>office 365 Administrator Username</username> <password>office 365 Administrator Password</password> <license>office 365 Account SKU ID</license> <usagelocation>office 365 Usage Location</usagelocation> <OnMicrosoftDomain>domain.onmicrosoft.com</OnMicrosoftDomain> <RoutingDomain>domain.mail.onmicrosoft.com</RoutingDomain> </o365settings> <onpremsettings> <url>exchange On premises OWA URL</url> <username>administrator on premises</username> <password>administrator on premises password</password> <powershell>exchange on premises PowerShell URL</powershell> <OUnit>OU with the on premises Exchange users with mailbox</ounit> <SmartHost>mail.domain.com</SmartHost> </onpremsettings> </Settings> Migration Waves For each migration wave, the consultant should create a CSV file with all the Source SMTP addresses of the users that will be migrated, as shown below: Note: The file name should be users.csv and the first row of the column should be named User.

12 Prerequisites Check list Follow the list below, to make sure you have all the prerequisites to run the MigrationWiz Enterprise Coexistence scripts. Step Action Instructions 1 Active Directory Readiness check for Office 365 Prepare AD for Office Prepare the server to run the scripts and AADSync Server Requirements 3 Make sure you have all the necessary admin users User Requirements 4 Install and configure the Microsoft Azure AAD Sync Configure Microsoft AAD Sync 5 Install MigrationWiz SDK MigrationWiz SDK 6 Install Windows Azure Active Directory Module Windows Azure AD Module 7 Prepare the config.xml file Config.xml file 8 Define Migration Waves Migration Waves Executing the MigrationWiz Enterprise Coexistence Scripts Once all the prerequisites are done, and both your Office 365 tenant and the on-premises Active Directory and Microsoft Exchange are ready for the integration, you can run all the MigrationWiz Enterprise Coexistence scripts. Scripts execution order and recurrence The table below provides you a high-level summary of all the scripts, the order you should follow when running them, the number of times you should execute them, and when you should do it: Order Script Recurrence When to run Description 1 MWEC-Phase1- PrepareCoexistence.ps1 Run Once After the pre requisites stage is done. Configures the coexistence and prepares the prerequisites for the migration batches.

13 2 MWEC-Phase2- InitiateBatch.ps1 Once Per Migration Batch After the coexistence scripts were executed successfully. Initiates the migration batch. 3 MWEC-Phase3- MonitorPreStage.ps1 As many times as needed until the pre-stage is done for all users on the batch 4 MWEC-Phase4-FinalSync.ps1 Once after the pre-stage and once before the cutover, per migration batch 5 MWEC-Phase5- FinalizeBatch.ps1 As many times as necessary to cutover all the users that had the full sync done After the batch is successfully initiated. After the prestage of the users is done. After the full sync is done. Moves the mailboxes with the pre-stage migration done to the next step. Starts the full sync before the cutover. Cuts over the users on the migration batch to Office 365. Phase 1 - MWEC-Phase1-PrepareCoexistence.ps1 The first script will prepare the coexistence between the On-Premises Exchange and Office 365, as well as prepare your MigrationWiz account. Estimated Duration (Consultant Actions / Automation): 1 Hour per 1000 users Prescriptive guidance: 1. Check the folder path on the script for the config.xml file (adjust if needed) 2. Make sure your config.xml is filled in with the correct information 3. Open the MigrationWiz PowerShell and execute the MWEC-Phase1-PrepareCoexistence.ps1 script 4. Once prompted access your public DNS zone to create the Federation record The script will perform the following tasks:

14 Prepare the On-Premises AD Creates a BtMigrationWiz OU to be used for future features of the MigrationWiz Enterprise Coexistence scripts. Prepare On-Premises Exchange Adds full access permission to all on-premises Exchange mailboxes for the MigrationWiz administrator user. Creates an Exchange certificate for Federation. Create the Microsoft Federation Trust (DNS validation is a manual task to be done by the consultant). Creates the Organization Relationship for the free busy coexistence. Creates and configures the remote domain for mail flow coexistence. Checks the Exchange on premises version to run the PowerShell cmdlets based on that (Config.xml file) Prepare Office 365 Creates a BtNotMigratedUsers Distribution List. Creates a MailEnabled User for every on-premises mailbox and adds users to the BtNotMigratedUsers distribution list. Configures a transport rule for criteria based routing. Creates an outbound connector for criteria based routing. Creates the Organization Relationship for the free busy coexistence. Configure MigrationWiz Project This task will automatically create the following MigrationWiz Projects in your account: [CustomerDomain]_Prestage o Project will automatically be configured to migrate all mail older than 30 days to Office 365 [CustomerDomain]_DeltaSync o Project will automatically be configured to migrate all mail [CustomerDomain]_NeedsAttention o Any mailboxes with errors that need user intervention will be moved to this project to be triaged and errors resolved. [CustomerDomain]_Completed o Final delta sync has been complete and the final onpremises mailbox has been converted to a remote mailbox Post-Script tests Once the script finishes, the consultant should test both mail flow and free busy coexistence, between a user on-premises and one on Office 365. If needed, the consultant should create a remote mailbox to execute the testing.

15 Phase 2 MWEC-Phase2-InitiateBatch.ps1 The second script will initiate the batch migration for the users defined for that specific batch. Estimated Duration (Consultant Actions / Automation): 30 minutes per 1000 users Estimated Duration (background pre-stage of mailbox data): 750MB 1GB * Concurrent mailboxes (300) per hour. *depending on customer bandwidth Prescriptive guidance: 1. Check the folder path on the script for the config.xml file (adjust if needed) 2. Make sure your config.xml is filled in with the correct information 3. Fill in the Users.csv file with all the addresses of the users to be included on the batch 4. Check the folder path on the script for the users.csv file (adjust if needed) 5. Open the MigrationWiz PowerShell and execute the MWEC-Phase2-InitiateBatch.ps1 script The script will perform the following tasks: On-Premises AD Creates backup users, that will be used to keep the Source mailbox of each user migrated to Office 365. Those backup users will be stored within the BtMigrationWiz OU created by the Phase 1 script. Office 365 Creates temporary users and mailboxes for all users from the migration batch. Assigns a license to each temporary mailbox. The temporary mailboxes address format will be tmp_userprincipalname@<customerdomain>. MigrationWiz Adds all the users from the batch to the [CustomerDomain]_PreStage MigrationWiz project. Starts the Pre-Stage migration for all users. Phase 3 MWEC-Phase3-MonitorPreStage.ps1 The third script will monitor the progress of the Pre-Stage migration. Estimated Duration (Consultant Actions / Automation): 10 minutes Prescriptive guidance: 1. Check the folder path on the script for the config.xml file (adjust if needed) 2. Make sure your config.xml is filled in with the correct information 3. Open the MigrationWiz PowerShell and execute the MWEC-Phase3-MonitorPreStage.ps1 script

16 The script will perform the following tasks: MigrationWiz The script will monitor the [CustomerDomain}_PreStage MigrationWiz project for failed and successful migrations, and take the following actions: o If the migration is finished with success the user is moved to the [CustomerDomain}_DeltaSync MigrationWiz project o If the migration failed less than 9 times the script restarts the migration o If the migration failed more than 9 times the user is moved to the [CustomerDomain]_NeedsAttention MigrationWiz project Phase 4 MWEC-Phase4-FinalSync.ps1 The fourth script will start a full migration pass for all users on the [CustomerDomain}_DeltaSync MigrationWiz project. Estimated Duration (Consultant Actions / Automation): 10 minutes Estimated Duration (background full migration of mailbox data): 750MB 1GB * Concurrent mailboxes (300) per hour. *depending on customer bandwidth Prescriptive guidance: 1. Check the folder path on the script for the config.xml file (adjust if needed) 2. Make sure your config.xml is filled in with the correct information 3. Open the MigrationWiz PowerShell and execute the MWEC-Phase4-FinalSync.ps1 script The script will perform the following tasks: MigrationWiz The script will start a full sync on all mailboxes of the [CustomerDomain]_DeltaSync project. If a sync is in progress for a mailbox the script will notify you and not try to start another sync. If a full sync was already executed for a mailbox the script will notify you and not try to start another sync. Phase 5 MWEC-Phase5-FinalizeBatch.ps1 The last script Estimated Duration (Consultant Actions / Automation): 1 Hour per 1000 users Prescriptive guidance:

17 1. Check the folder path on the script for the config.xml file (adjust if needed) 2. Make sure your config.xml is filled in with the correct information 3. Open the MigrationWiz PowerShell and execute the MWEC-Phase5-FinalizeBatch.ps1 script The script will perform the following tasks: MigrationWiz For each user it will look at the [CustomerDomain]_DeltaSync project, and if a full Delta sync is completed it will move the user to the [CustomerDomain]_Completed MigrationWiz project. After checking the above, and for all those users that had the full sync completed, the script will initiate the cutover of the user from on-premises to Office 365, by performing the following tasks: Office 365 The mail user is removed (and the MSOL user also). Converts the temporary user, created on phase 2, to the final username and primary SMTP address (temporary mailboxes transitioned to permanent). Updates the information needed for the Criteria Based Routing by removing the user from the BtNotMigratedUsers Distribution Group. On Premises Exchange Converts the on-premises mailbox to remote mailbox Stamps the value migrated on the attribute extensionattribute15, on the on-premises users, to include them on the AAD Sync scope Forces AAD Sync to run and SMTP match the user with the one on Office 365 Keeps the Source mailbox by attaching it to the Backup user Adds the user legacydn to the remote mailbox MigrationWiz Once the user cutover is done, the script will change both the Source and the Destination address of each user on the MigrationWiz project. The change pattern will be: Source: User1@domain.com -> backup_user1@domain.com Destination: tmp_user1@domain.com -> user1@domain.com After changing the addresses the script forces a full MigrationWiz sync. Once the script finishes the process for each user, the final result should be a remote mailbox on-premises, synched with a user on Office 365 (synched with AD) with a mailbox license, and all the mailbox items moved via MigrationWiz. The password sync should also be working, should you choose to activate it via the AAD Sync configuration.

18 Configure Deployment Pro GPO (Manual) Once the cutover is finished the DeploymentPro process, to reconfigure all the Outlook clients for those users, needs to be initiated manually, by clicking on the DeploymentPro Option of the [CustomerDomain]_Completed MigrationWiz project. Contact Us For technical information, and to learn more about our pricing and incentives, visit Or contact a BitTitan Partner Technical Strategist at sales@bittitan.com. About BitTitan BitTitan is the cloud services enablement leader, delivering solutions that help IT service providers sell, onboard, and service cloud technology. BitTitan s solutions are cloud-based and save time, money and resources without sacrificing security. Partners have used BitTitan s globally recognized products, including MigrationWiz, to help more than 75,000 global customers transition millions of employees seamlessly to the cloud. For more information, visit BitTitan Corporate Headquarters 3933 Lake Washington Blvd. NE, Suite 200 Kirkland, WA 98033