Single sign-on and Identity synchronization for CUSTOMER1 STATEMENT of WORK

Transcription

1 Single sign-on and Identity synchronization for CUSTOMER1 STATEMENT of WORK

2 Table of Contents Introduction Project Objectives and Scope Objectives Areas within Scope Phase 1 - Initiate Phase 2 - Assess Phase 3 - Remediate Phase 4 - Enable Services and Data synchronization Phase 5 - Enhance and training Training and Knowledge Sharing Project Approach and Timeline Approach Timeline Change Management Process...8 2

3 Introduction Office 365 tenant authentication and identity management is based on Azure Active Directory. Customer wants to eliminate the need for managing two separate user credentials in its own Office 365 tenant and on premise Active Directory by using either password synchronization or Federated single sign-on configuration. Pic. 1 Federated identity Pic. 2 Synchronized Identity The scope of the project will be configuration of Active Directory account and password synchronization between on-premises and cloud environment called Synchronized Identity which is recommended for small business customers. Because of one-way Directory Synchronization process On Premise Active Directory will become source of authority (source of truth) for any Office 365 synchronized object like User, Group, Contact and object properties (AD attributes) like Title, Phone, Manager, address, etc. and even Group Membership. 3

4 Pic. 3 Identity synchronization In order to manage mail-enabled objects (Mailbox, Mail Group, Mail Contact) in Exchange Online with DirSync (legacy name for AAD Connect) Microsoft offers the only supported way of their management via Exchange Management Tools, which are part of Exchange Server On Premise. 1. Project Objectives and Scope 1.1. Objectives Using Microsoft s standard deployment methodology and approach for Office 365 implementations, CloudRoute will work closely with Esperanza in a collaborative effort to provide planning, project management, and a predictable approach for setting up new services for Esperanza. 4

5 1.2. Areas within Scope CloudRoute will provide the services described in the following tables Phase 1 - Initiate Scope Determine your deployment goals with your internal and external stakeholders Deliverables Agree on scope and timeline Agree on project tracking mechanism Develop success criteria and a communication Develop training plan Develop project plan Phase 2 - Assess Scope Inventory customer's current on-premises environment o Inventory existing network environment o Inventory Active Directory Domain Services o Check for on-premises services health (event logs etc.) o Check for backup plans for Active Directory o Check for Legal Policies Inventory customer's current Office 365 environment o Inventory Office 365 tenant and assigned AAD o Dump all mail enabled objects and their attributes o Check for user configuration (accepted domain, UPN, etc.) Deliverables Summarize assessment results Develop remediation checklist Create licensing request required for this project implementation Renewed project plan Phase 3 - Remediate Scope Remediate Active Directory Domain Services with IdFix tool Prepare migration administrator account with Enterprise Admin/Schema Admins/Domain Admins role Optional: Add missing Office 365 UPN suffix to AD and setup it for existing users Remove Exchange 2007 Prepare VM or Hardware for AAD Connect and Exchange Server: CPU, RAM: 8GB, HDD: 100GB Exchange Server 2013 Installation: o Prepare Windows Server (install features) o Prepare AD Schema o Install Exchange Server 2013 pre-requisites 5

6 o Install Exchange Server 2013 AAD Connect Installation: o Prepare Windows server for AAD Connect o Install ADDS, Exchange, O365 Management tools on AAD Connect server o Disable synchronization job at this point Fixing differences between On Premise Active Directory and Azure Active Directory using assessment dump data Get your network ready (enough bandwidth, required ports opened). Deliverables Customer environment ready for identity synchronization Completion of configuration and remediation requirements outlined in the remediation checklist. Renewed project plan Phase 4 - Enable Services and Data synchronization Scope Configure Exchange Server 2013 (accepted domain, address policy copied from Exchange Online) Matching accounts from on-premises Active Directory with Azure Active Directory: o Updating users and contacts attributes o Updating distribution groups attributes Configure Active Directory Synchronization for Pilot OU Performing the initial Pilot synchronization with Office 365 Configure Active Directory Synchronization for Production OU Performing the initial synchronization with Office 365 Verifying identity synchronization and password sync Deliverables Identity synchronization enabled with default schedule (once per 3 hours) Verifying complete successfully Renewed project plan Phase 5 - Enhance and training Scope Web Meeting training Optional: Prepare end-user documentation Deliverables Web Meeting training complete 30 days of post deployment support Office 365 Best Practices 6

7 Training and Knowledge Sharing We will provide one 4 hour training class for up to 10 Help Desk engineers that will overview the synchronization process, deep dive into highest anticipated calls to the help desk, and detail answers to these anticipated calls. Help Desk Training format is Web Meeting. Knowledge transfer activities are secondary to completing deliverables and maintaining the project schedules. 2. Project Approach and Timeline 2.1. Approach During the engagement, the CloudRoute team will facilitate working with the Office 365 Onboarding Center, provide technical, and project management assistance for Esperanza to complete the Single sign-on and Identity synchronization project in distinct phases. The duration and timing associated with this project is specified in Section 2.2, bounding the work to keep delivery on track. Exceeding the specified limits can have cost, schedule, or scope impacts. All changes will be evaluated and will follow the change management process described later in this document Purchase Overview Below you can find an overview outlining the services, quantities, and pricing terms of your purchase. Item Quantity Price Type Total Deploy single sign-on functionality 32 $125/hr NRC $4000 Recurring Monthly Charges $0.00 Non-Recurring Charges $ Timeline Table below details the assumed duration for CloudRoute-led phases of this project. The total duration of the project can vary, depending on the level of customer-led remediation that is required to enter the Enable phase. 7

8 Estimated duration in days Phase 1 - Initiate Phase 2 - Assess Phase 3 - Remediate Phase 4 - Enable Services and Data synchronization Phase 5 - Enhance and training 2.4. Change Management Process During the project, either party may request, in writing, additions, deletions, or modifications to the services described in this SOW ( change request ). For all change requests, regardless of origin, CloudRoute will submit to Esperanza the CloudRoute standard change request form, which will describe the proposed changes to the project, including the impact of the changes on the project scope, schedule, fees, and expenses. For all change requests which Esperanza originates, CloudRoute will have a minimum of 5 business days from receipt of the change request to research and document the proposed change, and prepare the Change Request Form. Esperanza will have 5 business days from your receipt of a completed Change Request Form to accept the proposed changes by signing and returning the Change Request Form. If Esperanza does not sign and return the Change Request Form within the time period prescribe, the change request will be deemed rejected and CloudRoute will not perform the proposed changes. No change to this project will be made unless it is requested and accepted in accordance with the process described in this section. CloudRoute will have no obligation to perform or commence work in connection with any proposed change until a Change Request Form is approved and signed by the designated project managers from both parties. 8

9 Provider: CloudRoute Customer: xxx Signature: Signature: Print Name: Print Name: Title: Title: Address: Address: Date: Date: 9