I did a presentation recently on the Enterprise Mobility Suite for Microsoft and have uploaded the slides (Above) to my docs.com for you to download if you want. You’ll find the direct link at:

The main benefits I see of using the product is the fact that you get Azure AD Premium which means added features like password write back and more functionality in the Azure Single Sign On Portal amongst other things. There is plenty to commend EMS to customers but the first start for resellers is to understand the product.

Here are some additional links that I found relevant but didn’t include during my research:

Supported SaaS apps – https://azure.microsoft.com/en-us/marketplace/active-directory/

Deploying the Azure RMS connector – https://technet.microsoft.com/en-us/library/dn375964.aspx

Advanced Threat Analytics – http://www.microsoft.com/en-au/server-cloud/products/advanced-threat-analytics/

Advanced Threat Analytics Installation – https://technet.microsoft.com/en-us/library/dn707704.aspx

Although I did include this link to a presentation on Advanced Threat Analytics from Microsoft Ignite in May I’ll repeat it here because I think that anyone interested in what this product can do should take a look. It is also really cool technology as well, so even if you don’t you’d deploy I’d still encourage you to take a look.

https://channel9.msdn.com/Events/Ignite/2015/BRK3870

Office 365 Service Trust Portal

Security is a journey not a destination and that’s what makes it so hard when dealing with technology. One of the things that I believe that makes Office 365 the best product on the market is Microsoft’s commitment to security and compliance. A great place to start if you aren’t already aware is the

Office 365 Trust center

which has a huge amount of information around security for products like Office 365. If you have a security question about Office 365, start there.

What you may not be aware of is that Microsoft has just made available a dedicated an Office 365 Service Trust Portal for each Office 365 tenant. Once you sign up, you’ll find a vast array of security and compliance information tailored specifically for your Office 365 tenant. Here’s how you sign up.

Start by visiting:

https://trustportal.office.com/

You’ll be presented with the page shown above which you’ll need to login as an Office 365 global administrator.

After successfully logging in you need to approve access from the Office 365 Service Trust Portal to your Office 365 tenant. Simply select the Accept button to proceed.

(now for some reason I’ve had to repeat the login and accept twice a couple of times for different tenants I enabled, so if it doesn’t work the first time, simply try again)

You’ll then be asked to enter you region and industries. Simply select from the pull down options.

When you have made your selections select the Save button to the right.

In a moment or two you’ll receive a message that your configuration has been save and the Trust Portal has been updated with relevant information.

You can now navigate to the menu options on the left of the page, like Compliance Reports which are shown above. Here you will see all the security and compliance information available to you as you can see. You can also use the options at the top of the page to easily search for specific information.

One of the first options I suggest you take a look at is the Office 365 Customer Security Considerations spreadsheet. You’ll find details of this here:

https://blogs.office.com/2015/11/23/announcing-office-365-customer-security-considerations-preview/

You’ll find it by selecting Trust Documents from the menu on the left,

From the options on the left locate Office 365 Customer Security Considerations Preview. Selecting this will download a spreadsheet which you can save locally.

When you open the spreadsheet you should see something like that shown above.

If you take a look at all the content in the spreadsheet you’ll find links, PowerShell commands, best practices and more. There is also an Office 365 Customer Security Considerations Preview Reference Guide available from the portal to help you use the spreadsheet.

Security is a very important aspect of cloud computing and given resources like the new Office 365 Service Trust Portal I am confident that Microsoft is making available the best information needed to help both customers and resellers understand and better secure their information in their commercial services like Office 365. This is yet another reason why Office 365, for me, stands out from the pack when it comes to being serious about business cloud computing.

Using Office 365 Rights Management with SharePoint Online

You can protect the documents you save into SharePoint Online so that they can’t be opened by people without the appropriate security. This prevents situations where a confidential file is downloaded from SharePoint Online and then forwarded to someone that it should be for example.

This document control is managed by Azure Rights Management which you can easily enable in your Office 365 tenant for both Exchange Online and SharePoint Online. I have detailed how to enable office 365 Rights Management and use it with Office 365 message encryption previously at:

Office 365 message encryption

So check out that post to find out how to enable right management in Office 365 and then return here to find out how to use it with SharePoint Online.

After rights management has been enable in Office 365 you’ll need to enable it also in SharePoint Online.

Go to the SharePoint admin center and select Settings from the menu on the left.

Scroll down the options on the right until you locate Information Rights Management (IRM). Select Use the IRM service specified in your configuration.

Scroll to the bottom of the page and select OK to save your configuration.

Navigate to the item you wish to protect in SharePoint Online, here a Document Library.

Select the Library tab at the top left of the page to reveal the Ribbon Menu as shown above.

On the very right of the Ribbon select the Library Settings icon.

From the column in the middle of the page with the heading Permissions and Management select the Information Rights Management option.

Ensure the Restrict permissions on this library on download is checked. Also give he policy a title and description.

If you select the Show Options link below these description fields you’ll see a number of different options you can use to customise how the rights will be applied to the documents.

When complete, select the OK button at the bottom of the page to save your configuration.

Basically now when a document is downloaded from that library and opened by someone without appropriate permissions they will see the above message preventing them from accessing the document.

There is whole lot more you can do with rights management in Office 365 but hopefully this post has given you enough to get started on the journey of securing your documents better.

If you found value from this post I’d recommend you take a look at my online training courses at:

http://www.ciaopsacademy.com

where you’ll find lots and lots of courses on Office 365, SharePoint, Azure and more. These courses help support the information I provide here for free and on my YouTube channel, podcast, etc. I appreciate everyone who has already signed up to one of my courses and keep your eyes peeled for more coming soon.

Microsoft Advanced Threat Analytics

If you are wondering what Microsoft Advanced Threat Analytics is then take a look at these two videos.

and

To learn about how the product works then have a look at:

Microsoft Advanced Threat Analytics coming next month

and

Microsoft Advanced Threat Analytics public preview now available

If you are looking to purchase the product today have a look at:

Microsoft Advanced Threat Analytics Pricing

For most most smaller customers the best way to get the product today is via the:

Enterprise Mobility Suite

However, it is also expected to be part of the new E5 Office 365 license that will be available shortly.

— Update —

I found today that if you go to the Add-ons for your Office 365 subscription you can purchase Exchange Online Threat Protection as a stand alone extra to your existing Exchange Online mailboxes. That make it easy to quickly and easily increase the security of your email protection with Office 365.

For more details see:

Exchange Online Advanced Threat Protection

Office 365 Nation wrap up

Well I am back (finally, phew) from Seattle and being part of Office 365 Nation hosted by the one and only Harry Brelsford.

First, a shout out to Harry and his staff for putting on another great event. Everything ran very smoothly and everyone I talked to had a great time.

Next, I also have to thank all the attendees that came to my sessions (even those I was a tad under the weather for). Also to those who made time to come up and chat or just say hello. This is what community is all about and the main reason I’ll endure over 24 hours or travel door to door to be in attendance. That also doesn’t cover all the great new contacts I made during the time.

To these and everyone else who helped make the trip worthwhile I say thanks.

I have posted all my presentations from the event up at my DOCS.com site (which also has plenty of other interesting free stuff from me), in the Presentations collection:

https://docs.com/ciaops

https://docs.com/ciaops/7775/presentations

Across the Isle

Across the Isle – Office 365 Nation 2015—Robert Crane Docs.com

https://docs.com/d/embed/D25195817-5442-1372-7770-000678446948%7eMd4186d87-61d5-259a-4d26-00a8bd86cfff

Understanding Microsoft Cloud Identities

Understanding Microsoft Cloud identities – Office 365 Nation 2015—Robert Crane Docs.com

https://docs.com/d/embed/D25195817-5258-1123-6760-001997999724%7eMd4186d87-61d5-259a-4d26-00a8bd86cfff

Office 365 security, privacy and compliance

Office 365 security, privacy and compliance – Office 365 Nation 2015—Robert Crane Docs.com

https://docs.com/d/embed/D25195817-5129-1561-2200-001922537313%7eMd4186d87-61d5-259a-4d26-00a8bd86cfff

Office 365 Identity Management

Office 365 Identity Management – Office 365 Nation 2015—Robert Crane Docs.com

https://docs.com/d/embed/D25195817-4993-0293-6390-001510353638%7eMd4186d87-61d5-259a-4d26-00a8bd86cfff

Riding the Big Data Wave with Excel and Power BI

Riding the big data wave with Excel and Power BI – Office 365 Nation 2015—Robert Crane Docs.com

https://docs.com/d/embed/D25195817-4913-1019-8790-000843845982%7eMd4186d87-61d5-259a-4d26-00a8bd86cfff

More granular admin roles now available in Office 365

You should now start seeing in your Office 365 tenants the ability to set more granular administration roles for your users in Office 365 as shown above.

You’ll see all the old favourites such as Billing Administrator, User Management administrator but you’ll also now see some new ones like SharePoint and Skype for Business administrator. This allows you to delegate administration for a particular services to a particular user.

Great some more options when it comes to assigning rights with Office 365!

Azure AD Sync Services tool–the basics

The most popular post on my blog is currently:

Windows Azure Active Directory Sync tool (DIRSYNC) – the basics

The currently recommended tool for syncing your on premises AD to Office 365 is now is not DIRSYNC but:

Azure AD Sync Services

There is a further updated version that is currently in preview called:

Azure AD Connect

and you can read more about that preview here:

Azure AD Connect Preview 2 is available

I’ll do a blog post on that very soon, but for now let’s concentrate on what is generally available.

You can read more about Azure Active Directory Sync here:

https://msdn.microsoft.com/en-us/library/azure/dn790204.aspx

Firstly, download the tool from the link above. In this case I am installing on clean AD and I’m also going to install the tool onto a domain controller, which is supported but not best practice. I am also using a new demo empty Office 365 E3 tenant.

After you have made sure your on premises AD is in good health, and before installing the sync tool on your network, you should login to your Office 365 tenant as a global administrator and navigate to the Admin portal.

You then need to select the Active Users option from beneath the Users menu item from the option on the left of the Office 365 Admin portal.

Note: that I have no users apart from the Global Administrator in my new Office 365 tenant initially.

At the top of the Active Users dashboard you will see an option called Active Directory synchronization as shown above. Select the Set up hyperlink to the right.

This will then present you with a number of steps. You should complete Steps 1 and 2, which I have already completed.

Then select the Activate button under option 3.

You’ll then be prompted to confirm you do want to proceed with synchronization. Note the warnings and select the Activate button to proceed.

You should now see that option 3 displays Active Directory synchronization is activated as shown above.

Return to your on premises sync server and double click on the package you downloaded. It will be extracted.

Double click the icon it places on the desktop to commence the configuration process.

You are prompted for the location to install the software. The default location is:

c:\program files\microsoft azure ad sync

You can however change this if desired.

When you have entered in the appropriate installation directory and checked the I agree to the license terms box, you can select the Install button in the lower right hand corner.

You will now see the program install the files to the installation directory as shown above.

You will then see Microsoft SQL Express being installed. Having SQL on a domain controller is generally not best practice but is supported now. However, beware that they sync tool will install and use SQL Express by default.

You will then see it installing the actual Sync Service on your machine.

Amongst a few other Azure services installed on your machine you’ll now find the Microsoft Azure AD Sync service as shown above.

You’ll then be prompted to enter you details for Azure AD as shown above.

Remember, Office 365 is built on Azure AD and uses it to manage identity. Thus, here you now enter your Office 365 global administrator credentials.

Best practice is to use a dedicated global administration account that has not been assigned any licenses. That is, create a new user and make then a global administrator but don’t assign them a license in your Office 365. Then only use this user to synchronise your local AD to Office 365.

Here, I am am just going to use the default tenant administrator to keep it simple but importantly, the user you enter here MUST have the Office 365 Global Administration role.

When you have completed the required details here press the Next button to proceed.

The provided login will then be authenticated.

If you have not as yet enabled directory synchronization in your Office 365 tenant, as detailed previously, you will see the above error message.

You will be prompted to enable this before you can proceed further.

You’ll then be prompted for a local forest (domain) and domain administrator as shown above.

If you look at your local Active Directory Users and Computers you will normally find the forest name at the top of the tree. In this case it is kumoalliance.org.

Note, that you need to have users assigned to routable domain locally as their primary UPN, not something like .local or .lan. if they are, then you will need to change this prior to synchronisation or otherwise users won’t end up correctly in Office 365.

Take a look at this article:

How to synchronize a .local domain

on how to perform update your users if you only have a .local domain.

Also note here that I have four users in my local domain also shown above.

When the correct local domain administration credentials have been entered select the Add Forest button.

If that is successful you should see you domain listed below teh entry fields now as shown above.

Select the Next button to proceed.

You should now see the connector from your local AD to Azure being created and configured as shown above.

You are now given the options to match local users to Azure AD users if they exist. This will basically match on premise AD objects to those already in Azure AD.

Because there are currently no users in my Office 365 tenant there are none that require matching so best practice is to leave the default options configured and select the Next button to continue but as you can see, you can match users between your local AD and the cloud via a variety of options.

Remember again, that my Office 365 tenant is empty except for the default admin account as shown above.

You are now presented with the Optional features page. You can learn more about the options here at:

https://msdn.microsoft.com/en-us/library/azure/dn757602.aspx#BKMK_ConfigureSynchronizationOptions

Where many get confused is the difference between Password write-back and Password synchronization. Password write-back is an Azure Active Directory Premium feature. For more information on how to configure this, see:

Password writeback: how to configure Azure AD to amange on-premises passwords

and

http://blogs.technet.com/b/ad/archive/2014/04/29/deep-dive-password-reset-with-on-premise-sync-in-azure-ad-premium.aspx

Office 365 currently doesn’t include Azure AD Premium so the only option available is Password synchronization which you should select. More information on password synchronization can be found here:

https://msdn.microsoft.com/en-us/library/azure/dn835016.aspx

Remember, Azure AD sync allows the connection of more than just Office 365 to your local AD, that’s why there are more options here.

The new sync tool, Azure AD Connect, that is in preview, will support password writeback as the above blog post highlights towards the end of the post. As I said, I will also do a post on this soon.

So, in summary here, select Password synchronization and then the Next button to continue.

You can now review the information and when ready select the Configure button to continue.

The tool will now complete the configuration and enable the options you select. You see it connecting as shown above.

You will then see it enable the options you selected with any issues or errors highlighted.

When the process is complete you’ll have the option to Synchronize now, which you can uncheck if desired. Remember, this first sync may be quite large and take some time depending on how many objects are being copied to Office 365.

However, in most cases, you’ll leave this option checked and select the Finish button.

In a very short period of time you should see your users appear in the Office 365 console as shown above.

However, importantly, they will not have a license assigned to them so they won’t have things like a mailbox yet.

Why is that? Remember you can have many different types of licenses in Office 365 and you can allocate them to different users as you please. The sync client doesn’t know which licenses you want applied to which user so they need to be applied manually.

If all the users are going to get the same license simply select all the users in bulk as shown above, then select the Activate synced users hyperlink in the lower right hand side.

Then assign the location and license you want to apply to these users and select the Activate button at the bottom of the screen.

The process is now complete. Your local AD users are now synced to Office 365 using Azure Azure Sync Services. If they change their password on premises it is also synced using password hashing to Office 365.

Points to remember with Azure AD Sync (and DIRSYNC for that matter):

– By default, passwords changed in the cloud are overwritten when the next sync from on premises AD occurs.

– Information is copied from local AD to Office 365 not back. That is, the way it was installed above, it is a one way sync from on premises to Office 365.

– Owners of an on-premises distribution group that’s synced to Office 365 can’t manage the distribution group in Exchange Online

– Azure AD Sync services allow the configuration of object filtering

– Changes are synchronized based on a three hours interval (this is the same interval that is also used by DirSync). There is a scheduled task running as the service account which will run the cycle. If you unselected “synchronize changes now” during installation then the task is installed as “disabled”. You can force synchronization using a PowerShell command if required as well as running the following file:

C:\Program Files\Microsoft Azure AD Sync\Bin\directorysyncclientcmd.exe

– You can upgrade from DIRSYNC to Azure AD Sync Services

– The new Azure AD Connect tool is due soon with more features (blog post on that coming soon)

You’ll also find some tools installed on your sync machine to help manage and troubleshoot the sync process.

Like the Synchronization Service Manager show above that give you a low level insight into what the sync is actually doing. More on that again in an upcoming post.