Infrastructure before Implementing Hybrid with SSO
All of the email were hosted on local exhchange server with multiple SMTPs as per requirement.When a user on the internet sends the email to any email user or the user which we intented to move to the cloud, according to the MX records it is directed towards our premiter Network which is consisted of 2 Cisco Iron port for email security, filtering, spoofing etc. There are 2 MX records on our DNS each poiting towards one of the Cisco Iron port. Cisco Iron port has then SMTP forwarder configured in it which detects the SMTP and send it to one of the CAS server (Not array it is load balanced through hardware device and Mailbox servers are configured with DAG) and from CAS to MailBox server. CAS server has no public IP on it so it does not face internet and this job is done by iron port. CAS server has send connector which contains IP of inbount network interface of ironport to forward emails to iron port and then iron port sends it to internet. As shown in the picture. Iron port has list of accepted domains and it only allows mail from inside for the domains which are in accepted list. If somene tries to spoof and send an email from internet with the same SMTP to our network, it is catagorized as spoof. This setup is working fine.
Desired infrastructure
The requirements demanded by management were as follows
- Students and faculty should be moved to cloud.
- SSO so that user can be controlled on premises but can login to cloud without any new user nam/password.
- All the emails should be route through our current applience i.e. Iron port (ESA)/ exchange.
- We will never move our all users to the cloud and it will be coexisted environment
- The users which we want to move to the cloud will also be some on cloud and some on local exchange for some time with same SMTP address so in nut shell some of the users with same SMTP will be on cloud and some on local. (Please note that none of these users will be controlled or created in cloud.
- Autodiscovery should also work as well as well if users Signin to local exchange, they should automatically redirected to cloud without sumbitting user name and password agin.
Steps done so far and Problems which are faced.
- As current domain was abc.local, UPN was added to make it routable on the internet. So far only one UPN added as other’s will be added in the future. (So for reference keep this noted that adding further UPNs and adding it AD azure connecte later will be an issue or not).
- DNS was added to O365 tenant and since we wanted our own DNS to control everything and emails through out on-premises setup, according to Microsoft documentation DNS was just verified by just txt and nothing more changed and DNS skip was selected and DNS errors were ignored.
- Custom domain was added and was set as dafault.
- Azure AD connect was installed with the hybrid exchnage and password hash selected. Users were successfully relected to O365 active users.
- Users were given license i.e. offce 365 and they were able to login to www.office.com by using AD local user name and password. But when this user when logs in to local exchange OWA, it allows it to loggin and gives a link to login to office365. Ideally it should not ask for user name and password again but it asks again on office365 means SSO not working correctly though it accepts users and password.
- Before running HCW utility user cloud@students.xyz.com (which were made on local AD and reflected to O365) were able to send and receive emails from any where except to and from those users which had same SMTP address but were hosted on local exchange e.g. local@students.xyz.com.
- But when received email, it had email address like user1@abcuniversity.mail.onmicrosoft .com.
- After that HCW utility was run. During installation it did not ask for “Enable faderated trust” option and asked to add DNS token to out custom domain to verify the domain. It accepted the third party certificate and moved forward when asked for FQDN of CAS which is directly accessed by internet I was not sure and I given the FQDN of webservice which open local exchange OWA. E.g. xyz.com and address is like xyx.com/owa. After fininshing utility if gave warnings can be seen in the picture.
- After running HCW utility Now user on the cloud are not able to send mails anywhere except to those who’s mailboxes are hosted Office365.
10. Send and receive connector settings are like this on local exchange server
11. Connector setting in Office 365. We also made some changes in it. Changed the outbound connector setting to route email to our ironport. Also editedWhen do you want to use this connector? And set it to Only when email messages are sent to these domains and added some domains in it. Also edited the inbound connector and added IP address of our firewall from which emails will be sent to O365. After changing the outbound connector i.e. email from O365 to our Ironport, email from O365 users were started to bounce back because they were rejected by ironport. As soon as we released it from spoof capture, mails were delivered to recipients. This can be set on our side but now the problem is that user on cloud is not able to receive email from anywhere.
Issues and confusions
Email flow is not clear. Either all the emails will first to our gateway and then routed to EOP and then EOP will send next in case of centrlized email route is selected in HCW ?
If centrilized email is not selected what will be the flow of email like like only email to students.xyz.ac.ae will route via EOP or all of the exchange server’s domains will recv via EOP ?
What is IP address or URL will be added to send connector of local email exchange to enable it to send emails to Office365 ? If smart host then what is the URL of smart host of office 365. ?
*Address space: (local exchange outbound connector)Specify the address space or spaces to which this connector will route mail.?
What FQDN should be put in outbound connector of local exchange server?