Thursday, August 14, 2014

Replacing TMG with IIS ARR for an Exchange Hybrid

On September 12th 2012 Microsoft announced that the TMG Forefront 2010 product will be discontinued. Microsoft obviously had to replace this product with alternatives. 

One of those products is the Web Application Proxy feature in Microsoft Windows Server 2012 R2   Web Application Proxy Deployment Guide 

Another product which was was released was Microsoft Application Request Routing 3.0 

This product plugs into IIS and can act as a reverse proxy to publish Exchange 2013/2010.
The Exchange Team Blog have a three part article on how to set it up and install it
Part 1 , Part 2 , Part 3 

There is an excellent Article on the Office365 community site on how to configure TMG 2010 for an Exchange Hybrid scenario.

And the key paths that require publication from the Hybrid Server are 
  • /ews/mrsproxy.svc
  • /ews/exchange.asmx/wssecurity
  • /autodiscover/autodiscover.svc/wssecurity
  • /autodiscover/autodiscover.svc
So how do we get these paths working in IIS ARR?????

The following 4 images are how we add the paths into the https url re-write section of IIS ARR

And then finally to test the path you enter the public url as per the image above and when we press test.

The main purpose of this blog was to help people understand how to get different path types into IIS ARR as it took me a bit of time to configure. A server 2012 R2 server can be provisioned in minutes in the right environment. Publishing Exchange Hybrid services like this from a DMZ is in line with Microsoft Best Practices.

Wednesday, August 6, 2014

Converting Office365 Cloud Identities into Managed Identities

There are three core identity scenarios in Office365 as illustrated above. I created a previous blog post on how to covert cloud identities to federated identities which can be viewed HERE

To convert cloud identities to managed identities with password sync can be quite simple by changing the users UPN and also matching the user's UPN with their primary smtp address.

However , How many time have you received the dreaded email from Microsoft like below

Unable to update this object because the following attributes associated with this object have values that may already be associated with another object in your local directory services: [ProxyAddresses]. Correct or remove the duplicate values in your local directory. Please refer to for more information on identifying objects with duplicate attribute values.

So you search active directory and exchange online for conflicts but cant find any which will probably drive you CRAZY. So here is how to fix it.

I will demonstrate how to fix it for one user
It is very important that WAAD is not running when running these powershell commands.

The image below is a synchronization error message from in WAAD

So to fix this we copy the distinguished name and run the following command.

set-MsolUser -UserPrincipalName -ImmutableID JF9SbfTKlk2kMWlrce0fNA==