Webinars: Migration tools and best practices

by Contributed | Mar 24, 2021 | Technology

This article is contributed. See the original author and article here.

If you are evaluating , kicking off or in the process of moving your organizational data to Microsoft 365 here are some recommendations from the subject matter experts based on their learnings  managing large scale migrations for multiple organizations.

Tune in to learn more about the tools and options available to enable you to successfully migrate your organizational data to Microsoft 365 as well as best practices that will help you run an effective, speedy and seamless migration to OneDrive and SharePoint 

so that you can empower your users for collaboration and productivity.  

Webinar details :

Choosing the right tools for your Microsoft 365 migration

Date: 6/6/2021

Time: 9:00 am PT

Agenda:

• Introduction


• Migration from file shares and SharePoint servers


• Migration from cloud providers


• Future investments


• Conclusion and QA

Please register for the free webinar here.

Best practices for data migrations to Microsoft 365 

Date: 6/13/2021

Time: 9:00 am PT

Agenda:

• Introduction


• How to prepare data for migration


• How to plan and communicate about the migration


• How to run a successful migration


• Conclusion and QA

Please register for the free webinar here.

Looking forward to interacting with you! :)

Thanks,

Ankita

Best practices for migrating to SharePoint and OneDrive

by Contributed | Mar 24, 2021 | Technology

This article is contributed. See the original author and article here.

Many organizations are coming up on their first-year anniversary of supporting a remote workforce. While some have already started transitioning people back to the office, whether in full-time or hybrid mode, others are looking to make remote work permanent. Either way, having modern collaboration tools that help people share information and work together in real time has become absolutely essential to maintaining productivity. Last year, many IT organizations found themselves scrambling to quickly get people access to tools and information they needed to work from home effectively. Now, they’re in a position to think more strategically about the best ways to support a remote workforce. For organizations who’ve deployed Microsoft 365, one of those ways is by migrating content to SharePoint and OneDrive.  

Why migrate?

Your organization may have any number of reasons for migrating to SharePoint and OneDrive. Maybe you were already planning the migration when the pandemic hit, maybe you realized that asking people to VPN in to access on-premises file shares wasn’t providing a good employee experience, or maybe your subscription to 3^rd party cloud storage is expiring and you realized you can centralize administration and save costs by moving to Microsoft 365.

But the most important reason to migrate is that SharePoint and OneDrive work securely and seamlessly with Microsoft Teams, the digital hub for teamwork that over 115 million daily users rely on to connect and collaborate. And the integration between Teams, SharePoint, and OneDrive empowers you to set governance and compliance policies at an organizational level that can be extended across Teams, SharePoint, and OneDrive—something you can’t do with third-party tools.

With content stored in SharePoint and OneDrive, you can configure secure sharing policies, use Microsoft Information Protection to create policies for automatic classification of sensitive data, or implement information barriers to restrict communication and collaboration between specific business units or teams to avoid conflicts of interest from occurring or between certain people to safeguard internal information. You can also monitor shared content, adding an extra layer of security and control. Through detailed audit logs and reports available in the Microsoft 365 Security and Compliance Center, you can trace SharePoint and OneDrive activity at the folder, file, and user levels, so you can see at a glance if any unauthorized users have tried to access sensitive company or client information. Every user action, including changes and modifications made to files and folders, is recorded for a full audit trail. In addition, even remotely, you also get device visibility and control that’s especially important for thwarting breaches and ransomware attacks.

What are the critical steps for a successful migration?

No matter what your reasons for migrating to SharePoint and OneDrive, the process can seem overwhelming. You have so much to consider: What content do you have, and where is it stored? What will you move? What needs extra consideration, like regulatory compliance? How will you get data from file shares or third-party cloud apps into SharePoint and OneDrive? And those are just some of the logistical aspects—you also need to think about things like timing for the migration and how to communicate what’s happening to the rest of the organization. To help, we’ve outlined some critical steps for you to consider for a successful migration.

Consider your current environment

The first step is to understand your current environment. Many organizations have a combination of solutions: file servers with many years’ worth of data, third-party storage solutions holding archived data for legal or regulatory reasons, or third-party cloud storage apps adopted by specific business units. In considering your current environment, you’ll want to review:

• Where your data is located, and whether you need it. As a first step you need to determine what content you have, what you need to keep, and what you want to get rid of.


• What content people are using. You’ll also want to understand how people across the organization are using the file shares or cloud storage apps to do their daily jobs, so you can plan around the way people work to avoid disrupting productivity.


• Who has access to what. You probably have certain groups who need to share a lot of information with external parties—clients, partners, or vendors. You’ll need to know what access has been granted so you can ensure they still have access once the content is migrated.


• How you want to structure things going forward. Once you’ve collected that information from the business, you can reconsider your file and permissions structures for more streamlined administration and better security.


• Whether you need help. All of this can be daunting, so consider enlisting support: Microsoft FastTrack services can help you get started by helping to assess your environment and develop a plan, If you need help with migrating your file shares, on-premises SharePoint environments, or other cloud sharing solutions to Microsoft 365.

Create a high-level timeline and outline any risks

Develop a high-level timeline for your migration based on priority and your earlier assessments. This will help you determine cutover dates for all content and users and address any risks you’ve identified, such as sites or file shares that need to be scrubbed, legal hold or eDiscovery issues, or even holidays or other important business dates or events that you need to consider.

Choose the right tool(s)

You may not want or need to migrate all your data the same way. For example, your organization may prefer to have users in some business units manually move their content to OneDrive or SharePoint from share network files or other sharing apps, while other business units with many TBs of customer content or sensitive IP may prefer that IT and security teams work together to move content to its new location. Microsoft offers a broad range of tools to help you migrate different types of content, depending on your needs:

Manual Upload. You can ask users to manually upload their files to SharePoint or OneDrive. This works best for smaller files like general Word documents, Excel spreadsheets, and PowerPoint presentations.
Best for: Moving small individual files

OneDrive Sync App. For individual users who have a lot of content to move, they can install the OneDrive Sync App for Windows or Mac to drag and drop files from file shares or their computer’s File Explorer to OneDrive. This app also lets users easily manage and access OneDrive files in the same way they manage and access files in File Explorer.
Best for: Moving a personal file library to the cloud

SharePoint Migration Tool. You can use the SharePoint Migration Tool (SPMT) to migrate your files from SharePoint on-premises document libraries, lists, or regular files shares.

You can also use the new PowerShell cmdlets based on the SharePoint Migration Tool (SPMT) migration engine to move files from SharePoint 2010 and SharePoint 2013 on-premises document libraries and list items, and file shares to Microsoft 365.
Best for: Migrating SharePoint Server 2010, 2013, and 2016 environments

SharePoint Assessment Tool. You can use this simple command line executable to assess and identify issues with your on-premises SharePoint Server content prior to migration. It also includes the SharePoint Migration Identity Management Tool, that performs identity mapping by scanning SharePoint, Active Directory, and Azure Active Directory.
Best for: Assessing SharePoint Server 2010 and 2013 content prior to migration

Migration Manager. Available in the SharePoint Admin center, Migration Manager provides a centralized way of connecting servers, creating tasks, and automatically distributing your migration tasks.
Best for: Migrating network file shares

Mover. Automated cloud-to-cloud migration service for Office 365 tenant-to-tenant migrations or moving from cloud apps like Box and DropBox.
Best for: Migrating data from other cloud service providers

Azure Data Box. The Microsoft Azure Data Box is a service that lets you order a device from the Microsoft Azure portal. You can then copy TBs of data from your servers to the device, ship it back to Microsoft, and your data is copied into Azure. Once your data is in Azure, you can use SPMT to migrate content to SharePoint.
Best for: Removing the dependency on your WAN link to transfer data when migrating files

Plan your migration and communicate the plan

Depending on the tool you choose to use for your migration and your organization’s business needs, you may want to plan your migration during off-work hours or on weekends, if possible, just to avoid disrupting daily business. You may decide to move content and users in waves by business units or teams, or you may decide to move certain content types first—for example, moving smaller documents and working your way up to larger files such as video or CAD files. Whenever and however you decide to move content, you should also create a communications plan, giving people plenty of advanced notice and explaining what they should expect and when. If you have a change management team, you could also work with them on ensuring that documentation and training materials are readily available when the migration begins.

Prepare and run your migration

Before you begin your actual migration, consider running a pilot to ensure you’ve worked out most of the kinks. A successful pilot can help build confidence, especially with leadership and other key stakeholders, and can help you mitigate risks. Select people from across the organization who own data that they are sharing with each other and/or with external parties so you can test how permissions transfer. You can keep your pilot running even during the actual migration just to help minimize surprises.

On the selected migration date—one you’ve communicated ahead of time to everyone in the organization—ensure people cannot edit or add files. We also suggest leveraging the “Big Bang” approach that involves moving all your users at once providing highest concurrency, throughput and speed.

To keep key stakeholders up-to-date on the progress consider publishing a report that highlights data migrated, status and any errors which can be mostly eliminated by re-running your transfers. Once concluded, your change management team can help with user adoption and onboarding for a smooth transition to OneDrive and SharePoint.

Learn more and stay engaged..

Check out all the details on migrating to Microsoft 365 documented here. 

We are very thrilled to showcase the tools and best practices for migrating to Microsoft 365 . Please join us for these webinars 

Choosing the right tools for your Microsoft 365 migration on April 6, 2021 at 9:00 am PT.

Best practices for data migrations to Microsoft 365 on April 13, 2021 at 9:00 am PT.

Also, check out our latest episode of Sync Up- a OneDrive podcast to hear the experts on success factors that can help you drive an effective migration.

https://html5-player.libsyn.com/embed/episode/id/18429635/height/90/theme/custom/thumbnail/yes/direction/backward/render-playlist/no/custom-color/f99400/

We continue to evolve OneDrive as a place to access, share, and collaborate on all your files in Office 365, keeping them protected and readily accessible on all your devices, anywhere.

You can stay up-to-date on all things via the OneDrive Blog and the OneDrive release notes.

Check out the new and updated OneDrive documentation.

Take advantage of end-user training resources on our Office support center.

Thank you again for your support of OneDrive. We look forward to your continued feedback on UserVoice and hope to connect with you at Ignite or another upcoming Microsoft or community-led event.

Thanks for your time reading all about OneDrive,

Ankita Kirti

OneDrive | Microsoft

The Best of Microsoft Compliance at Ignite March 2021

by Contributed | Mar 24, 2021 | Technology

This article is contributed. See the original author and article here.

This will be your guide to the best things about Microsoft Compliance at Ignite March 2021. Bookmark it. Save it.  Come back to it. Share it. Reference it. Enjoy.

Microsoft Ignite March 2021 may be over but that does not mean you have to stop learning about Microsoft Compliance.  Earlier this year Microsoft CVP of Security, Compliance, and Identity (SCI), Vasu Jakkal spoke about how Microsoft surpassed over $10 billion of security business revenue. And while that’s a significant milestone we are just getting started.  Don’t be fooled…we are not just best in suite; we are best in breed. Just ask Gartner – the Magic Quadrants we reside in say so.  

Anyway, I digress.  Here is a quick recap of the Compliance announcements you may have missed:

• Microsoft Information Protection document co-authoring


• Microsoft 365 Insider Risk Management Analytics


• Microsoft 365 data loss prevention (DLP) for Chrome browsers and more


• Azure Purview integration with Microsoft Information Protection

Additionally, here goes the list of on-demand sessions you must absolutely watch in case you missed any of our Compliance goodies.

Security Keynote

CVP Vasu Jakkal talked about Microsoft’s vision on Security for All including how to reduce complexity and defend your organization against business risk with innovations in security, compliance, identity, and management. She is joined by a start studded cast in Security leader Andrew Conway, Identity leader Irina Nechaeva, and Compliance leader as they dig into the latest news, releases, and updates. WATCH ON-DEMAND Security for All

Compliance Keynote

Microsoft Compliance GM Alym Rayani illuminates how Microsoft’s risk management and compliance solutions enable you to identify and respond to these emerging risks while keeping your most important information safe. WATCH ON-DEMAND Manage risk and secure information across your environment

Compliance Sessions

• Deploy intelligent information protection and data loss prevention


• Take charge of data governance across your digital landscape


• Secure your sensitive information with Insider Risk Management

Ask the Experts

• Secure your sensitive information with Insider Risk Management (microsoft.com)

Security & Compliance Certifications

• Exam SC-900: Microsoft Security, Compliance, and Identity Fundamentals (beta)


• Exam SC-400: Microsoft Information Protection Administrator (Security exam beta)

Security & Learning Path (Online – Free)

• Describe the concepts of security, compliance, and identity


• Manage information protection and governance

Compliance Blogs

• 4 ways Microsoft is delivering security for all in a Zero Trust world


• Securing and governing data in a new hybrid work reality


• Compliance joins Microsoft Intelligent Security Association (MISA)

To learn more about Microsoft Security solutions, visit our website. Bookmark the Security blog to keep up with our expert coverage on security matters. Also, follow us at @MSFTSecurity for the latest news and updates on cybersecurity.

Follow Christopher on Twitter and LinkedIn

Launching threat analytics for Microsoft 365 Defender

by Contributed | Mar 24, 2021 | Technology

This article is contributed. See the original author and article here.

Threat analytics is Microsoft 365 Defender’s in-product threat intelligence (TI) solution designed to help defenders like you to efficiently understand, prevent, identify, and stop emerging threats. It provides a unique combination of in-depth TI analysis and reports from expert Microsoft security researchers, and consolidated data showing your organization’s security posture relative to the threats. Threat analytics helps you respond to and minimize the impact of active attacks.

As part of a unified extended detection and response (XDR) experience in Microsoft 365 Defender, threat analytics is now available for public preview. It includes better data coverage, incident management across security pillars, automatic investigation and remediation, and cross-domain hunting capabilities.  Microsoft 365 Defender threat analytics is available for Microsoft Defender for Office 365 and Microsoft Defender for Endpoint users.

If you’re familiar with threat analytics in Microsoft Defender for Endpoint, you’ll be excited to know that the integrated experience you’ll see in Microsoft 365 Defender threat analytics takes your report consumption to another level.

What’s new?

Threat analytics for Microsoft 365 Defender introduces:

• Better data coverage between Microsoft Defender for Endpoint and Microsoft Defender for Office 365, making combined incident management, automatic investigation, remediation, and proactive or reactive threat hunting across-the domain possible.


• Email-related detections and mitigations from Microsoft Defender for Office 365, in addition to the endpoint data already available from Microsoft Defender for Endpoint.


• A view of threat-related incidents that aggregate alerts into end-to-end attack stories across Microsoft Defender for Endpoint and Microsoft Defender for Office 365 to reduce the work queue, as well as simplify and speed up your investigation.


• Attack attempts detected and blocked by Microsoft Defender for Office 365. You can also see data that you can use to drive preventive actions that mitigate the risk of further exposure and increase resilience.


• Enhanced design that puts actionable information in the spotlight to help you quickly identify data to urgently focus on, investigate, and leverage from the reports. 

What’s in each report?

With each threat analytics report, you’ll find:

• Detailed analyst report—deep-dive analysis, MITRE techniques, detection details, recommended mitigations, and advance hunting queries that expand detection coverage.


• Active alerts and incidents. 


• Impacted assets, including your devices and mailboxes.


• Prevented email attempts, indicating whether you were a target of this threat even if the email has been blocked before delivery or delivered to the junk mail folder.


• Mitigations and their statuses, with options to investigate further and remediate weaknesses using threat and vulnerability management (please note that email related mitigations are found in the analyst report).

How do I get there?

• Threat analytics can be accessed from the Microsoft 365 security center navigation bar.


• When a new threat report is published or updated, you’ll get a badge in the navigation bar.


• A dedicated threat analytics card has also been added to the Microsoft 365 security center dashboard, so you can track the threats that are active on your network.

Ready to check it out? Explore these threat analytics reports.

Solorigate supply chain attack

Microsoft continues to work with partners and customers to expand our knowledge of the threat actor behind the nation-state cyberattacks that compromised the supply chain of SolarWinds and impacted multiple other organizations. Microsoft previously used ‘Solorigate’ as the primary designation for the actor, but moving forward, we want to place appropriate focus on the actors behind the sophisticated attacks, rather than one of the examples of malware used by the actors. Microsoft Threat Intelligence Center (MSTIC) has named the actor behind the attack against SolarWinds, the SUNBURST backdoor, TEARDROP malware, and related components as NOBELIUM. As we release new content and analysis, we will use NOBELIUM to refer to the actor and the campaign of attacks.

This report about the sophisticated attack details how NOBELIUM inserted malicious code into a supply chain development process. A malicious software class was included among many other legitimate classes and then signed with a legitimate certificate. The resulting binary included a backdoor and was then discreetly distributed into targeted organizations. This attack was discovered as part of an ongoing investigation.

Emotet breaks hiatus with spike in cybercrime activity

Understand how Emotet operators have started to ramp up activity starting July 2020. Notable for their involvement in Ryuk ransomware distribution, Emotet operators are back with basically the same goals, utilizing similar lure themes and macro-enabled documents. Despite the recent take-down which has interrupted Emotet, your security operation centers should continuously monitor Emotet-related alerts in your antivirus and EDR solutions. Secondary payloads delivered by Emotet prior to the take-down remain a serious and real threat to your network.

BazaLoader: Foothold for ransomware

Possibly tied to the same cybercriminals leveraging Trickbot infrastructure, these campaigns appear to be part of ongoing attempts to shift to other entry vectors. Started in late October 2020, these campaigns use phishing emails that take recipients through link chains to implant BazaLoader. Unsurprisingly, the new implant brings in potent tools like Cobalt Strike, which make persistent, direct human attack activity possible. Microsoft’s security solutions remain effective against this threat, regardless of the recent BazaLoader activities that we’ve observed this month. Use advanced hunting to proactively hunt for this threat in your Microsoft 365 security portal (Microsoft 365 Defender) or Microsoft Security Center portal (Microsoft Defender for Endpoint).

IcedID’s frosty arrival can lead to data theft

Get your shields up by learning about this modular banking trojan’s modus operandi and how Microsoft 365 Defender can help detect and stop IcedID campaigns at multiple points along the attack chain and across domains, including the very start.

New transactable offers from Denodo, Genymobile, and Confluent in Azure Marketplace

by Contributed | Mar 24, 2021 | Technology

This article is contributed. See the original author and article here.

Microsoft partners like Denodo, Genymobile, and Confluent deliver transact-capable offers, which allow you to purchase directly from Azure Marketplace. Learn about these offers below: Denodo Standard 8.0 (Hourly): Denodo Standard is a new, cost-effective option that helps small to medium-sized organizations get started with Denodo for departmental use cases. Its real-time integrated views can combine your Microsoft Azure data sources with data from on-premises databases and applications. Use Denodo’s modern data virtualization to accelerate your analytics and data services. Genymotion Cloud – Run Android as a VM on Azure: Genymotion Cloud is a suite of Android operating systems based on Microsoft Azure server instances. With Genymotion Cloud, you can access an Android application or environment from any device, just as you would access a remote desktop. This enables mobile threat detection, app testing, content sharing, and more. Apache Kafka on Confluent Cloud: Confluent Cloud lets you harness the power of Apache Kafka without the burden of infrastructure management. The fully managed event-streaming platform helps development teams deliver immediate value with real-time analytics use cases. Start streaming with Confluent Cloud on Microsoft Azure in seconds, with on-demand provisioning of elastically scalable clusters.

Microsoft Teams and on-premises mailboxes: Part 2 – Troubleshooting the Teams Calendar App

by Contributed | Mar 24, 2021 | Technology

This article is contributed. See the original author and article here.

This blog post is part 2 of the three-part series on Microsoft Teams and on-premises Exchange mailboxes.

Microsoft Teams and on-premises mailboxes: Part 1 – How do Teams and Exchange Server interact?

Teams Backend AutoDiscover
The Teams Backend Services use AutoDiscover Version 2 to find a user’s Exchange mailbox on behalf of a Teams client. This AutoDiscover V2 call is an anonymous call for performance reasons to determine the Exchange target URL for the mailbox sought as quickly as possible. As already mentioned in the previous blog post, the Teams Backend Services query the AutoDiscover endpoint of Exchange Online first. If Exchange Online does not host the mailbox, the services receive an HTTP redirect to search for the local Exchange organization’s endpoint.

The detailed steps are:

1. The Teams Backend Services query the Exchange Online AutoDiscover endpoint for the URL for the EWS protocol using an AutoDiscover V2 JSON query
https://outlook.office365.com/autodiscover/autodiscover.json?Email=John.Doe@varunagroup.de&Protocol=EWS

2. Exchange Online verifies the recipient type for the email address contained in the JSON query and replies with one of the following options:

a. RecipientType: Mailbox
https://outlook.office365.com/EWS/Exchange.asmx

The mailbox is an Exchange Online mailbox. No further steps are necessary. The Teams Services have the information they need to access the users’ calendar.

b. RecipientType: MailUser
Exchange Online determines the AutoDiscover endpoint based on the ExternalEmailAddress attribute; in this example autodiscover.varunagroup.de

3. Exchange Online replies with an HTTP 302 redirect to autodiscover.varunagroup.de

4. The Teams Backend Services send an AutoDiscover V2 JSON query for the URL for the EWS protocol
https://autodiscover.varunagroup.de/autodiscover/autodiscover.json?Email=John.Doe@varunagroup.de&Protocol=EWS

5. On-premises Exchange Server replies with an external EWS URL of a virtual Exchange Web Services virtual directory
Example: {“Protocol”:”EWS”,”Url”:”https://mail.varunagroup.de/EWS/Exchange.asmx“}

6. The Teams Backend Services use the received URL to establish a connection to the on-premises Exchange organization

But what do the Teams Backend Services exactly, after receiving the EWS URL? The services perform the following steps:

• Open an HTTPS connection to the on-premises EWS URL and perform an OAuth authentication using the registered services principal


• Send an EWS calendar query


• Receive the Exchange Web Services response


• Send the parsed calendar data to the Teams clients’ calendar app for further use

As you can see, accessing the calendar of a user mailbox hosted in an on-premises Exchange organization is complex. This complexity can lead to errors.

How can you now perform an error analysis for the AutoDiscover process and the subsequent calendar access? Let’s start with AutoDiscover.

Troubleshooting AutoDiscover
Since Microsoft Teams Backend Services perform all AutoDiscover and other client accesses, there are no viable troubleshooting steps on the local Teams client. The client itself must have access to the internet and proper DNS name resolution working.

Because AutoDiscover V2 uses anonymous access, you can test it for any email address. This self-test helps you as an IT administrator check AutoDiscover for a users’ email address that might not work correctly. You can check the AutoDiscover response using PowerShell or with the help of a browser.

PowerShell
Run the Invoke-RestMethod cmdlet with the following Uri-Strings for EWS and REST protocol

Invoke-RestMethod -Uri ‘https://outlook.office365.com/autodiscover/autodiscover.json?Email=John.Doe@varunagroup.de&Protocol=EWS‘

Invoke-RestMethod -Uri ‘https://outlook.office365.com/autodiscover/autodiscover.json?Email=John.Doe@varunagroup.de&Protocol=REST‘

Out-of-Office information and calendar-based presence status requests use the on-premises REST-endpoint.

Ensure that there are no unsupported characters in the Uri.

Browser
You can test and query the AutoDiscover endpoint using the following URLs

https://outlook.office365.com/autodiscover/autodiscover.json?Email=john.doe@varunagroup.de&Protocol=EWS
https://outlook.office365.com/autodiscover/autodiscover.json?Email=john.doe@varunagroup.de&Protocol=REST

For an on-premises mailbox, you receive an AutoDiscover response from your on-premises Exchange Server, like the one shown in the following screenshot.

Perform a Fiddler trace for a more detailed error analysis when executing the HTTPS queries. The trace results help you to identify other possible sources of error, i.e., a failed TLS handshake.
If an error occurs while determining the AutoDiscover information, this does not automatically imply a problem. Check the following options:

• The AutoDiscover query terminates with a timeout
  
  
  
  • Is the HTTPS access to your Exchange organization restricted to the remote IP address ranges of Microsoft 365?
  
  
  • Maybe the Exchange Server systems have a performance problem and cannot respond promptly?
  
  
  
  


• You receive a “User Not Found”-response
  
  
  
  • Is the user account excluded from the Azure AD Connect synchronization and does not exist as a “Mail User” object in Exchange Online?
  
  
  
  


• The response does not contain the expected EWS or REST URL
  
  
  
  • The mailbox is an on-premises mailbox, but the response contains the Exchange Online endpoint
  
  
  
  

https://outlook.office365.com/EWS/Exchange.asmx

Most likely, the user has an additional mailbox in Exchange Online. Resolve the double mailbox situation.

• 
  
  
  
  • The response contains a URL that seems to be an internal URL, i.e.,
  
  
  
  

https://exch01.varunagroup.local/EWS/Exchange.asmx 

The ExternalUrl attribute configuration is not correct for all virtual directories.

• 
  
  
  
  • You use bound namespaces, the user mailbox location is AD site EMEA, but the response contains an URL of a different site, i.e.,
  
  
  
  

https://mail.apac.varunagroup.de/EWS/Exchange.asmx

Expected URL: https://mail.emea.varunagroup.de/EWS/Exchange.asmx

Until March 2021, AutoDiscover V2 is not AD site-aware. The March 2021 cumulative updates for Exchange Server 2016 and 2019 fix this issue. Read more about the updates in this blog post.

• DNS Name resolution fails for the email address target domain
  
  
  
  • There is no DNS resource record for AutoDiscover in the internet-facing DNS zone
  
  
  
  

The next steps to identify connection problems lead us to the on-premises Exchange servers. With a local network trace, you can determine whether there are TLS handshake errors. Please note that your Exchange Server systems must be configured correctly for TLS 1.2. The TLS 1.2 configuration might require manual steps if you use Exchange Server 2016 or Exchange Server 2013.

If there are no errors in the TLS handshake, you must check the Exchange server’s log files. Checking the log files on the local Exchange servers requires several steps. Depending on your local Exchange organization’s size and the number of Exchange Servers, this check can be very complicated.

The following diagram shows the participating Exchange Server components of a single Exchange Server for incoming connections from the Teams Backend Services to the Exchange Web Services endpoint.

The IIS Default website receives the incoming HTTPS connection from the Teams Services and passes it to the Frontend Proxy component, i.e., EWS or REST. You find information about those two connections in the W3SVC1 (1) and the HttpProxy logs of the targeted protocol (2). The Frontend Proxy component proxies the connection to the Exchange Backend website of the Exchange Server, where the active database copy containing the user mailbox is mounted. This is not necessarily the same Exchange Server accepting the Frontend connection. You find information about this proxied connection in the W2SVC2 IIS logs (3) and the queried Exchange service (4). Depending on the Exchange protocol you want to troubleshoot, you must check the AutoDiscover, EWS, or REST log files.

Troubleshooting Calendar App
Now that you know how to deal with the AutoDiscover process’s errors, it’s time to take a look at the Teams Calendar app.

Suppose the access to AutoDiscover works without errors. There is a high probability that the access to the Exchange Web Services will also work, and therefore the calendar app in the Teams client will show calendar information.

However, if the Teams client does not display the calendar, check the following:

• Can the EWS URL determined by AutoDiscover, is the hostname resolvable in the domain’s external DNS zone, and can it be reached from the Internet via HTTPS?
  
  
  
  • Use a browser to connect to the EWS URL and use Fiddler to identify any connection-based issues
    The EWS endpoint must reply with am HTTP 401 status code
  
  
  
  


• Use the Remote Connectivity Analyzer to perform a Teams Calendar Access Tab Test

http://bit.ly/TeamsCalTest

• Verify the OAuth Authentication configuration
  
  
  
  • Use the PowerShell Cmdlet Test-OAuthConnectivity
  
  
  • Verify ServicePrincipalNames, IntraOrganization- and AuthServer-configuration
  
  
  
  

In the next blog post, we will take a closer look at calendar delegate situations.

Links

• Exchange Server TLS guidance Part 2: Enabling TLS 1.2 and Identifying Clients Not Using It


• My user has a mailbox both on-premises and in Exchange Online. Help!


• Configure OAuth authentication between Exchange and Exchange Online organizations


• Troubleshoot Microsoft Teams and Exchange Server interaction issues


• Released: March 2021 Quarterly Exchange Updates
  
  

Thomas Stensitzki is a leading technology consultant focusing on Microsoft messaging and collaboration technologies and the owner of Granikos GmbH & Co. KG. He is an MVP for Office Apps & Services and an MCT Regional Lead. As a user group organizer, he hosts the Microsoft Teams User Group Berlin and the Exchange User Group DACH.

Twitter: https://twitter.com/stensitzki
Blog: https://JustCantGetEnough.Granikos.eu
Teams User Group: https://TeamsUserGroup.berlin
Exchange User Group: https://exusg.de

To write your own blog on a topic of interest as a guest blogger in the Microsoft Teams Community, please submit your idea here: https://aka.ms/TeamsCommunityBlogger