MyUCLab

Automating Teams allowed domains - part 2

Sun, 05 Apr 2020 14:35:00 +0000

This is the second part of te article how to create a provisioning system for allowed domains. In the first part we started with creating a SharePoint List to store all the requests. After we created the list we started creating the approval flow.

In this part we will finish the flow and will create the Azure Runbook to configure the allowed domains in our tenant.

Before we continue with our Microsoft Flow we first need to jump to Azure and configure our Azure Runbook.

The steps required can be divided in 4 sections:

Create an Azure Automation Account
Adding credentials which can be used within the runbooks
Upload the Skype for Business PowerShell module
Create the script which needs to be executed

Create an Azure Automation Account

To perform this task we first need to create an Azure Automation Account this can be done by following the steps below:

Browse to https://portal.azure.com
In the Search field enter Automation Accounts
Select the Automation Accounts from the Services section
Select Add
Provide a Name
Select the correct Subscription
Select the Resource group
Select the Location (select the region closest to your O365 tenant)
CLick Create

The creation of the account might take several minutes.

Adding credentials

Once the task has been created we can continue with adding the credentials which will be used by the automation account to connect to our Teams tenant. An important thing is that the account you want to use for this should NOT be enabled for MFA and has been assigned the Teams Service Administrator permissions.

To do this perform the following steps:

Select the automation account created
In the left menu browse to the Shared Resources and select Credentials
Select Add a credential and provide a username and password which can be used to connect to the Teams tenant
Provide the username and password and select Create

Remark: Since it does not have MFA it is a good idea to monitor > the usage of this account to ensure it is not abused. > Guidance how to do this can be found here:

https://docs.microsoft.com/en-us/azure/active-directory/users-groups-roles/directory-emergency-access#monitor-sign-in-and-audit-logs

Now the credentials are added the next step is to add the Skype for Business Online PowerShell module to our automation account. By default several PowerShell modules are included such AzureRM modules. To make the Skype for Business Online Module available we first need to install it on a local machine. If you don’t have it installed you you can download the latest version of the module from the linke below:

https://www.microsoft.com/en-us/download/details.aspx?id=39366

Remark: If you already had the module installed make sure it is the latest version available. During the preparation of writing this blog I also hit an issue where uploading the PowerShell module failed with different errors. Upon further investigation I found out that I did not had the latest version of the module installed. Once the most recent version of the module was installed the PowerShell module could be uploaded without an issue.

Once the Skype for Business Online PowerShell module is installed we need to zip the module so we can upload it to Azure. Perform the following steps:

Browse to C:\Program Files\Common Files\Skype for Business Online\Modules
Zip the SkypeOnlineConnector directory
Ensure the zip is named SkypeOnlineConnector.zip

Now we zipped the PowerShell module the next step is to upload it to Azure so we can use it in our Azure Runbook. To do this perform the steps below:

Go back to Azure Automation Accounts**
Select the automation accounts created earlier
In the Shared resources section select Modules
From the main pane select Add module
In the Add a module window select the zip file and press OK

Importing the module might take several minutes. Once the module is imported it is time to create the Runbook.

Now the module has been important we can provide the script which needs to be executed everytime the runbook is executed. To create the runbook perform the following steps:

In the Process Automation section select Runbooks
Select Create a runbook from the main pane
Provide a Name and make sure Runbook type is set to PowerShell
Select Create
In the main pane add the script below:

param(
    [string] $domainName
)
# Get stored credentials
$credential = Get-AutomationPSCredential -Name 'svc_sfb_automation'
# Connect to tenant 
$session = New-CsOnlineSession -Credential $credential
import-pssession $session -AllowClobber|Out-Null

# Initialize variables
[bool] $dnsValidation = $false
[string] $proxyFqdn = ""
[string] $result = ""
[string] $fedrecordresult = ""
$fedrecord = "_sipfederationtls._tcp." + $domainName

# Retrieve current allowed domain list
$tenantConfig = Get-CsTenantFederationConfiguration
$domain = $tenantConfig.AllowedDomains.AllowedDomain | ?{$_.Domain -eq $domainName}

if($domain -ne $null)
{
    Write-Warning "Domain is already part of allow list, skip processing"
}
else
{
    # Validate if sipfederation record exists
    $uri = "https://dns.google.com/resolve?name={0}&type=srv" -f $fedrecord
    $dnsresolve = Invoke-RestMethod -uri $uri

    if($dnsresolve -ne $null)
    {
    $proxyFqdn = $dnsresolve.answer.data.split(" ")[3].trimend(".")
    $dnsValidation = $true
    }

    # If the domain is not in the list and the dns record exists add the domain to the allow list
    if ($domain -eq $null -and $proxyFqdn -ne $null)
    {
        $allowedDomain = New-CsEdgeDomainPattern -Domain $domainName
        $tenantConfig.AllowedDomains.AllowedDomain.Add($allowedDomain)|Out-Null
        Set-CsTenantFederationConfiguration -Tenant $tenant.tenantID  -AllowedDomains $tenantConfig.AllowedDomains

        $tenantConfig = Get-CsTenantFederationConfiguration
        $domainresult = $tenantConfig.AllowedDomains.AllowedDomain | ?{$_.Domain -eq $domainName}

        if($domainresult -ne $null)
        {
            $result = "succeeded"
        }
        else
        {
            $result = "failed"
        }
    }
    else
    {
        $result = "failed"
    }

    # Create result object
    $Results = New-Object -Type PSObject
    $Results | Add-Member -Type NoteProperty -Name "domainName" -Value $domainName
    $Results | Add-Member -Type NoteProperty -Name "dnsValidation" -Value $dnsValidation
    $Results | Add-Member -Type NoteProperty -Name "proxyFqdn" -Value $proxyFqdn
    $Results | Add-Member -Type NoteProperty -Name "Result" -Value $result
}

# Return results
Write-Output $Results|ConvertTo-Json
Remove-pssession $session

Once the script has been added select Save
Optionally you can select Test Pane and test the runbook. Keep in mind that this adds the domain to the allowed domain list.
Once your happy with the results select Publish

Updating Flow

Now we have created the runbook let’s make sure that once the item is approved the item in the SharePoint list will be updated. To do this we need to add an update item block in the If yes tree from the workflow.

Once the update item block has been added update perform the following tasks

In the Site Address select the SharePoint site which contains SharePoints list used to be stored the allowed domains
In the List Name select the list containing the allowed domains
in the Id select the Id parameter from the When a new item is created section
In the DomainName select the DomainName parameter from the When a new item is created section
In the DateApproved select Expression and enter Utcnow() as the value of the expression and press OK

Update the value of the status field to processing

In the flow add a Create Job block. This block is not part of the default set and requires an additional license which support the Premium features.

Once you have inserted the block perform the following steps:

Make sure the correct Subscription is selected
Select the resource group the drop down list and make sure it is the same as the automation account created earlier
Create the earlier created Automation Account
Select the earlier created Azure Runbook from the drop down menu in the RunBook Name field
Set Wait for Job to Yes
Select the SharePoint field value DomainName as the value for the Runbook Parameter DomainName field

Now we have added the job we need to retrieve the results from the job. Reason for this is that we need the results from the job to populate the Result field in our SharePoint list.

To get the results from the Azure Runbook add a Get job output block and configure it as follows:

Select the correct Azure Subscription in the Subscription field
Add the same Resource Group as in the Create Job block
Select the same automation account as used earlier
Select the Job ID as value from the Job ID field. This can be done by clicking in the field and select Job ID from the list of available parameters

Since we generated a JSON output using our script we need to use a Parse JSON block to parse the results from the Azure Runbook.

Before adding the block make sure you have an example of the JSON output which can be used to generate the schema. You can get this by running the Azure Runbook once manually.

If you want to take the easy route add the following content to the Schema field of the Parse JSON block.

{
    "type": "object",
    "properties": {
        "domainName": {
            "type": "string"
        },
        "dnsValidation": {
            "type": "boolean"
        },
        "proxyFqdn": {
            "type": "string"
        },
        "Result": {
            "type": "string"
        }
    }
}

In both scenarios select the Content parameter from the Get job output section by clicking somewhere in the Content field from the Parse JSON block.

Now we have the result of the runbook stored in an object we can access the properties of the object and use them in the workflow.

We are going to check the value of the Result property. If it is set to succeeded we know the allowed domain has been succesfully added to the allowed domain list, if it has a different value it has failed.

Based on this condition we can update the SharePoint list and send an e-mail to the requestor that the request has been completed either successfully or has failed.

Add a Condition block to the workflow below the Parse JSON block.

Click in the Choose a value field and in the Search dynamic content field enter Result. This will return the Result property from the Parse JSON object. Leave the is equal to value as is and set the value to succeeded.

In the If yes tree add two blocks:

update item
send an email (V2) 2

Update item

This update item block will be used to update the item in the SharePoint list. Make the following changes once you added the block:

In the Site Address select the SharePoint site which contains SharePoints list used to be stored the allowed domains
In the List Name select the list containing the allowed domains
in the Id select the Id parameter from the When a new item is created section
In the DomainName select the DomainName parameter from the When a new item is created section
In the Requestor field add the Requestor parameter from the When a new item is created
Set the DomainValidated to No
The value for the DomainDNSRecordValidated field will be set by using a function. Select Expression and specify the expression as follows:

if(equals(body('Parse_JSON')?['dnsValidation'],bool('true')),bool('true'),bool('false'))

In the proxyFQDN field add the proxyFQDN property from the Parse JSON section
Set the Status field to completed

Send an email

The last step is to update the fields of the Send an email(V2) 2 block.

In the To field add the Created by Email from the When a new item is created section
In the Subject field add the DomainName from the variables section and add some additional text, for example successfully added to allow list
In the Body field enter text which you want to send to the requestor
Optionally you can change the from address by selecting Show advanced options

In the If no tree we will do exactly the same as in the If yes tree.

Update item

In the Site Address select the SharePoint site which contains SharePoints list used to be stored the allowed domains
In the List Name select the list containing the allowed domains
in the Id select the Id parameter from the When a new item is created section
In the DomainName select the DomainName parameter from the When a new item is created section
In the Requestor field add the Requestor parameter from the When a new item is created
Set the DomainValidated to No
The value for the DomainDNSRecordValidated field to No
Set the Status field to failed

Send an email

The last step is to update the fields of the Send an email(V2) 2 block.

In the To field add the Created by Email from the When a new item is created section
In the Subject field add the DomainName from the variables section and add some additional text, for example was not added to the allowed domain list
In the Body field enter text which you want to send to the requestor
Optionally you can change the from address by selecting Show advanced options

Here end the second part of the multi-part article on how to create a provisioning system for allowed domains in Teams. In this part we started with configuring the Azure piece of the provisioning system. Once that was completed we updated our flow to execute the Azure Runbook, update the SharePoint List and sending an e-mail to the requestor.

In the next part we will look at how to build a more user friendly way to add a domain to the allowed domain list. How we are going to do that remains a surprise ;-)

Automating Teams allowed domains - part 1

Thu, 19 Mar 2020 20:49:00 +0000

This is a multi-part article which describes how to build a provisioning system for allowed domains. In the first part we will start building our provisioning system by building the fundamentals first.

Within Teams it is possible to communicate with external companies, this is also known as federation. Federation can be either configured as open or closed federation. In case of open federation your users are able to to communicate with all external users (assuming those companies also allow federation). When using closed federation users can only communicate with users from domains which are part of the allowed domain list.

In most cases this requires some kind of approval either from a manager or sometimes even the legal department. This due to the fact that when allowing federation users are able to exchange information with other companies which might not be allowed in some scenarios.

So what will the provisioning do:

allow users to submit a new allowed domain
contain an approval process to allow someone within your organization to approve or reject a request
add the domain to the allowed domain list in Teams

Now we know what we want to build let’s have a look which tools we are going to use to build the solution. To allow users to submit a new request we will build a PowerApp which stores requests in a SharePoint list.

Once entries are created we use Microsoft Flow to pickup those entries and start the approval process. If a request is approved the Flow will continue and will start an Azure Runbook to perform some validation tests and add the domain to the allowed domain list.

Our journey starts on SharePoint Online. To store the results we are going to use a list. You can either create a complete site from scratch and add a list to it or use an existing site and add a list.

In our case we are going to use an existing SharePoint site and add a List. To do this perform the following steps:

Browse to the SharePoint site
Select New and from the menu select List

Provide a name for the SharePoint list, for example FederationAllowedDomains
From the left menu select Site contents and locate the list created earlier
Select the dots next to the list and select Settings
This will bring us to a new page which allows us to add additional columns
Browse to the Columns part and click on the Title column
Rename the column to DomainName
On the bottom part of the Columns section locate the Create column option
Add the following columns:

Columname	Type
Requestor	single line of text
DateApproved	date and time
BusinessJustification	multipe lines of text
DomainValidated	Yes/No
DomainDNSRecordValidated	Yes/No
proxyfqdn	single line of text
Status	single line of text

Once all columns have been added select Site contents from the left menu. Once the content site content has been loaded open the list just created

Now we’ve created the list the next step is to create create the Flow.

To start this task select the Flow button from the menu followed by Create a flow. Once pressed this will open a new menu on the right side of the screen which contains templates which can be used as a good startpoint.

As described already we want to create an approval flow. One of the templates available is the Start approval when a new item is added. Select this option from the menu and wait till the Microsoft Flow website has loaded.

Continue with the steps below to complete the creation of the flow:

In the This flow will connect to section make sure a green checkmark is listed behind each item. If not select the + sign.
Repeat this step for item until all lines have a green checkmark and click continue

Remark: this account will also be displayed as the from address of the approval mail

If we want all approvals to be send to a one or more users in the environment perform the following step:

In the Start an approval block add a user who will be responsible for approving every request to the Assigned To. If you want the approval request to be send to more users simply add an additional user.

In case you want to send the approval to the manager of the requestor perform the following steps instead of the previous step:

Insert a Get Manager (v2) block after the When a new item is created block
In the Get Manager (v2) block add the Created By Email from the list
In the Start an approval add the Mail item to the Assigned To field

Here end the first part of the multi-part article on how to create a provisioning system for allowed domains in Teams. In this part we started with creating a SharePoint list which will be used to store the requests and made a start creating the approval flow.

In the next part we will continue our work on the flow and will implement the Azure Runbook to configure the allowed domain in Teams.

Skype for Business Location Information Services (LIS) - part 1

Fri, 01 Nov 2019 20:49:00 +0000

This is a multi-part article. In the first part we will have a look what Location Information Services (LIS) is and how to configure. In the second part we will look at how it works and how you can troubleshoot Location Information Services.

Location Information Services is a functionality build-in Skype for Business Server. The initial version of LIS was introduced in Lync Server 2010 and changes were made in the newer versions of the product.

In most cases you will see that LIS is implemented due to the requirement to have E9-1-1 functionality.

Enhanced 9-1-1 (E9-1-1) is an emergency notification feature that associates the calling party’s telephone number with a civic or a street address. Using this information, the Public Safety Answering Point (PSAP) can immediately dispatch emergency services to the caller in distress.

source: Deploy emergency services

Deploying LIS requires you to perform the following steps:

Configure the telephony part
Create location policies
Configure the LIS database
(Optional) configure advanced features

The configuration can be partially done via the Skype for Business Control Panel but most work needs to be done via PowerShell.

As mentioned in the numbered list the first thing you have to do is setup the telephony part

#Configure PSTN usage
Set-CsPstnUsage -Usage @{add='EmergencyUsage'}

#Create a new voice route for E-9-1-1 and add the earlier previously created PSTN usage
New-CsVoiceRoute -Name "EmergencyRoute" -NumberPattern "^\+911$" -PstnUsages @{add="EmergencyUsage"} -PstnGatewayList @{add="e911-trunk"}

Once those steps have been performed you need to decide if you want to configure the E9-1-1 settings for all users in the organization or only for a subset of the users. If you need to configure it for all users you can modify the Global location policy else you will need to create a policy which can be assigned on a per user level.

#Modify global location policy
Set-CsLocationPolicy -Identity Global -EnhancedEmergencyServicesEnabled $true -LocationRequired "disclaimer" -EnhancedEmergencyServiceDisclaimer "Your company policy requires you to set a location. If you do not set a location emergency services will not be able to locate you in an emergency. Please set a location." -PstnUsage "emergencyUsage" -EmergencyDialString "911" -ConferenceMode "twoway" -ConferenceUri "sip:+31201234567@myuclab.nl" -EmergencyDialMask "112" NotificationUri "sip:security@myuclab.nl" -UseLocationForE911Only $true -LocationRefreshInterval 2

#Per user policy
New-CsLocationPolicy -Identity Tag:Amsterdam - EnhancedEmergencyServicesEnabled $true -LocationRequired "disclaimer" -EnhancedEmergencyServiceDisclaimer "Your company policy requires you to set a location. If you do not set a location emergency services will not be able to locate you in an emergency. Please set a location." -UseLocationForE911Only $false -PstnUsage "EmergencyUsage" -EmergencyDialString "911" -EmergencyDialMask "112" -NotificationUri "sip:security@myuclab.nl" -ConferenceUri "sip:+31201234567@myuclab.nl" -ConferenceMode "twoway" -LocationRefreshInterval 2

#Assign the policy to a user
(Get-CsUser | where { $_.Name -match "Johan" }) | Grant-CsLocationPolicy -PolicyName Amsterdam

Once the location policy has been configured and assigned (in case you did not use the global one). It is time to populate the LIS database.

The LIS database is part of the backend databases of Skype for Business and is named LIS. The database contains the following tables which contain the location, physical location and network related data:

Tablename	Data
dbo.CivicAddress	Contains the civic address details and mapping to the location id
dbo.Location	Contains the location info
dbo.Port	Contains the switchport info and mapping to the location
dbo.Subnet	Contains the subnet info and mapping to the location
dbo.Switch	Contains the switch info and mapping to the location
dbo.WirelessAccessPoint	Contains the access point info and mapping to the location

Data can be added to the database by using the following PowerShell cmdlets:

#Add a subnet
Set-CsLisSubnet

#Add a wireless access point
Set-CsLisWirelessAccessPoint

#Add a switch
Set-CsLisSwitch

#Add a switch port
Set-CsLisPort

#Example of adding a subnet to a civic location
Set-CsLisSubnet -Subnet 157.56.66.0 -Description "Subnet 1" -Location Location1 -CompanyName "MyUCLab" -HouseNumber 1234 -HouseNumberSuffix "" -PreDirectional "" -StreetName 163rd -StreetSuffix Ave -PostDirectional NE -City Redmond -State WA -PostalCode 99123 -Country US

Once all network related data has been added it is time to configure the external LIS provider. This requires both a password and a valid certificate:

$pwd = Read-Host -AsSecureString <password>
Set-CsLisServiceProvider -ServiceProviderName <Identity of provider> -ValidationServiceUrl <URL provided by provider> -CertFileName <location of certificate provided by provider> -Password $pwd

Now the LIS provider has been configured we can validate the civic addresses which are configured as part of the network configuration.

#Validate all civic addresses configured
Get-CsLisCivicAddress | Test-CsLisCivicAddress -UpdateValidationStatus

Now everything has been configured the last step is to publish the configuration to the LIS database.

Publish-CsLisConfiguration

Now the LIS data has been published it is time for some testing. But for that you will have to wait for part 2 of this article.

Hit refresh

Mon, 28 Oct 2019 22:02:22 +0000

It has been a very long time ago since I have wrote my last blog. Multiple things happened in my life which resulted in no time to write blogs anymore: finished my study, work, family etc. This weekend I decided to pickup blogging again.

As you might already have seen a few things have changed: moved away from Wordpress, changed website layout and last change was completed this week changing my domain from johanveldhuis.nl to myuclab.nl.

In the coming weeks I will write several blogs. Focus of the blogs will remain the same although it will probably be more Lync/Skype and Teams related since I have changed focus.

SefaUtil Gui v2.1

Sun, 15 Nov 2015 15:22:22 +0000

SefaUtil Gui v2.1 is a new minor version is published of the SefaUtil GUI script. It contains some small improvements to fix some issues some users experienced. Issues fixed in this release are:

searching for delegates doesn’t work correctly
time before forwarding to a team could not be configured

If you find new issues please let me know.

Download SefaUtil GUI v2.1

SefaUtil GUI v2

Mon, 07 Sep 2015 21:26:48 +0000

With pleasure I present you SefaUtil GUI v2. First thanks to all the beta tester which provided a lot of good feedback which has been incorporated in the tool.

So know you probably want to know what has improved?

SQL querying

Well several things have been improved but most improved piece is retrieving the current settings. As you may know Sefautil signs in for every action which you executie: both query and change. Greig Sheridan (@greiginsydney) pointer me to the script of James Cussen which contained soms SQL to query certain databases for Lync. Based on that script I started the research on how I could user those scripts in SefaUtil GUI. It took soms time but in this version querying the setting for a user is performed by using SQL queries. This speeds up the process amazingly. Changing settings is still performed by invoking SefaUtil.exe

Pool switching

The GUI now contains an option to switch from pools. So if you have multiple pools you can now easily switch by using the GUI. This will safe you time because you now don’t have to reload the tool. In addition to this the user list now only contains the users homed on that pool. The delegates list still is the long list which contains all Enterprise Voice enabled users.

Backup and recovery

An option has been introduced to backup & recovery your SefaUtil settings. Please test this functionality yourself before using it in production. As far as I have tested I it worked good for me but I strongly encourage you to test it in a lab environment prior to restoring settings in production.

Skype for Business support

Skype for Business is available for a while so I added support for this also. Keep in mind this will user a different version of SefaUtil.exe compared to the one for Lync 2013.

Parameters

Additional parameters have been added most on request:

SfB2015: Could be used to overwrite the default location of SefaUtil for Skype for Business Server 2015
Groupiddigits: Could be used to overwrite amount of digits used for team calls incl. # if used, default value is 3
Loaddata: Can be used to prevent to automatically load data

Besides this a lot of code optimization has been performed and several bugs have been fixed.

As with all software despite the heavy testing you might find an issue. If so please let me know so I can assist you with troubleshooting the issue and make code changes if necessary so other people can benefit from it.

SefaUtil GUI V2 van be downloaded via the link below:

SefaUtil GUI V2 SefaUtil GUI V2 106.88 KB

Download

An error occurred when processing the security tokens in the message

Thu, 09 Jan 2014 22:43:21 +0000

Federation always fun as you may have read in one of my previous blogs. Starting this week we had some issues at a customer where the Free/busy lookups across environments stopped working. Not only to other Exchange environments but also Office 365.

Both the Outlook logging and event logs on the CAS provided the same error. The complete error message is displayed below:

Process Microsoft.Exchange.InfoWorker.Common.Delayed`1[System.String]: <johan.veldhuis@domain.com>SMTP:johan.veldhuis@domain.com failed. Exception returned is Microsoft.Exchange.InfoWorker.Common.Availability.AutoDiscoverFailedException: Autodiscover failed for e-mail address <johan.veldhuis@domain.com>SMTP:johan.veldhuis@domain.com with exception System.Web.Services.Protocols.SoapHeaderException: An error occurred when processing the security tokens in the message.

at System.Web.Services.Protocols.SoapHttpClientProtocol.ReadResponse(SoapClientMessage message, WebResponse response, Stream responseStream, Boolean asyncCall)

at System.Web.Services.Protocols.SoapHttpClientProtocol.EndInvoke(IAsyncResult asyncResult)

at Microsoft.Exchange.SoapWebClient.AutoDiscover.DefaultBinding_Autodiscover.EndGetUserSettings(IAsyncResult asyncResult)

at Microsoft.Exchange.InfoWorker.Common.Availability.UserSoapAutoDiscoverRequest.EndGetSettings(IAsyncResult asyncResult)

_ at Microsoft.Exchange.InfoWorker.Common.Availability.SoapAutoDiscoverRequest.<>c__DisplayClass4.b\_\_3()_

at Microsoft.Exchange.InfoWorker.Common.Availability.SoapAutoDiscoverRequest.ExecuteAndHandleException(ExecuteAndHandleExceptionDelegate operation). —> System.Web.Services.Protocols.SoapHeaderException: An error occurred when processing the security tokens in the message.

at System.Web.Services.Protocols.SoapHttpClientProtocol.ReadResponse(SoapClientMessage message, WebResponse response, Stream responseStream, Boolean asyncCall)

at System.Web.Services.Protocols.SoapHttpClientProtocol.EndInvoke(IAsyncResult asyncResult)

at Microsoft.Exchange.SoapWebClient.AutoDiscover.DefaultBinding_Autodiscover.EndGetUserSettings(IAsyncResult asyncResult)

at Microsoft.Exchange.InfoWorker.Common.Availability.UserSoapAutoDiscoverRequest.EndGetSettings(IAsyncResult asyncResult)

at Microsoft.Exchange.InfoWorker.Common.Availability.SoapAutoDiscoverRequest.<>c__DisplayClass4.b\_\_3()

at Microsoft.Exchange.InfoWorker.Common.Availability.SoapAutoDiscoverRequest.ExecuteAndHandleException(ExecuteAndHandleExceptionDelegate operation)

— End of inner exception stack trace —

. Name of the server where exception originated: EXC01. This event may occur when Availability Service cannot discover an Availability Service in the remote forest.

The bold part marks the error in this case An error occurred when processing the security tokens in the message. This error tells you there is an issue with the security token which your server has received from the Microsoft Federation Gateway. So probably this customer is not the only customer facing this issue.

Microsoft has acknowledged there were some issues earlier this week which not only affected this functionality but also some Office 365 services.

Currently a work around is available to fix this issue. To fix the issue you will need to refresh the federation trust metadata. This can be done by using the following Powershell cmdlets:

_Get-Federationtrust

Set-Federationtrust -Refreshmetadata_

It is important to know that this cmdlet will need to be run on both sides else it may not fix the issues. Once the cmdlet have been executed it may take some time before the free/busy lookups start to work again.

Relinquishing job because the mailbox is locked

Fri, 20 Dec 2013 20:46:32 +0000

During a migration to Office 365 I had this issue. The migration of a mailbox was stalled several times with the following entry logged in the migration log Relinquishing job because the mailbox is locked. Sometimes this occurs only once but I have seen times that the mailbox will get stuck in this phase.

12/20/2013 9:24:08 AM [DB4PR04MB459] The Microsoft Exchange Mailbox Replication service ‘DB4PR04MB459.eurprd04.prod.outlook.com’ (15.0.842.8 caps:01FF) is examining the request. 12/20/2013 9:24:09 AM [DB4PR04MB459] Connected to target mailbox ‘Primary (4ca8eac9-f378-4e82-8d07-f984c64176e8)’, database ‘EURPR04DG029-db041’, Mailbox server ‘DB4PR04MB459.eurprd04.prod.outlook.com’ Version 15.0 (Build 842.0). 12/20/2013 9:24:09 AM [DB4PR04MB459] Connected to target mailbox ‘Archive (07121074-d871-4db9-9f4e-153010131a50)’, database ‘EURPR04DG029-db041’, Mailbox server ‘DB4PR04MB459.eurprd04.prod.outlook.com’ Version 15.0 (Build 842.0). 12/20/2013 9:24:14 AM [DB4PR04MB459] Connected to source mailbox ‘Primary (4ca8eac9-f378-4e82-8d07-f984c64176e8)’, database ‘MB_Others’, Mailbox server ‘CAS02.corp.local’ Version 14.3 (Build 158.0), proxy server ‘CAS01.corp.local’ 14.3.151.0 caps:05FFFF. 12/20/2013 9:24:15 AM [DB4PR04MB459] Connected to source mailbox ‘Archive (07121074-d871-4db9-9f4e-153010131a50)’, database ‘MB_Archives_Large’, Mailbox server ‘CAS02.corp.local’ Version 14.3 (Build 158.0), proxy server ‘CAS01.corp.local’ 14.3.151.0 caps:05FFFF. 12/20/2013 9:24:15 AM [DB4PR04MB459] Relinquishing job because the mailbox is locked. The job will attempt to continue again after 12/20/2013 9:29:15 AM.

When searching in Googl you will see several tips but most of them will point to TMG or a Firewall which will block the large amount of requests Office 365 sends because it thinks it’s unsafe. Microsoft has published a Knowledge Base article about this which you can find here.

The solution Microsoft offers is raising the value of the Custom Limit in the Flood Mitigation Settings. Microsoft will tell you to raise this number to a higher value but it depends on the amount of mailboxes how high you will configure this value.

Of course this is a nice solution but it might require the modification of the value multiple times. Despite this value will be applied to all IP addresses including those from evil users. There must be a nicer solution. A more suitable solution is to not apply the Flood mitigation settings to the IP addresses of Office 365.

To configure this it is recommended to create a computer group which contains the separate IP addresses and subnets which are being used by Office 365. In the image below you can see an example.

For a complete overview of the IP addresses used by Office 365 you van visit the following pages:

Exchange Online Protection IP addresses

Office 365 URLs and IP address ranges

It is recommended to visit both pages and add the IP’s and subnets to the computer group. Once the group is created add the group to the IP Exceptions tab. Once the configuration has been activated in TMG you wille see that the migrations will continue and will not stop anymore. This last benefit has another benefit the migration of a mailbox will be completed faster.

Troubleshooting federated sharing – part III

Fri, 29 Nov 2013 21:29:54 +0000

In the first two parts of the blog series about troubleshooting federated sharing we had a look at the infrastructure and configuration which is required. Besides this we did some basic troubleshooting on the components involved during federated sharing. In this part we will look at some examples which I gathered during troubleshooting a federated sharing issue.

Below you will see an example of an error which was received when trying to retrieve the free/busy information from a user hosted on another Exchange environment.

Process 1212: ProxyWebRequest FederatedCrossForest from S-1-5-21-1671710892-3805255249-3875359145-102309 to https://mail.domain.com/ews/exchange.asmx/WSSecurity failed. Caller SIDs: WSSecurity. The exception returned is Microsoft.Exchange.InfoWorker.Common.Availability.ProxyWebRequestProcessingException: System.Net.WebException: The underlying connection was closed: Could not establish trust relationship for the SSL/TLS secure channel. —> System.Security.Authentication.AuthenticationException: The remote certificate is invalid according to the validation procedure.

at System.Net.TlsStream.EndWrite(IAsyncResult asyncResult)

at System.Net.PooledStream.EndWrite(IAsyncResult asyncResult)

at System.Net.ConnectStream.WriteHeadersCallback(IAsyncResult ar)

— End of inner exception stack trace —

at System.Web.Services.Protocols.WebClientAsyncResult.WaitForResponse()

at System.Web.Services.Protocols.WebClientProtocol.EndSend(IAsyncResult asyncResult, Object& internalAsyncState, Stream& responseStream)

at System.Web.Services.Protocols.SoapHttpClientProtocol.EndInvoke(IAsyncResult asyncResult)

at Microsoft.Exchange.InfoWorker.Common.Availability.Proxy.Service.EndGetUserAvailability(IAsyncResult asyncResult)

at Microsoft.Exchange.InfoWorker.Common.Availability.FreeBusyApplication.EndProxyWebRequest(ProxyWebRequest proxyWebRequest, QueryList queryList, Service service, IAsyncResult asyncResult)

at Microsoft.Exchange.InfoWorker.Common.Availability.ProxyWebRequest.EndInvoke(IAsyncResult asyncResult)

at Microsoft.Exchange.InfoWorker.Common.Availability.AsyncWebRequest.EndInvokeWithErrorHandling():. The request information is ProxyWebRequest type = FederatedCrossForest, url = https://mail.domain.com/ews/exchange.asmx/WSSecurity

Mailbox list = Johan@domain.comSMTP:Johan@domain.com, Parameters: windowStart = 10/1/2013 10:00:00 AM, windowEnd = 10/31/2013 10:00:00 AM, MergedFBInterval = 30, RequestedView = Detailed

. —> System.Net.WebException: The underlying connection was closed: Could not establish trust relationship for the SSL/TLS secure channel. —> System.Security.Authentication.AuthenticationException: The remote certificate is invalid according to the validation procedure.

at System.Net.TlsStream.EndWrite(IAsyncResult asyncResult)

at System.Net.PooledStream.EndWrite(IAsyncResult asyncResult)

at System.Net.ConnectStream.WriteHeadersCallback(IAsyncResult ar)

— End of inner exception stack trace —

at System.Web.Services.Protocols.WebClientAsyncResult.WaitForResponse()

at System.Web.Services.Protocols.WebClientProtocol.EndSend(IAsyncResult asyncResult, Object& internalAsyncState, Stream& responseStream)

at System.Web.Services.Protocols.SoapHttpClientProtocol.EndInvoke(IAsyncResult asyncResult)

at Microsoft.Exchange.InfoWorker.Common.Availability.Proxy.Service.EndGetUserAvailability(IAsyncResult asyncResult)

at Microsoft.Exchange.InfoWorker.Common.Availability.FreeBusyApplication.EndProxyWebRequest(ProxyWebRequest proxyWebRequest, QueryList queryList, Service service, IAsyncResult asyncResult)

at Microsoft.Exchange.InfoWorker.Common.Availability.ProxyWebRequest.EndInvoke(IAsyncResult asyncResult)

at Microsoft.Exchange.InfoWorker.Common.Availability.AsyncWebRequest.EndInvokeWithErrorHandling()

— End of inner exception stack trace —

. Name of the server where exception originated:CAS01. Make sure that the Active Directory site/forest that contain the user’s mailbox has at least one local Exchange 2010 server running the Availability service. Turn up logging for the Availability service and test basic network connectivity.

When looking at the marked text you will see the actual cause, a certificate issue. So how to deal in this case? The first step you can take is try to access the Exchange Web Services of the other Exchange environment. In this case we can do it by browsing to https://mail.domain/com/ews/exchange.asmx/WSSecurity what will probably happen is that you receive a certificate warning. And that is exactly why the lookup fails. The certificate from the remote Exchange environment is not valid according to the validation procedure. However when you open it in a browser you will see the reason why the certificate is not trusted. This can be caused by several things among them:

Certificates is signed by a root CA which is not trusted
Name on the certificate is incorrect

In this case the root CA was not trusted by the Exchange environment. By importing the root CA in the Enterprise Trusted Root folder of the CAS the problem was solved.

The second one was pretty hard to troubleshoot but the solution to solve it was pretty easy. Again the error is marked in the text below. The error tells you that the other side did close the connection. OK nice and now what? In this case you will need to search in the IIS logs on the CAS of the target Exchange environment to see what happens when traffic from your Exchange environment arrives at the CAS.

Process 1212: ProxyWebRequest FederatedCrossForest from S-1-5-21-1671710892-3805255249-3875359145-102309 to https://mail.domain.com/ews/exchange.asmx/WSSecurity failed. Caller SIDs: WSSecurity. The exception returned is Microsoft.Exchange.InfoWorker.Common.Availability.ProxyWebRequestProcessingException: System.Net.WebException: The underlying connection was closed: An unexpected error occurred on a receive. —> System.IO.IOException: Unable to read data from the transport connection: An existing connection was forcibly closed by the remote host. —> System.Net.Sockets.SocketException: An existing connection was forcibly closed by the remote host

at System.Net.Sockets.Socket.EndReceive(IAsyncResult asyncResult)

at System.Net.Sockets.NetworkStream.EndRead(IAsyncResult asyncResult)

— End of inner exception stack trace —

at System.Net.Security._SslStream.EndRead(IAsyncResult asyncResult)

at System.Net.TlsStream.EndRead(IAsyncResult asyncResult)

at System.Net.PooledStream.EndRead(IAsyncResult asyncResult)

at System.Net.Connection.ReadCallback(IAsyncResult asyncResult)

— End of inner exception stack trace —

at System.Web.Services.Protocols.WebClientAsyncResult.WaitForResponse()

at System.Web.Services.Protocols.WebClientProtocol.EndSend(IAsyncResult asyncResult, Object& internalAsyncState, Stream& responseStream)

at System.Web.Services.Protocols.SoapHttpClientProtocol.EndInvoke(IAsyncResult asyncResult)

at Microsoft.Exchange.InfoWorker.Common.Availability.Proxy.Service.EndGetUserAvailability(IAsyncResult asyncResult)

at Microsoft.Exchange.InfoWorker.Common.Availability.FreeBusyApplication.EndProxyWebRequest(ProxyWebRequest proxyWebRequest, QueryList queryList, Service service, IAsyncResult asyncResult)

at Microsoft.Exchange.InfoWorker.Common.Availability.ProxyWebRequest.EndInvoke(IAsyncResult asyncResult)

Mailbox list = Johan@domain.comSMTP:Johan@domain.com, Parameters: windowStart = 9/29/2013 12:00:00 AM, windowEnd = 11/10/2013 12:00:00 AM, MergedFBInterval = 30, RequestedView = MergedOnly

. —> System.Net.WebException: The underlying connection was closed: An unexpected error occurred on a receive. —> System.IO.IOException: Unable to read data from the transport connection: An existing connection was forcibly closed by the remote host. —> System.Net.Sockets.SocketException: An existing connection was forcibly closed by the remote host

at System.Net.Sockets.Socket.EndReceive(IAsyncResult asyncResult)

at System.Net.Sockets.NetworkStream.EndRead(IAsyncResult asyncResult)

— End of inner exception stack trace —

at System.Net.Security._SslStream.EndRead(IAsyncResult asyncResult)

at System.Net.TlsStream.EndRead(IAsyncResult asyncResult)

at System.Net.PooledStream.EndRead(IAsyncResult asyncResult)

at System.Net.Connection.ReadCallback(IAsyncResult asyncResult)

— End of inner exception stack trace —

at System.Web.Services.Protocols.WebClientAsyncResult.WaitForResponse()

at System.Web.Services.Protocols.WebClientProtocol.EndSend(IAsyncResult asyncResult, Object& internalAsyncState, Stream& responseStream)

at System.Web.Services.Protocols.SoapHttpClientProtocol.EndInvoke(IAsyncResult asyncResult)

at Microsoft.Exchange.InfoWorker.Common.Availability.Proxy.Service.EndGetUserAvailability(IAsyncResult asyncResult)

at Microsoft.Exchange.InfoWorker.Common.Availability.FreeBusyApplication.EndProxyWebRequest(ProxyWebRequest proxyWebRequest, QueryList queryList, Service service, IAsyncResult asyncResult)

at Microsoft.Exchange.InfoWorker.Common.Availability.ProxyWebRequest.EndInvoke(IAsyncResult asyncResult)

at Microsoft.Exchange.InfoWorker.Common.Availability.AsyncWebRequest.EndInvokeWithErrorHandling()

— End of inner exception stack trace —

. Name of the server where exception originated: CAS01. Make sure that the Active Directory site/forest that contain the user’s mailbox has at least one local Exchange 2010 server running the Availability service. Turn up logging for the Availability service and test basic network connectivity.

Search for traffic destined to /ews/exchange.asmx/WSSecurity and you will probably find the error that did occur. Normally when everything works a 200 will be displayed. If you do receive a 4XX error then verify that the federation with the Microsoft Federation Gateway works correctly as explained in the first part. Besides this verify that WSSecurity is enabled on the Autodiscover and EWS directory.

However you might get other errors, in this case it was a 500 error. What this means and that it doesn’t know how to deal with the traffic which arrives and will close the connection. If this happens make sure WSSecurity is enabled on the virtual directories for Autodiscover and EWS. When this is confirmed verify that the svc-integrated handler is assigned to both the Autodiscover and EWS. If this is both configured correctly everything should be OK but why doesn’t it work?

In some occasions it may happen that EWSSecurity is correctly enabled but for some reason IIS doesn’t pick this up. If this happens an iisreset will fix your issue and you will be able to retrieve the free/busy information from the other Exchange organization.

Here ends the series of troubleshooting federated sharing. I am aware there might be other solution for the issues you might find during the implementation but these were just two examples of issues I found.

I hope you liked this series and if you have any questions use the contact form on the site to send me a message or ask your question by posting a comment.

Review: Microsoft Exchange Server 2013 Inside Out: Mailbox and High Availability

Fri, 08 Nov 2013 20:30:41 +0000

It has been a while ago since I received this book for review, initially I started reading it on my way to Exchange Connections in Las Vegas on my iPad mini. And the last few weeks I finished reading the book. So what do I think of the book? The book is a must have resource for everyone who is working with Exchange 2013. Tony Redmond is amazing good in describing the several parts of Exchange related to mailbox and high availability. Yes you are reading it correct this book only describes the mailbox an high availability of Exchange 2013. For the Client Access ,Connectivity and UM part of Exchange 2013 you will have to read the book from Paul Robichaux.

Tony starts with describing some important things you will have to consider when implementing Exchange 2013. This starts with a discussion about the architecture and continuous with several decisions you have to make before implementing Exchange 2013. Then he continuous to describe which preparations you have to make before you can implement Exchange 2013. After these topics have been described Tony describes how to install it and the basic management tools you will need to use to manage your Exchange 2013 and in more detail how to manage your mailboxes.

Starting from chapter 8 the book makes a very deep dive. For those who are already familiar with Exchange 2013 and want to skip the basic things this is were you should start reading the book. In very deep detail Tony describes several topics among them:

how does the store work
the database availability group
migrating mailboxes
compliance management
public folders and site mailboxes

For example in the _how does the store work _chapter will describe what is under the hood of the store. When you have read this chapter you will probably have a better understanding of the store process and how complex the product Exchange is under the hood. After the store is described the book continuous with the database availability group. In this chapter Tony describes several topics related to the DAG including: design considerations, daily administration tasks and several important components of the DAG among them the active manager.

Once the mailbox and high availability part have been discussed the book continues with the mailbox migration process. In this chapter the components are discussed which are key components of the migration process and of course how to perform the migration. This is not limited to only the cmdlets but also contains several practical tips from Tony about planning.

Some people are already working with the compliance part but some haven’t probably touched it. Both groups will benefit from this chapter as it describes some basic things but contains enough detail so people with experience will also learn a lot from this chapter. Compliance is a topic which becomes more important now-a-days since more and more companies will start implementing it either due to company regulations or government regulations.

In the last chapter Tony describes one of the probably most discussed topics of Exchange. Will it be there in the next release? How long will Microsoft Public Folders? These are just a few questions you will hear every time during the development phase of the next version of Exchange. In Exchange 2013 the Public Folders have changed a lot since the public folders can now be part of a normal mailbox database so no separate public folder database anymore. But how to get from the “legacy” Public Folder to the “new” Public Folder. Read Tony’s book and you have some good info on how to do this.

So what’s the conclusion of this review? The book is a must read for everybody who works with Exchange. It does not contain the basic information which most books do but describes several things in very deep detail. Besides this Tony also provides some additional information which really adds value to the book.

So if you got curious about the book just press the link below to buy the book:

Buy Microsoft Exchange Server 2013 Inside Out: Mailbox and High Availability