This document summarizes a presentation about deploying mobile devices at large scale using Microsoft Exchange Server and Windows Mobile. The presentation covers infrastructure requirements, procurement considerations, provisioning tools, device management, support needs, and lessons learned from Microsoft's internal deployment of over 40,000 mobile devices. Effective planning of infrastructure, standardized device selection, centralized management capabilities, and end-user support are key to a successful large-scale mobile rollout.

2. Jason Langridge Enterprise Mobility Solution Specialist Mobile Communications Business Group Microsoft E-mail: [email_address] Blog: http://blogs.msdn.com/jasonlan ITP202 How Can You Deliver E-mail to 40,000 Users with Exchange Server and Windows Mobile?

3. Session Objectives and Takeaways Session objective Describe infrastructure requirements and scalability considerations for a large scale rollout of mobile devices Describe device provisioning and user training tools available for a large scale rollout Explain how to successfully plan a large scale mobile deployment with Microsoft Exchange Server 2007

4. Agenda Infrastructure Procurement Provisioning and Management Support Decommissioning Microsoft Internal Usage Conclusion

5. Business Wants Connected Mobility Solutions YOY % shipping growth 35 30 25 20 15 10 5 0 CAGR 2006-2010 Source: Gartner Dataquest, and IDC 2006 18.6% Mobile PCs 5.8% Mobile Phones 3.9% Desktop PCs 34.1% Converged Mobile Phones

6. Agenda Infrastructure Procurement Provisioning and Management Support Decommissioning Microsoft Internal Usage Conclusion

8. Exchange Mobile Access Deployment Exchange Front End Server(s)/Client Access Servers Mailbox Server Mailbox Server Internet (Cellular Networks) Wireless PDA HTTPS (443 ) Smart phone Wi-Fi PDA Wi-Fi Smart phone Internet (802.11x - hotspots) Wi-Fi PDA Wi-Fi Smart phone Wireless Intranet (802.11x) Corporate Network ISA Server (Optional) HTTPS (443) Outlook from home (rpc/http) OWA from kiosk or from home Wi-Fi Laptop Wi-Fi Laptop Wired line Wireless line Legend

9. ISA Server Benefits ISA Server is “recommended” not “required” Any firewall that can publish port 443 (SSL) can be used ISA is recommended because it has: The ability to pre-authenticate all traffic before it reaches your Exchange Server The option to inspect Exchange ActiveSync traffic passing through it and validate it is genuine ISA Server 2006 provides Kerberos-constrained delegation to the Exchange server

10. Agenda Infrastructure Procurement Provisioning and Management Support Decommissioning Microsoft Internal Usage Conclusion

11. So Many Devices to Choose From! > 140 Windows Mobile phones worldwide

12. User Profiling and Device Selection Mobile device is a very personal choice Need to accommodate choice while delivering standardization Typical portfolio will include Phone-style device Keyboarded device

13. Device Decisions When someone Senior asks for an unsupported device... Line of Business Collaboration Concierge

14. Procurement Decisions Billing Corporate Individual Liable Corporate Responsible – Individual Liable Global/local decision-making Breaking out service plan and devices? Length of commitment Early termination fees Data tariffs Flat rate Per user or Data buckets

15. Agenda Infrastructure Procurement Provisioning and Management Support Decommissioning Microsoft Internal Usage Conclusion

16. Device Management Provisioning methods WAP/Client Provisioning OMA DM Provisioning OMA DM Client Desktop ActiveSync WAP Push App Installer USB Bluetooth .CAB SMS Initiated OMA DM SMS Initiated WAP Exchange ActiveSync In-ROM Configuration XML Cold Boot Initialization Configuration Service Providers Over-the-Air OMA DM Over-the-Air Exchange Provisioning Over-the-Air WAP/Client Provisioning Desktop ActiveSync® (RAPIConfig) New New Get an installable onto the device

17. Device Management Challenges Enterprise Mobile Operator Ensure device data protected Enable secure network access Deploy rich device apps Ensure secure device Ensure reliable device Operator-specific configuration Enable rich device services Data access anywhere/anytime Ability to run rich applications Ensure secure device A reliable and secure device Device Owner

18. Device Management Considerations Devices are harder to detect then PCs How many are already being used in your organization? Do you have a policy on devices/applications? Who will manage the devices? Mobile Operator Enterprise

19. Exchange Server 2007 Manageability Self-service model Users can do remote wipe from OWA without calling help desk IT pros don’t become a bottleneck Provide greater control to the admin More granular security policies and access control Easy to maintain Greater manageability and support options

20. Manageability More granular access control By device ID: Allows only enterprise- provisioned devices By user agent : Allows only enterprise-recommended models Per-user policies New incremental policies Storage card encryption enforcement Allow/disallow attachments and maximum size Allow/disallow UNC/SharePoint access New device lock policies Device timeout enhancements Password expiration Password history User Pin/password reset Policies and access controls

21. Manageability Device management Track and manage device partnerships Track device change history See devices connected to Exchange Server Identify and troubleshoot problems seen by devices Reset users’ PIN over the air Users can wipe their own device from OWA

22. Manageability Server management Improved protocol logging to aid troubleshooting MOM support Alerts/rules: To alert IT pros when something is wrong Diagnostic tasks/probes: To ensure everything is working Summary reports about device sync usage Integrated setup/admin to reduce administrative costs

23. MOM Availability Report

24. Exchange Server 2007 Device Management

25. Mobile Operator Management Tool

26. Microsoft Systems Management Server 2003 (SMS) and Microsoft System Center Configuration Manager 2007 SMS 2003 Device Management Downloadable “Feature Pack” available on the Web Client settings and core features Pocket PC 2002 and 2003 and 5.0 only; no smartphone support Intranet only; no support for devices over the Internet ActiveSync to discover and install Microsoft Windows CE .Net 4.2 and 5 on the ARM processor Scripting Host Configuration Manager 2007 Device Management Integrated Device Management in core product Support for all DMFP features plus: Smartphone support Internet-based client management Native Mode security (required for Internet facing) Connection management Windows CE 6 + CE on X86 Processor in SP1 Dropping Windows Mobile 02 support Dropping DMScript support

27. Configuration Manager 2007 Core capabilities Device management Hardware/software inventory File collection Software distribution Settings management Password policy management Security policy management Support for Smartphone Internet-based management LOB device management Windows CE on ARM at RTM, x86-based Windows CE device support coming in SP1 Deployment Full integration with Configuration Manager 2007 Over the air client upgrade for SMS 2003 DMFP devices Automated client distribution via SMS Advanced Client desktop Storage card or “self service” install

28. DMSec Partner Offering Windows Mobile and Exchange Server 2003 meets the needs for the majority of business customers For customers that wish to extend security or management capabilities a select group of Microsoft partners are offering discounted solutions for a limited time Customer chooses one security and one DM partner solution We have partnerships with the following vendors: Security: Credant Technologies, Trust Digital Device Management : iAnywhere, Odyssey Software

29. Device Management Application lock-down and control Automatic distribution and installation of software updates to remote devices Support for Systems Management Server (SMS) OTA file management Collection, logging, and publishing of device information Fully-automated provisioning of remote devices Automatic device discovery and registration

30. Security Data at rest encryption using FIPS 140-2 (AES & 3DES) validations Centrally-managed end point policy management End point security enforcement Network Access Control OTA device management, software distribution, configuration provisioning & updating Compliance reporting

31. DMSEC Partner Capability Matrix * The Odyssey solution has an optional console and can support other third party consoles. While Odyssey does not have its own reporting tool, they support the standard reporting tools in the marketplace. ** The iAnywhere solution included in the DMSec Offer represents a subset of the entire Afaria solution and does not include security components. Only Afaria Session Manager, Afaria Inventory Manager, and Afaria Configuration Manager for the Windows Mobile platform are included. FEATURES ODYSSEY* iANYWHERE** TRUST DIGITAL CREDANT Centralized server No Yes Yes Yes Data encryption No No FIPS 140-2 (3DES, AES) FIPS 140-2 (3DES, AES) Removable storage encryption No No Yes Yes Selective encryption No No Yes Yes Authentication Yes Yes Yes Yes Asset management Yes Yes No Yes Network access management No No Yes Yes Device provisioning Yes Yes Yes Yes User self-provisioning & self-help No No Yes Yes IT policy admin. w/dynamic policy updating No No Yes Yes File management Yes Yes No No Automated application updating Yes Yes Yes No Selective function/application control No No Yes Yes Remote control Yes No No No Diagnostic tools Yes Yes No No Device backup No Yes No No Local device wipe No No Yes Yes Remote device wipe No No Yes Yes System access/mgmt. Yes Yes Yes No Image distribution Yes No Yes No Logging Yes Yes Yes Yes Reporting No Yes Yes Yes Selective Bluetooth mgmt No No Yes Yes Exchange integration No No Yes Yes Active Directory integration No Yes Yes Yes SMS integration Yes No No No Private APN support Yes Yes Yes Yes

32. Agenda Infrastructure Procurement Provisioning and Management Support Decommissioning Microsoft Internal Usage Conclusion

33. IT Support Troubleshooting where the problem lies is biggest challenge Mobile device Support is very different to PC or even laptop support Time coverage Issues generally around connectivity Different vendors involved: Mobile Operator, IT, device manufacturer, and potentially an outsourcer

34. IT Skills Required Experience working with Active Directory Good Knowledge of Exchange Server 2003/2007, Microsoft Office Outlook Web access and Exchange ActiveSync Working knowledge of mobile devices and mobile networks Experience using or managing Microsoft Windows Mobile 5.0 Familiar with network concepts such as firewalls, reverse proxy, certificates, and security protocols (EAP, TLS, WPA, WEP, and 802.1x)

35. IT Training Learn it: Microsoft E-Learning course, Course 5139: Designing, Implementing, and Managing a Microsoft Windows Mobile Infrastructure Prove it: Microsoft MCP Exam 70-500, Microsoft Windows Mobile Designing, Implementing, and Managing

36. Agenda Infrastructure Procurement Provisioning and Management Support Decommissioning Microsoft Internal Usage Conclusion

37. Devices That are No Longer Required Perform a master reset Remove any removable media, as the master reset will affect only the data on the device itself Return the device and removable media to your manager Contact the mobile operator and terminate or transfer the service Transfer service to new device For GSM: Move SIM card For CDMA: Contact mobile operator Dispose of unneeded devices in an environmentally responsible manner

38. Devices That are Lost or Stolen Notify security Notify help desk Can leverage remote wipe capability if available as part of device/security management solution Use self-service wipe tools if available Contact the mobile operator and suspend or terminate the service Notify your manager File a police report. (Insurance companies often require this step before they will reimburse you for the loss.)

39. Agenda Infrastructure Procurement Provisioning and Management Support Decommissioning Microsoft Internal Usage Conclusion

40. Microsoft Mobile Messaging Common URL namespace for mobile messaging clients OWA, Exchange ActiveSync (EAS), Outlook Anywhere (RPC/HTTP) Integration: all mobile messaging services on a common Exchange Server 2007 CAS platform Mobile messaging s ervice u sage OWA: ~70,000 unique users/month RPC/HTTP: ~80,000 unique users/month EAS: ~38,000 unique users/month Highly scalable Exchange Server 2007 CAS infrastructure Load balancing and fault tolerance Our servers are dual CPU 2.2GHz with 4GB memory

41. Topology Dublin: - ExternalURL “https://emeamsg.microsoft.com/...” Singapore: -ExternalURL “https://apsmsg.microsoft.com/...” Sao Paulo: -ExternalURL “https://spamsg.microsoft.com/...” Redmond: - ExternalURL “https://msg.microsoft.com/...”

42. Device Standardization What does this mean? Process for selecting hardware for internal employees to utilize within the company Including requirements for internal beta programs What are some of the benefits? Documentation/education Helpdesk support Pricing and availability Enterprise warranty Infrastructure interoperability

43. Support Call Generators 15% 11% 7% 4% 63% Help configure install Other symptom Corp WLAN configuration Request for information Mobile operator connectivity failure

44. Self-help End-User Documentation (Intranet) 05/26/09

45. 05/26/09 Self-help End-User Documentation (Takeaway Guides)

46. Microsoft Provisioning Tool

47. By the Numbers Costs / FY06 User Base - 41,000 Call Volume (Yr) - 8,800 Call Volume (Mth) - 733 Calls Per/U (Yr) - .21 Total Cost - $402k Costs / FY07 (Projected) User Base - 50,000 Call Volume (Yr) - 10,300 Call Volume (Mth) - 858 Calls Per/U (Yr) - .20 Total Cost - $488k

48. Agenda Infrastructure Procurement Provisioning and Management Support Decommissioning Microsoft Internal Usage Conclusion

49. Conclusion Manage mobile devices like a laptop/PC However handheld-specific issues should be taken into consideration Create standards for purchasing, provisioning and management Ensure end-to-end security for mobile users Don’t dismiss security vs. usability Provide help desk support for mobile users Determine a plan for retirement and upgrades of devices

50. Reference Direct Push deployment guide http://www.microsoft.com/technet/itsolutions/mobile/deploy/msfpdepguide.mspx Whitepaper on Mobile Messaging with Microsoft Exchange Server 2003 SP2 and Windows Mobile 5.0 http://www.microsoft.com/exchange/evaluation/features/mobility/e2k3sp2.mspx The Benefits of Microsoft Mobile Messaging http://www.microsoft.com/windowsmobile/business/strategy/roi.mspx Microsoft IT Scalability Experience with Windows Mobile 2003 and Exchange Server 2003 Mobile Messaging http://www.microsoft.com/windowsmobile/business/strategy/scalability.mspx My blog http://blogs.msdn.com/jasonlan Exchange blog http://blogs.technet.com/exchange

52. While You're Here Fill out your session evaluation Enter to win a Windows Mobile ® phone or Zune™ Geek out with a huge rack of servers Enterprise Mobility in Action is in the Expo Hall Meet the geeks The Expert Cabana is packed with MEDC speakers and MVPs

53. © 2007 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.