This document summarizes an agenda for supporting Office 365 architecture on Windows Azure infrastructure as a service (IaaS). It discusses different identity options including directory synchronization and Active Directory Federation Services. It provides details on directory synchronization, including how it works and which objects are synced. It also covers ADFS topologies for hybrid deployments in IaaS and considerations for deploying ADFS in Windows Azure, including terminology like availability sets and endpoints. The document concludes with a brief overview of migrating directory synchronization and ADFS from on-premises to Windows Azure.

1. #comdaybe
Supporting Architecture Office 365
on Windows Azure - IaaS
J-Solutions - Flexamit
Jethro Seghers

2. Jethro Seghers

3. Agenda
• Different types of Identity
• Supporting Architecture
• Different Deployments
• Windows Azure IaaS
• ADFS + DirSync + Azure
• Migration
• Q&A

4. Identity Options

5. Introduction to identity options
1. MS Online IDs
Appropriate for
• Smaller organizations without
AD on-premise
Pros
• No servers required on-
premise
Cons
• No SSO
• No 2FA (strong authentication)
• 2 sets of credentials to
manage with differing
password policies
• Users and groups mastered in
the cloud
2. MS Online IDs + Dir Sync
Appropriate for
• Orgs with AD on-premise
Pros
• Users and groups mastered on-
premise
• Enables co-existence scenarios
Cons
• No SSO – BUT PASSWORD
SYNC
• No 2FA
• 2 sets of credentials to manage
with differing password policies
• Single server deployment
3. Federated IDs + Dir Sync
Appropriate for
• Larger enterprise organizations
with AD on-premise
Pros
• SSO with corporate cred
• Users and groups mastered on-
premise
• Password policy controlled on-
premise
• 2FA solutions possible
• Enables co-existence scenarios
Cons
• High availability server
deployments required

6. Directory Synchronisation

7. What is DirSync?
•
“…is a Directory Synchronization engine
based on Forefront Identity Manager (FIM)
that will synchronize a subset of your on-
premise Active Directory with Windows Azure
Active Directory (Office 365).”

8. Why use DirSync?
Long term coexistence between Active Directory On Premise and
Windows Azure Active Directory.
(Easy/quick provisioning*)
Single place for managing identities including:
• Users
• Groups
• Memberships
• …
Enabler for Hybrid Deployments (required)
• Two-way Directory Synchronization

9. Deployment Considerations
Active Directory Assessment
• Prerequisites check (Readiness Tool)
Topology
• Single Forest?
• Multiple Domains?
Security
• Firewalls, Permissions
64-bit only!
De/Activation time; can take some time to complete
Object filtering required?
SQL Version - Windows 2012 Server Supported

10. DirSync
How does DirSync work?
Active Directory
METAVERSE

11. What objects are synced?
From AD to Office 365: http://support.microsoft.com/kb/2256198
From Office 365 to AD (aka write-back):
Write-Back attribute Exchange "full fidelity" feature
SafeSendersHash
BlockedSendersHash
SafeRecipientHash
Filtering: Writes back on-premises filtering and online
safe and blocked sender data from clients.
msExchArchiveStatus Online Archive: Enables customers to archive mail.
ProxyAddresses
(LegacyExchangeDN <online LegacyDn> as X500)
Enable Mailbox: Off-boards an online mailbox back to on-
premises Exchange.
msExchUCVoiceMailSettings
Enable Unified Messaging (UM) - Online voice mail: This
new attribute is used only for UM-Microsoft Lync Server
2010 integration to indicate to Lync Server 2010 on-
premises that the user has voice mail in online services.

12. Active Directory Federation
Services

13. ADFS: On Premise Topology
Enterprise DMZ
AD FS 2.0
Server
Proxy
Internal
user
Active
Directory
AD FS 2.0
Server
AD FS 2.0
Server
AD FS 2.0
Server
Proxy

14. ADFS: On Premise Topology
Enterprise DMZ
AD FS 2.0
Server
Proxy
Internal
user
Active
Directory
AD FS 2.0
Server
AD FS 2.0
Server
AD FS 2.0
Server
Proxy

15. ADFS: Hybrid Topology: IAAS
Enterprise
Internal
user
Active
Directory
AD FS 2.0
Server
AD FS 2.0
Server
IAAS
External
user
Active
Directory
AD FS 2.0
Server
AD FS 2.0
Server

16. ADFS: Hybrid Topology: IAAS
Enterprise
Internal
user
Active
Directory
AD FS 2.0
Server
IAAS
External
user
Active
Directory
AD FS 2.0
Server

17. ADFS: Cloud Topology: IAAS
IAAS
Internal
External
user
Active
Directory
AD FS 2.0
Server
AD FS 2.0
Server

18. What about Windows Azure

19. Windows Azure & ADFS
• Virtual Network Support – Site to Site VPN
• Computing: 99,95% SLA Uptime for High Available System
– 99,9% SLA Uptime for Single System
• Storage: 99,9%
• Full Control over your Virtual Machines
• Pay as you Go, OPEX vs CAPEX
• PowerShell Support

20. Windows Azure: Terminology
Cloud Service: Role which several VM’s take upon themselves to
execute. E.G. ADFS. Cloud services need to have two instances or more
to quality for the SLA of 99,95%. 1 External Virtual IP Address per Cloud
Service
Availability Set

21. Windows Azure: Terminology
EndPoints: You need to add an endpoint to a machine for other resources
on the Internet or other virtual networks to communicate with it. You can
associate specific ports and a protocol to endpoints. Resources can
connect to an endpoint by using a protocol of TCP or UDP. The TCP
protocol includes HTTP and HTTPS communication.
Virtual Network enables you to create secure site-to-site connectivity, as
well as protected private virtual networks in the cloud.

22. Windows Azure Example

23. demo
How does it look like in Azure

24. Migration

25. Migration
DirSync:
1. Shutdown DirSync on Premise
2. Install DirSync on Azure
3. Configure DirSync on Azure
4. Uninstall DirSync on Azure
ADFS:
1. Convert all ADFS Domains to Standard Domains
2. Logon to primary ADFS on Azure
3. Convert all Standard Domains back to Federated Domains

26. Q&A

27. Thank you!
Twitter: @jseghers