Hybrid Search Planning Implementation

Overview Implementation of hybrid search could be challenging or delayed if crucial resources are not available, not installed or not compatible with the hybrid search requirement. It’s always advisable to verify the configuration, installations and script execution is a trail environment. Hybrid search involves few critical implementations which should be configured/implemented during initial phase of implementation. During discovery phase, it’s very important to map the following hybrid search requirement with your current SharePoint environment and find the gaps and plan for it in advance. The following are the sections to complete discovery: Hybrid search : Pre-Requisite Office 365 Discovery and Planning SharePoint 2013 Discovery and Planning Identity Management Discovery and Planning

Pre-Requisites SharePoint Online SharePoint 2013 Enterprise On-premise Must have a required subscription of SharePoint online with min build number. Must have a SharePoint 2013 farm with required services running. Active Directory (Windows Server 2003 R2 or later) with DirSync implemented. Users synchronized and licensed in SharePoint online Azure Active Directory. SharePoint Online Office 365 subscriptions with SharePoint Online licenses E1 or E3 license type Minimum Build Number: 15.0.0.4420 SharePoint 2013 Enterprise On-premise SSL-secured On-Premise deployment of SharePoint Server 2013 On-premise SharePoint Server license Running with Required Services Identity Management Cloud Identity or Synchronized Identity On-Premise Active Directory & DirSync Reverse Proxy

Cloud Discovery and Planning 1 of 2 During the discovery phase, it’s always beneficial to validate the following information. Need of this information will be in setting up hybrid search with multiple parameters. Verify Organization Domain: Office 365 admin credentials and SharePoint 2013 administrator level access Login to SharePoint Online Administration Portal with Office 365 admin credentials Go to Domains > Verify your domain from list of all domains Find out if you have Cloud only identity or Synchronized identity Verify DirSync settings and synched user profiles An organization must have DirSync as a minimum setup running and synchronization users account between SharePoint online and On-premise environment DirSync Status, last run Users and groups > Office 365 users and local AD users Verify minimum build number: Navigate to your site collection at https://<your Office 365 domain>/_vti_pvt/service.cnf Find the entry vti_extenderversion:SR and this is the value of build number Verify

Cloud Discovery and Planning 2 of 2 Verify Company Information using PowerShell: Run the following PowerShell commands: Login to any web/app server Run “Connect-MSOLService” with admin credentials Run “Get-MSOLCompanyInformation” The following information appears: Company Name and Address Directory Service Synchronization Enabled Last Dir Sync Time Password Synchronization Enabled Secure Channel SSL Certificate location and file name Required to help secure communication channel between SharePoint Online and Reverse Proxy with friendly name, expiry date and password (incase private key associated) Stockholders/Teams Involved: Project Sponsor/decision makers for necessary approvals and decisions Office 365 and SharePoint 2013/2016 administrators, Reverse Proxy Team (F5 or Windows Server Team)

On Premise Discovery and Planning Verify Farm Information: Total Web Front Ends, Application Servers and SQL Servers Services Status The following services must be running in SharePoint 2013 environment: Search Service, User Profile Service, App Management Service Microsoft SharePoint Foundation Subscription Settings Service Verify the following: CU update August 2015 or later Web Application should be Integrated Windows Authentication NTLM Server Version : For password sync min should be 2008 R2 SP1 or later. User properties exist with attributes like “UserPrincipalName” and “ProxyAddress” (Work Email) in user profile service settings. Web Application SSL Certificate location and file name with expiry date Tool Installations Install the following tools on WFE or APP Server The Microsoft Online Services Sign-In Assistant https://www.microsoft.com/en-us/download/details.aspx?id=41950 The Azure Active Directory Module for Windows PowerShell http://go.microsoft.com/fwlink/p/?linkid=236297 The SharePoint Online Management Shell https://www.microsoft.com/en-my/download/details.aspx?id=35588

Identity Management Planning Verify Current Farm and Search Topology Current search load, crawling issues Search performance, query latency and search fault tolerance scenarios Check Current Security Certificates Run the following PowerShell Command on any SharePoint 2013 Server: (Get-SPSecurityTokenServiceConfig).LocalLoginProvider.SigningCertificate Expected Return: CN=SharePOint Security Token Service, OU= SharePoint, o = Microsoft, C= US Identity Federation The goal of identity federation is to enable resource access across completely unrelated security domains by sharing a limited amount of information, such as security identities and policies. Reverse Proxy Requirement When inbound traffic from SharePoint Online needs to be relayed to the on-premises SharePoint Server 2013 farm. When a federated user goes to a SharePoint Online Search portal that is configured to return hybrid search results, a reverse proxy device intercepts and pre-authenticates the request for on-premises SharePoint Server 2013 content and then relays it to SharePoint Server 2013. Supported Reverse Proxies Reverse proxy Options: Windows Server 2012 R2 with Web Application Proxy Forefront Threat Management Gateway (TMG) 2010 ( Limited Support until 2010) F5 Big IP with “Access Policy Manager” implemented for authentication

DirSync Role & Readiness Check What is DirSync and why it’s important DirSync (Directory Synchronization) is a tool and responsible for provisioning directory objects from an on-premises Active Directory to Azure Active Directory. 64-bit edition of Windows Server 2008 R2 SP1 Standard or Enterprise or higher.  Most of the organization is pre-configured with SharePoint Online and On-premise environment and a DirSync already in-place and working profile synchronization. To make sure a DirSync is in-place, follow these steps: Browse to Office 365 Admin center https://portal.microsoftonline.com. On the Microsoft Online Services page, in the Windows Live ID field, provide an account name that has  Global admin rights on your Office 365 subscription On the Home page, click Admin. On the Admin page, select Users, which is under the Management section on the left side. Under status column, you must see status “Synched with Active Directory”, it means the SharePoint 2013 users are synced with SharePoint online Azure AD.

Additional Checklist The below mentioned information is equally important while configuring the hybrid federated search. Information may vary based on the SharePoint environment, requirements and configuration required. On-Premise Web Application name and URL Identity Management Type (Cloud Identity, ADFS with SSO or DirSync with Password Sync) STS Certificate PFX file (with password) with start and end date and CER file with start and end date STS Certificate Friendly Name Teams SLAs UPN domain suffix SSL Certificate Location Network Requirements Farm and Server Information Network Ports

Design Considerations MultiTenancy: SharePoint 2013 farm can only attach to a single tenant in SharePoint online. Ex: Check if active directory is not shared with trail tenant. Search Issues: If your SharePoint 2013 search has pre-existing search related issues with search crawl, index or end user search, it is highly recommended to correct it. Service Federation: Services shared across multiple farms or separate Search farm implementation can cause issues. Few SharePoint 2013 services can not be shared across farm in hybrid search implementation. Search Service Latency: Verify your search service latency and consider it to add more load after hybrid search implementation. It is advisable to scale out search infrastructure in such cases.

Thank You