1. SharePoint Online Hybrid – Configure Outbound Search
Manas Biswas
Sr. Support Escalation Engineer,
SharePoint Online Escalation Services
Microsoft

2. Meet Manas Biswas Escalation Services, Microsoft.
Microsoft’s Cloud strategies, Office 365 and Azure
Passion for informing and inspiring the world to embrace the future “Office365”

3. Meet Rob Latino
Part of the Office 365 Support organization for over 4 years Certified in Office 365 Administration Involved in the Office 365 community and technical content management

4. Module Overview SharePoint Hybrid Scenarios
Hybrid Components and Configuration
Infrastructure Validation
Configuring Hybrid Search & Query Rules

5. Microsoft SharePoint Server 2013
What is Hybrid? And why ?
Hybrid Solution

6. Microsoft SharePoint Server 2013
Supported Workloads
On Premises
Cloud

7. One-way outbound topology
TechReady 18
12/2/2018
One-way outbound topology
Customer network
Microsoft data center
Internet
Intranet
Microsoft Office 365 tenant
SharePoint Server 2013 Farm
Outbound
SharePoint Online
SharePoint
Local search results only
Inbound
Hybrid search results
Site collection
Primary web app
SharePoint Online cannot query SharePoint Server
SharePoint Server can query SharePoint Online
On-premises SharePoint Server 2013 Enterprise Search portal: Local and remote search results are available
SharePoint Online search portal: Local search results are available

8. One-way inbound topology
12/2/2018
One-way inbound topology
Customer network
Microsoft data center
Internet
Perimeter network
Intranet
Microsoft Office 365 tenant
SharePoint Server 2013 Farm
Outbound
SharePoint Online
SharePoint
Hybrid search results
Inbound
Reverse proxy
Local search results only
Site collection
Primary web app
SharePoint Online can query SharePoint Server
SharePoint Server cannot query SharePoint Online
On-premises SharePoint Server 2013 Enterprise Search portal: Local search results are available
SharePoint Online search portal: Local and remote search results are available

9. Two-way (bidirectional) topology
12/2/2018
Two-way (bidirectional) topology
Customer network
Microsoft data center
Internet
Perimeter network
Intranet
Microsoft Office 365 tenant
SharePoint Server 2013 Farm
Outbound
SharePoint Online
SharePoint
Hybrid search results
Inbound
Hybrid search results
Site collection
Reverse proxy
Primary web app
SharePoint Online can query SharePoint Server
SharePoint Search can query SharePoint Online
On-premises SharePoint Server 2013 Enterprise Search portal and SharePoint Online search portal: Local and remote search results are available.

10. Query Flow – On Premise Search Center
Microsoft SharePoint Server 2013
Query Flow – On Premise Search Center
User Profile Service App
SharePoint
Online
Index Component
Query Processing Component
Index Component
SharePoint
On Premises
Index Component ? ?
On Premises
Search Center
Query Processing Component
Index Component
Authenticated
User

11. Results from SharePoint Online Sharepoint On Premises
User Experience
Results from SharePoint Online
Results from
Sharepoint On Premises

12. Query Flow – On Premise Search Center
Microsoft SharePoint Server 2013
Query Flow – On Premise Search Center
User Profile Service App
SharePoint
On Premises
Index Component
Query Processing Component
Index Component
Reverse Proxy
SharePoint
Online
Index Component ? ?
Office 365
Search Center
Query Processing Component
Index Component
Authenticated
User

13. Deployment - Phases Infrastructure Setup
12/2/2018
Deployment - Phases
Infrastructure Setup
S2S Trust & Identity Management
Search Service Integration

14. Deployment - Phases Infrastructure Setup
12/2/2018
Deployment - Phases
Infrastructure Setup
Domain Setup
ADFS
Directory Synchronization
Reverse Proxy
S2S Trust & Identity Management
Search Service Integration

15. Infrastructure Deployment
TechReady 18
12/2/2018
Infrastructure Deployment
Customer network
Microsoft data center
Internet
Perimeter network
Intranet
Office 365 tenant
ADFS Proxy
ADFS Servers
On Premises Infrastructure
Identity Platform
AD Servers
Federation Gateway
Azure AD
Directory Service
DirSync Server
User Profile Sync Service
SharePoint
SharePoint
Reverse Proxy
Secure Store
Target App
SharePoint STS
Azure AD Tenant
Azure AD Proxy
ACS Trust

16. Infrastructure for Outbound Hybrid with Password Sync
TechReady 18
12/2/2018
Infrastructure for Outbound Hybrid with Password Sync
Customer network
Microsoft data center
Internet
Perimeter network
Intranet
On Premises Infrastructure
On Premises Infrastructure
Office 365 tenant
Identity Platform
AD Servers
Federation Gateway
Azure AD
Directory Service
DirSync Server with Password Sync
User Profile Sync Service
SharePoint
SharePoint
SharePoint STS
Azure AD Tenant
ACS Trust
Azure AD Proxy

17. Infrastructure for Inbound Hybrid with Password Sync
TechReady 18
12/2/2018
Infrastructure for Inbound Hybrid with Password Sync
Customer network
Microsoft data center
Internet
Perimeter network
Intranet
Office 365 tenant
On Premises Infrastructure
Identity Platform
AD Servers
Federation Gateway
Azure AD
Directory Service
DirSync Server with Password Sync
User Profile Sync Service
SharePoint
SharePoint
Reverse Proxy
Secure Store
Target App
SharePoint STS
Azure AD Tenant
ACS Trust
Azure AD Proxy

18. Core identity scenarios with Office 365
Cloud Identity
Single identity in the cloud Suitable for small organizations with no integration to on-premises directories
Windows Azure Active Directory
On-Premises Identity
DirSync & Password Sync*
Directory & Password Synchronization* 
Single identity suitable for medium and large organizations without federation*
Windows Azure Active Directory
Federated Identity
On-Premises Identity
Federation
Single federated identity and credentials suitable for medium and large organizations
Windows Azure Active Directory
Directory Sync

19. Directory Synchronization Features
TechReady 18
12/2/2018
Directory Synchronization Features
Directory synchronization between on-premises and online
Identities are created and managed on-premises and synchronized to the cloud
Single identity and credentials but no single Sign-On for on-premises and Office 365 services
Windows Azure Active Directory
Directory Synchronization AD
On-Premises Identity
Ex: Domain\Alice
Cloud Identity
Ex:
User

20. Steps to configure Directory Sync
Activate directory synchronization in your tenant
Activate
Add on-premises domain to Office 365 tenant
Add Domain
Update DNS records
TXT or MX Records
Run the wizard and start the sync
Install and Configure
In Office 365 dashboard validate users and groups
Sync
Activate users and grant licenses
Activate Users
For Directory synchronization detailed configuration see:

21. Synchronisation of User Account
demo
Synchronisation of User Account

22. Deployment - Phases Infrastructure Setup
12/2/2018
Deployment - Phases
Infrastructure Setup
Directory Synchronization
S2S Trust & Identity Management
Replace S2S Token Signing Certificate for S2S Trust
Validate UPA
ACS Trust Setup
Search Service Integration

23. Establish Server To Server Authentication
TechReady 18
12/2/2018
Establish Server To Server Authentication
For Remote Index to work we need to establish an OAuth Trust with ACS between SharePoint On-Premises and Online.
This enables S2S Authentication – 7 Steps
Replace the STS certificate across all SharePoint servers in on-premises farm
Deploy Windows Azure AD PoSH with the pre-requisite of Microsoft Sign-in Assistant
Establish trust between on-premises SP Farm and SP Online by replacing certificate
Add SPN for the on-premises domain. (Eg ff1-ce “ /*.techready.com)
Register SP Online application principal as a trusted provider in SP on-premises
Set authentication realm for SharePoint
Configure a proxy in the on-premise farm for Azure AD

24. Validate User Profile Service Application
TechReady 18
12/2/2018
Validate User Profile Service Application
User Profile Service Application is configured and running
Profile Service App created
Profile Services Started
Profile Sync Service Running
MIIS Client
User Profiles are synced with AD for the same set of users as specified for DirSync
User Profile Service Profile Search
Office 365 Users and Groups
User profile attributes are correctly populated, key ones are:
User Principal Name (UPN)
Name Identifier (Most Commonly this is Windows Security Identifier(SID))
Simple Mail Transport Protocol (SMTP) Address
Session Initiation Protocol (SIP) address

25. S2S Authorization and ACS Trust
demo
S2S Authorization and ACS Trust

26. Configure Result Source – On Premises
TechReady 17
12/2/2018
Configure Result Source – On Premises
Protocol should be chosen as Remote SharePoint
SPO URL should be specified as Tenant Root Site URL (
For Credentials information select Default Authentication

27. Create A Query Rule – On Cloud
Select the inbound result source then ‘New Query Rule’
Under ‘Query is performed on these sources’, if you select “One of these sources”, make sure to select the result source you created
Query Conditions section, click Remove Condition so that the rule will fire for every query
Within Actions choose Add result Block
Edit Result Block and choose settings as desired

28. Validate your Search Configuration
Launch Query Builder from the Query Rule you’ve created
Click on the Test tab and then
Click the Show more link
Type some query terms in the “{subjectTerms}:” edit box
Click the Test query button
You should see SharePoint On Premises search results or a detailed error message

29. Configure Result Source and Query Rule
demo
Configure Result Source and Query Rule

30. Infrastructure for Outbound Hybrid with Password Sync
TechReady 18
12/2/2018
Infrastructure for Outbound Hybrid with Password Sync
Customer network
Microsoft data center
Internet
Perimeter network
Intranet
Office 365 tenant
On Premises Infrastructure
Identity Platform
AD Servers
Federation Gateway
Azure AD
Directory Service
DirSync Server with Password Sync
User Profile Sync Service
SharePoint
SharePoint
Reverse Proxy
Secure Store
Target App
SharePoint STS
Azure AD Tenant
ACS Trust
Azure AD Proxy

31. References TechNet Blogs
Configure hybrid Search for SharePoint Server 2013
Blogs
Office 365-Configure Hybrid Search with Directory Synchronization –Password Sync
Office 365-Configure Inbound Hybrid Search with Directory Synchronization –Password Sync –Part2
Identity Federation & Single Sign on Deployment for Hybrid Search in Office 365 –SharePoint Online –Part3