2. RequirementsDeployment Options 2 3 Dirsync Overview 1 Understanding Synchronization 4

3. 3

7. Directory Synchronization Options Suitable for small/medium size organizations with AD or Non-AD Performance limitations apply with PowerShell and Graph API provisioning PowerShell requires scripting experience PowerShell option can be used where the customer/partner may have wrappers around PowerShell scripts (eg: Self Service Provisioning) PowerShell & Graph API Suitable for Organizations using Active Directory (AD) Provides best experience to most customers using AD Supports Exchange Co-existence scenarios Coupled with ADFS, provides best option for federation and synchronization Supports Password Synchronization with no additional cost Does not require any additional software licenses Suitable for large organizations with certain AD and Non-AD scenarios Complex multi-forest AD scenarios Non-AD synchronization through Microsoft premier deployment support Requires Forefront Identity Manager and additional software licenses

11. Windows Azure Active Directory User Multi-forest AD support is available through Microsoft-led deployments Multi-forest DirSync appliance supports multiple dis-joint account forests FIM 2010 Office 365 connector supports complex multi-forest topologies On-Premises Identity Ex: Domain\Alice Federation using ADFS AD DirSync on FIM AD

12. Windows Azure Active Directory User Preferred option for Directory Synchronization with Non-AD Sources Non-AD support with FIM is available through Microsoft-led deployments FIM 2010 Office 365 connector supports complex multi-forest topologies On-Premises Identity Ex: Domain\Alice Federation using Non- ADFS STS Office 365 Connector on FIM Non-AD (LDAP) Non-AD (LDAP)

13. 13

14. Run the Microsoft Office 365 Deployment Readiness Tool - http://community.office365.com/en-us/forums/183/p/2285/8155.aspx Analyse on-premise environment Domains User Identity and Account Provisioning Exchange Online Lync Online SharePoint Online Client Network

15. When utilising the full SQL option you must ensure that the EA account has “sysadmin” rights on the SQL database and that the Dirsync service account has “public” permissions on the Dirsync DB. From the Field Dirsync (Single Forest)must be joined to a domain within the same forest that will be synchronized Dirsync Server should never be installed on a domain controller Dirsync Server should be Windows Server 2008 (x64) By default SQL Server 2008 R2 Express is installed. 10GB database limit (approx. 50,000 objects) Full SQL Option Available. X64 Single\Multi Forest Appliance available (O365 connector also available for complex scenarios)

16. When installing Dirsync ensure that you use EA credentials and that all DC’s are accessible from the Dirsync Server. From the Field

17. Number of objects in Active Directory CPUMemoryHard disk size Fewer than 10,0001.6 GHz4 GB70 GB 10,000–50,0001.6 GHz4 GB70 GB 50,000–100,0001.6 GHz16 GB100 GB 100,000–300,0001.6 GHz32 GB300 GB 300,000–600,0001.6 GHz32 GB450 GB More than 600,0001.6 GHz32 GB500 GB

18. ServiceProtocolPort LDAPTCP/UDP389 KerberosTCP/UDP88 DNSTCP/UDP53 Kerberos Change Password TCP/UDP464 RPCTCP135 RPC randomly allocated high TCP ports TCP 1024 - 65535 49152 - 65535 1 SMBTCP445 SSLTCP443 SQLTCP1433

21. AttributeObject Type MSExchArchiveStatusUser MSExchBlockedSendersHashUser SExchSafeRecipientsHashUser MSExchSafeSendersHashUser MSExchUCVoiceMailSettingsUser ProxyAddressesUser, Contact, Group

22. 22

24. Synced object attribute UserGroupContact (Src)Description Company Read- The person's (user or contact) company name. Department Read- The name of the person's (user or contact) department. DescriptionRead Human-readable descriptive phrases about the object DisplayNameRead The display name for an object, usually the combination of the person's first name, middle initial, and last name. List of attributes that are synced to Windows Azure Active Directory and attributes that are written back to the on-premises Active Directory Domain Services http://support.microsoft.com/default.aspx?scid=kb;en-US;2256198

28. Microsoft Online Services Logon Enabled User Object (Unlicensed) Mail-Enabled User (not Mailbox-Enabled) ProxyAddresses: SMTP: John.Doe@contoso.com smtp: John.Doe@contoso.onmicrosoft.com TargetAddress: John.Doe@contoso.com Logon Enabled User Object (Unlicensed) Mail-Enabled User (not Mailbox-Enabled) ProxyAddresses: SMTP: John.Doe@contoso.com smtp: John.Doe@contoso.onmicrosoft.com TargetAddress: John.Doe@contoso.com On-premises Active Directory Exchange Server DirSync Online Directory DirSync Web Service SharePoint Online Live ID Exchange Online Lync Online Sync Cycle Step 1: Import Users, Groups, and Contacts from source Active Directory forest Sync Cycle Step 1: Import Users, Groups, and Contacts from source Active Directory forest Sync Cycle Step 2: Imports Users, Groups, and Contacts from Microsoft Online Services via AWS Sync Cycle Step 2: Imports Users, Groups, and Contacts from Microsoft Online Services via AWS Sync Cycle Step 3: Export Users, Groups, and Contacts that do not already exist in Microsoft Online Services Sync Cycle Step 3: Export Users, Groups, and Contacts that do not already exist in Microsoft Online Services User Object Mailbox-Enabled ProxyAddresses: SMTP: John.Doe@contoso.com User Object Mailbox-Enabled ProxyAddresses: SMTP: John.Doe@contoso.com Users only Mail-enabled objects

33. 33