training – Page 2 – Zupertails Blogs

OFFICE 356 MIGRATION (6)

09/05/2018 Zupertails office 365, tech, training

BOOM! Let’s do this.

You didn’t think I was going to let you start a migration process without making you read the detailed “how and why”, did you ?
There’s a couple of migration types to keep in mind, where one is easier than the other.
Usually the more difficult one is also the most interesting one, but even this is dependant on specific needs.

Remote move migration
Staged migration
Cutover migration
IMAP migration
PST import

The last one (PST) is in most cases forgotten as an official way, since it’s possibly way too simple in Microsoft’s eyes.

As the target audience for this specific blog post is the average Belgian SME with an average of 5 to 20 employees, I’ll stick to the basics in this post.
An other post will cover the heavier subjects in a nearby future (aka ‘when I feel like it’)

PST Migration (1)

Difficulty level

Microsoft has this pretty cool tool to either upload PST files to a temporary Azure storage or to actually send them a physical copy by mail (yes, snailmail)

More info on this can be found on https://go.microsoft.com/fwlink/?LinkID=544944

It’s a bit out of the scope of our average situation here, but know that such a method exists.
It will require the use of the program AZCopy, which is well explained in the link above.
Check it out if you want to look like a cool IT guy in the eyes of your customer 😉

(although Powershell is still the way to go if you really want to impress your customer)

PST Migration (2)

Difficulty level

Being a ton easier and providing more oversight than the PST Migration above, the ‘basic’ PST migration will have the average end-user require/demand your presence more often.

Although remote tools like Teamviewer/LogMeIn/… have made the life of the IT’er a lot easier, there’s got to be a bit of physical contact every now and then. This type of migration will give you the opportunity to sit down and explain Office 365 to your users while the data is slowly uploading through MS Outlook.
Grab some coffee and get your hands dirty as this type of migration will get you closest to the actual customer’s computer than any other.

Try to avoid using this migration type, when the customer has an IMAP mail account you need to move to your O365 tenant, as often IMAP saves the mail headers, but not the mail an sich, resulting in a very empty mailbox in the end.

Now, how does this process work ?
Pretty easy :

First of all, get your mail users to stop using their mail for a while.
Preferably redirect the mailflow, by use of the MX record we talked about in this post, already 24 hours before starting your PST import, to make sure no trailing mail gets left behind on a mail server you won’t be able to access anymore after migrating.
If you’re really sure that the mail is good to go, the easiest way would be to locate the current location of the PST files.
https://www.msoutlook.info/question/827 explains this quite well.
Keep in mind that the PST files aren’t always in their default location. Some customer prefer to save their PST files on a network location or redirected folder.
If you happen to be the IT guy that implemented this specific setup, shame on you. PST files will get corrupted by just looking at them. Placing them in a network drive, will only make things worse.
No PST file found ? No problem !
There’s a possibility that your user has disabled ‘cached mode’ in Outlook (often occurs in cases of local desktop computers in connection with an Exchange Server on that same location)
In that case you’re more likely to find OST files or something similar.
The ‘clean’ way to go here is to start a simple PST export procedure in Outlook
Seeing as reinventing the wheel is not my hobby, here’s the link to the Microsoft article that explains how to do this :
https://support.office.com/en-us/article/export-or-backup-email-contacts-and-calendar-to-an-outlook-pst-file-14252b52-3075-4e9b-be4e-ff9ef1068f91
Writing walls of text is one of my hobbies, though ^_^
Once you’ve gotten hold of the PST files, there’s a couple of ways to get them in Office 365, but seeing as I already advised to stop your users from using their email for a while, you get to strike while the iron is still hot.
The easiest way is to create a new Outlook profile.
Mac users : check this out –> https://support.office.com/en-us/article/manage-profiles-or-identities-in-outlook-for-mac-fed2a955-74df-4a24-bef6-78a426958c4c
Windows users : Open Control Panel, go to Mail (32 bits or no reference to the number of bits, depending on the version).
Afterwards, click ‘View Profiles’ and add a new one.
The ‘new account‘ wizard starts, where you can simply enter your new mail address (given you’re not migrating from a local Exchange server on your own domain – more on this later)
Outlook will start and an empty mailbox or even a partly filled one will appear. Depending on whether you changed the MX record already or left it unchanged.
Eventually, change the default profile to your new O365 one.
Thanks again to Microsoft for the following step ; import the PST file again in the correct profile.
https://support.office.com/en-us/article/import-email-contacts-and-calendar-from-an-outlook-pst-file-431a8e9a-f99f-4d5f-ae48-ded54b3440ac
If you’re still using the same version of Outlook (and you’ve set your user’s languages to that same language in the O365 portal *cough*), this will be a breeze. Calendar, Contacts (NO NOT AUTOFILL), Tasks, … will be imported.
No stress (*)
*actual stress level may vary.
Repeat x times where x is the number of computers where Outlook is running the old mailbox.

IMAP migration

Difficulty level

The difficulty level could vary depending on the version of the IMAP server, but the thought train runs on that same track. (did I just invent a new proverb ?)

First of all, let’s take a look at this schema below, which explains the process of migration quite neatly and in an understandable manner.

If you’ve followed our current steps in the previous posts, we’ve already established the steps up to the creation of the mailboxes, which starts us at step 5. isn’t that tidy ?

You need to create a specific CSV file, that we’re going to use in our migration batch.
Usually it will suffice to base yourself on this template, but there are exceptions for Exchange, Dovecot, Mirapoint and couple of weirder ones.

EmailAddress,UserName,Password
terrya@contoso.edu,contoso\terry.adams,1091990
annb@contoso.edu,contoso\ann.beebe,2111991
paulc@contoso.edu,contoso\paul.cannon,3281986

The exceptions to this layout are discussed at this Microsoft page.

The general idea behind this CSV file is to provide the mailbox address TO which you need to copy the content of the IMAP folder, together with the username and password of the ORIGINAL IMAP mailbox, where the mail is currently residing.

You can start the migration in the O365 Exchange Control Panel, by going to ‘Recipients’ and then clicking ‘Migration’ in the topmenu.

Click the little ‘+‘ and select ‘Migrate to Exchange Online’

Select ‘IMAP migration’

Upload your CSV file and allow unknown columns

Enter the IMAP server data and means of authentication of your old provider

Pressing ‘Next’ will start the initial setup.

The migration top menu will provide you with more information on how your migration is going. You can click the migration batch and review potential errors or view the overall progress.

A picture’s worth a thousand words, so I’m guessing a Youtube video will be worth at least “De Leeuw van Vlaenderen” :

Finally, there are some handy links on https://support.office.com/en-us/article/what-you-need-to-know-about-migrating-your-imap-mailboxes-to-office-365-3fe19996-29bc-4879-aab9-5a622b2f1481 to give you tons more info on IMAP migrations.

Things that might will go wrong

Every IT related action has a counter-action that results in something going wrong.
Keep Murphy’s laws in mind, especially the computer-based ones.

Oh no! I lost my contacts.
First of all, wear glasses.
Second, they’re not your contacts. They’re your autocomplete list in the to-field
Third, you might have used the global address list instead of your own contact list.
Still found no contacts ? Have you imported from a different folder language of Outlook ? Check ‘all folders‘ and see if you’ve got an other ‘Contacts’ folder somewhere (check for specific Contacts icons)
Also, an IMAP migration does not cover contacts (or calendar or tasks for that matter, import them using the PST method, while excluding mail)
My IMAP-imported items cannot be moved/deleted/…
Prepare for fun in the MFCMAPI tool (2 do : actually writing an article on MFCMAPI)
I can’t send an internal mail after the O365 migration.
Actually, you can, but you’re still using the wrong address in the background.
Your to-field might say ‘my_colleague@mydomain.com’, but in the background it’s saved this entry as a unique ID (especially when migrating from your own local mail server).
The solution : delete this user from your address book/autocomplete list and type the address manually.
I didn’t have Outlook before migrating. How can I create this new profile you speak of ?
2 do : tools for migrating from other crappy software
My old mails appear in ‘Postvak In’, while my new mail arrives in ‘Inbox’. Also my calendar says ‘Calendar’ instead of what the native language of my Outlook used to be.
Change your account locales in the webmail version of Outlook.
How ? Like this –> https://webapps.stackexchange.com/questions/95913/how-do-i-change-the-language-in-office-365s-outlook
My PST file will not import (/partly).
Most common reason is a corrupt PST file. Fix it using the scanPST tool.
Corruption can happen if you save your PST file on a network drive or if a specific mail is being a d*ck. ScanPST will solve this.
An often overlooked reason could also be not having enough space in your new O365 mailbox. In this case you might have to upgrade the O365 subscription for this specific user with extra space or clean up the mailbox before doing the export to a PST file.
Very big mails don’t get IMAP-migrated.
This is normal. IMAP migration supports email size up to 35MB/mail
I had a sh*tload of mails in my old IMAP folder and now some of them are missing.
If you had over 500.000 mails in your old IMAP box, this is bound to happen as number of maximum items you can migrate in one batch is limited to 500.000
Migrating from Google to O365 is constantly failing. What am I doing wrong ?
You haven’t google’d enough.
No, seriously, there’ s a security setting you must turn on in your Google Security Settings :

You’ll find this here : https://myaccount.google.com/security?pli=1#signin

Self-signed server certificate has expired (usually in SBS environment)

08/05/2018 Zupertails tech, training, windows

If you’re born before 1990 (and if you’re in IT), you probably grew up with self-signed certificates.
They give you a lovely fake feeling of security, but more than that, they will give users and the IT department horrible stress to configure.
In “days of olde” (early 2000’s), an Exchange server was able to run over http traffic and a certificate was absolutely not required.

Times have changed and so have security protocols. It’s ill-advised to use a self-signed certificate nowadays, as it is equally ill-advised to use a .local domain anymore on your domain controller.

That being said, there’s a couple of ways to fix an expired self-signed certificate on a Windows SBS server. (read first, perform later, you’ll see why)

Lazy mode

aka ‘fix my network’

Open the SBS console, go to the ‘network’ menu and select the ‘Connectivity’ tab.

Click ‘Fix my network’ and deselect everything except the certificate error, after this wizard stops scanning.

The usual Next-Next-Next will follow and according to Microsoft, you’re good to go.

HOWEVER…

There’s a couple of things that can go wrong here :

Your certificate contains a custom entry referring to a domain name or subdomain name that wasn’t originally added in the SBS wizard.
You’ll need to perform the manual method for renewing a certificate. See below.
Your Exchange webmail (https://your_mail_server_ip/owa/) still gives a certificate error, stating your certificate’s still expired.
In this case, your IIS needs to be reminded of the fact that he should use the newly created certificate.

Somewhat easy mode

Start the ExMngmtnShell (Exchange Management Shell) as Administrator
type Get-ExchangeCertificate to list the installed certificates
Match the certificate to the expired certificate (using subject the name and services) from the Console then copy the associated thumbprint
Type Get-ExchangeCertificate –Thumbprint INSERTTHUMBPRINTHERE | New-ExchangeCertificate | Enble-ExchangeCertificate -services pop,imap,smtp,iis
Type Y to renew the certificate
Restart SBS2008/2011 Console or restart server.
Profit.

Like-a-bawz-mode

Beautifully explained on http://www.petenetlive.com/KB/Article/0000535, so no need to repeat what Pete already wrote.
The main idea here is to use the IIS built-in Certification Authority (certsrv), while manually defining all entries needed in the certificate.

It’s still relatively easy, but requires a lot of steps.

Of all three mentioned methods, this last one is most likely to succeed.

Sources :

http://www.petenetlive.com/KB/Article/0000535
https://serverfault.com/questions/526221/renewing-sbs2011-exchange-self-signed-certificate-w-o-changing-home-page-in-ie
My own meandering experience

OFFICE 356 MIGRATION (5)

24/04/2018 Zupertails office 365, tech, training

Force The User, Luke

In our previous post, we’ve set up everything so we’d be able to start creating the users and their respective mailboxes.

If at this point you’ve already changed the mail server name in the domain’s MX record to that of the Office 365 one, remember that actual mail might already be arriving (or bouncing) in the O365 environment, so be cautious of this, when migrating a live situation.

A small recap below in case you forgot our intended setup :

If you’ve been paying attention in the previous posts, you’ll know we will be needing to create three users here :

Oliver
Annie
John

All other mail related stuff will be handled with mail groups or shared boxes.
Remember : the Microsoft licensing system in O365 is user-based, not computer-based.

Let’s start off with creating these three accounts.
Open the Office 365 admin portal and open the “Users” menu, and then select “Active Users”.

Next, Click the “+ Add a user” button and a small form appears.

Creating a user in O365 — Creating a user

You’ll notice a couple of things in the user creation form (except from the obvious things of course) :

The domain field shows your recently added domain as well as the onmicrosoft.com tenant name.
This means that you’re not obliged to actually use a domain name in an O365 environment. When going for mailboxes, it’d be stupid/silly/… not to do so.
Password generation : either let Microsoft generate a password for you that complies with the O365 password policies or type one for yourself.
You can also allow the user to be able to change their password on first logon.
Make your choice depending on the end-customer’s needs.
After confirming the user creation, you’ll also be given the option to send the credentials to an email address of your choice.
Roles : by default, new users will be given the “User” role, which allows for basic usage of the O365 environment. Other roles can be “Global administrator” or a custom mix of rights.
For more info on the different types of admin rights, see this Microsoft page.
If you’re ever to go and do a Microsoft exam on O365, these roles will pop up more than once in the questions list.
The Roles parts also allows you to fill in an alternative email address, instead of the user having to do this. Purely intended for password retrieval purposes.
Product licenses : in the O365 demo you’ll be given 25 Enterprise E3 licenses.
Depending on your user’s needs, provide the correct licenses by clicking the slider next to the license name.
Creating an user without a product license, which is also an option, is ill-advised and used in only a few specific situations.

Click the “Add” button and you’ll be greeted with the send-password screen asking you if you need to send the password in case you forget to write it down.

Repeat for all the necessary users.
In this case Annie and John will be created in the same way.

Remember to remove the admin’s E3 license for good measure. (but keep him admin !!)
In this demo environment, it doesn’t really matter, but you don’t want your customer to be paying for an unused license.

Just a tiny heads-up : if you don’t want your users to be calling you every 90 days, you might want to perform the small task of changing the Password policy.
Go to Settings > Security and Privacy and change password policy to “Never expire” and “Never notify” by clicking the “Edit” button.

The spice must flow. So must the mail

Well, that didn’t seem so difficult, right ?

Office 365 has automatically created a mailbox already for your users, in the background.
The system knid of predicted that you’d be wanting a mailbox for your E3-licensed users, as otherwise it wouldn’t be logic that you’d provided them with such a license.
Of course there’s still some things that need to be done, so let’s have a look there.

There are two ways to edit mailbox properties.
The easiest, but with the least fancy options is through the same “User” menu we used to create the users themselves.
The second option is through the Exchange Admin Center.
Let’s start with “easy mode” :

Click the user in the Active Users menu and his properties will appear in an overview.
One of the options visible will be “Mail Settings”, where you can set up a couple of things :

Mailbox permissions : literally what it says. Allow others to have specific access to this mailbox. We’ll get into more detail when we reach a shared mailbox.
Email forwarding : allows you to *drumrolls* forward your user’s mail to another mailbox, with the option of leaving the original mails in your O365 box.
External mailboxes (unrelated to your O365 tenant) are also possible recipients.
Litigation Hold : allows for items in the mailbox to be retained even if the user deletes them.
Pay attention that this can increase the size of your mailbox significantly.
More info on litigation can be found on this Technet article.
Automatic replies : I don’t believe this needs much explaining.
Can also be done through the user’s personal settings in either Outlook or throught https://outlook.office365.com and preferably so. If you need to manage all your customers’ mailboxes and set their Out of Office message yourself, you’d best be charging by the hour.
Email apps will provide you the option of disabling certani ways of connecting to the O365 mail system. I can imaging you might want to disable POP ad IMAP for instance. It depends on the specific needs, however.
Show in global address list sets visibility of this mailbox in the address list when browsing through your company contacts. Usually you’d want this setting to remain untouched. Only in certain cases (for instance a logging or journaling mailbox) will this be a good choice.
Converto to a shared mailbox basically unlinks the mailbox from a user license and changes it to an mailbox which is only visible through an other O365 account within your tenant.
Edit Exchange properties opens the “hard mode” Exchange Admin Center screen, which we’ll discuss in more detail next.

The Exchange Admin Center is actually the way to go when you want to configure your mail environment in more detail.
It’s also a lot more fun to fiddle around in and it will give you a more general idea on all the mailbox features.

For all on-premise Exchange server admins with experience in 2013 server or higher : you’re in for a treat as this is an almost-perfect copy of the “Exchange Control Panel” with just a tiny difference in some functionality. You can probably skip most of this part.
Even the URL is similar : https://outlook.office365.com/ecp/

Don’t be startled by the amount of clickable options in the Exchange admin Center.
We’ll cover the basics, under the “recipients” section.
Have a look around in the other options, but don’t change anything for now.
For your ease, click the Recipients link in the left menu.

This will show us six options in the top menu :

Mailboxes : an advanced view per mailbox for setting up rights, mailflow, aliases, …
Groups : allows for creation of either a fixed ditribution group, a security group or a dynamic distribution group. The dynamic groups are actually quite fun to play around with. They set up a mail-enable group depending on certain variables such as company name, department, …
Resources are practically identical to shared mailboxes, with the difference that they have a fancy looking icon. Resource mailboxes have the purpose of creating a mailbox (more preferrably a calendar) for your hardware.
If Oliver Shortstraw has a meeting room and a shared car, he might benefit from giving these items a calendar of their own (it’s free, anyway) so managing whoever needs to borrow the car or use the meeting room becomes a super-easy task.
Contacts : if you were to use external email addresses in tenant-wide mail rules, they need to be defined in this area.
“Mail contacts” are used for administrative purposes only.
“Mail users” are Active Directory enabled objects linked to an external mail address, allowing external users (like a gmail user) to perform things inside your cloud AD environment.
Shared mailboxes : as mentioned before, these mailboxes host mail, but aren’t linked to a physical user, thus not accounted for during licensing cost calculation.
Migration. I’ve always found this option to be somewhat misplaced in the recipients menu.
The “Migration” option oviously lets you migrate to (and from !) Exchange Online through a couple of ways.
We’ll be doing the second-to-easiest migration later on, as we’ll be importing shortstraw.be mail from the current provider over an IMAP migration.
In case you’re wondering : importing PST files in Outlook is the easiest way.

Mailbox properties

Let’s start alphabetically and have a look at Annie’s mailbox.
Doubleclick her entry in the Mailboxes part of the Exchange Admin Center

The more important options in this popup window (allow popups in your browser for this to work, by the way) aren’t the ones you see at first.

Except from the “hide from address list” check mark, you can safely move on the “email address” menu for now. Feel free to have a gander at the other options.

You’ll see three entries by default, after having created a user with only one domain attached to the O365 tenant :

SIP : used in Lync/Skype for Business/Teams (the communication part)
SMTP (in uppercase) : the default address, by which all outgoing mail from this mailbox is sent. Also called the “reply address”
smtp (in lowercase) : an alias to the mailbox. Mail sent to this address will appear in the mailbox as well. Replies will be sent from the SMTP address.

In our example, we’d like for Annie to receive cfo@shortstraw.be as well.
This can be easily achieved by clicking the little + icon and filling out the form, where you type the complete e-mail address and pressing the “Save” button.
You can edit here if this new address needs to become the reply address.

Mailbox features holds a plethora of options such as disabling the use webmail, denying mobile phone connectivity, litigation (see above), archiving, …
The part I want to focus on is “Mail flow” (scroll down a little in the list or enlarge the window).
Again, feel free to check out the other options as well.

Click mail flow and a new window will appear where you get to fill out another form.

Pretty straightforward option where you can setup a server-side mail forwarding, without Annie knowing about it.
For legal reasons I’m obliged to tell you that you should inform your users of this forwarding rule.
Ticking “Enable forwarding” enables you to click the “Browse” button, which in its turn shows you the list of available users to select from.
You’ll see that this list is populated only by the internal addresses in your own global address list.
And this is where our “Mail contacts” from above come in of oyu’re to setup a forwarding to an address that’s not housed in your customer’s O365 tenant.

“Deliver message to both forwarding addresses and mailbox” simply does what it says. If you weren’t to activate this after enabling the forward option, Annie wouldn’t receive mails anymore in her own mailbox, but all mails are forwarded without leaving a copy.

One more option in the left menu of our user mailbox properties that we’ll look into within a couple of minutes is the “Mailbox delegation” menu. This option is a mini rights management where you can set “full access”, “send on behalf” and “send as” rights for a mailbox.

In our example, Oliver had a couple of aliases in his old mail setup.
Because we love our customer, we’ll gladly copy and paste these addresses in the new environment so he can be mailed on e.g. tha-bawz@shortstraw.be

Our third “straw” is John, who luckily doesn’t need extras so he’s good to go with an out-of-the-box setup, which starts him up automatically as john@shortstraw.be

We’re almost done with our basic mailflow configuration.
All that remains from our initial analysis (concerning the shortstraw.be domain name) is the remaining info@shortstraw.be that needed to be seen by both Annie and Oliver.
We’ve already established that a shared mailbox would be the most appropriate solution for this, so let’s configure one !

Go to the “shared” top menu and click the little + icon.
A familiar looking form appears.
You might recognize this from when you just recently created a new mailbox.

The biggest difference is the appearance of the permissions box.
Select the user(s) with permission to view and send from this box and press “Save”.

You’re good to go !
Setting up a shared mailbox is THAT easy.

That’s it !

Play FFXV, you'll get it ;) — Recipeeeaaahhhh

You’ve got a basic mail configuration up and running.

If you’ve changed the DNS settings for the MX record as discussed in the previous migration post, you should be receiving mail by now.

If you’ve set up this mail config as a placeholder for when the actual migration starts, it’s time to move on to the migration now.

THAT’S RIGHT !! YOU GET TO ACTUALLY MIGRATE AFTER 5 CONSECUTIVE POSTS CLAIMING SO.

All jokes aside, in my humble opinion the prep work is incredibly important in deciding between keeping or losing your customer.
And that’s a decision from both the customer and the IT guy/girl !

SPF records and how they work

13/04/2018 Zupertails office 365, tech, training

The mysteries of the internet : SPF edition

First of all, SPF stands for “Sender Policy framework”.
Now you know.
Period.

Just kidding.

An SPF record is used as a “sort of ” security/anti-spam measure in order to protect your outgoing mail from being sent FROM a certain list of sender locations.
You read it right : “from” (not “to“).
It’s in no way a fail-safe antispam solution, but it will decrease the amount of mails sent in your name significantly.
Office 365 even requires this specific record on first setup (although you can skip this step eventually).

Who didn’t configure his Outlook Express in the old days to send mail from as his boss to fake a “you’re fired” mail to your new colleague ? Right ? Right ? N-Nobody ?
Oops. Sorry, Bjorn.

Comment ça marche ?

In order to understand how things work, wel’ll start out with a little example from our fake (?) company Shortstraw LLC and their Office 365.
After setting up your O365 subscription, your SPF records looks a bit like this :

Note the “subtle” reference to mxtoolbox.com

I deliberately used the expression “text record” as SPF is nothing more than a TXT record with a specific markup. Most hosting companies have a separate entry box for SPF nowadays, but in the background it’s still a TXT.

Let’s split up everyting in this text record, so we can understand completely what exactly it is that Microsoft wants us to do.

v=spf1 :
All this does is stating the obvious.
This record is “version SPF1”.
To make things confusing, there’s an unrelated spf2.0 record, which stands for “Sender ID”

include:spf.protection.outlook.com :
The include value *drumrolls* includes the values of another SPF record, in this case a large list of IP addresses of Microsoft servers.

The very same website I’ve used in the example above (MX Toolbox) easily provided me with this information. You can see that in itself this record loops through to more SPF values in spfa.protection.outlook.com.
This has to do with the maximum accepted length for a TXT record, which is limited to 255 characters, as explained on this RFC page.

-all
The final entry in the record is also the most conclusive one.
The “-all” stands for “disallow all other entries”

Other entries

The above example was just a textbook sample provided by Microsoft to get you started. It should be sufficient for the average O365 setup.

Reality however will often slap you in the face with a more complex situation where you’ll be needing to configure all-in-one printers, old software packages with support for mail over port 25 only, websites sending from something@your_domain_name, …
They all have a couple of specific things to keep in mind when configuring your SPF record.

A handy tool for helping you configuring your SPF record is https://www.spfwizard.net/, which does exactly what the name implies.

Other possible entries you might use in your record :

A:
It’s usually followed by an actual DNS A-record
An example will make things clear.

v=spf1 include:spf.protection.outlook.com a:mail.suamae.br -all

The classic O365 SPF record was added a:mail.suamae.br, which will allow the IP resolving to this Brazilian mail server name to be able to send mails from shortstraw.be’s domain name as well.

Just adding “A” and not defining anything behind it, will result in all A-records in shortstraw.be being able to send mail from this domain name.

MX:
Works similar to the A-entry.

v=spf1 include:spf.protection.outlook.com MX:uwmoeder.com -all

The example above will allow all the mailservers in the domain uwmoeder.com to be able to send mail from shortstraw.be

Double checking on this, it will resolve to redirect.ovh.net in this case.

Just adding “MX” without a domain name, will allow all MX entries in the shortstraw.be domain to send mail.

IP4:
You may enter one specific IPv4 address or a group of IP addresses in the typical “slash” notation (it’s called “CIDR format” in big-boy-language).
Note the omission of the letter “v” in ip4. Pay attention to this common typo.

v=spf1 include:spf.protection.outlook.com ip4:194.78.56.8 ip4:37.230.164.0/22 -all

This will allow the single host “194.78.56.8” and the group of IP addresses “37.230.164.0 to 37.230.167.255” to send mail from your domain name.

IP6:
See above.

v=spf1 include:spf.protection.outlook.com ip6:2a01:4f8:d16:1355::2 -all

Completely the same, but for IPv6 addresses.

~all
Replacing the “-all” entry with this “~all”, results in the mails from the “not-allowed” list to be marked as so-called “Soft Fail”. You can see the result of this in the headers of a received mail as something like …

Received-SPF: softfail (google.com: domain of transitioning mail@example.com does not designate 203.0.113.2 as permitted sender) client-ip=203.0.113.2;

+all
Stating the “+all” addendum, ignores everything you just added in the previous part of the SPF record.
Your mails might (or might not, depending on the server) be tagged with an extra header that says something in the likes of “this mail is probably not OK, but it doesn’t matter anyway”.

?all
Almost the same as “+all”, with the exception that your mails will not be flagged.
?all stands for “No policy statement” and simply does not hold the SPF record in account.
Often used when trying to delete an SPF record without actually deleting it.

Now how does this REALLY work ?

Every self-respectable and up-to-date mail server will do an SPF checkup, when receiving mail.
That’s right, even Exchange Server 2003 can do this, updated to Service Pack 2. (not sure how it’s implemented in an Exchange 2000, though – I’ve seen software by GFI that used to be able to do this, but if you’ve come to this page looking for an antispam solution for your Exchange 2000, you can probably guess what I’m thinking right now…)
In a side-note, this function is usually referred to as “Sender ID” in an Exchange environment.

It’s usually a hard-coded feature with nothing much to tweak, except for turning it on or off.

A basic representation of SPF functionality (picture shamelessly stolen from this site)

One simple image explains how it works.
Mail server A sends mail from a certain domain.
Mail server B receives mail from this domain and does a quick DNS lookup looking for any TXT records containing “v=spf1” after which he interprets the information like I’ve explained about one page up.

That’s it !

You now know how an SPF record works !

More information

I’ve taken the liberty of compiling a small list of handy websites should you want to read more on the subject.

Pretty hardcore and a tough cookie to read ; the official RFC for SPF records :
https://tools.ietf.org/html/rfc7208#section-6.1
SPFWizard, for creating your own custom SPF records on the fly :
https://www.spfwizard.net
DKIM, a next-level form of protection your domain.
It’s not covered on this page, but it’s just a friendly reminder to let you know that there’s more than one way to perform mail protection :
https://blog.returnpath.com/how-to-explain-dkim-in-plain-english-2/
Mxtoolbox.
Your trustworthy website on troubleshooting DNS and mail related stuff.
https://www.mxtoolbox.com
Microsoft Message Header Analyzer.
Not mentioned in this page yet, but a great tool nevertheless.
If reading a wall of text is too hard, copy your mail headers in this website and it will provide you with readable text. Huzzah !
https://testconnectivity.microsoft.com/?tabid=mha

OFFICE 356 MIGRATION (4) – 3 steps ahead

11/04/2018 Zupertails office 365, tech, training

Remember Oliver’s company (Shortstraw LLC) mail profile in one of our previous posts ?
Refresh your memory if you stumble upon this website and have forgotten / not read the previous one.
I will base this actual setup on our findings in that post.
The hardware and operating system upgrading procedures, that I spoke about, will not be handled here.

Preparing the environment

Since we’ve established our to-do list, we can now start the procedure in which the customer will experience the least downtime.
Depending on the expectations of the customer, you can either perform all these actions on-the-fly or prepare yourself thoroughly. In this case we’ll take the long(er) road.

After having created the 30-day trial (or go ahead and buy one instantly through Microsoft or a Cloud Solutions Partner)

You’ll be greeted with something similar to the screenshot above.
Clicking the upper left square icon will get you into the apps menu.
Depending on the user rights and licenses, you’ll see less or more icons, representing the programs and apps you’re allowed to use.

One important icon you’ll see, is the “Admin“.
Users that have administrator rights will be provided with this option.
In this example, our admin user has a fully working E3 license (you get 25 of these buggers in an O365 trial), which is something that’s “not done” in a real life situation.
Were you to upgrade this 30 day trial to a full tenant, I strongly suggest stripping the admin account of all his licenses. It’s bad practice to use your O365 admin account for anything else than … well… admin purposes.
We’ll get into licensing later.

Click on “Admin” and a specific administrative portal opens.
You can take a short tour of everything by clicking “Start the tour” if you want or read onward and click “Skip”.

On the left side of the admin page you’ll notice the admin menu (which is deliberately placed as a screenshot on the right side of this page, just to confuse you)

First thing you’ll be wanting to do is to create the situation with the correct internal mailflow, user rights etc.
Remember : as long as you don’t change the MX record in the customer’s DNS settings, NOTHING will happen to the existing setup.
You can safely mess around until you’ve got the flow up and running to your own standards.

Remembering our previous conclusion, we’ll start creating our users’ mailboxes first.
If you want to get this right at first try, you’ll want to include the domain first as an “inbound” domain into your O365 tenant. This will allow you to create user names ending in @yourdomain.com instead of @yourdomain-com.onmicrosoft.com.
Again, including the domain name will not change your current mail flow.
DON’T PANIC !!!

Open the Setup menu and click “Domains”

One domain will be listed by default.
This is you tenant name (in my example “shortstraw.onmicrosoft.com”) and cannot be removed.

Click “Add Domain” and fill in the desired domain name, after which you click “Next”.

In order for Microsoft’s servers to verify your identity and double checking if you’re actually the owner or admin for your added domain, you’ll be given the choice of either adding a TXT record or adding a fake MX record into your own DNS management software at your hosting company’s admin package.

In my case, the lovely French hosting company “OVH” will be my location to turn to.

Eventually, practically every DNS hosting company allows you to manage your settings through some form of admin portal for easy setup purposes.
Once the record has been added, you can click the “Verify” button to let Microsoft doucble check the creation of the record.

Troubleshooting :

If the TXT record is not yet found, according to the O365 domain verification wizard, you can always start your troubleshooting on a global level by surfing to https://dnschecker.org/DNS Checker creates a worldwide DNS lookup, using all sorts of DNS servers to see if your DNS record has propagated already to all locations.
Usually DNS propagation for a brand new domain record will probably not take a lot of time. It’s those record changes that tend to take longer.

Successful verification will get you to this screen

From this point on, you’ll be able to pick your domain name already in the user creation wizard.
Should you choose to continue, more DNS records will be added.
Skip forward to user creation. (link not yet implemented, because too lazy)

The screenshot above will give you a sneaky Microsoft question, with the default option set to “Set up my online services for me”.
Though Microsoft might say “Recommended”, I strongly disagree here.

“Why’s that”, you say ?
In case you decide to stop your O365 adventures and want to move on to a new platform for mail, you’re going to have to go through a lot of hassle to set this straight again.

Always choose to manage your own DNS records and click “Next”. Unless you’re REALLY pissed about your current DNS provider. In that case, I still suggest just finding another one. BUT NOT MICROSOFT FOR THE LOVE OF GOD.

A step that has been neatly added in the onboarding wizard, since Q4 of 2017 is the “Choose your Online Services” wizard.
This narrows down the amount of DNS records for you to add, according to the active checkmarks.
I’m going to select all of them, because I know my end-customer Oliver Shortstraw will need toe Exchange parts as well as the Mobile Device Management.
He’s also a somebody that changes his mind in the blink of an eye, so just to be sure we won’t have to setup anything else later, I also picked “Skype for Business”.

A somewhat huge list of DNS records will appear, for you to fill into your favorite DNS hoster *cough* OVH *cough*

A wild list appears. You crit it for 9000. It was super effective

Now in order to fully understand what’s going on here, I’ll explain in detail the actual stuff that’s going on. Teach a man to fish etc.

FINAL WARNING (I won’t repeat it again) DO NOT CHANGE THE MX RECORD JUST YET (unless this is a brand new setup for a brand new domain, then go ahead and have fun)

CNAME : autodiscover > autodiscover.outlook.com
This record basically tells your Outlook client to read a pre-made config file on a Microsoft server.
Thus allowing you to just enter your e-mail address and password in the Outlook setup wizard, instead of having to go through the hassle of manually setting up your O365 config.

CNAME : sip > sipdir.online.lync.com
Refers to the actual SIP server for using Skype for Business/Lync/Teams. Your communication client will connect to this server and this server will in place patch you through to the geographically most redundant SIP server.

CNAME : lyncdiscover > webdir.online.lync.com
This server uses the same Autodiscover protocol as the Outlook one.
It patches you through to the correct Microsoft server cluster where your tenant is hosted, as well as other various kinky background processes. Dragons be here.

CNAME : enterpriseregistration > enterpriseregistration.windows.net
Basically serves as a registration server (duh), so the Microsoft servers know what mobile device was added to the tenant for so-called “conditional access”

CNAME : enterpriseenrollment > enterpriseenrollment.manage.microsoft.com
Enrolling (again, duh) Windows mobile devices and managing them through Microsoft Intune, requires these servers.

TXT : v=spf1 …
Specifies the server(s) that may send mail, originating from your domain name.
More on SPF records in an other post.
For now, follow the suggested entry, which – shortly explained – allows a group of servers that are defined in the name spf.protection.outlook.all to send mail from your domain. All others are denied.

SRV : _SIP
Together with the sipfederationtls entry, these are usually the more tricky ones to enter, depending on the DNS management tool.
[An example from the one.com hosting panel].
This specific entry provides the security layer.

SRV : _SIPFEDERATIONTLS
This entry states the TCP port 5061 is being used for everything federation-related in communicating over SIP. A Classic SIP port uses port 5060. Microsoft likes to do things in their own special way…

MX : xxxx-yy.mail.protection.outlook.com
An automatically generated server name, based on your domain name and domain extension.
MX is short for Mail Exchanger and tells other mailservers in the world where to go dump its mail for your specific domain name.
The second you change this record in your DNS management (and it gets propagated world wide, bla bla) your mail will be directed to the server(s) in this record.

<lazy mode> Let’s assume for the time being, that our test company does not care much for just a little downtime and let’s change all these records in our DNS management tool </lazy mode>

Clicking the “Verify” button at the bottom of the wizard page will get Microsoft’s O365 server to check all your entries. Depending on the DNS management tool and the hosting company, this might take a couple of seconds up to a couple of hours.

After a successful verification of all entered services, let’s move on to creating new users in the next post.
For now, pat yourself on the back for a job well done and have a refreshing beverage.

SMTP relay on your Windows server for use with Office 365

05/04/2018 Zupertails office 365, tech, training

Antique software ? No TLS/SSL support for outgoing mail ?

No problem !

If you stumble upon this article through a Google search (who uses Bing, anyway…), you’re probably wondering how to solve the following issue (or something similar) :

You have this old invoicing software that doesn’t get updates anymore ever since 2008 and relies on port 25 – unauthenticated – to send mails through your ISP’s outgoing mail server.

You happen to have this beautiful product called ‘Office 365’ and use its mail functionality for your own domain name. This domain name is used as outgoing mail domain in your software.

Luckily, you still have a Windows Server randomly lying about (hopefully 2008 R2 or higher, but this trick works with older stuff as well – also : this works on a Windows 7/8/10 , even though the IIS install method will be different)

Installing SMTP in IIS

2012 R2 Server
Install Internet Information Services (IIS)
1. In Server Manager, select Add Roles.
2. On the Before you begin page in the Add Roles Wizard, select Next.
3. On the Select Installation Type page, select Role-based or Feature-based installation.
4. On the Select destination server page, choose Select a server from the server pool, and select the server that will be running SMTP services. Select Next.
5. On the Select Server Roles page, select Web Server (IIS), and then select Next. If a page that requests additional features is displayed, select Add Features and then select Next.
6. On the Select Role Services page, make sure that Basic Authentication under Security is selected, and then select Next.
7. On the Confirm Installation Steps page, select Install.
  
  Install SMTP
  1. Open Server Manager and select Add Roles and Features.
  2. Select Server Selection and make sure that the server that will be running the SMTP server is selected and then select Features.
  3. On the Select Features screen, choose SMTP Server. You may be prompted to install additional components. If that’s the case, select Add Required Features and select Next.
  4. Select Install. After the installation is finished, you may have to start the SMTP service by using the Services snap-in for the Microsoft Management Console (MMC).
2008 R2 Server
Install Internet Information Services (IIS)
1. In Server Manager, select Add Roles.
2. On the Before you begin page in the Add Roles Wizard, select Next.
3. On the Select Server Roles page, select Web Server (IIS) and select Install.
4. Select Next until you get to the Select Role Services page.
5. In addition to what is already selected, make sure that ODBC Logging, IIS Metabase Compatibility, and IIS 6 Management Console are selected and then select Next.
6. When you’re prompted to install IIS, select Install. You may need to restart the server after the installation is finished.Install SMTP
  1. Open Server Manager and select Add Roles and Features.
  2. On the Select Features screen, choose SMTP Server. You may be prompted to install additional components. If that’s the case, select Add Required Features and select Next.
  3. Select Install. After the installation is finished, you may have to start the SMTP service by using the Services snap-in for the Microsoft Management Console (MMC).
Windows 10 / 8 / 7Use the instructions on https://www.howtogeek.com/112455/how-to-install-iis-8-on-windows-8/
You’re probably oing to need at least the ‘Professional’ version of the operating system to be able to pull this one off.

Configuring the SMTP Service for use with O365

Set up SMTP
1. Select Start > Administrative Tools > Internet Information Services (IIS) 6.0.
2. Expand the current server, right-click the SMTP Virtual Server, and then select Properties.
3. On the General tab, select Advanced > Add.
4. In the IP Address box, specify the address of the server that’s hosting the SMTP server.
5. In the Port box, enter 587 and select OK.
6. On the Access tab, do the following:
  1. Select Authentication and make sure that Anonymous Access is selected.
  2. Select Connection > Only the List Below, and then specify the IP addresses of the devices that will be connecting to the SMTP server, such as printers.
  3. Select Relay > Only the List Below, and then specify the IP address of the devices relaying through this SMTP server
7. On the Delivery tab, select Outbound Security, and then do the following:
  1. Select Basic Authentication.
  2. Enter the credentials of the Office 365 user who you want to use to relay SMTP mail.
  3. Select TLS Encryption.
  4. Select Outbound Connections and in the TCP Port box, enter 587 and select OK.
  5. Select Advanced and specify SMTP.office365.com as the Smart Host.

/!\ Restart the IIS service and the SMTP service. /!\

Actually testing, before applying

You can test SMTP relay services without using your software that needed it in the first place.

To test SMTP relay services, use the following steps.

Create a text file using Notepad or another text editor. The file should contain the following code. Replace the source and destination email addresses with the addresses you will use to relay SMTP.
```
FROM: <source email address>
TO: <destination email address>
SUBJECT: Test email

This is a test email sent from my SMTP server
```
Save the text file as Email.txt.
Copy the Email.txt file into the following folder: C:\InetPub\MailRoot\Pickup.
Try to copy it instead of just moving it. The mail file will disappear.
After a short time, the file should automatically be moved to the C:\InetPub\MailRoot\Queue folder. When the SMTP server delivers the mail, the file is automatically deleted from the local folder.

Warning: If the SMTP server can’t deliver the message, a non-delivery report (NDR) is created in the C:\InetPub\MailRoot\BadMail folder. You can use this NDR to diagnose delivery issues.

Troubleshooting

This is where most guides fall short.

Read the mails, that appear in the Badmail folder.Usually there will be a reason for refusal or non-delivery explained in these files.
If you have ‘show file extensions’ turned on, they will appear as .BAD files.
Open with Notepad or a similar pogram to see something like this :

Self-explanatory, I guess.
If mails were to actually arrive at their destinaton, but marked as “phishing” or appear in the spam folder of your recipient, chances are pretty high, your software package is still sending out through the wrong outgoing mailserver.
Seeing as I’m not a psychic, I can’t know how to configure outgoing mail in every piece of software.Press F1

An other reason for your mails being marked as “phising” (and I deliberately left this near the end of this article), is also related to the above (still sending out through your ISP’s SMTP server using an Office 365 mail address).
HOWEVER…

When the mail arrives – even though its marked as spam – this means your ISP was able to actually deliver it. In Office 365 cases, this usually means that your ISP is not allowed to send out as your O365-linked domain name.
I’ll provide a detailed how-to on interpreting mail headers in a later post, but for the purpose of this exercise, let’s presume the mails are being marked because of the above.

In this case, just adding/editing an SPF record that relates to your ISP will be enough.

I hear a couple of muffled hillbilly-sounding voices in the background asking me ‘what in tarnation is an SPF record’ and how does that work ?
Read and weep : https://blog.returnpath.com/how-to-explain-spf-in-plain-english/

For all you Belgians out there, these are the values you need to include in your SPF record for the bigger ISP’s :

Telenet
include:_spf.telenet-ops.be

Proximus
include:ispmail.spf.secure-mail.be
include:bgc.spf.secure-mail.be

The somewhat attentive reader might be asking himself ‘if I could just add an SPF record using the records for my ISP, then why did I even bother reading this article ?

I’ll keep the answer very simple : EVERY user of this ISP will have the ability to send mail as your domain name, without passing some form of verification in this case.

AAaaaaand we’re back to the 80’s/90’s , where it was common fun and games to change your mail address in Outlook Express or other old mail software.

Random :
Did you know that Outlook Express’ executable file msimn.exe was named, because it’s short for MicroSoft Internet Mail and News ?
Mail does not arrive and the NDR gives an authentication error :
Did you change your O365 password for the account that you use to authenticate for the SMTP connection ?
Yes you did. (or you just made a typo)
Mail does not arrive and the NDR gives a ‘does not permit to send as’ error :
Most often, this occurs when not sending as the account that is the SMTP relayer.
Your fancy 80’s software probably sends as (e.g., which is latin for exempli gratiā and is often translated as example given – just sayin’) invoicing@shortstraw.be, while your SMTP’er is oliver@shortstraw.be.

To solve this, either change your outgoing mail address in your 80’s software, change the authenticating O365 in your SMTP relay server OR…. *drumrolls* add ‘send as’ permissions to the invoicing mailbox for Oliver’s account.

What’s that ? invoicing@shortstraw.be does not exist in your O365 tenant ?
Yeah… I figured as much…
Add is as an alias to Oliver’s box or create a new box. Choice is yours.

Oh, and in a footnote : you will not find the mails sent through your relay’er in the resp. mailbox’ Sent Items.
Handy for troubleshooting… NOT

Re-linking an Office 365/2016/2013 installation to a new user

30/03/2018 Zupertails office 365, tech, training

Disaster strikes !

You company has lost an employee and his or her computer gets transferred to a new colleague, who’s freshly hired.

When your lazy-mode kicks in as an IT implementor, you’re probably gonna go and rename the old account in the Office 365 portal and go on with ordinary life as a sysadmin.
However, this will bring some new issues to the table.

The user will still be named as the old user in the internal database of O365
Here and there, references to the old name will still appear in the web portal, as well as in the ‘edited by’ properties of Office documents.
Your physical install of Office will still refer to the old user and will ask for reactivation, which will not work.
… (which is short for “I can’t think of anything else, but I’m sure there is more”)

Having been told I should be less agressive, I’ll try to go towards a passive agressive mode and say “this is what I suggest you should do” instead of “now do this”.

The general idea here is to convert the old mailbox (if there is any, this depends on the O365 subscription) to a shared mailbox, wait for the actual conversion to be done (this is an incredibly important part which is overlooked often) and then take away the e-mail-holding license (Plan 1, Business Premium, E3, E5, …) from that user.
The detailed explanation on how to do that, is not relevant to this post, right now.
Afterwards, create the new user and add the license.

What IS relevant, is the removal of the old license on the computer that remains behind and is passed on to the new user.

A couple of steps need to be taken in order to clean up the installation, so it can be re-linked to a new O365 user.

Use the Office Software Protection Platform script to remove the license from the computer.
To remove the Office 365 license, you must run two cscript command lines. The command lines are:

A. Run C:\program files <x86>\Microsoft office\office15>cscript ospp.vbs /dstatus

The above command line will generate a report of the currently installed/activated license. (See Below)

NOTE: You might see multiple licenses in the /dstatus report.

B. Make note of value for “Last 5 characters of installed product key”

C. Run C:\program files <x86>\Microsoft office\office15>cscript ospp.vbs /unpkey:“Last 5 of installed product key” For example: C:\program files <x86>\Microsoft office\office15>cscript ospp.vbs /unpkey:WB222 (See Below) Repeat the step above if necessary until all keys are removed.

After running the /unpkey: command line you will see a “Product Key uninstall successful” message. You can now close the Command Prompt and move onto Step 2.
Remove cached identities in the registry.
In the Registry Editor navigate to HKCU\Software\Microsoft\Office\15.0 or 16.0\Common\Identity\Identities and remove all of the identities under \Identities.

NOTE: If using Shared Computer Licensing remove the above Identities from HKEYUsers\SID.
Remove stored credentials in Credential Manager.
A. Open Control Panel > Credential Manager. Remove all Windows credentials listed for Office15 or Office16.

B. To remove the Credential Click on the Drop down arrow and choose Remove from Vault.(See Below)

In Shared Computer Licensing scenarios you must remove the Token and identities listed below.
%userprofile%\Appdata\local\Microsoft\Office\15.0 or 16.0\Licensing
Manually cleanup specific folders.
Credential Manager:

Appdata\Roaming\Microsoft\Credentials
Appdata\Local\Microsoft\Credentials
Appdata\Roaming\Microsoft\Protect
HKCU\Software\Microsoft\Protected Storage System Provider

Office 365 activation Tokens and Identity

Appdata\local\Microsoft\Office\15.0 or 16.0\Licensing
HKCU\Software\Microsoft\Office\15.0 or 16.0\Common\Identity
HKEYU\(The Users SID)\Software\Microsoft\Office\15.0 or 16.0\Common\Identity

The above steps will be reset to the activation state for Office 365(2013/2016). The activation flow after the locations are cleared will represent an initial activation scenario.

TL;DR ? Download OLicenseCleanup.vbs_1 , rename to a .VBS file (by removing the .TXT extension, why am I even saying this. Really? If you don’t know how file extensions work in Windows, please stop reading now and educate yourself on this subject)

Partly taken from Technet

Office 356 Migration (3) – getting ready to rumble

29/03/2018 Zupertails office 365, tech, training

Wanna mess around in a demo version of Office 365, before trying the real thing ?
No problemo !
Go to https://products.office.com/nl-be/try and create an account to your heart’s content.

One big /!\ warning /!\ before actually doing so :
Experience has taught me that – while you can create a 30-day demo account and perform all the fun stuff that the full version can – there’s a couple of things you need to know about your demo version.

All domain names added to this O365 tenant, even if it’s in demo mode, have a tendency to remain there even after your trial has expired.
In concreto, this signifies, you will not be able to add this domain to a new O365 tenant, should you want to do this, after ignoring the renewal of your demo.
Microsoft has this funny way of holding onto your old data if anything external is still linked to your account. In this case a domain name.
So, when you plan to stop your demo account, be sure to remove all external factors first (such as the link to your own domain name, linked mailboxes that are being pushed into an O365 mailbox, …)
If you don’t do this and you will need this to be re-linked afterwards, you might have to call Microsoft support. *sigh*
You’ll never be able to fully clean up all the messing around you performed in your demo version, so make sure you actually start a new and clean tenant if you want the start using O365 “for real”, thus no mistakes that you made are moved into your live setup (hey, I’m not judging, this is actually what demo environments are for).
If you want the full experience, I do suggest buying a domain name (or using one you have lying around) to integrate into your O365 demo environment, as this will teach you how to fiddle around in the DNS settings later on.
This will also allow you to log into your environment using your actual email address instead of some my_user_name@some_tenantname.onmicrosoft.com .
Mail functionality coming from a .onmicrosoft.com domain is usually blocked or filtered in many cases, so for good form, just integrate a domain name.
We’ll see how this is done later on.
Make sure you get a domain host that allows you to add SRV records, if possible. This will allow you to properly configure your Skype For Business / Lync / Teams communication setup.
A more simple explanation on SRV records can be found through this link.

Getting our hands dirty (almost)

In this example setup, we will be creating a basic startup scene through which we will continue to enlarge our virtual company, adding the necessary services as we need them.

For now, our company “Shortstraw LLC” has not seen the proverbial light yet and just wants his mail in the cloud and accessible at all times.
Shortstraw’s current mail setup for their Belgian branch consists of some simple POP boxes (or so they told us, their IT implementor *dramatic sound*)

shortstraw mail_01 — Shortstraw’s mail setup according to first contact with the customer

The image above (because a wall of text doesn’t read as easy as a children’s illustrated book) shows how the customer describes his current mail situation, after having established first contact over the phone.
Oliver (the CEO) and Annie (the CFO) each have a mailbox which they read in their not-yet-documented mail program.
Together they both read the info@shortstraw.be mailbox as a POP box, while leaving a copy of the messages on the server, which is an old-school way of sharing a mailbox.
Their technician, John, receives his to-do list from Annie onto his personal Gmail mailbox john.vercammen@gmail.com , so he can use his calendar on his smartphone.

Actually getting your hands dirty

For good form and for good measure you as the IT guy decide to visit the customer, because that’s what you do in cases like this. You go and check on what’s real instead of relying on end-user information.
No offence to you dear end-user, who might also be reading this article. I’m just stating the obvious, which is also the reason you contact an IT guy in the first place instead of performing the move to O365 yourself.

After a small audit, you discover the situation to be as follows (example taken from real life) ⇒

You’ll notice already the subtle difference after you got your hands on the computer.
Seemingly unsignificant, there are a few things to be taken into account.

Windows Vista : the easiest one to notice AND resolve. Get rid of this product.
Don’t upgrade to Windows 10 as this is not supported. You can always try to do a fresh W10 install, should the hardware support this, but see this as a sales opportunity.
Office 2007 OEM : 2 things.
– you cannot reinstall (license-wise) an OEM license onto a new computer
– don’t apply Office 2007 for future use in an O365 environment. I’ve mentioned this before. You’ll get into tons of trouble, such as calendars and contacts not synchronizing.
Office 2010 OEM : upgrade this to the latest service pack.
Windows 7 : try to get this to at least Service Pack 1.
info@shortstraw.be : only a copy of the messages is being held onto Annie’s computer, which means… Oliver probably has the most chance of having a more complete inbox.
Every time Oliver checks the mails, Annie would no longer receive this mail if Oliver was the first to receive them.
oliver@shortstraw.be : make good note of all his aliases in the mailbox management system he’s currently using at his Belgian mail hosting company. Chances are he’s going to want to split this up into multiple boxes for overview purposes.
shortstraw@provider.be : an older POP mailbox that customers still use now and then. This mailbox is mainly kept for historical reasons, but Oliver wants to be able to at least read this mail in the future.
annie@shortstraw.be : has the cfo@ alias.
She has her Outlook configured to receive her personal mails through IMAP. According to herself, this was intentional so that she could read her mails on her cell phone as well. This was never configured, however, but the situation remains to this day.
Annie’s computer uses the local Outlook calendar to plan all things for the business, including keeping a double of the invites she sent to the technician.
John Vercammen : with the exception of having his LTE/4G data plan payed for by Shortstraw and receiving his Samsung Galaxy S8 for work, he is not linked into the company network as such.

Analysis

Having all the information above, even as a layman at O365, you can see that there is much room for improvement, such as getting rid of old techniques for sharing a mailbox, getting your employees in sync with your company, upgrading software etc.
For this case, which is a fine example of a typical situation, my suggestions, based upon my personal experience and Office 365 support are the following (all mailflow suggestions can also be done in different ways; I just hand out the most common ones) :

Partly related to Office 365, I’d suggest getting rid of Windows Vista AND the Office 2007.
I deliberately added the term ‘OEM’ in my example as OEM software cannot be transferred (in terms of license) to new hardware in case of Office and Windows.
Even were Oliver to buy a new computer and he’d want to re-use his Office 2007 – which would have been an silly choice due to compatibility issues – OEM licensed software can’t be transferred to new hardware.
In a related side-note : Office installations ‘bought’ through O365 can be installed on 5 computers for personal use.
Office 2010 on Annie’s computers needs to be upgraded to Service Pack 3.
Her operating system, Windows 7, needs at least Service Pack 1.
info@shortstraw.be : this needs to become a so-called shared mailbox. Shared boxes have the same value as an ‘ordinary’ mailbox, but without a physical user linked directly to it. Hence, no financial cost is attached to this box.
In the migration process, you’ll need to use Oliver’s computer for the most correct and up-to-date content of this mailbox, due to the nature of how ‘leave copy of messages on the server’ works in a POP3 environment (crf. Annie’s PC)
oliver@shortstraw.be / shortstraw@telenet.be : both boxes are POP mail. You can easily export these boxes through Outlook’s “Export to PST” function. Don’t forget to export all content of the mailbox, such as agenda and contacts
Speaking of contacts : a common mistake is confusing the autocomplete list in Outlook (that’s the list of addresses that appears when you start typing the first letters of an e-mail address) with an actual contact list.
Seeing as you’ll be creating either a new profile in Outlook or a clean install on a new computer, you’re going to want to back up this list somewhere.
Microsoft has a handy how-to on how to accomplish this.
Should you want to dive a bit deeper in the markup of an NK2 file (which is the file extension for an autocomplete list up until Office 2013), I suggest downloading NK2Edit by Nirsoft (a website totally worth visiting for tons of handy tools, by the way)
annie@shortstraw.be : now this is an other story. IMAP mailboxes are to be handled with caution, due to their nature in which they are built.
If you were to simply export an IMAP mailbox to a PST file, for import purposes later on in O365, you might run into the fact that only the mail headers are stored in the PST file. The actual content isn’t.
Microsoft has yet another handy couple of ways of importing IMAP mailboxes. We’ll get to that when the actual process of importing starts.
It basically involves the Office 365 servers at Microsoft connecting to the IMAP server themselves, without you having do anything client-side.
You tell the servers in which mailbox to ‘dump’ the content of the remote IMAP mailbox and the process runs slowly in the background. You’ll have to ability to check on the status.
John Vercammen : don’t worry about John (yet). The implementation of integrating John in shortstraw.be is as easy as creating a new mailbox. There’s still a couple of options left open, such as integrating his personal gmail directly into his O365 and choosing the right subscription for John, depending on his specific needs (for instance if he wants to work from home on his personal computer and he’d need a Microsoft Office installed)
The IT guy guides, Oliver decides.

As a personal thought exercise I suggest you try to come up with a couple more improvements for this customer’s network, as I’ve left some subtle ones yet unhandled.

In the next post, we start the process of migrating, while explaining every step’s why and how.