Update on timing of opt-in Microsoft Search in Bing through Microsoft 365 Apps for enterprise*

Today we’re updating Microsoft 365 IT Admins on availability of the Microsoft Search in Bing browser extension for Chrome. Based on customer feedback, this capability will be opt-in and for AD-joined devices only. As we’ve stated previously, unless an admin chooses to install the extension it will not be deployed. Once deployed by opting in through Microsoft 365 Admin Center, the user remains in control and can revert to their original search engine settings at any time. With Version 2005 of Office, we are starting to roll out the admin capability to easily deploy this extension to Insider builds through Microsoft 365 Apps for enterprise on Windows devices.  

  

Thank you to our customers who have given us valuable feedback about the process for rolling out this extension as well as the capabilities it enablesWe’re glad to serve you and your organizations, as we are delivering Microsoft Search in Bing at this time to enable a simple, powerful search experience for information both inside an organization and across the web.  

 

With many of your employees using AD-joined devices at home to work remotely, connecting people with the right information quickly is essential to sustaining everyday productivity. Microsoft Search helps employees to find the right people in a dispersed organization, relevant documents as collaborators may not be online at the same time, and critical internal sites for latest information from IT, benefits, and HR. The Bing extension makes it possible to access work and web content from the Chrome address bar if an IT admin decides to deploy it. 

 

We understand IT admins are dealing with challenging environments now that more people are using their own devices at home while working remotely. As previously communicated, the extension will only be available to AD-joined devices at this time and the improved admin experience for managing this feature now includes a check box in the Microsoft 365 admin center.  

 

For more detailed information about deploying the Microsoft Search in Bing browser extension for Chrome through Microsoft 365 Apps for enterprise and the timing of availability (based on your channel) please refer to this support article. Thank you for your ongoing feedback. Please continue to share with us through UserVoice. 

 

*formerly known as Office 365 ProPlus 

Re: Deploy Office 365 ProPlus to remote workers

 Thanks for your feedback. My team is actually working on a comprehensive guide for install options and which network optimization technologies can be used when. On your ask: You can employ Delivery Optimization for Office in combination with Connected Cache to reduce the load on your corp internet circuits. We save tremendous saving when the combination of the two technologies is leveraged. For completeness, we could also use Configuration Manager Client Peer Cache,  but this would only cache the setup.exe and configuration file included in the deployment package.

 

Thanks again for the feedback, I will add this to the blog post later.

Multi-Geo reduced seat minimum and expanded geo coverage

Multi-Geo reduced seat minimum and expanded geo coverage

We are excited to announce the availability of Microsoft 365 Multi-Geo in Switzerland, and the reduction of the seat minimum requirement to 250 for Enterprise Agreement customers. These updates will allow more organizations to utilize Microsoft 365 Multi-Geo to address their legal, compliance, industry, or other related data residency requirements.

 

Please note that this product was previously referred to as ‘Multi-Geo Capabilities for Office 365,’ and will now be named ‘Multi-Geo Capabilities for Microsoft 365,’ consistent with the overall Microsoft 365 announcement on March 30. We previously announced the general availability of Multi-Geo Capabilities, in addition to the workload expansion from Exchange Online and OneDrive to include SharePoint Online.

 

Microsoft 365 Multi-Geo provides a solution for multi-national businesses seeking a balance between working as a single organization in the Microsoft 365 cloud and addressing global data residency needs. With the reduced seat minimum requirement and coverage across Exchange Online, OneDrive, and SharePoint Online this feature helps bring the full power of Microsoft 365 – the world’s productivity cloud – to organizations at any stage in their digital transformation journey.

 

Microsoft 365 Multi-Geo enables customers to reduce their on-premises footprint by allocating user data at rest to our available geo locations in the Microsoft 365 cloud, facilitating their ability to meet data residency obligations, all within a single tenant. For in-depth information on how Multi-Geo capabilities work and how to get started, please review the links above.

 

Available Geos

Microsoft is continuously making new infrastructure investments in response to growing customer demand as more industry leaders choose Microsoft’s cloud services. As a result, Microsoft 365 Multi-Geo is increasing our geo coverage as we expand our datacenter footprint for Microsoft 365. With the latest addition of Switzerland, you can now extend your Microsoft 365 tenant to store your users’ data in one or more of the following geos:

 

Australia

Asia Pacific

Canada

European Union

France

India

Japan

Korea

United Kingdom

United States

United Arab Emirates

South Africa

Switzerland

 

 

John_Mighell_0-1586976202697.png

 

Learn about where your Microsoft 365 data is stored at aka.ms/DataMaps

 

Industry Focus

We see worldwide organizations of all sizes and across all industries currently investing in new ways of empowering their employees with modern tools to enable secure, flexible, and mobile working that fosters collaboration. The ability to configure data residency on a by-user basis helps organizations meet regulatory requirements, which is particularly important and relevant in industries such as healthcare, manufacturing, public sector, and financial services. This latest step enables companies adopting Microsoft 365 to accelerate their digital transformation journey. As a result, we see Microsoft 365 Multi-Geo assisting organizations across the world to enable the scalability required to address critical challenges affecting the global community.

 

 

John_Mighell_1-1586976202701.jpeg

 

“We now have as many people outside the US as in it, and although the GDPR doesn’t mandate a particular Geo for data residency, our clients are hypersensitive about data privacy issues, so we prefer to get in front of it,” Ackermann says. “Our lifeblood includes data which is personal information about people and with Multi-Geo, we’re able to proactively address client concerns about data residency.”

–       Bryan Ackermann, Chief Information Officer, Korn Ferry

 

Pricing and Licensing:

Multi-Geo is available as an add-on to the following Microsoft 365 subscription plans for EA customers with a minimum of 250 Microsoft 365 seats in their Microsoft 365 tenant, and a minimum of 5% of the Microsoft 365 seats within a tenant have corresponding Multi-Geo Capabilities for Microsoft 365. Please contact your Microsoft account team for details.

 

Microsoft 365 F1, E1, E3, or E5

Microsoft 365 F1, E1, E3, or E5

Exchange Online Plan 1 or Plan 2

OneDrive for Business Plan 1 or Plan 2

SharePoint Online Plan 1 or Plan 2

 

Licensing

  • USD $2/user/month for users in Satellite Geos
  • Resource mailboxes (Rooms/Equipment) and Shared mailboxes need to be licensed
  • Microsoft 365 Group Mailboxes moved to Satellite Geos will not need to be licensed for Multi-Geo

How to buy Multi-Geo?

Please talk to your Microsoft representative to buy Multi-Geo Capabilities for Microsoft 365.

 

Questions?

Please comment on this thread with your questions

How to secure your remote workers with Office Cloud Policy Service

How to secure your remote workers with Office Cloud Policy Service

With more and more users working from home, organizations are facing new security and privacy challenges. One of them might be, that users are working on unmanaged, maybe personal devices accessing corporate data. Classic technologies like Active Directory Group Policy Management do not help in such scenarios, as these do not apply to unmanaged devices.

This blog post will provide guidance on how to leverage the Office cloud policy service (OCPS) to address those scenarios. OCPS allows an admin to target a user with policies which follow them across all devices, regardless of the way the devices are managed (if at all). We will also share some recommended security settings which might be worth considering.

 

Step 1 – Enable OCPS

The Office cloud policy service (OCPS) is a cloud-based service that enables you to apply policy settings for Microsoft 365 Apps for enterprise (formally known as Office 365 ProPlus) on a user’s device. The policy settings roam to whichever device the user signs into and uses Microsoft 365 Apps for enterprise. This applies whether the device is managed through on-premises domain devices, as a Azure AD registered, Azure AD Joined, or Hybrid Azure AD joined device.

 

You should start by verifying the requirements:

  • Supported version of Microsoft 365 Apps for enterprise deployed
  • Licensed for Microsoft 365 Apps for enterprise
  • At least one Azure AD group which contains the users you’re targeting.
  • An admin user with at least the Office Apps Admin role assigned

Sign in on https://config.office.com and accept the EULA for OCPS. That’s it. No more prep work needed.

 

Secure_remote_devices_w_OCPS_2.jpg

 

Step 2 – Create a policy configuration and assign to users

Now you should create your first policy configuration and assign it to a group of users:

  • Expand the Customization node and select Policy Management
  • On the Policy configurations page, choose Create and provide a name and a description (optional)
  • In assignments, choose whether this policy applies to all users of Microsoft 365 Apps for enterprise, or just to users who anonymously access documents using Office for the web.
  • Select the AAD-based security group that is assigned to the policy configuration. Each policy configuration can only be assigned to one group, and each group can only be assigned one policy configuration.

 

Secure_remote_devices_w_OCPS_3.jpg

 

We also have a video ready for you which walks you through these steps.

Step 3 – Set policies

After clicking on Configure policies you can start to search for and configure policies. Please note that most policies are only applicable to Office on Windows, but some are applicable cross-platform as noted in the platform column in the policy list.

 

As a starting point, you can filter the Recommendation column to view the recommended Microsoft Security baseline policies. Click on each policy name to view the description and decide if you want to keep the baseline’s recommended value or manually configure it. The reviewed items will switch the Status to Configured when applied.

 

Secure_remote_devices_w_OCPS_4.jpg

 

Especially for the scenario of remote workers, here are some policies you might want to have a closer look at:

 

Policy Name Comment
Block signing into Office Can be used to prevent users from being signed in with a corporate and personal account at the same time in order to prevent data leakage to e.g. a personal OneDrive.
Hide file locations when opening or saving files Setting to “Hide local PC” will discourage users from saving corporate data to the maybe non-corporate device.
Disable VBA for Office applications VBA/macros are powerful tools and can help automate data processing or entry. But it is also used for malicious attacks and might be better prevented to run on non-managed/remote devices.
Do not open files from the Internet zone in Protected View If set to “Disabled”, Office files downloaded from the internet will always be opened in Protected View first.
Set document behavior if file validation fails Admins can enforce Protected View for files which failed validation. Those files could e.g. try to exploit Office through malformed documents.
Allow the use of connected experiences in Office, et al. Admins can control if Office is allowed to leverage cloud services for downloading and analyzing content. Review documentation for available controls.
Force Runtime AV Scan If enabled, all files opened by Office will be passed to the installed AV engine for scanning.
Use Cached Exchange Mode for new and existing Outlook profiles You can use this policy to enforce Online Mode for Exchange in order to prevent users from syncing down their inbox content to a maybe insecure device. Note that this setting will apply to all devices the user is signing into.
Block all unmanaged add-ins This setting allows you to block all add-ins from being loaded by Office.

 

Step 4 – Additional considerations

As policies configured through OCPS are following the user across all devices, it is not limited to remote workers or users on un-managed devices. You should consider folding your on-prem policies into OCPS policies and go forward with a single solution for both on-prem as well as off-prem users.

 

Once you have deployed OCPS policies, you can also enable the Security Policy Advisor to get further insights into high impactful these changes are for your users. Maybe there are opportunities to further tightening it up without impacting users.

 

Overview of blog post series

This post is part of a series which is covering different stages and phases in the Office lifecycle in remote worker/work from home scenarios. The others are:

We hope this will help you to minimize the impact of deploying, servicing and managing Microsoft 365 Apps for enterprise on your own network and your user’s VPN connections.

 

FAQ

Q: Am I secure after enabling OCPS and setting the Microsoft recommended policies?
A: “Being secure” is a relative state where you can try to achieve a high bar, but basically never be 100% secure. Using OCPS is one building block in a broader strategy to secure remote workers. In addition make sure to review Azure Multi-Factor Authentication, Azure Conditional Access and the user’s sign-in risk assessment to further protect the user’s identity. For guidance on protecting your corporate data, please review Azure Information Protection.

Q: I’ve got issues with OCPS, how can I troubleshoot the service?
A: We got you covered, please review Troubleshooting OCPS on Windows.

 

Q: Can I fully secure a device not owned by my organization?
A: There are limits on how secure a device that you don’t own or manage can be. Each employed security technology raises the bar for an attack/exploit on the device/user/data successfully, but unless you fully manage the device there is a risk to your data. Security is sometimes not about secure/not secure, but more about the right level of security for a given scenario. You can use Intune to manage devices that you don’t own.

 

Q: Can I also secure and control Office on iOS or Android using OCPS?
A: While some policies also apply to Office on Android or iOS, there are more advanced controls available through Intune Application policies. These allow you to e.g. enforce a PIN, local data encryption of cloud-only storage of data for the Office apps on mobile devices.

 

Q: We’re an Intune shop, can I also use Intune to manage OCPS policies?
A: Sure thing. You can manage the Policies for Office apps from the Intune portal as well.

 

Q: Can we use OCPS to block syncing OneDrive for Business content on devices which aren’t managed?

A: No. However, we can address this concern by having your Office 365 tenant administrator running Set-SPOTenantSyncClientRestriction cmdlet. This permits adding restrictions on whether users can sync items to non-domain joined machines.

 

The Authors

This blog post is brought to you by the Microsoft 365 Apps for enterprise Ranger Team at Microsoft. Feel free to share your questions and feedback in the comments below.

Deploy Office 365 ProPlus to remote workers

Deploy Office 365 ProPlus to remote workers

This blog post will address the enterprise IT admin’s challenge on how to deploy Office 365 ProPlus to remote workers without saturating the company’s VPN connections. It will show you how to implement a tactical approach which allows an IT admin to stay in control and quickly relief the pain of VPN congestion by offloading content distribution to the Microsoft Content Delivery Network (CDN). Maybe you are in the process of moving off legacy versions of Office and want to keep the pace with e.g. the Office 2010 end-of-support approaching fast. There are multiple strategic solutions available (e.g. Intune and Windows Autopilot), but for now we focus on a quick fix.

 

Overview of blog post series

This blog post is part of a three-part series, which is brought to you by the ProPlus Rangers at Microsoft, a group of most senior deployment experts. The series provides guidance on how to offload content distribution to the Microsoft CDN across the lifecycle of an Office 365 ProPlus installation:

 

We hope this will help you to minimize the impact of deploying, servicing and managing Office 365 ProPlus on your own network and your user’s VPN connections.

 

The Concept

With the approach described below, we want to achieve two things:

  • Keep IT admins in control what happens when by continue using your enterprise management solution like Microsoft Endpoint Configuration Manager (formally known as System Center Configuration Manager (SCCM))
  • Offloading the content distribution to Microsoft’s CDN to allow remote user to leverage their local internet connection instead of pulling large source files from your ConfigMgr Distribution Points over VPN connections

We will walk you through the process on how to adjust an existing Office 365 ProPlus deployment package for a hybrid approach, update your sources and ensure that the source file download will bypass your VPN.

 

Step 1 – Adjust your deployment package

To allow remote users to leverage their local internet connection for source file access, we have to remove the source files from the Configuration Manager application. Navigate to the folder which is holding your software sources, locate the “office” folder and delete it:

Deploy_O365PP_to_Remote_workers_2.jpg

In the above example, 11 Language Packs were included in the deployment package, bumping the size up to 6+ gigabytes. Keep the setup.exe as well as any configuration files located in the folder. This reduces the size of your deployment package to less than 10 megabyte. That’s a huge saving on your VPN connections.

In case you don’t have an Office 365 ProPlus installation package yet, you can use the built-in wizard to create one. Maybe you want to adjust the handling of languages, instead of hard-coding those you might want to use MatchOS or MatchPreviousMSI. After that, apply the steps above.

 

Step 2 – Update the content sources

If your application was already synced to Distribution Points, those still have the larger package cached. Navigate to Software Library > Application Management > Applications, select your application, switch to the Deployment Types Tab, right-click the appropriate entry and click Update Content.

Deploy_O365PP_to_Remote_workers_3.jpg

This will re-sync any changes to your Distribution Points, so those will now also have the smaller deployment package ready to sync to devices.

 

Step 3 – Verify VPN configuration and deploy

Once a client has received the smaller deployment package through ConfigMgr and kicks off the installation, it will download the source files directly from the Microsoft CDN. It is important to ensure that your devices can actually reach out to those endpoints directly and don’t backhaul through the VPN tunnel. We published guidance on how to enable so-called VPN split-tunneling, the endpoints relevant for Office 365 ProPlus source file download are listed at Office 365 URLs and IP address ranges as entry #92.

If you already have an active deployment of the newly-updated package, clients will start receiving it after the Distribution Points have finished syncing the changes. If you want to start with a fresh deployment, just follow the regular guidelines in your organization.

 

FAQ

Q: We usually controlled which build is installed by embedding the matching source files. How can I control this now?
A: By default, setup will fetch the latest build available for the specified update channel. You can use the version attribute in the configuration file to specify a build. This might be important if your organization is wants to deploy the older SAC feature release.

 

The Authors

This blog post is brought to you by  from the Office 365 ProPlus Ranger Team at Microsoft. Feel free to share your questions and feedback in the comments below.

How to quickly optimize Office 365 traffic for remote staff & reduce the load on your infrastructure

How to quickly optimize Office 365 traffic for remote staff & reduce the load on your infrastructure

Over the past few weeks, Microsoft, and more specifically the Office 365 Network team have seen a large influx of questions from customers around how best to optimize their Office 365 connectivity as they work diligently to plan for a large amount of their userbase suddenly working from home. We’ve also seen similar queries from customers looking for best practice whilst rapidly enabling their Office 365 benefits, Free Teams plans or free 6 month E1 trial recently announced to rapidly roll out Teams to allow their business to continue to function and allow users to collaborate effectively without being in the Office.  

 

The recent COVID-19/Coronavirus outbreak has caused many customers to rapidly enable, or proactively plan for the bulk of their employees working from home. This sudden switch of connectivity model for the majority of users typically has a significant impact on the corporate network infrastructure which may have been scaled and designed before any major cloud service was rolled out and in some cases, not designed for a situation when it is required simultaneously by all users.

Network elements such as VPN concentrators, central network egress equipment such as proxies, DLP etc, central internet bandwidth, backhaul MPLS circuits, NAT capability and so on are suddenly put under enormous strain due to the load of the entire business using them, with the end result being poor performance and productivity coupled with a poor user experience for those users forced to adapt to working from home.

A simple diagram of a traditional network model can be seen below, where remote user’s connectivity is forced in and back out of the corporate network to reach critical resources as well as branch offices using MPLS circuits to reach the services offered at head office. It is an incredibly common network model for businesses around the world, but it was designed to be effective for a pre-cloud world.

A traditional enterprise network, which does not work well in a cloud first worldA traditional enterprise network, which does not work well in a cloud first world

This model made perfect sense and worked very well when the bulk of applications, data and services resided within the corporate network (the dotted line in the diagram), but as enterprises shift to the cloud, it rapidly becomes a cumbersome environment which doesn’t scale well or provide the organization with any agility to react to situations such as that we face today. Many customers report to Microsoft that they have seen a very rapid shift of network traffic which used to be contained within the corpnet now almost exclusively connecting to some external cloud-based source.

 

Fortunately, Microsoft has been working closely with customers and the wider industry for many years to provide effective, modern solutions to these problems from within our own services, and also aligned to industry best practice. Solutions that apply very simply and effectively to remote workers as much as they do to branch offices. Microsoft has designed the connectivity requirements for the Office 365 service to work efficiently for remote users whilst still allowing an organization to maintain security and control over their connectivity.

 

Below we will outline the simple steps an organization can take to drastically reduce the impact Office 365 traffic has on the traditional corporate infrastructure when we have a large percentage of users working remotely all at once. The solution will also have a significant impact on user performance and also provide the benefit of freeing up the corporate resources for elements which still have to rely on it.

 

Most remote users who are not using a virtualized desktop will use a VPN solution of some sort to route all connectivity back into the corporate environment where it is then routed out to Office 365, often through an on premises security stack which is generally designed for web browsing.

 

The key to this solution is separating out the critical Office 365 traffic which is both latency sensitive and that which also puts enormous load on the traditional network architecture. We then treat this traffic differently and use the user’s local internet connection to route the connectivity directly to the service. To do this we need to follow a simple set of actions:

 

1. Identify the endpoints we need to Optimize

 

Microsoft has already identified these endpoints and marks them very clearly for reference. In the URL/IP list for the service these endpoints are marked as “Optimize”. There are just four URLS which need to be optimized and nineteen IP subnets. In just this small group of endpoints we can account for around 80% of the volume of traffic to the service and it also includes the latency sensitive endpoints such as those for Teams media. Essentially this is the traffic that we need to take special care of and is also the traffic which will put incredible pressure on traditional network paths.

 

URLs in this category have the following characteristics:

 

  • Are Microsoft owned and managed endpoints hosted on Microsoft infrastructure.
  • Have IPs provided
  • Low rate of change to URLs/IPs compare to other two categories
  • Expected to remain low in number of URLs
  • Are High volume and/or latency sensitive

 

You can also query the REST API Web Service for this information, and a PowerShell example script which does this and outputs the URLs/IPs/Ports for all three endpoint categories can be found using the link above.  

 

 

Endpoint to Optimize

Port/s

Use

https://outlook.office365.com

TCP 443

This is one of the Core URLs Outlook uses to connect to its Exchange Online server and has high volume of bandwidth usage and connection count. Low network latency is required for online features including: Instant search, Other mailbox calendars, Free / busy lookup, manage rules & alerts, Exchange online archive, Emails departing the outbox.

https://outlook.office.com

TCP 443

This is use for Outlook Online web access to connect to its Exchange Online server and network latency. Connectivity is particularly required for large file upload and download with SharePoint Online.

https://<tenant>.sharepoint.com

TCP 443

This is the primary URL for SharePoint Online and has high volume of bandwidth usage.

https://<tenant>-my.sharepoint.com

TCP 443

This is the primary URL for OneDrive for Business and has high volume of bandwidth and possibly high connection count from the OneDrive for Business Sync tool.

Teams Media IPs (no URL)

UDP 3478, 3479, 3480, and 3481

Relay Discovery allocation and real time traffic (3478), Audio (3479), Video (3480), and Video Screen Sharing (3481). These are the endpoints used for Skype for Business and Microsoft Teams Media traffic (Calls, meetings etc). Most endpoints are provided when the Microsoft Teams client establishes a call (and are contained within the required IPs listed for the service).

UDP is required for optimal media quality.

  

 

<tenant> should be replaced with your Office 365 tenant name. For example contoso.onmicrosoft.com would use contoso.sharepoint.com and constoso-my.sharepoint.com

 

At the time of writing the IP ranges which these endpoints correspond to are as follows. It is strongly advised you use the script referenced previously or the URL/IP page to check for any updates when applying the policy, and do so on a regular basis.

 

104.146.128.0/17

13.107.128.0/22

13.107.136.0/22

13.107.18.10/31

13.107.6.152/31

13.107.64.0/18

131.253.33.215/32

132.245.0.0/16

150.171.32.0/22

150.171.40.0/22

191.234.140.0/22

204.79.197.215/32

23.103.160.0/20

40.104.0.0/15

40.108.128.0/17

40.96.0.0/13

52.104.0.0/14

52.112.0.0/14

52.96.0.0/14

52.120.0.0/14

 

 

note.png

  • TCP ports 80/443
  • UDP ports 3478, 3479, 3480, 3481

 

IPV6 endpoints can be ignored if not currently required, i.e. the service will currently operate successfully on IPV4 only (but not the other way round). This will likely change in future but IPV4 only is possible for the time being.

 

2. Optimize access to these endpoints via the VPN

 

Now that we have identified these critical endpoints, we need to divert them away from the VPN tunnel and allow them to use the user’s internet connection to connect directly to the service. The vast majority of VPN solutions allow split tunnelling, where identified traffic is not sent down the VPN tunnel to the corporate network but rather sent direct out the user’s local internet connection. The VPN client should be configured so that traffic to the above, Optimize marked URLs/IPs/Ports are routed in this way. This allows the traffic to utilize local Microsoft resources such as Office 365 Service Front Doors such as AFD as one example, which deliver Office 365 services & connectivity points as close to your users as possible. This allows us to deliver extremely high performance levels to users wherever they are in the world. There is also Microsoft’s world class global network which is very likely within  a small number of milliseconds of your users direct egress, and is designed to take your traffic securely to Microsoft resources wherever they may be in the world, as efficiently as possible.

The solution would look something like that below.

 

A client's VPN connection with split tunneling enabledA client’s VPN connection with split tunneling enabled

 

Sounds simple? It is in most cases, but for an enterprise, this shift in connectivity invariably raises questions about security. In the traditional network approach security is often applied inline to network traffic as it egresses to the internet. Proxies and firewalls perform inspection on the traffic to check for data exfiltration, viruses and so on. By bypassing this we are removing this layer of protection we have come to rely on when connecting to the internet. The good news is, for the highlighted endpoints above, Microsoft has numerous features in place which means your security with the modern approach may well be higher than available previously. We will run through some of the common solutions below, not all will be relevant or necessary to all customers, but we will cover the majority of common concerns that come up when implementing modern network connectivity.

 

3. Common questions when implementing local breakout and split tunnelling for Office 365

 

It should be noted that the two steps above are all that is necessary to solve the performance/scalability issues if you need to move very quickly given the current situation. The elements below can be added as needed and as time allows or you may have them in place already.

 

Q1. How do I stop users accessing other tenants I do not trust where they could exfiltrate data?

 

A: The answer is a feature called tenant restrictions. Authentication traffic is not high volume nor especially latency sensitive so can be sent through the VPN solution to the on-premises proxy where the feature is applied. An allow list of trusted tenants is maintained here and if the client attempts to obtain a token to a tenant which is not trusted, the proxy simply denies the request. If the tenant is trusted, then a token is accessible if the user has the right credentials and rights.

 

So even though a user can make a TCP/UDP connection to the Optimize marked endpoints above, without a valid token to access the tenant in question, they simply cannot login and access/move any data.

 

Q2. Does this model allow access to consumer services such as personal OneDrive accounts?

 

A: No, it does not, the Office 365 endpoints are not the same as the consumer services (Onedrive.live.com as an example) so the split tunnel will not allow a user to directly access consumer services. Traffic to consumer endpoints will continue to use the VPN tunnel and existing policies will continue to apply.

 

Q3. How do I apply DLP and protect my sensitive data when the traffic no longer flows through my on-premises solution?

 

A: If required, endpoints can be protected with Office DLP if required and it’s much more efficient to provide this feature in the service itself rather than try and do it in line at the network edge. Azure Information protection can also be used to provide a high level of information protection if required.

 

Q4. How do I evaluate and maintain control of the user’s authentication when they are connecting directly?

 

A: In addition to the tenant restrictions feature noted in Q1, conditional access policies can be applied to dynamically assess the risk of an authentication request and react appropriately. Microsoft recommends the Zero Trust model is implemented over time and we can use Azure AD conditional access policies to maintain control in a mobile & cloud first world. Conditional access policies can be used to make a real-time decision on whether an authentication request is successful based on numerous factors such as:

 

  • Device, is the device known/trusted/Domain joined?
  • IP – is the authentication request coming from a known corporate IP address? Or from a country we do not trust?
  • Application – Is the user authorized to use this application?

 

We can then trigger policy such as approve, trigger MFA or block authentication based on these policies.

 

Q5. How do I protect against viruses and malware?

 

A: Again, Office 365 provides protection for the Optimize marked endpoints in various layers in the service itself, outlined in this document. As noted, it is vastly more efficient to provide these security elements in the service itself rather than try and do it in line with devices which may not fully understand the protocols/traffic.

 

For the Exchange endpoints listed above, Exchange Online Protection and Office 365 Advanced Threat Protection do an excellent job of providing security of the traffic to the service.

 

Q6. Can I send more than just the Optimize traffic direct?

 

A. Priority should be given to the Optimize marked endpoints as these will give maximum benefit for a low level of work. However, if you wish, the Allow marked endpoints are required for the service to work and have IPs provided for the endpoints which can be used if required.

 

There are also various vendors who offer cloud based proxy/security solutions called secure web gateways which provide central security, control and corporate policy application for general web browsing. These solutions can work well in a cloud first world, if highly available, performant, and provisioned close to your users by allowing secure internet access to be delivered from a cloud based location close to the user. This removes the need for a hairpin through the VPN/corporate network for general browsing traffic, whilst still allowing central security control.

Even with these solutions in place however, Microsoft still strongly recommends the Optimize marked Office 365 traffic is sent direct to the service.

 

Q7. Why is port 80 required? Is traffic sent in the clear?

 

A. Port 80 is only used for things like redirect to a port 443 session, no customer data is sent or is accessible over port 80. This article outlines encryption for data in transit, and at rest for Office 365 and this article outlines how we use SRTP to protect Teams media traffic.

 

Q8. Does this advice apply to users in China using a worldwide instance of Office 365?

 

A. No it does not. The one caveat to the above advice is users in the PRC who are connecting to a worldwide instance of Office 365. Due to the common occurrence of cross border network congestion in the region, direct internet egress performance can be variable. Most customers in the region operate using a VPN to bring the traffic into the corporate network and utilize their authorized MPLS circuit or similar to egress outside the country via an optimized path. This is outlined further in this article https://docs.microsoft.com/en-us/office365/enterprise/office-365-networking-china

 

Finally, please ask any questions you may have in the comments section below and we will do our best to answer as quickly as possible.

 

4. Further reading

 

General best practice for Office 365 connectivity:

http://aka.ms/pnc

https://docs.microsoft.com/en-us/archive/blogs/onthewire/__guidance

 

Recorded Ignite sessions

https://myignite.techcommunity.microsoft.com/sessions/81561?source=sessions

https://myignite.techcommunity.microsoft.com/videos/64276

https://myignite.techcommunity.microsoft.com/videos/64275

 

Office 365 Partner Program

https://resources.techcommunity.microsoft.com/networking/

Current partners are Citrix, Netfoundry, NTT, SilverPeak and Zscaler

 

Network Connectivity performance testing

https://connectivity.office.com/

This tool runs some tests against Office 365 endpoints including the Optimize marked ones and give you some clear feedback around how connectivity looks for those endpoints and anything you can do to improve the connectivity.

 

Bandwidth planning

https://aka.ms/bandwidth/

This tool is one mechanism you can use to monitor user’s Office 365 network traffic volumes to get a clear figure for bandwidth requirements for the wider business.

Configuring Office 365 ProPlus updates for remote workers using VPN

Configuring Office 365 ProPlus updates for remote workers using VPN

Due to the dynamic situation with COVID-19 many IT pros are being challenged to assess ways to configure Office 365 Client to update directly from Microsoft CDN. Today, the majority of customers I engage with manage updates using Configuration Manager (ConfigMgr), predominately on-premises. The objective of this posting is how to minimize internet egress through customer VPN network for Office updates.

 

Network considerations

There are an infinite number of ways customers configure network access, no two customers are identical in configuration.  Speaking generally, the VPN client needs to support split tunneling or be configured so network traffic destined for Office 365 are directed to internet and are not required to pass through VPN Server.  Microsoft provides a list of all Office 365 URLs and IP address ranges in the following document.  Some customers have VPN clients dynamically aware of Office 365 Services using Microsoft Graph API, some support URLs and others only support IP exclusions.  You’ll notice item(s) 90 and 92 which provide specific URLs used by the Office 365 Client to perform updates.

90

Default
Required

mrodevicemgr.officeapps.live.com (Description: Device Management Service (DMS) is used to advertise the C2R builds to the machines which are non-admin managed based on the meta data passed by the machine.)

TCP: 443

92

Default
Required

officecdn.microsoft.com, officecdn.microsoft.com.edgesuite.net (Description: Office CDN where content is downloaded)

TCP: 443, 80

Tip: Please review blog posting How to quickly optimize Office 365 traffic for remote staff & reduce the load on your infrastructure

Tip: Please review blog posting Managing remote machines with cloud management gateway in Microsoft Endpoint Configuration Manager

 

Background on how Office 365 Client works by default

Office 365 ProPlus is designed by default to update from CDN.  A scheduled task called “Office Automatic Updates 2.0” uses a trigger to routinely check for updates as advertised by DMS service.  The Office client will always move to the latest versionbuild available by assigned channel documented hereDocumentation around what to expect from a user experience when updates are delivered from CDN can be found here.  If ConfigMgr Office 365 Client Management integration is enabled by Configuration.xml during initial installation, ConfigMgr Client settings, or Domain Policy, the scheduled task will continue to execute but will only perform software updates from ConfigMgr. 

 

Options available to update from CDN

Option 1: Cloud managed

Steps:

  • Disable OfficeMgmtCOM (required if previously ConfigMgr managed)
    • On the next restart of Microsoft Office Click-to-Run Service, Office COM application will de-registered.  Allows Office Client to do its thing and get updates from the CDN.  
    • This can be done by changing client settings in ConfigMgr or by Group Policy.
  • Set UpdatesEnabled GPO to True (optional)
    • Allows the client to resume normal update checks from the CDN
  • UpdateDeadline GPO as an integer (optional) in days (ex. 12) to ensure the client is updated to ensure compliance.  Using an integer value allows the admin to not have to continually change the date to a future date/time for every update.

Option 2: SCCM managed but offload content distribution

Use normal deploy software updates wizard within ConfigMgr console selecting deploy option. When completing deployment package screen, it is important to select option “No deployment package”. In this way, clients will download content directly from CDN but keep existing controls and user experience during software update workflow.

Steps:

Deploy1.png

NoDeployPackage.png

FAQ:

How can I verify ConfigMgr integration is disabled?

Start -> Run ->dcomcnfg.exe and look for presence of OfficeC2Rcom application.

COMEnabled.png

COMDisabled.png

Where in the Office logs can I confirm Office updates are coming from CDN?

Use http://aka.ms/office365logcollector to collect Office logs or search for files in C:windowstemp which have your NetBIOS name like MININT-314VFT4-20200318-0857.log.  (There will be a bunch of them).  Use your favorite text editor to search for strings like ‘officecdn.microsoft.com’ or the build number you deployed.

 

Starting with version 1902, ‘Prefer cloud based sources over on-premise sources’ allows IT Pro to prioritize Cloud content.  Does this feature extendsupport Office 365 Client updates?

No, this appear to be a bug which is under investigation.  Workaround is to ensure Distribution Points used by VPN clients do not host Office 365 Client updates resulting in error 404.  If the software deployment has selection ‘If software updates are not available on distribution point in current, neighbor or site boundary groups, download content from Microsoft Updates’, this should allow new location of CDN fallback to be used.  I will update this item with updates when available.

 

The Authors

This blog post is brought to you by Dave Guenthner and Martin Nothnagel, two ProPlus Rangers at Microsoft.  We’re looking forward to your questions and feedback in the comments below.

Excluding and re-including applications within the Office 365 ProPlus Suite

Excluding and re-including applications within the Office 365 ProPlus Suite

When installing Office 365 ProPlus using the Office Deployment Tool (ODT), the standard configuration includes the entire suite of applications by default. In some cases, IT Pros need to exclude one or more of the apps or add back previously excluded ones. The article will go over the various scenarios and provide guidance on how to implement them. These scenarios include:

  • Exclude apps during initial install
  • Remove specific apps after initial install
  • Re-including apps that were previously removed
  • Adding Visio and/or Project after initial ProPlus installation

So, let’s look at each of these scenarios:

 

Exclude apps during initial install

There are two main ways how admins can control which apps are excluded at the initial install of Office 365 ProPlus. First, using the Office Customization Tool (OCT) at https://config.office.com, admins can simply toggle the buttons for the apps they wish to exclude from the initial install:

 

apps.png

 

This will craft the configuration file with the necessary exclusions for you. You can either export and save the file locally or to the cloud and reference this file during setup.

A second way that admins can control which apps are installed at the initial install of Office 365 ProPlus is to leverage the <ExcludeApp ID=”APPNAME” /> attribute in the ODT configuration file directly. The names of all the app values are as follows:

  • ID=”Access”
  • ID=”Excel”
  • ID=”Groove” (This is the old sync client for on-Premises SharePoint)
  • ID=”Lync” (Skype for Business)
  • ID=”OneDrive”
  • ID=”OneNote” (OneNote 2016, Win32 app. NOT the UWP Windows 10 app)
  • ID=”Outlook”
  • ID=”PowerPoint”
  • ID=”Publisher”
  • ID=”Teams”
  • ID=”Word”

A sample configuration file with Groove and OneNote excluded from the install would look like this:

 

 

<Configuration>
<Add OfficeClientEdition=”64″ Channel=”Monthly”>
<Product ID=”0365ProPlusRetail”>
<Language ID=”MatchOS” />
<ExcludeApp ID=”Groove” />
<ExcludeApp ID=”OneNote” />
</Product>
</Add>
</Configuration>

 

With either method at install time, Office 365 ProPlus will be installed with the selected apps excluded. You can verify by looking at this registry key:

HKEY_LOCAL_MACHINESOFTWAREMicrosoftOfficeClickToRunConfiguration
O365ProPlusRetail.ExcludedApps
registry.png
Or simply by checking the start menu and noticing those applications are not present.   

Remove specific apps after initial install

If Office 365 ProPlus is already installed on a device or devices and you need to remove one or more of the apps, you can use the same method as above. However, there are a couple things to keep in mind.

  • You can use Version=”MatchInstalled” to eliminate the need to keep track of the Architecture and Servicing Channel as this attribute will read the existing values and honor them. This can cut down on the number of configuration files needed in environments with multiple Office 365 ProPlus configurations.
  • Setup.exe and the configuration file will need access to the Office source files. Either from the Microsoft CDN (Recommended) or internally by including them in a Configuration Manager application. Click-to-Run Office does not cache source files like the MSI version did in the MSOCache location.

warning.png
If you had previously excluded an app or apps at initial install time, and wish to keep them excluded, you must continue to exclude them via the <ExcludeApp…/> section of the new configuration file you create along with whichever app or apps you now also want to exclude. Failure to do so will result in those applications being present and usable by your users.

 

The below example configuration file, leveraging “MatchInstalled” would remove Access from the device after initial install:

 

 

<Configuration>
<Add Version=”MatchInstalled”>
<Product ID=”O365ProPlusRetail”>
<Language ID=”MatchOS” />
<ExcludeApp ID=”Access” />
</Product>
</Add>
</Configuration>

 

 

Like the warning pointed out, running the above configuration will result in Access excluded and ONLY ACCESS EXCLUDED. If you had previously excluded apps such as Groove or OneNote 2016 from your initial install and now wish to exclude Access while keeping Groove and OneNote 2016 also excluded, you must have all three applications called out like in this example:

 

 

<Configuration>
<Add Version=”MatchInstalled”>
<Product ID=”O365ProPlusRetail”>
<Language ID=”MatchOS” />
<ExcludeApp ID=”Access” />
<ExcludeApp ID=”Groove” />
<ExcludeApp ID=”OneNote” />
</Product>
</Add>
</Configuration>

 

Re-including apps that were previously removed

This is very similar to the above scenario. Since Office 365 ProPlus does not include or exclude applications in the traditional sense, but rather asks “what do you want the suite to look like after this configuration?” So therefore If you excluded an app at initial install or post install and now wish to add it back in, you will use a similar configuration to the above example leaving any other apps still excluded you want to remain that way.

Consider this scenario: The IT Pro excluded Access, Groove and OneNote 2016 at initial install and now wishes to add OneNote 2016 back into the suite but leave Access and Groove still excluded. The example configurations would look like this:

 

 

Initial install Configuration:

<Configuration>
<Add OfficeClientEdition=”64″ Channel=”Monthly”>
<Product ID=”O365ProPlusRetail”>
<Language ID=”MatchOS” />
<ExcludeApp ID=”Access” />
<ExcludeApp ID=”Groove” />
<ExcludeApp ID=”OneNote” />
</Product>
</Add>
</Configuration>
Second install Configuration:

<Configuration>
<Add Version=”MatchInstalled”>
<Product ID=”O365ProPlusRetail”>
<Language ID=”MatchOS” />
<ExcludeApp ID=”Access” />
<ExcludeApp ID=”Groove” />
</Product>
</Add>
</Configuration>

 

Adding Visio and/or Project after initial ProPlus installation

Visio and Project operate in a different manner as they are different Product ID’s. These products cannot be added or excluded with the <ExcludeApp/> attribute. They can be added after the initial install by using a configuration file with Visio and/or Project as the <add Product ID> value. You must match the servicing channel and version of Click to Run architecture (64/32-bit) to prevent making unwanted changes. Better yet, you can leverage the power of the CDN and the new <MatchInstalled> attribute to do the heavy lifting here. Deploying Visio and/or Project from the Microsoft CDN after installing Office 365 ProPlus is very bandwidth friendly as most of the shared files are already installed.

Here is an example configuration of adding Visio and Project to device after Office 365 ProPlus has already been deployed:

 

<Configuration>
<Add Version=”MatchInstalled”>
<Product ID=”ProjectProRetaill”>
<Language ID=”MatchOS” />
<ExcludeApp ID=”Groove” />
</Product>
<Product ID=”VisioProRetaill”>
<Language ID=”MatchOS” />
<ExcludeApp ID=”Groove” />
</Product>
</Add>
</Configuration>

 

warning.png

Notice in the above example I have excluded Groove from both Product sections. Groove, OneDrive and Teams operate slightly different at install time and if not excluded from each product they will get installed along with Office 365 ProPlus, Visio and Project Click-to-Run.

 

The Author

This blog post is brought to you by Eric Wayne, a Sr. Office Deployment expert and ProPlus Ranger at Microsoft. Feel free to share your questions and feedback in the comments below.

Update to the background image of the Office 365 sign-in screens

Update to the background image of the Office 365 sign-in screens

I’d like to give you an early heads up on a visual design update that is coming to the Office 365 sign-in experience. These are the screens used to sign in to Microsoft’s apps and services, including Office 365, Azure and Dynamics.

 

We’re updating the default background image on our sign-in screens to something that’s fresher and more performant. The new image is just 1% the size of the previous one, which reduces bandwidth requirements and improves perceived page load times, especially on slower networks.

 

Sign-in screen with old vs new background imagesSign-in screen with old vs new background images

 

This is solely a visual user interface (UI) change with no changes to functionality. There is no change to your users if you have configured a custom background image in Company Branding for your tenant. This change will only affect screens where the default background image (screenshot on the left above) shows up today. 

 

We plan on rolling this out globally in early-April. If this change affects your users, we recommend updating any documentation that contains screenshots and to give your help desk a heads up. 

Calendaring is Tricky and That Might be Why You Were An Hour Late to that Meeting

Writing code for calendaring features is hard. Some of you might say writing any kind of code is hard, and you might have a point, but calendaring is particularly tricky. Why’s that? Well, consider time zones for a start – a meeting you set up isn’t necessarily in the same time as it is for me, and then you also invited people, from a whole bunch of other time zones (did you know some time zones are 30 mins off, not a full hour?), and then you made the meeting recurring, not every week, but every third Monday, except for next month, when it’s on Tuesday… and so on and so forth. But you got a meeting set up, all good.

And then one of the attendees happens to live in a country that decided to implement Daylight Saving Time (DST) and change the local time by an hour. Just in that country.

And we have an good example, as Brazil changed their DST rules in 2019 to eliminate DST and those changes are coming up very soon and they might impact users even with the latest OS updates applied. Users may see various issues with “off by an hour” calendar items when using the Brasilia time zone.

Sometimes we get caught out by a DST change made by a country, or a particular change needs us to code something new to account for it, and for the most part we make it so you don’t notice. But despite our best efforts sometimes users notice meetings are off by an hour. Then the users call you, their IT Pro to complain.

What do you do? There are a number of things we recommend, and so we wanted to share some simple advice on what to do, if it happens.

The “off by one hour” issue can vary widely in terms of scope and symptom, although it is typically limited to recurring appointments and meetings. For example, a user might report:

  • Every single recurring meeting is off by an hour, but only in Outlook on the Web (OWA).  The meetings render correctly in Outlook for Windows.
  • Only a few meetings are off by an hour, but they show incorrectly in both OWA and in Outlook for Windows.
  • Only exceptions to a recurring meeting are off by an hour, and only for attendees, not for the organizer.
  • Only existing meetings that were created BEFORE the Windows Operating System DST patches were applied are off by an hour.
  • Some other possible variation of meeting creation, attendee vs organizer, all vs some, OWA or Outlook desktop, etc.

The #1 best thing you can do to avoid seeing these issues in the first place is to keep your client software and operating system up to date. Sorry if that’s obvious to you, but the OS is the master time source for the client (in OWA’s case that means Exchange Online), and sometimes these DST patches require an update to Windows/Mac/Linux – so keep them patched. Sometimes we need to patch Outlook for Windows, Mac, iOS or Android, and so keeping the client up to date can prevent these issues from showing up. There’s a strong case to be made here for switching to Office 365 ProPlus and having updates regularly applied.

These DST issues can also require server-side changes. Exchange Online does all that for you, of course. In an on-premises world you need to update your servers, so make sure you keep up to date on Cumulative Updates (CU’s) for Exchange and OS updates.

Assuming you’ve done all that, your clients and servers/services are up to date – what then?

You need to figure out how large the scope of this issue is for your users. Is it every user? Is it Outlook for Windows only? What about OWA, does that work? Because the easiest thing might be to have the user switch to another client app until you figure it out.

If it’s only a subset of users (as you only have a small number of users in that geography where DST changed the time) perhaps you decide to manually ‘fix’ the meetings. If so, here’s what we suggest;

  1. Make sure the DST patches/updates are in place.
  2. Make sure you note any existing meeting exceptions that might exist if the problem meeting is recurring.
  3. Have the organizer cancel the meeting that is problematic.
  4. Have the organizer create and send a new meeting so that the start time correctly takes into account the new DST rules.
  5. Recreate the needed exceptional instances.

We also see cases where users ‘fixed’ their meetings ahead of a patch/update by just dragging them to the ‘correct’ start time, which then results in them breaking again when updates are installed (and their automatic changes come into effect) – that’s confusing but it’s all the same issue.

We realize re-creating the meeting series is a bit inconvenient, but that’s because time zone rule information is stored on the meeting itself and re-creating it on a patched machine will ensure the correct rules are being used for that series. And it’s often the quickest solution. But what if the impact is too large to handle that way, and you’ve made sure your clients are patched – then you should call into support and get some advice.

On multiple occasions we have made service side changes in Exchange Online to ‘fix’ it there. Those changes do make it to on-prem, but not until the next CU typically.

We give you a lot of flexibility in how you can create meetings (and we are not done improving meetings by a long shot) but it sometimes feels like it’s something of a minor miracle any of us ever get to meet and talk to each other at all, it really is. We celebrate people meeting every day, and we work really hard on this stuff, all the time, to make sure changes such as DST are accounted for.

We’re working on the Brazilian DST issue very hard right now, but we want to call it out so admins with users in that timezone are aware, and have a chance to make sure patches are applied, users are aware and so on. We’ll get things patched and fixed in time, no doubt, but we thought this a good time to broadly discuss DST, what it means, what you can do, and why writing code for calendaring can sometimes be a bit hard.

The Office 365 Calendaring Team