M365 - Exchange Online Center

The Confusing Case of Cross-Forest Delegation

If you've even participated in an Exchange Online migration at almost any level, it's likely you've run into the issue of cross-forest delegation. You know that Exchange allows you to delegate rights from one mailbox to another, allowing users to access other mailboxes. When you do an Exchange hybrid migration, there are some special considerations you have to take to keep these delegated rights working. Depending on who you ask, you'll get all kinds of different answers about what works when. In this blog post I will explain the confusing case of cross-forest delegation, and what you can expect to work or not work.

There is no cross-forest delegation

Much of the success of Office 365 is built on the Exchange hybrid migration. Since the initial release of Office 365 it has been possible to connect your on-premises Exchange organization to Exchange Online and have the two organization work almost like a single Exchange deployment. In the early days getting hybrid to work was a long and complicated process, but it was possible. The introduction of the hybrid configuration wizard has made the process of configuring hybrid Exchange much better.

In February, Microsoft released the initial public preview version of the Hybrid Agent, about which was written here. The purpose of the Hybrid Agent, also branded as the “Exchange Modern Hybrid Topology”, is to simplify the process of setting up and deploying Microsoft Exchange Hybrid for Exchange 2010 and later deployments, where full “classic” Exchange Hybrid is not an option.

Microsoft just introduced the new Hybrid Agent Public Preview. This represents a small, but important, step toward making it easier for on-prem organizations to implement a hybrid configuration with Exchange Online.

A few weeks back, Microsoft announced the Public Preview of a new and very interesting feature, named Attack Simulator. The idea behind Attack Simulator is to give you a safe toolset to use in order to probe some aspects of the security of your organization, when it comes to email hygiene and password strength, with more to come in the future. In this article, we will do a quick overview of Attack Simulator.

This is a multi-part article in which we will cover Migration Endpoints. First, we will cover what Migration Endpoints are, what you use them for and how you can manually configure a migration endpoint. In the second part of this article, we will dive deeper into how you can leverage multiple migration endpoints to potentially speed up your migration to Exchange Online. Lastly, we'll discuss some of the most common mistakes regarding Migration Endpoints and how to avoid or solve them.

This is a multi-part article in which we will cover Migration Endpoints. First, we will cover what Migration Endpoints are, what you use them for and how you can manually configure a migration endpoint. In the second part of this article, we will dive deeper into how you can leverage multiple migration endpoints to potentially speed up your migration to Exchange Online. Lastly, we'll discuss some of the most common mistakes regarding Migration Endpoints and how to avoid or solve them.

Editor's Note: Originally posted by Paul Cunningham (Microsoft MVP) on his blog, Practical365, this review is extremely comprehensive and discusses the many ways Mailscape 365 can be used in Office 365 cloud and hybrid environments. 

When it comes to sizing a typical on-premises Exchange Server deployment, Microsoft has really gone out of their way to provide all the information you need. Along with the Mailbox Role Requirements Calculator, I believe Microsoft’s guidance to be one of the most complete in the industry—–leaving little to the imagination and with clear guidance on what you should and should not do.

Over the past few years, Microsoft has made many attempts to do away with public folders. If you have had the pleasure to work or are still working with Exchange 2007 and Exchange 2010, I’m sure you’ll remember the many rumors about Public Folders being deprecated in “vNext”. Yet, they still exist today in Exchange 2016 –although not in exactly the same form as in earlier versions of Exchange. Not only do they still exist, but Public Folders are still widely used! It’s not unheard of that a company has several million public folders representing terabytes worth of data.

Many administrators reacted surprised when Microsoft first announced “Modern Public Folders” back when Exchange 2013 was introduced to the world. Modern Public Folders offer the same exact user functionality as traditional public folders, but align with Microsoft’s efforts to improve high availability using Database Availability Groups. Traditional Public Folders, which were stored in separate Public Folder databases, did not fit into that paradigm. Even more so, because of that architecture with separate databases and no real HA story, Microsoft could not really support Public Folders in Office 365. To be honest, I am almost certain that Microsoft made the changes to the Public Folder architecture so that they would be able to offer them in Office 365. The fact that on-premises customers can now take advantage of those advancements is an added bonus.

Hybrid environments are complicated. Microsoft has done tons of work over the years to try to simplify the hybrid experience—a huge task when you remember that hybrid Office 365 deployments can cover Active Directory, Exchange, SharePoint, and Skype, along with cloud-only services such as Office 365 Groups. Sometimes, despite the best efforts of the wizards of Redmond, running a hybrid deployment leads to situations that we call Hybrid Headaches… problems that "on-prem only" environments won’t encounter but which can be incredibly frustrating obstacles in a hybrid environment.