Configure Skype for Business Server 2015 Hybrid for Microsoft 365 operated by 21Vianet

Infrastructure requirements

You must have the following available in your environment in order to implement and configure a Skype for Business Server 2015 hybrid deployment.

• An Active Directory Federation Services (AD FS) Server running Windows 2008 R2 SP1 or the latest service pack. For additional system requirements for AD FS, see Active Directory Federation Services 2.0.

• An on-premises deployment of Skype for Business Server 2015 or Lync Server 2010 with Cumulative Updates for Lync Server 2010: March 2013.

• Skype for Business Server 2015 administrative tools.

• A Directory Synchronization server. For details about Directory Synchronization, see the Directory Synchronization Tool.

Skype for Business client support

There are some differences in the features supported in Skype for Business clients, as well as the features available in on-premises and online environments. Before you decide where you want to home users in your organization, you can view the client support for the various configurations of Skype for Business Server. The following clients are supported with Skype for Business Online in a Skype for Business hybrid deployment:

• Lync 2010

• Skype for Business

• Skype for Business Microsoft Store app

• Skype for Business Web App

• Lync Mobile

• Lync for Mac 2011

• Lync Basic 2013

Topology Requirements

To configure your Skype for Business Server 2015 deployment for hybrid with Skype for Business Online, you need to have one of the following supported topologies:

• Microsoft Office Communications Server 2007 R2 with Skype for Business Server 2015 on-premises. The Skype for Business Server 2015 federation Edge Server and the next hop server from the federation Edge Server must be running Skype for Business Server 2015, and there must be a Central Management Store deployed. The Edge Server and pool must be deployed on-premises.

• Microsoft Lync Server 2010 with Cumulative Updates for Lync Server 2010: February 2013 applied, and the Skype for Business Server 2015 administrative tools installed on-premises. The federation Edge Server and next hop server from the federation Edge Server must be running either Microsoft Lync Server 2010 with the latest cumulative updates.

  Important: The Skype for Business Server 2015 administrative tools should be installed on a separate server that has access to connect to the existing Lync Server 2010 deployment. The Move-CsUser cmdlet to move users from your on-premises deployment to Skype for Business Online must be run from the Skype for Business Server 2015 administrative tools connected to your on-premises deployment.

• A Skype for Business Server 2015 deployment with all servers running Skype for Business Server 2015.

Requirements for Federation Allowed/Blocked Lists

The Allowed domains list includes domains that have a partner Edge fully qualified domain name (FQDN) configured. These are sometimes referred to as allowed partner servers or direct federation partners. You should be familiar with the difference between Open Federation and Closed Federation, referred to as partner discovery and allowed partner domain list, respectively, in on-premises deployments. The following requirements must be met to successfully configure a hybrid deployment:

• Domain matching must be configured the same for your on-premises deployment and your Microsoft 365 tenant. If partner discovery is enabled on the on-premises deployment, then open federation must be configured for your online tenant. If partner discovery is not enabled, then closed federation must be configured for your online tenant.

• The Blocked domains list in the on-premises deployment must exactly match the Blocked domains list for your online tenant.

• The Allowed domains list in the on-premises deployment must exactly match the Allowed domains list for your online tenant.

• Federation must be enabled for the external communications for the online tenant, which is configured by using the Skype for Business Online Control Panel.

DNS Settings

When creating DNS SRV records for hybrid deployments, the records, _sipfederationtls._tcp.<domain> and _sip._tls.<domain>, should point to the on-premises Access Proxy.

Firewall Considerations

Computers on your network must be able to perform standard Internet DNS lookups. If these computers can reach standard Internet sites, your network meets this requirement.

Depending on the location of your data center, you must also configure your network firewall devices to accept connections based on wildcard domain names (for example, all traffic from *.partner.outlook.cn). If your organization’s firewalls do not support wildcard name configurations, you will have to manually determine the IP address ranges that you would like to allow and the specified ports.

Refer to the Help topic URLs and IP address ranges for Microsoft 365.

Port and Protocol Requirements

In addition to the port requirements for internal Skype for Business Server 2015 communication, you must also configure the following ports for your on-premises network.

User Accounts and Data

In a Skype for Business Server 2015 hybrid deployment, any user that you want to home in Skype for Business Online must first be created in the on-premises deployment, so that the user account is created in Active Directory Domain Services. You can then move the user to Skype for Business Online, which will move the user’s contact list.

When you synchronize user accounts between your Skype for Business on-premises and Skype for Business Online deployments with AD FS and Dirsync, you need to synchronize the AD accounts for all Skype for Business users in your organization between your on-premises and online Skype for Business deployments, even if users are not moved to Skype for Business Online. If you do not synchronize all users, communication between on-premises and online users in your organization may not work as expected.

You should also consider the following user-related issues when planning for a hybrid deployment.

• User contacts - The limit for contacts for Skype for Business Online users is 250. Any contacts beyond that number will be removed from the user’s contact list when the account is moved to Skype for Business Online.

• Instant Messaging and Presence - User contact lists, groups, and access control lists (ACLs) are migrated with the user account.

• Conferencing data, meeting content, and scheduled meetings - This content is not migrated with the user account. Users must reschedule meetings after their accounts are migrated to Skype for Business Online.

User Policies and Features

• In a Skype for Business Server 2015 hybrid environment, users can be enabled for Instant Messaging, voice, and meetings either on-premises or online, but not both simultaneously.

• Lync Client - Some users may require a new client version when they are moved to Skype for Business Online.

• On-premises policies and configuration (non-user) - Online and on-premises policies require separate configuration. You cannot set global policies that apply to both.

Administrator Credentials

When you are asked to provide your administrator credentials, use the username and password for the administrator account for your Microsoft 365 tenant. You will also use these credentials when you configure Active Directory Federation Services (AD FS) 2.0, Directory Synchronization, Single sign-on, federation, and moving users to Lync Online.

Connecting to Skype for Business Online PowerShell

Administrators now have the ability to use Windows PowerShell to manage Skype for Business Online and their Skype for Business Online user accounts. To do this, you must first download and install the Lync Online Connector Module from the Microsoft Download Center. For more information on downloading, installing, and using the Skype for Business Online Connector Module, and for detailed information about using the module, see Using Windows PowerShell to manage Lync Online.

Steps to prepare and configure Skype for Business Server 2015 on-premises for hybrid with Skype for Business Online

The following table lists the steps required to prepare your environment for a hybrid deployment with Microsoft Skype for Business Online and Microsoft Microsoft 365.

Configure federation of Skype for Business Server 2015 with Skype for Business Online

Federation allows users in your on-premises deployment to communicate with Microsoft 365 users in your organization. To configure federation, run the following cmdlets:

New-CSHostingProvider -Identity LyncOnline -ProxyFqdn "sipfed.online.partner.lync.cn" -Enabled $true -EnabledSharedAddressSpace $true -HostsOCSUsers $true -VerificationLevel UseSourceVerification -IsLocal $false -AutodiscoverUrl https://webdir.online.partner.lync.cn/Autodiscover/AutodiscoverService.svc/root

Configure Your Skype for Business Online Tenant for a Shared SIP Address Space

A Session Initiation Protocol (SIP) address is a unique identifier for each user on a network, similar to a phone number or an email address. Before you try to move Skype for Business users from on-premises to Skype for Business Online, you’ll need to configure your Microsoft 365 tenant to share the SIP address space with your on-premises deployment. If this is not configured, you may see the following error message:

Move-CsUser : HostedMigration fault: Error=(510), Description=(This user’s tenant is not enabled for shared sip address space.)

To configure a shared SIP address space, establish a remote PowerShell session with Skype for Business Online, and then run the following cmdlet:

Set-CsTenantFederationConfiguration -SharedSipAddressSpace $true

To establish a remote PowerShell session with Skype for Business Online, you first need to install the Skype for Business Online module for Windows PowerShell, which you can get here: Windows PowerShell Module for ;Lync Online.

After you install the module, you can establish a remote session with the following cmdlets:

Import-Module LyncOnlineConnector

$cred = Get-Credential

$CSSession = New-CsOnlineSession -Credential $cred

Import-PSSession $CSSession -AllowClobber

For more information about how to establish a remote PowerShell session with Skype for Business Online, see Connecting to Lync Online by using Windows PowerShell.

For more information about using the Skype for Business Online PowerShell module, see Using Windows PowerShell to manage Lync Online.

Migrate User Settings to Skype for Business Online

User settings are moved with the user account. Some on-premises settings are not moved with the user account.

Moving Pilot Users to Skype for Business Online

Before you begin to move users to Skype for Business Online, you may want to move a few pilot users to confirm that your environment is correctly configured. You can then verify that Skype for Business features and services function as expected before attempting to move additional users.

To move an on-premises user to your Skype for Business Online tenant, run the following cmdlets in the Skype for Business Server Management Shell, using the administrator credentials for your Microsoft Microsoft 365 tenant. Replace "username@contoso.com" with the information for the user that you want to move.

$creds=Get-Credential

Move-CsUser -Identity username@contoso.com -Target sipfed.online.partner.lync.cn -Credential $creds -HostedMigrationOverrideUrl <URL>

The format of the URL specified for the HostedMigrationOverrideUrl parameter must be the URL to the pool where the Hosted Migration service is running, in the following format: Https://<Pool FQDN>/HostedMigration/hostedmigrationService.svc.

You can determine the URL to the Hosted Migration Service by viewing the URL for the Skype for Business Online Control Panel for your Microsoft 365 tenant account.

To determine the Hosted Migration Service URL for your Microsoft 365 tenant

1. Login to your Microsoft 365 tenant as an administrator.

2. Open the Skype for Business admin center.

3. With the Skype for Business admin center displayed, select and copy the URL in the address bar up to partner.lync.cn. An example URL looks similar to the following:

   https://webdir0a.online.partner.lync.cn/lscp/?language=zh-cn&tenantID=

4. Replace webdir in the URL with admin, resulting in the following:

   https://admin0a.online.partner.lync.cn

5. Append the following string to the URL: /HostedMigration/hostedmigrationservice.svc. The resulting URL, which is the value of the HostedMigrationOverrideUrl, should look like the following:

   https://admin0a.online.partner.lync.cn/HostedMigration/hostedmigrationservice.svc

Moving Users to Lync Online

You can move multiple users by using the Get-CsUser cmdlet with the –Filter parameter to select the users with a specific property assigned to the user accounts, such as RegistrarPool. You can then pipe the returned users to the Move-CsUser cmdlet, as shown in the following example.

Get-CsUser -Filter {UserProperty -eq "UserPropertyValue"} | Move-CsUser -Target sipfed.online.partner.lync.cn -Credential $creds -HostedMigrationOverrideUrl <URL>

You can also use the –OU parameter to retrieve all users in the specified OU, as shown in the following example.

Get-CsUser -OU "cn=hybridusers,cn=contoso.." | Move-CsUser -Target sipfed.online.partner.lync.cn -Credentials $creds -HostedMigrationOverrideUrl <URL>

Verify Skype for Business Online User Settings and Features

You can verify that the user was moved successfully in the following ways:

• View the status of the user in the Skype for Business Online Control Panel. The visual indicator for on-premises users and online users is different.

• Run the following cmdlet:

  Get-CsUser -Identity

Moving Users Back to On-premises

This section applies only to users that were created and enabled for Skype for Business on-premises and then moved from an on-premises deployment to Skype for Business Online. If you want to move users that were created in Skype for Business Online (and not ever enabled for Skype for Business in an on-premises deployment), see Moving users from Skype for Business Online to Skype for Business on-premises in Skype for Business Server 2015.

Run the following cmdlets to move a user from Skype for Business Online back to Skype for Business on-premises:

$cred=Get-Credential

Move-CsUser -Identity username@contoso.com -Target localpool.contoso.com -Credential $cred -HostedMigrationOverrideUrl <URL>

To determine the URL for the Hosted Migration service, see "To determine the Hosted Migration Service URL for your Microsoft 365 tenant" in the preceding section.