Over the last few years I’ve worked on projects where we enable customers towards Office 365. Mail migration, collaboration (SharePoint) skype for business, yammer etc..

Most of the times we have difficult discussions about the choice that could be make about changing the userprincipalname and if it’s really required to change it.

Next to it, it looks like is has become a complex situation convincing our customers to choose for the one single identity. And understand the importance of it. Mostly struggling thought an assessment phase we give the understand to our customers that we should take enough time for the importancy of “identity”. Certainly in this time were security is one of the most important priorities for organizations to improve. And we don’t want to mix-up accounts and make new account for each platform where we like a user could connect to.

In this blog I would like you to understand from an end-user and administrator perspective why to choose for a single identity, cross-premises. And how we could start from this perspective to guarantee that it will become easier for you and your end-users.
In parallel i’ve mixed it with the discussion of changing a part of your identity which is an uniform userlogonname, the userprincipalname.

Hybrid identity – is it a central identity?

“The core of a Microsoft-based centralized identity is Active Directory.” As for a lot of customers we see they have a well implement Active Directory in their organization on a mature and strict way. They use their identity for signing in on their devices, use their identity for their CRM solution, HR platforms, etc…

Hybrid identity – cross premises.

Now, after we have our ‘central identity’ platform ADDS on-premise. We could extend this towards another premise. Therefore we use Azure AD to synchronize the on-premise identity towards Azure Active Directory.

“What is a UserPrincipalname, should it change, and if we change it, will we impact all our users?”

It’s one of the most raised questions, and it could be a complex one. An userprincipalname is the logon name for the user to authenticate toward Active Directory. In an O365 deployment it’s the unique identifier we are using through the environment. As for exchange on-premise and in the cloud.

Administrators are aware where to find it, but let me show you what I meant:

Blue = Userprincipalname = Userlogon (max lenght in characters 64)
Orange Samaccount = Pre-Windows 2000 Logon (max lenght in characters 20)

Like it or not, working towards an identity synchronization directory requires some effort for administrators to provide the best experience for your end-users. In a lot of companies we see a difference in configuration when we are talking about UserPrincipalName (UPN) and the synchronization of it. Some companies are confident that they should not change their UPN and keep them identical to the samaccount. Some choose to change the UPN to the mail address.

For better user experience. It’s well recommended to change the UPN and match it with the primary mailaddress. Make it synchronized to have the same identical name in the on-premise environment as in the cloud.

Make it easier for your users:

When logging in in Onedrive, Onenote and almost all Microsoft services you will be asked to fill-in your mail address. But they mean your UPN.

Skype for Business:

When using skype for business, your default ‘login’ will be your SIP Address. So it is unclear for a user which login they should enter. You could update your SIP addresses to have the same identifier as your mail/upn. Or you could choose for a different address and let your business contacts know that you cannot be reached on your mail address but on your dedicated Skype For Business address. So splitting up your mail address and skype address could be chosen.

What about federation:

You could implement Active Directory Federation Services (ADFS) to have Single Sign-on (SSO) features to help your user logging-in in O365 services. Keep in mind that when they are at home they still need to go through the ADFS and authenticate based on Windows Authentication or Forms Authentication.

Bring it all together:

For an end-user perspective, it’ best to explain your employees that since you are moving more and more services to Office 365 to start working with their UserPrincipalname which is their mail address.

Keep it simple: Let your employees login with 1 identifier which is their mail skype and every other Office 365 services address.

And If it requires a change, let’s do it right away. Communicate the change to all your employees. So you could start as soon as possible with their one and only, simple, single identity.

Microsoft introduced “Cloud App Discovery” more than a year ago, but not many enterprises benefit or even thought about using this service.

It’s actually very simple, Microsoft explains this very good in its own words:

In modern enterprises, administrators are often not aware of all the SaaS applications that are used by the users to do their work. As a consequence of this, administrators often have concerns in conjunction with unauthorized access to corporate data, possible data leakage and other security risks inherent in the applications. Because they don’t know how many or which apps are used, even getting started building a plan to deal with these risks seems to be daunting.

Benefit

So, what can you expect form this:

• discover applications in use and measure usage by:

o   volume (traffic)

o   number of users

o   number of web requests

• identify the users that are using an application
• export data
• easier to practice shadow IT
• bring applications under IT control and integrate applications easily to enable

o   single sign-on

o   user management

What do you need

Cloud App Discovery is part of the Azure AD premium features portfolio of Microsoft.

With the new licenses models of Microsoft, a P1 license is sufficient.

Keep in mind that only the admins that want to access the logs and reports need a license, so you’re users don’t need any kind of license for this, this is the nice part of the service.

There is not much needed to configure it’s an out-of-the box service.

Follow these few steps and you’re good to go:

1)     Login to your Azure portal as an Administrator (https://portal.azure.com)

2)     Search for “cloud app discovery”

3)     Click on “create” and you can start configuring it.

4)     Go to settings

For the Agent part, you only have a few options that can be changed.

Notification for the users is the most important part, this is can be a legal issue if you don’t configure it correctly.

Deep Inspection and Automatic Updates can be set/left to “on” nothing special about these things.

On the data collection part, you can select which apps that can be discovered. There are about 1465 apps and 25 categories.

If you want to use the data for your own research, this is possible in the “store data” section.

You can export the data to Azure Blob Storage if you want using the configuration screen above.

Through Manage access, you can add people that can use this service and consult the reporting and/or settings.

Notifications can be set in the last menu item. You don’t have many options here, only on weekly base.

Once you have checked and changed the config, we can start using the service.

How does it work

Collecting data

With cloud app discovery, the data retrieval part is accomplished by agents that run on computers in your environments.

You need to deploy a client agent to the machines/users you want to assess.

This is done using the client that can be downloaded in the portal:

You can also deploy the client using GPO’s or SCCM for large scale deployment:

http://social.technet.microsoft.com/wiki/contents/articles/30965.cloud-app-discovery-group-policy-deployment-guide.aspx

http://social.technet.microsoft.com/wiki/contents/articles/30968.cloud-app-discovery-system-center-deployment-guide.aspx

After installation, you’ll see this in your services:

Uploading data

The app usage information that is captured by the agents is send over a secure, encrypted channel to the cloud app discovery service on the Azure platform.

Analysis

The cloud app discovery service evaluates the data and generates reports you can use to analyse your environment.

You have a few basic reports available on the portal.

• The total number (count) of observed apps, the number of unmanaged apps and the number of managed apps. This graph can be modified to show volume or web requests.
• The total number of observed users.
• The total number of observed agent installations.

If you go to the details, you get the list of managed and unmanaged applications.

You can do the same for “users” and “agents”.

Disadvantages

The only disadvantage is the agent that is needed for the assessment:

• Agent is an executable, not an MSI package
• Agent is not fail proof with other clients (for example with the Microsoft TMG agent)

Conclusion

Very nice service, can be setup very fast without a lot of additional work (except client deployment).

Data from this tool is also being used for the Azure AD Identity Protection service that Microsoft released a few months ago.

There are several options, mainly SharePoint, Office Groups and OneDrive for Business. So, what is the best one for your company data? It may even be so that some of your file shares should migrate to different Office 365 platforms, depending on their use and requirements, and some should not at all migrate to the cloud.

First, let us look at it from a technical point of view.

SharePoint, Office Groups and OneDrive for Business document data are al stored on the SharePoint data platform, which is a database driven environment. So, in terms of performance and response time, there are no differences.

In the past, Microsoft has been recommending not to use SharePoint storage as a replacement for some file shares, since it doesn’t offer the same performance, and that advice is still applicable for some of the file share data.

All application-related data that requires high performance and IO throughput should remain on local file storage. So, you need to assess first what not to migrate, as well as what to put aside in an archive, to avoid to pay for the unnecessary usage of cloud storage.

SharePoint uses a “tenant” for storage of data, made of “site collections” – a tenant can contain up to 500 000 site collections, and every site collection has a maximum capacity of 25 TB. The default storage space included in every Enterprise license is 1 TB + 0.5 GB per Enterprise licence. If you use more than this, you bill will be charged per extra GB, and there is no hard limit for the total storage on your tenant. As every Office Group has its own site collection, there a maximum of 25 TB per Office Group. Your intranet or any other site collection next to the Office Groups site collections can serve as a storage space for additional 25 TB of documents data. If you need more storage space, you can split up your data in up to 500 000 site collections. Be aware that every site collection has its own security environment, so splitting up your data among numerous site collections has quite a few drawbacks from management perspective.

Then there is OneDrive for Business, which is using a personal site collection that is assigned to every Enterprise user (also called the SharePoint “My Site”), and has a standard storage of 1TB for most Enterprise plans. Microsoft has announced “unlimited storage” for OneDrive on some of its plans, but those plans have a hard limit of 5 TB, which is largely over the average use of OneDrive for Business and so it is considered as equivalent to unlimited.

Then, when it comes to functional specifications, what are the differences?

You are not, from an end-user perspective, faced with the standard SharePoint interface when using Office Groups and OneDrive for Business.

In these cases, SharePoint is used as a repository, and Microsoft has built a presentation layer abstracting many of the features and settings that have little or no use for average users of these environments.

SharePoint

SharePoint is an enterprise content management solution, with many features and templates, that can be almost fully customized in terms of data structure and metadata, interfaces, workflows, data integration, search facilities…

It offers a complete set of sharing options, including with external users, fully customizable permission settings, and nearly unlimited customization and automation options through its API’s.

When you migrate your documents to the cloud, these kinds of features may be way out of scope of your document storage needs, but then again you might take a look at the longer term and evaluate future improvements of you file repository.  If you lock your documents down in a more restricted environment (like Groups and OneDrive for Business), you’re basically denying yourself from future custom improvements of your document storage, and you tie yourself to the environment proposed by Microsoft, as it evolves through the time.

On the other side, customizations always come with a price because it requires advanced configuration, templating or even custom app development. But you can limit the impact of these by adopting an iterative approach to the improvements.

Office Groups

Office Groups is a basic group collaboration tool, that offers a limited subset of SharePoint functionalities, such as storage of documents in a document library and the ability to share the documents with a set of “members” or guests. Office Groups are not positioned as a replacement solution for SharePoint, but as a platform for teams that need a collaboration tool that is quick & easy to setup.

In addition to this, Office Groups offers integration with Exchange via a shared mailbox and calendar, and with OneNote online via a shared Notebook.

Security settings are currently limited (open/closed groups with owners and members), but more security options like categorizing groups into sets of policies have been announced. Sharing with external users is available with the “guest access” feature. And as O365 is continuously being updated, other options will become available for Groups.

Automation is possible via PowerShell API’s.

As opposed to SharePoint, Office Groups offer little or no possibilities of customization, in terms of UI, structure, security, workflows, … So, if your business processes don’t match with the standard set of Groups, you need to consider the SharePoint option. But as Office Groups is being constantly updated, you can settle with the current features, and evaluate future improvements through the features that are being rolled out. The Office 365 roadmap (check link below) is a resource to watch when adopting Office Groups in your company.

OneDrive for Business

OneDrive for Business covers a limited subset of SharePoint functionalities, such as storage of documents in a personal document library, sharing (including with external users) and syncing with your desktop via a desktop client.

In addition to this, the client can sync all libraries that are part of a SharePoint environment, so it can sync personal data from the users OneDrive for Business, but also documents in Office Groups and SharePoint libraries.

Automation is possible via PowerShell API’s, and OneDrive for Business can be centrally managed & monitored with the tenant admin tools.

As opposed to SharePoint, OneDrive for Business offers little or no possibilities of customization, in terms of UI, structure, security, workflows, … So, if your business processes don’t match with the standard set of OneDrive for Business, you need to evaluate other options.

To summarize

SharePoint is a fully-fledged collaborative document workspace that enables customized integration of business processes. It requires a more extensive set up phase than other solutions, and may require more time to adopt in your enterprise than a simple tool. When you need a templated approach, a tailormade solution for your business, think SharePoint.

Office Groups is a standard solution for “quick and ad hoc” collaboration based on shared files, a shared calendar and a shared message folder. If you need a simple collaborative solution for projects, this is the ideal solution.

OneDrive for Business is a solution for personal document data, that is work-related data that is confidential and needs little or no sharing with others. It offers the additional benefit of backup storage of all your Office 365 documents on your desktop.

References

Should SharePoint replace file servers?

https://msdn.microsoft.com/en-us/library/dd163523.aspx

SharePoint versus File Shares https://blogs.msdn.microsoft.com/scaravajal/2008/05/06/sharepoint-vs-file-shares/

SharePoint Online software boundaries and limits

https://support.office.com/en-us/article/SharePoint-Online-software-boundaries-and-limits-8f34ff47-b749-408b-abc0-b605e1f6d498?ui=en-US&rs=en-US&ad=US&fromAR=1

Office 365 Roadmap

https://fasttrack.microsoft.com/roadmap

–

–

Below you’ll find some guidance on Windows Server, SQL server & SharePoint server level.

Windows server

To have an optimal performance of the servers you need to select “Adjust for best performance”

Following thing is adjusting the page file. It’s recommended that you set this to minimum 1.5 times the amount of server RAM. So in case your server has 16GB RAM, you’ll need a page file with a minimum size of 24GB. Ideally you also have a dedicated disk for this page file as shown in the screenshot below.

In the power options in the control panel, pick the following setting

It’s also recommended to split up into multiple drives to reduces disk I/O.

SQL Server

To have an optimal performance of you SharePoint farm, it’s recommended to install a dedicated SQL server for SharePoint. So it’s not designated to host other databases which are not used for SharePoint.

Following thing you need to keep in mind is the Collation, for an optimal performance in your SharePoint farm you’ll need to set it to Latin1_General_CI_AS_KS_WS

One of the most important SQL Databases with regards to SharePoint is the TempDB. Most SharePoint performance issues are due to improper SQL configuration and more importantly, not giving enough thought to the TempDB itself. In SharePoint, every action that you take is staged in the TempDB before it is committed.

So I advise to add as much TempDB files as the amount of processors in your server with a maximum of 8. The size should be set to 25% of your largest content database.

When using SQL Server 2016 you’ll be able to specify the TempDB’s settings during the installation configuration. In older versions you need to adapt them after the installation.

For SharePoint the Max Degree of Parallelism should be set to 1

It’s also important to set minimum and maximum values for instance memory. The default maximum when doing installation is 2147483647 MB. I advise to set the maximum memory to 80% of the available RAM on the server where SQL is installed.

Set the fill factor to 80

Furthermore, it is also designated to set the auto growth of databases in MB instead of % and to pre-size your databases.

All disk Raid types are supported for SharePoint 2016 but I recommend to use RAID 10 to optimize the performance of you farm.

Some additional estimations of RAM recommended for the server that is running SQL.

SharePoint 2016

For optimizing performance in SharePoint 2016 Microsoft has come up with the new Minrole topology.

Some of the primary benefits to using MinRole are:

• Simplified deployment
• Improved performance and reliability
• Simplified capacity planning and farm scalability

More info about this new topology and the way to implement this can be checked at another blog which I wrote earlier this year. /2015/09/22/sharepoint-2016-minrole-farm-topology-installation-process/

Since November Microsoft has also release a minimized Minrole which comes together with Feature Pack1 for SharePoint 2016.

Within this “minimized Minrole” it’s possible to combine the Front-End role with Distributed Cache role & the Application role with the Search role.

On web application level it’s advised to:

• Set quotas on all your Web Application
• Disable Certificate Revocation List
• Use make-up scripts
• To have maximum 10 Application Pools and 20 Web Applications

You also need to keep in mind the different possibilities of caching:

• Distributed cache: provides caching functionality to features (Authentication, Page Load…)
• Object cache: Is used internally store properties of sites, page layouts, and pages. reduces the amount of traffic between the WFE and SQL
• Output cache: Stores rendered output of all controls on a given page, and it also stores several different versions of this pre-rendered page.
• BLOB cache: Disk-based cache that stores files that are used by web pages to help them load quickly in the browser, and reduces the load on the database server when it uses those files.

Keep also in mind that Antivirus will slow down your SharePoint farm.

Minimum requirements for SharePoint 2016

The values in the following table are minimum values for installations on a web and application servers that are running SharePoint Server 2016 in a multiple server farm installation.

For all installation scenarios, you must have sufficient hard disk space for the base installation and sufficient space for diagnostics such as logging, debugging, creating memory dumps, and so on. For production use, you must also have additional free disk space for day-to-day operations. In addition, maintain two times as much free space as you have RAM for production environments.

Just keep in mind those are just minimum requirements, those must be assessed on the business requirement specific to each customer.

Ruben Plehiers

Senior SharePoint Consultant @ Spikes

Before we start with the installation of SharePoint 2016 Preview we have to keep in mind that the farm topology will be different from the previous SharePoint version.

Within SharePoint server 2016 there are 6 different roles we can give to a server.

By using the new MinRole feature in SharePoint Server 2016 IT Preview, SharePoint farm administrators can define each server’s role in a farm topology. The role of a server is specified when you create a new farm or merge a server to an existing farm. SharePoint automatically configures the services on each server based on the server’s role, and the performance of the farm is optimized based on that topology.

MinRole management of service instances doesn’t only happen when you join a server to a farm. As you enable or disable services in the farm, or as you create and delete service applications in the farm, MinRole starts and stops service instances on the existing servers in the farm. This ensures that each server in your SharePoint farm is only running the services it needs.

The result is that SharePoint farm administrators no longer need to think about service instances at an individual server level. Instead, administrators can now focus on which services should be enabled at the SharePoint farm level.

The following table gives an overview of the Microsoft recommended MineRole topologies

Hardware Requirements

The values in the following table are minimum values for installations on a single server and for Web, Application, and Cache servers that are running SharePoint Server 2016 Preview in a multiple server farm installation.

For all installation scenarios, you should have sufficient hard disk space for the base installation and sufficient space for diagnostics such as logging, debugging, creating memory dumps, and so on.

The operating system I used for the setup of SharePoint server 2016 Preview is Windows Server 2012 R2 Standard. For the databases I used SQL Server 2014 Standard, the setup of the SQL Server instance is not described in this document.

Installing SharePoint 2016

SharePoint server 2016 Preview can be downloaded from https://www.microsoft.com/en-us/download/details.aspx?id=48712

Installation of SharePoint 2016 IT Preview looks similar to previous SharePoint installations.  When you mount the ISO, you will see a familiar splash screen.

SharePoint prerequisites installation

Before we can start the installation of SharePoint 2016 software we need to install the following software prerequisites first. During the prerequisites installation the tool will ask you multiple times to restart.

• Application Server Role, Web Server (IIS) Role
• Microsoft SQL Server 2012 Native Client
• Microsoft ODBC Driver 11 for SQL Server
• Microsoft Sync Framework Runtime v1.0 SP1 (x64)
• Windows Server AppFabric
• Microsoft Identity Extensions
  
• Microsoft Information Protection and Control Client 2.1
• Microsoft WCF Data Services 5.6
• Microsoft .NET Framework 4.5.2
• Cumulative Update Package 1 for Microsoft AppFabric 1.1 for Windows Server (KB2671763)
• Visual C++ Redistributable Package for Visual Studio 2013
• Update for Microsoft .NET Framework to disable RC4 in Transport Layer Security (KB2898850)

SharePoint Binaries installation

Trial key, which can be found on the website where the preview was downloaded. Accept the Microsoft Software License agreement.

Choose the file location & click “Install Now”. The installation will take some time depending on the resource you’ve been allocated to the server. When the installation is completed you can select the check box that will start the SharePoint configuration wizard.

SharePoint Product Configuration Wizard

By clicking on Close button, the Wizard will start to run. If you want to run it later on you can find it in the starting menu.

Select “Create a new server farm” and click Next. If you already installed and just want to add a new server and doing a minfin installation, then select “Connect to an existing server farm”

On the following screen you have to specify your configuration database settings and database access account.

If you completed the settings, the wizard will try to access the database server. After that you will get a screen where you can fill in the farm security settings. In this screen you have to specify a passphrase which is used to secure farm configuration data and is required for each server that joins the farm. Keep in mind that the passphrase can be changed after the farm is configured.

On the next screen we will come to the new part of SharePoint 2016 installations, the MinRoles.

As described earlier in this document SharePoint 2016 has six types of server roles:

• Front-end
• Application
• Distributed cache
• Search
• Custom
• Single-Server farm

Is this particular case I’ve selected the “Single-Server farm” as I don’t want to do a multiple server installation using the MinRole topology. If you select this role, it is not possible to extend to a multi-server farm in the future.

On the next screen specify the port for SharePoint Central Administration web application and press Next.

Verify the configuration wizard settings and press next to start it. If you’ve chosen the single-server installation the “advanced settings” will be greyed out.

Click cancel to abort the services installation wizard.

Below you can see the Central Administration page of SharePoint 2016.

In system settings menu we can see 2 new tabs “Manage services in this farm” and “Convert server role in this farm”.

Hybrid in SharePoint Server 2016 Preview

In SharePoint Server 2016 IT Preview, new hybrid features are available to enable hybrid solutions.

Hybrid sites features allow our users to have an integrated experience while using SharePoint Server and SharePoint Online sites:

• Users can follow SharePoint Server and SharePoint Online sites, and see them consolidated in a single list.
• Users have a single profile in Office 365, where all of their profile information is stored.

Hybrid sites features are used in concert with Hybrid OneDrive for Business (introduced in SharePoint Server 2013 with Service Pack 1 (SP1)):

• Users can sync files with Office 365 and share them with others.
• Users can access their files directly through Office 365 from any device.