Microsoft Exchange Online for Enterprises Dedicated Plans Service Description Published: October 2011 The information contained in this document represents the current view of Microsoft Corporation on the issues discussed as of the date of publication. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information presented after the date of publication. This document is for informational purposes only. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS DOCUMENT. Complying with all applicable copyright laws is the responsibility of the user. Without limiting the rights under copyright, no part of this document may be reproduced, stored in or introduced into a retrieval system, or transmitted in any form or by any means (electronic, mechanical, photocopying, recording, or otherwise), or for any purpose, without the express written permission of Microsoft Corporation. Microsoft may have patents, patent applications, trademarks, copyrights, or other intellectual property rights covering subject matter in this document. Except as expressly provided in any written license agreement from Microsoft, the furnishing of this document does not give you any license to these patents, trademarks, copyrights, or other intellectual property. ©2011 Microsoft Corporation. All rights reserved. Microsoft, ActiveSync, Active Directory, Entourage, Forefront, Internet Explorer, Lync, Outlook, SharePoint, Windows, Windows Phone, Windows Mobile, Windows PowerShell, and Windows Vista are trademarks of the Microsoft group of companies. All other trademarks are property of their respective owners. Exchange Online for Enterprises Service Description (Dedicated Plans) | October 2011 2 Contents Introduction ........................................................................................................................................................ 5 About Exchange Online Dedicated Plans .............................................................................................................................. 5 What’s New for Exchange Online ............................................................................................................................................. 5 Overview.............................................................................................................................................................. 7 Service Design .................................................................................................................................................................................. 7 Key Benefits ....................................................................................................................................................................................... 7 Core Features ...................................................................................................................................................... 9 Exchange Online Infrastructure ................................................................................................................................................. 9 Messaging Plans ........................................................................................................................................................................... 10 Mailbox Size Limits ...................................................................................................................................................................... 10 Resource Mailboxes and Shared Mailboxes ...................................................................................................................... 11 Conference Room Management ........................................................................................................................................... 11 Mailbox Administration ............................................................................................................................................................. 11 Accessing Exchange Online Services .................................................................................................................................... 13 Office Outlook ............................................................................................................................................................................ 13 Outlook Web App ..................................................................................................................................................................... 14 Macintosh Clients ...................................................................................................................................................................... 15 Mobile Device Connectivity with Exchange ActiveSync .............................................................................................. 15 POP3 and IMAP4 ...................................................................................................................................................................... 17 SMTP Relay.................................................................................................................................................................................. 17 Application Connectivity ........................................................................................................................................................... 17 Exchange Web Services Application Permissions .......................................................................................................... 18 Self-Service Administration ...................................................................................................................................................... 18 Exchange Control Panel ......................................................................................................................................................... 18 Mailbox Environment Viewing and Reporting ................................................................................................................ 19 User Schedule Availability ........................................................................................................................................................ 19 Message Transport Limit........................................................................................................................................................... 20 Address Book View Customization ....................................................................................................................................... 20 Transport Rule Configuration ................................................................................................................................................. 20 Disclaimer Support ...................................................................................................................................................................... 20 Records Management ................................................................................................................................................................ 21 Multiple Language Support ..................................................................................................................................................... 22 Antivirus Support ......................................................................................................................................................................... 22 Blocked File Types ....................................................................................................................................................................... 23 Secure Messaging and Encryption ........................................................................................................................................ 23 S/MIME Certificate Support ................................................................................................................................................... 23 Information Rights Management Support ....................................................................................................................... 23 Message Encryption .................................................................................................................................................................. 23 Deleted Item Retention ............................................................................................................................................................. 23 Exchange Online for Enterprises Service Description (Dedicated Plans) | October 2011 3 Deleted Mailbox Retention ...................................................................................................................................................... 24 Mailbox Data Protection and Recovery .............................................................................................................................. 24 Service Continuity Management ........................................................................................................................................... 24 Usage and Performance Metrics ............................................................................................................................................ 25 Usage Metrics ............................................................................................................................................................................. 25 Support for WAN Acceleration Devices .............................................................................................................................. 26 Optional Service Features ...............................................................................................................................27 Message Filtering ......................................................................................................................................................................... 27 Message Journaling .................................................................................................................................................................... 29 Litigation Hold .............................................................................................................................................................................. 30 Information Rights Management Integration .................................................................................................................. 31 Message Archiving ...................................................................................................................................................................... 32 Outbound Desktop Fax ............................................................................................................................................................. 33 Inbound/Outbound Fax Integration ..................................................................................................................................... 33 Two-Factor Authentication for Outlook Web App ......................................................................................................... 33 Mailbox Data Migration ............................................................................................................................................................ 34 User Communications ................................................................................................................................................................ 35 BlackBerry Device Connectivity .............................................................................................................................................. 36 BlackBerry Mobile Data System Connection Service .................................................................................................... 36 Management and Reporting of BlackBerry Enterprise Server ................................................................................... 37 Hosted Voicemail ......................................................................................................................................................................... 38 Planning for Service Changes and Growth ..................................................................................................39 Exchange Online for Enterprises Service Description (Dedicated Plans) | October 2011 4 Introduction Microsoft® Exchange Online is an enterprise-class, remotely hosted email messaging solution that uses the power of Microsoft Exchange Server to provide the mission-critical messaging services that businesses require today. When your organization subscribes to Exchange Online, your email is hosted on dedicated servers that are housed in Microsoft data centers and is accessible to users on a wide range of devices from inside your corporate network or over the Internet. This document provides IT professionals with a comprehensive description of the Exchange Online features that are available with Exchange Online for enterprises dedicated plans. About Exchange Online Dedicated Plans Customers purchase Exchange Online services that are delivered from dedicated hardware by subscribing to Microsoft Office 365 for enterprises “dedicated plans.” There are three Exchange Online standalone dedicated plans: Exchange Online Kiosk D Exchange Online Plan 1D Exchange Online Plan 2D See Table 2. Messaging Plan Feature Overview for a summary of Exchange Online key features included in each plan. In addition, Exchange Online standalone plans are available as part of Office 365 dedicated plan suites as shown in Table 1. Table 1. Office 365 Suite Plans Office 365 Plan K1D Office 365 Plan K2D Office 365 Plan E1D Office 365 Plan E2D Office 365 Plan E3D Office 365 Plan E4D Exchange Online Kiosk D Exchange Online Kiosk D Exchange Online Plan 1D Exchange Online Plan 1D Exchange Online Plan 2D Exchange Online Plan 2D SharePoint Online Kiosk D SharePoint Online Kiosk D SharePoint Online Plan 1D SharePoint Online Plan 1D SharePoint Online Plan 2D SharePoint Online Plan 2D Office Web Apps Lync Online Plan 2D Lync Online Plan 2D Lync Online Plan 2D Lync Online Plan 3D Office Web Apps Office Web Apps Office Web Apps Office Professional Plus Office Professional Plus Customers should contact a Microsoft sales representative for additional information about Office 365 standalone and suite subscription plans. What’s New for Exchange Online The current release of Exchange Online introduces the following upgrades and improvements to the service: Exchange Online for Enterprises Service Description (Dedicated Plans) | October 2011 5 Litigation Hold Policy. Exchange Online now provides customers with the ability to leverage the Exchange 2010 litigation hold feature. Litigation hold can be applied by the customer to specific mailboxes in their organization. This feature is commonly used in scenarios where a reasonable expectation of litigation exists and customers are required to preserve electronically stored information—including email—that is relevant to the case. When a user mailbox is placed on litigation hold, copies of deleted or edited email items are captured and retained in a litigation hold store for discovery and/or recovery. Items captured under litigation hold cannot be altered by the customer. Information Rights Management Integration. Exchange Online now offers customers the ability to integrate their on-premises Active Directory Rights Management Services (AD RMS) systems with Exchange Online. Integration with on-premises AD RMS enables customers to take advantage of Exchange 2010 Information Rights Management (IRM) features. By applying IRM settings, an organization and its users can prevent information leakage by controlling the rights that recipients have for email. Records Management Improvements. Exchange Online adds Exchange 2010 messaging records management (MRM) technology that uses retention policies and retention tags. Retention tags are used to apply retention settings to messages and folders to user mailboxes. A retention policy is a logical grouping of retention tags. When a retention policy is applied to a user’s mailbox, all retention tags linked to the policy are deployed in a single operation. Exchange Online for Enterprises Service Description (Dedicated Plans) | October 2011 6 Overview The Exchange Online service is a remotely hosted enterprise messaging solution managed by Microsoft. It provides a reliable, security-enhanced messaging environment with the flexibility to meet changing business needs. Exchange Online provides the core business capabilities of Exchange Server from a dedicated hosting environment. Exchange Online gives users single sign-on access to email, calendar, and contacts from virtually anywhere, at any time. Together with the Microsoft Outlook® messaging and collaboration client, Exchange Online simplifies communications. It improves the way information is shared and how users connect with others, while also increasing message security and compliance. This combination gives organizations a comprehensive time and information management solution for improved collaboration with customers, partners, and coworkers. Service Design Microsoft operates robust data centers around the world. Each data center houses a network of highly reliable equipment that hosts customer mail solutions and delivers 99.9-percent uptime. Organizations that choose the Exchange Online service have exclusive use of the servers that are needed to support their messaging requirements; this ensures that their data is isolated from data that Microsoft is hosting for other organizations. Exchange Online also provides synchronization capabilities that enable on-premises customer directory information to be synched continuously with the customer directory in the Microsoft data centers. As a result, users have seamless access to email from a wide range of devices, whether they are inside their corporate network or downloading email from the Internet. With Exchange Online, customers retain control over the messaging services offered to users. Easy integration with the Active Directory® service means that customer IT personnel can control service availability through existing group policies. Exchange Online, along with all other Office 365 for enterprises offerings, is backed by service-level agreements (SLAs) that guarantee optimal performance. Key Benefits The Exchange Online service offers the following benefits: Flexible messaging services. Email, shared calendar, Outlook connectivity, and Microsoft Outlook Web App provide the flexibility to meet diverse and evolving organizational needs. Regulatory compliance features. Meeting the increasingly complex regulatory requirements is eased with Sarbanes-Oxley and SAS 70 Type II self-assessment and audit support. Multilevel data protection. Safeguards are applied on multiple fronts, from message encryption support to the multilevel message filtering capabilities that include spam and virus protection, to the logical and physical security that protects customer information in the data centers. Mobility device support. Mobility features provide the messaging agility that organizations require to stay competitive in the marketplace, so that users can access their hosted services and stay connected anywhere in the world. At the same time, remote device wipe and policy provisioning help to ensure that sensitive data is protected. Exchange Online for Enterprises Service Description (Dedicated Plans) | October 2011 7 Remote administration of key features. Customer and user administration features are designed to help reduce help-desk escalations, enhance customer service management, and empower users. Exchange Online for Enterprises Service Description (Dedicated Plans) | October 2011 8 Core Features Core features of the Exchange Online service are described in detail in the following sections. Exchange Online Infrastructure The Exchange Online solution includes Exchange Server deployments that are integrated with other components to provide a comprehensive, remotely hosted messaging service for the enterprise. A diagram of the high-level architecture for this service is shown in Figure 1. Figure 1. Exchange Online infrastructure for dedicated plans Exchange Server is deployed in the Microsoft data centers in several different roles: Mailbox servers. Transport servers for routing email. Internet client access servers that provide Outlook Web App, Microsoft Exchange ActiveSync® technology, and the Outlook Anywhere feature of Outlook. Customer Responsibilities Maintain the existing message solution during the coexistence phase—the phase in which customers begin using Exchange Online while still using their existing email system. Decommission the existing messaging solution after migration to Exchange Online. Exchange Online for Enterprises Service Description (Dedicated Plans) | October 2011 9 Microsoft Responsibility Deploy and maintain Exchange Server and related components in Microsoft data centers. Messaging Plans An Exchange Online customer assigns messaging plan to users in its organization. Each messaging plan has a mailbox. Folders and messages in these mailboxes reside on a computer running Exchange Server at a Microsoft data center. To simplify the provisioning process, messaging seat features are packaged according to the Exchange Online dedicated plan to which the user is subscribed. as shown in Table 2. The Kiosk Plan seat is designed for those who require fewer messaging features. Table 2. Messaging Plan Feature Overview Exchange Online Kiosk D1 Features Exchange Online Plan 1D Exchange Online Plan 2D Mailbox size 500 megabytes (MB) 5 gigabytes (GB) 25 GB Access methods HTTP (Outlook Web App with some settings disabled2), POP3** MAPI, HTTP, Exchange ActiveSync, POP33, IMAP43 MAPI, HTTP, Exchange ActiveSync, POP33, IMAP43 Device connectivity support Not supported Exchange ActiveSync Exchange ActiveSync BlackBerry Enterprise Server (optional) BlackBerry Enterprise Server (optional) Service levels 99.9 percent 99.9 percent 99.9 percent Service continuity from full data center failure 2 hours or less recovery time objective (RTO) 2 hours or less RTO 2 hours or less RTO Outbound fax Not supported Optional Optional Hosted voicemail Not supported Not supported Supported4 Plan names for Exchange Online have changed under Microsoft Office 365. Kiosk D Plan was formerly Deskless Worker, Plan 1D was formerly Standard, and Plan 2D is a new plan. 1 2 Inbox rules, instant messaging (IM) integration, short message service (SMS) integration, and access to other mailboxes are disabled. 3 Intranet only. Hosted voicemail is a Tech Preview feature for early adopter customers. During the Tech Preview, users with Exchange Online Plan 1D subscriptions can also access hosted voicemail. 4 Mailbox Size Limits The default mailbox size for Exchange Online Plan 1D is 5 GB, with Exchange Online Plan 2 25-GB mailbox available. Customers select a mailbox size that applies to each user by setting an extension attribute in Active Directory. The mailbox size for the Exchange Online Kiosk D Plan is 500 MB. Exchange Online provides three different notifications to users when their mailbox has reached a certain size limit: Warning. The user receives an email warning when the mailbox is approaching the maximum size limit. Exchange Online for Enterprises Service Description (Dedicated Plans) | October 2011 10 Prohibit Send. The user receives an email prohibit-send notification when the mailbox size limit is reached. The user cannot send new messages until enough email is deleted that the mailbox is below the size limit again. Prohibit Send/Receive. Exchange Online rejects any incoming mail when the mailbox size limit is reached, and sends a non-delivery report (NDR) to the sender. The sender has the option to try resending the mail later. To receive messages again, the user must delete email until the mailbox is below the size limit. Table 3 shows Exchange Online mailbox sizes, and the levels at which notifications and restrictions take effect. Table 3. Mailbox Size Limits and Notifications Messaging Plan Warning Prohibit Send Prohibit Send/Receive Kiosk D Plan (500 MB mailbox) 450 MB 500 MB 1000 MB Plan 1D (5 GB mailbox) 4.5 GB 5.0 GB 5.5 GB Plan 2D (25 GB mailbox) 24.5 GB 25.0 GB 25.5 GB Resource Mailboxes and Shared Mailboxes Not all mailboxes are associated with individual users. Exchange Online also makes these special-purpose mailboxes available: Resource mailboxes. Provide access to conference rooms. Shared mailboxes. Used for business functions such as help desk requests, where one or more people process the email. These mailboxes can be used to send or receive all types of email. Customer Responsibility Identify and populate the defined extension attribute in the customer’s Active Directory to set resource and shared mailbox size, features, and options. Submit a change request to Microsoft in order to report shared mailboxes and initiate billing. Conference Room Management Exchange Online includes the Resource Booking Attendant (RBA), which automates scheduling of conference rooms and other resources. A resource mailbox that is RBA-configured accepts, declines, or acknowledges messages from a meeting organizer. Exchange Online enables the customer to customize these responses through Outlook Web App. The customer sets booking policies or rules for the organization’s resource mailboxes. These might include who can schedule a resource, when it can be scheduled, what meeting information is visible on the resource's calendar, and the percentage of schedule conflicts allowed. Customer Responsibility Define and manage RBA settings through remote Windows PowerShell. Mailbox Administration Exchange Online provides mailbox permission capabilities for customers through the Customer Exchange Online for Enterprises Service Description (Dedicated Plans) | October 2011 11 Management Portal (CMP). With this web portal, customer service desk and IT personnel can gain full mailbox rights to users' mailboxes. When full mailbox permissions are applied, they are able to conduct common mailbox administration tasks, view CMP audit logs within CMP, and minimize escalation of issues to Office 365 support teams. After permissions are applied, the following mailbox administration tasks can be performed: Set delegate permissions. Set "out of office" messages on behalf of employees who are away or on leave. Export PST files. Manage conference rooms. Recover deleted items from the Recover Deleted Items folder. Configure multiforest support with self-service forest configuration. Access basic usage log reporting via command-line interface. Create scripts to automate routine tasks. The CMP makes two roles available to customers: MSO Perms Admin and MSO Perms Helpdesk. The customer assigns individuals in the organization to each of these roles by adding them to security groups within the customer forest. The MSO Perms Admin role provides comprehensive read-write access to the CMP’s functionality, including the ability to grant full mailbox rights for target mailboxes. The Perms Admin role may perform functions such as searching for a mailbox, selecting a mailbox in the search results, and viewing owners for mailboxes listed in the search results. The MSO Perms Helpdesk role provides read-only access and is intended for use by Tier 1 support technicians who need to troubleshoot mailbox administration issues, including confirmation that full mailbox rights should be enabled for a target mailbox. Customer Responsibilities Create the MSO Perms Admin and MSO Perms Helpdesk mail-enabled security groups. Assign users to CMP security groups as needed and ensure that these user roles are updated and accurate. Create and configure the domain account record that is directed to the CMP IP address provided by Microsoft. Ensure that designated users have network access to the CMP IP address and port provided by Microsoft. Train mailbox administration support personnel on how to perform common mailbox administration tasks using the CMP and Microsoft-provided training materials. Microsoft Responsibilities Deploy, run, monitor, and support CMP. Provide break-fix assistance for the CMP and general mailbox administration tasks. Provide customer training materials for the CMP. Obtain the Secure Sockets Layer (SSL) certificate required for the CMP. Limits The CMP is intended for service desk and IT professionals, not general users. The CMP currently allows the administration of up to 10 accounts at a time. Bulk updates to mailbox permissions are available for delegated administration through remote Windows PowerShell. Exchange Online for Enterprises Service Description (Dedicated Plans) | October 2011 12 Accessing Exchange Online Services Exchange Online supports the following options for user access to Exchange Online: Microsoft Outlook 2010 Microsoft Outlook 2007 with the latest service pack Microsoft Outlook Web App Exchange ActiveSync devices (including Windows Phone and Windows Mobile devices, Nokia E and N series devices, Palm devices, Apple iPhone and iPad, and certain Android phones) BlackBerry devices Microsoft Outlook for Mac 2011 Microsoft Entourage® 2008 for Mac, Web Services Edition POP3 and IMAP4 protocols Applications developed with Exchange Web Services SMTP submission and relay Exchange Online enables these access options by default. Customer Responsibility Using remote Windows PowerShell, configure the user or set of users that have access to common service access protocols such as Outlook Web App, Exchange ActiveSync, and Outlook Anywhere. The following sections describe the advantages and limitations of each access method. Office Outlook Microsoft recommends using the latest version of Outlook to access Exchange Online. Using Outlook in Cached Exchange Mode is recommended because it provides offline access and helps to provide a responsive user experience even when network conditions between the client and the server are not ideal. Customer Responsibility Procure, deploy, manage, and support client software and compatible devices to access Exchange Online. Limits Customers must use Outlook 2010 or Office Outlook 2007—with the latest service pack installed—to access Exchange Online. Outlook 2003 is not supported for use with Exchange Online. Outlook Anywhere With the Outlook Anywhere feature of Outlook, users can connect to an Exchange Online mailbox through the Internet using remote procedure call (RPC) over HTTP. The feature gives users a reliable, efficient way to connect to their mailbox remotely when working outside their organization's firewall. Customer Responsibilities Provide configuration instructions to users. Enable the Outlook Anywhere setting within Outlook, if necessary. Limits Outlook Anywhere requires Windows Vista or a later Windows operating system. Exchange Online for Enterprises Service Description (Dedicated Plans) | October 2011 13 Autodiscover Service With the Exchange Autodiscover service, Outlook clients can receive user profile settings directly from Exchange Online when client domain credentials are submitted. These settings automatically update the client with the information necessary to create and maintain the user's profile. An SSL certificate is required in conjunction with the Autodiscover service. This SSL certificate is limited to a single primary SSL domain. Users who are associated with other primary or secondary domains that are not included in the certificate experience receive a one-time prompt in Outlook for their credentials the first time they connect to the service. The users can then select the option to not receive further prompts. An Office Outlook 2007 hotfix (KB 956528) is available that allows users to avoid this prompt altogether. Customer Responsibilities Provide written proof of ownership of the requested primary SSL domain through the Office 365 deployment discovery process and associated documentation. Provide a single primary SSL domain for inclusion in certificate requests for the Autodiscover service. Provide the published Office Outlook 2007 hotfix to all client computers, or implement Domain Name System (DNS) and service connection point (SCP) configuration updates to allow the credential prompting scenario to be avoided. Create a DNS record for mobility-related URLs. Microsoft Responsibilities Request an SSL certificate that includes the primary customer domain. Install SSL certificates. Limits Requires Outlook 2010 or Office Outlook 2007. Customer must provide written proof of ownership before Microsoft can request the certificate for the primary SSL domain. Outlook Web App With Microsoft Outlook Web App users can access email, calendar, and contacts from a web browser such as Windows Internet Explorer®. The Outlook Web App client provides Exchange Online users with a rich messaging client experience similar to that of Outlook users. The Outlook Web App Premium client provides features that are not available in the Outlook Web App Light client. For more information about the different features available in Outlook Web App Premium and Outlook Web App Light, visit the Outlook Web App Supported Browsers page. Default automatic timeout values for the Outlook Web App sessions are as follows: Outlook Web App Premium client o o Public computer: fifteen (15) minutes Private computer: eight (8) hours Outlook Web App Light client o o Public computer: fifteen (15) minutes Private computer: thirty (30) minutes Exchange Online for Enterprises Service Description (Dedicated Plans) | October 2011 14 Options A global update for the Outlook Web App sign-in page is available to enable customers to include usage guidelines or a disclaimer. Outlook Web App includes an integrated light instant messaging client for Microsoft Lync Online users. Customer Responsibility Provide localized text if a language-specific disclaimer is requested. Microsoft Responsibility Provide a common Outlook Web App URL. Limits The Outlook Web App interface automatically localizes standard content to the language pack preference that is selected in Outlook Web App options. Any disclaimer additions to the Outlook Web App logon page appear only in the language in which the disclaimer was provided. Internet Explorer versions prior to version 7.0 can use only Outlook Web App Light, which has a reduced set of features. Lync Online is required for instant messaging (IM) and presence integration in Outlook Web App. Forms-based authentication (FBA) is required for Outlook Web App. The optional two-factor authentication feature is available for Outlook Web App, which would work in conjunction with FBA. Access to Outlook Web App requires an encrypted SSL connection. Macintosh Clients Exchange Online supports two email clients developed by Microsoft for the Apple Macintosh operating system. Microsoft Outlook for Mac 2011 Microsoft Entourage 2008 for Mac, Web Services Edition Both clients use Exchange Web Services to communicate with Exchange Online. Customer Responsibility Procure, deploy, manage, and support client software and compatible devices. Limit Exchange Web Services message size limit is restricted to 10 MB. Mobile Device Connectivity with Exchange ActiveSync Exchange Online supports the Microsoft Exchange ActiveSync protocol. Exchange ActiveSync provides synchronization of mailbox data between mobile devices and Exchange Online, so users can access their email, calendar, contacts, and tasks on the go. Exchange ActiveSync is supported by a wide range of mobile devices, including Microsoft Windows Phone and Windows Mobile devices, Nokia E and N series devices, Palm devices, Apple iPhone and iPad, and certain Android phones. A complete list of current Exchange ActiveSync licensees is available at the Exchange ActiveSync Licensing site. Some important Exchange ActiveSync features include : Exchange Online for Enterprises Service Description (Dedicated Plans) | October 2011 15 Direct push technology. This technology allows timely message delivery to mobile devices without delay. Remote wipe. With this feature, users can manage the process of remotely erasing lost, stolen, or otherwise compromised mobile devices using the Exchange Control Panel in Outlook Web App or through remote Windows PowerShell. Mobile device security policy. Administrators can enforce security policies on mobile devices that connect to Exchange Online through Exchange ActiveSync. Administrators can customize these policies for specific users and groups within their company, using web-based graphical user interface (GUI) or Remote PowerShell. Exchange Online supports the same ActiveSync policies as Exchange Server 2010 Service Pack 1. Free/busy lookup. Users can view a contact's calendar availability directly from their mobile devices. A free/busy information timeline shows when contacts are available for a call or meeting. Users can look at a contact's contact card and see when that person is available on that day or other days. SMS sync. Exchange ActiveSync provides the ability to send and receive SMS text messages from Outlook and Outlook Web App. Incoming messages sent via Exchange ActiveSync to the user's mobile device can be seen both in the usual SMS message location and in the email inbox. Device allow, block, and quarantine control. This feature provides control over which devices are allowed to connect to Exchange Online via Exchange ActiveSync. With the allow, block, and quarantine feature, administrators can create approved device lists and block specific devices when necessary. Administrators can also set exceptions at the individual level and can quarantine any device not on the block or allow lists for additional evaluation. For a comparison of Exchange ActiveSync features implemented by various mobile clients, visit the Exchange ActiveSync Client Comparison Table at Microsoft TechNet. Customer Responsibilities Procure, deploy, manage, and support client software and compatible devices, including all relationships with wireless carriers. Define the Exchange ActiveSync policy settings and configure in the Exchange Online environment using remote Windows PowerShell. Each policy may contain multiple settings. Define and configure which users are assigned to each Exchange ActiveSync policy through remote Windows PowerShell. Set up and control distribution groups to allow for role-based access permissions for custom Exchange ActiveSync policy configuration. Supply educational material to users to make them aware of the Exchange ActiveSync policies. Choose whether to configure Exchange ActiveSync policy to allow downloading of device .cab files via an email notification sent to the end-user. Educate and train end users and support teams about the email message that is sent to the enduser’s inbox with instructions for downloading the device .cab file. Limits Microsoft does not provide support for user devices. Organizations are responsible for procuring, deploying, managing, and supporting mobile client software and compatible devices, as well as managing relationships with wireless carriers. Microsoft does not provide end-user device support. For Exchange ActiveSync, certain features (such as Direct Push technology, remote wipe, or device security settings) require Windows Mobile 6.1, 6.0, or 5.0 with the Messaging and Security Feature Pack (MSFP) and an active Exchange ActiveSync policy. Exchange Online for Enterprises Service Description (Dedicated Plans) | October 2011 16 POP3 and IMAP4 Exchange Online supports both POP3 and IMAP4 protocols. Internal customer network POP3 and IMAP4 access is enabled by default and requires encryption using SSL. Internet access to these protocols is blocked. Customer Responsibility Manage per-mailbox protocol settings using remote Windows PowerShell. Limits Exchange Online does not support connectivity from external Internet clients. Delegated logon is not supported. For outbound email, the SMTP client must authenticate over an encrypted channel via Transport Security Layer (TLS). SMTP Relay The primary mail protocol that is used by Exchange Server is SMTP. Transport servers use SMTP for routing and delivery. Exchange Online supports two types of SMTP relay services for authorized internal customer applications that require SMTP mail submission: SMTP message submission to users inside the managed environment. Authenticated SMTP message relay to addresses outside the managed environment. Customer Responsibilities Provide IP addresses of authorized source servers. Manage and implement necessary changes in the customer environment to allow mail flow from the customer environment to the Exchange Online environment. Limits IP addresses for authorized source servers are required to allow SMTP relay. Application Connectivity Applications that use messaging protocols such as MAPI, SMTP, POP3, and IMAP4 are allowed to connect to Exchange Online. Exchange Web Services or the Exchange Web Services Managed API is recommended for application development. Customer Responsibilities Test applications to understand how they will interact with the service. Provide support for individual applications, add-ins, and related application compatibility testing. Notify Microsoft of any applications that require connectivity to the Exchange Online environment. Microsoft Responsibility Assist the customer in resolving problems with applications that have a negative impact on the service. Limits Customer-managed applications are not hosted in Microsoft managed data centers. Exchange Online does not provide support for Outlook add-ins. Exchange Online for Enterprises Service Description (Dedicated Plans) | October 2011 17 Exchange Online does not provide guidance for custom application development. Connectivity using web-based Distributed Authoring and Versioning (WebDAV) is not allowed with Exchange Online. Applications that utilize MAPI via Outlook to connect to Exchange Online should use Cached Exchange Mode to minimize performance degradation in the event of network latencies. Applications that use MAPI in Online mode are more prone to network-related issues, and Microsoft does not provide escalation or troubleshooting support for these applications. Exchange Web Services message size is restricted to 10 MB. Exchange Web Services Application Permissions Exchange Online enables Exchange Web Services functionality by granting application permissions to customer accounts. These permissions allow the customer application to access the application mailbox and add content. Exchange Impersonation is one method used to grant application permissions. Customer Responsibility Identify the account that is to be granted impersonation rights. Microsoft Responsibility Grant the provided account impersonation rights. Self-Service Administration Exchange Online provides customer administrators with the capabilities and tools to manage a variety of messaging-related tasks. Exchange Control Panel The Exchange Control Panel (ECP) provides self-service administration capabilities through its Web-based management interface that is accessible from Outlook Web App. The following capabilities are available to IT professionals and can be delegated to end users if desired. Message tracking. Through ECP, end users and IT professionals who have been assigned the appropriate role-based access control (RBAC) permissions can track delivery receipt information, which helps reduce one of the most common help desk calls. End users can track messages they have sent and received, and IT professionals can track all messages that are delivered to the Exchange Server 2010 environment. Multi-Mailbox Search. Compliance and security officials who have been assigned appropriate RBAC permissions can search a variety of mailbox items, including email, attachments, calendar appointments, tasks, and contacts through ECP. For legal discovery purposes, email that is located through search can be copied to another specified mailbox, as defined by the administrator, for further investigation. Rich search capabilities include searching for information in the sender, receiver, message type, sent/receive date, and cc/bcc fields. Search results include items in the Deleted Items folder if they match the search query. Remote device wipe. With this ECP feature, users can manage the process of remotely erasing lost, stolen, or otherwise compromised mobile devices. ActiveSync device management. Using ECP, administrators can carry out a variety of tasks related to Exchange ActiveSync mobile phones and devices. These tasks include: o o Manage the default access level for all mobile phones and devices. Set up email alerts when a mobile phone or device is quarantined. Exchange Online for Enterprises Service Description (Dedicated Plans) | October 2011 18 o o o Personalize the message that users receive when their mobile phone or device is either recognized or quarantined. Provide a list of quarantined mobile phones or devices. Create and manage Exchange ActiveSync device access rules. Mailtips. With this feature, informative messages are displayed to users while they are composing a message. These informative messages, which provide information about the recipient to help avoid non-delivery reports (NDRs), can be configured using ECP. Customer Responsibility Set up and control access to security groups to allow role-based access permissions for ECP access. Microsoft Responsibility Grant role-based access to customer security groups. Limits Multi-Mailbox Search works only with mailboxes in the Exchange Online environment. Multi-Mailbox Search does not search user PST files. The discovery mailbox, where search results are stored, is limited to 50 GB in size. Multi-Mailbox Search cannot search content of messages encrypted using S/MIME or Information Rights Management (IRM). Encrypted messages are returned as failed items, if the user selects the option to include failed items in search results. Message tracking only provides information for message flow within an organization's Exchange Online environment. When messages are delivered to outside mail systems, the message is listed as transmitted, but there is no visibility into its subsequent delivery status. Mailbox Environment Viewing and Reporting Exchange Online makes a mailbox “view-only” user role available to customer administrators. This role is accessed through the remote Windows PowerShell® command-line interface and enables self-service viewing and reporting of the customer’s messaging seats. The view-only role does not allow the administrator to read the contents of messages in mailboxes. User Schedule Availability During the coexistence phase of an Exchange Online deployment, Exchange Online synchronizes data concerning user schedule availability between a single customer source and Exchange Online. This step ensures that users can retrieve schedule availability from both the customer and Exchange Online environments. Customer Responsibility Create an account and grant credentials in the customer’s environment to enable user schedule availability. Documentation about configuration is provided to the customer. Limits Synchronization is allowed from a single forest or IBM Lotus Domino domain. Synchronization requires representation of objects in both the customer and Exchange Online environments. Exchange Online for Enterprises Service Description (Dedicated Plans) | October 2011 19 The minimum synchronization frequency between the customer and Exchange Online environment is every 15 minutes. Synchronization is supported for Exchange Server, Lotus Notes, and Lotus Domino. Exchange Server customer environments must provide user schedule availability data on computers running Exchange Server 2007. Message Transport Limit Message transport size limits are necessary to avoid having large messages block delivery of other messages and affecting service performance for all users. These limits are applied organizational-wide and cannot be configured on per user basis. Email sent from the Exchange Online environment to recipients inside or outside the customer’s intranet can have a total message size of up to 50 MB (including attachments). Address Book View Customization Exchange Online provides the ability to configure customized views of the Outlook Address Book. Customer Responsibility Submit requested changes to Address Book views using the change request process. Microsoft Responsibility Implement requested customer changes to Address Book views. Limits Customization of the Outlook Details Template is not permitted. Customers are limited to the Exchange custom attributes when adding Address Book fields. Transport Rule Configuration Exchange Online provides the ability to manage transport rules using remote Windows PowerShell capabilities. Available commands are provided upon request. Limits Transport rules cannot be deleted due to restrictions in place with the RBAC role. Rules can be disabled. Disclaimer Support Customers may be required by law or other regulatory requirements to provide disclaimers within email between recipients and senders, both inside and outside the organization. Exchange Online provides disclaimers to meet these compliance requirements. Default Settings Global disclaimers can be applied to all messages sent to the Exchange Online environment. Global disclaimers can be applied to all messages sent from the Exchange Online environment. Scenario-specific disclaimers that are defined in customer requirements can be applied separately from global disclaimers. Scenario-specific disclaimers are scoped based on distribution group membership. Exchange Online for Enterprises Service Description (Dedicated Plans) | October 2011 20 Disclaimer text uses default font, size, and color settings of Exchange Server. Disclaimers are appended below the entire message thread for all outgoing messages. Disclaimers include a line separator between the message content and the disclaimer. If the disclaimer cannot be added in the original message—as with encrypted messages—a new message is created with the disclaimer, and the original message is attached to the new message. Customers can change some of the default settings for disclaimers using the Microsoft Office 365 change request process. Customer Responsibilities Define requirements regarding disclaimers, including any scenario-specific requirements, if applicable. Define and manage distribution groups for scenario-specific disclaimers. Define and configure disclaimer content, including text in all desired languages, for all applicable distribution groups. Set up and control access to security groups to allow role-based access. Microsoft Responsibility Configure and implement customer-provided disclaimers as part of the initial Exchange Online deployment. Grant role-based access to customer security groups. Limits Configuration of up to thirty (30) customer-provided disclaimers is allowed for initial deployment. Font type, color, and size apply only in HTML and rich-text messages. Plain-text messages have disclaimers that also appear in plain text. Exchange Online does not support the following in disclaimers: o o o Text greater than 1,000 characters Active Directory–related queries other than distribution group inclusion Images (including logos) Exchange Online does not provide language translation services for disclaimers. Disclaimers are not programmatically localized. Users do not see disclaimers in the messages in the Sent Items folder, because the disclaimers are appended by the server after messages are sent by the users. If a user is a member of multiple distribution groups that are used for specific disclaimer scenarios, the user’s outgoing messages display multiple disclaimers. Records Management Exchange Online supports the use of the messaging records management (MRM) features in Exchange Server to help organizations reduce the liabilities that are associated with email and other communications. MRM makes it easier to keep messages that are needed for compliance with company policy, government regulations, or other needs—and to remove content that has no business value. This is accomplished through the use of retention policies and tags. Retention policies and retention tags are part of the MRM technology. Retention policies use retention tags to apply retention settings to e-mail messages and folders. Retention tags define an age limit that specifies how long items are retained, and a retention action that specifies what happens to items that Exchange Online for Enterprises Service Description (Dedicated Plans) | October 2011 21 reach the retention age limit. Retention tags are linked to a retention policy, which is then applied to a mailbox. All MRM tasks are managed directly by the customer by using remote Windows PowerShell. Details are described in the Self-Service document, which is made available to customers during an Office 365 deployment. Customer Responsibilities Create and manage retention polices. Create and manage retention tags. Link retention tags to retention policies. Assign mailboxes to retention policies. Set up and control access to security groups to allow role-based access permissions for selfservice features. Validation and testing of all policies to be implemented Recovery of any data deleted by an incorrect policy Microsoft Responsibilities Grant role-based access to customer security groups. Limits Conversion of MRM managed folders to retention policy tags is not supported. Office 365 does not provide restoration of items deleted as a result of retention policies. Multiple Language Support Exchange Server provides multiple language packs that provide a localized experience in Outlook Web App and Office Outlook for Exchange Online users. The availability of languages may differ between Outlook Web App and Outlook. For the current list of languages, see Client Language Support for Outlook and Client Languages for Outlook Web App at Microsoft TechNet. Customer Responsibility Deploy language packs to users. Microsoft Responsibility Install available server-side language packs. Limit Microsoft customer support is available in the English language only. Antivirus Support All messages that are transported through Exchange Online are scanned for viruses. If a virus is detected, the virus is deleted and the message is then delivered to the recipient. A notification of the virus detection is sent to the sender and/or recipient of the message. Limit Notifications are sent only to Exchange Online senders who are sending mail within the Exchange Online environment. Exchange Online for Enterprises Service Description (Dedicated Plans) | October 2011 22 Blocked File Types Particular types of email attachments from non-trusted sources are blocked from entry into the Exchange Online environment. Customers can extend the list of blocked attachment file types through the Office 365 change request process. Secure Messaging and Encryption Exchange Online supports a variety of messaging security solutions. These solutions can be integrated with existing customer solutions for encryption and security. S/MIME Certificate Support Secure/Multipurpose Internet Mail Extensions (S/MIME) is a standard for public key encryption and signing of email that is encapsulated in MIME. Exchange Online provides support for S/MIME certificates by synchronizing certificate information from the customer environment to the Exchange Online environment as part of Active Directory synchronization. Customer Responsibility Provide support and infrastructure for S/MIME to allow item-level security. Limits Exchange Online does not provide antivirus or other content management services (such as including the message body text of an S/MIME message in multi-mailbox searches) for encrypted messages. S/MIME in Outlook Web App is not supported. Information Rights Management Support Exchange Online supports transfer of email and attachments that are protected with customer-owned Active Directory Rights Management Services (AD RMS) systems. For more information about this feature, see the Information Rights Management Integration section of this document. Customer Responsibility Manage the AD RMS infrastructure and client integration. Message Encryption Exchange Online provides SSL or TLS encryption for all Outlook Web App, Exchange ActiveSync, Outlook Anywhere, IMAP4, and POP3 connections. Deleted Item Retention Exchange Online provides deleted item retention, which allows users to restore items from any folder, including the Deleted Items folder. Users can perform this recovery themselves using Outlook Web App or Outlook, eliminating the need for a mailbox restore. Limit The deleted item retention period is 30 days and is not configurable by the customer Exchange Online for Enterprises Service Description (Dedicated Plans) | October 2011 23 Deleted Mailbox Retention Exchange Online retains mailboxes for a period of time after they have been deleted. Deleted mailboxes can be recovered by placing a service request with Microsoft or, under certain circumstances, automatically through the directory synchronization process. Changes to the default mailbox retention period can be requested through the Office 365 change request process. Limit The deleted mailbox retention period is 30 days. After that time, deleted mailboxes cannot be recovered. Mailbox Data Protection and Recovery Continuous replication of mailbox data to multiple servers provides data recovery capability in the event of a local messaging infrastructure failure. For large-scale failures, established service continuity management processes are initiated. Limit Data restoration limits are defined in the Deleted Item Retention and Deleted Mailbox Retention sections of this document. Service Continuity Management Exchange Online is hosted in enterprise-level Microsoft data centers that are designed to deliver highly available, highly resilient online services. Because of this design, Exchange Online is available at 99.9percent uptime. However, service availability can be affected by hardware failures, natural disasters, and human error. To address this possibility, Exchange Online offers service continuity management, a process for managing risks to ensure that the Office 365 IT infrastructure is capable of providing continuing services if normal availability solutions fail. Service continuity management for Exchange Online includes provisions to recover from such unexpected events. Two metrics commonly used in service continuity management to evaluate disaster recovery solutions are: Recovery point objective (RPO). The acceptable amount of data loss at the conclusion of the data recovery process. Recovery time objective (RTO). The acceptable amount of time the service can be down before being brought back online. Exchange Online dedicated plans have set the following RPO and RTO in the event of a disaster: 45-minutes RPO: In the event of a failover to a secondary data center, Exchange Online restores a copy of customer data that is equal to or less than forty-five (45) minutes old at the time of service disruption. Two-hour RTO: Customer services will resume within two (2) hours after disaster declaration is made to failover from the primary to secondary data center. Standard services restored with service continuity management are core mail (Exchange Online mailboxes), client access services (Outlook Web App, Windows Mobile), transport, and delegated administrative controls through ECP and remote Windows PowerShell. Optional services included are BlackBerry Enterprise Server and archiving. Exchange Online for Enterprises Service Description (Dedicated Plans) | October 2011 24 Customer Responsibilities Update internal and Internet DNS records and other name records that point to Exchange Online resources, such as mail gateways and mobile messaging URLs. Update targets and costs of the mail routing connectors. (Note that connectors may be preprovisioned during the initial deployment.) Update network firewall ACLs. (Note that ACLs may be pre-provisioned during the initial deployment.) Create an archiving validation account (documentation about configuration requirements will be provided to the customer). Provide logon and password for the archiving account to the Exchange Online team. Be available to work with the Exchange Online team in the event of a declared disaster. Ensure network connectivity to a secondary site. Microsoft Responsibilities Microsoft enables the service continuity management process to restore access to core services and data within the stated RPO and RTO. Testing for mailbox failover only is offered once annually with 180 days prior written notice from the customer. Limits To restore service, customer client access may require some reconfiguration. All onboarding activities are excluded from service continuity management. Some services and processes are not functional at RPO/RTO, including mailbox migration, crossforest free/busy, and the Customer Mailbox Permissions Management Tool. Usage and Performance Metrics Microsoft Office 365 provides a set of availability and support service-level agreements (SLAs) that measure those aspects of its services that it directly controls. However, Microsoft is responsible for and can control only a portion of the elements that combine to provide the total experience for Office 365 users. For example, Microsoft provides services from a global network of Microsoft data centers. It is not responsible for the network connections to the data centers, the customer’s wide area network (WAN), and the customer's local area networks (LANs). In addition, it does not control the user device and its configuration. All of these factors have significant effects on the user experience. To help customers monitor areas that are not directly under Microsoft control, Microsoft reports on a set of service usage metrics and key performance indicator (KPIs). Usage metrics provide customers with information about service usage patterns and activities. KPIs provide information that Microsoft uses as part of its continuous service improvement. The information may also be of use to customers in evaluating aspects of service for which they are responsible. Microsoft measures and reports the same KPIs for all customers. Usage Metrics The following usage metrics are reported monthly to Exchange Online customers: Number of mailboxes by type. User detail report that lists every mailbox, along with its display name, email address, optional services enabled for the user, mailbox size, current mailbox capacity, and last logon information. Average mailbox size. Exchange Online for Enterprises Service Description (Dedicated Plans) | October 2011 25 Email summary report that includes email traffic count and email traffic volume (applicable only to customers using message filtering). Key Performance Indicators The following performance metrics are available to Exchange Online customers: Exchange Availability (client). Measures the total percentage of successful RPC client/server operations completed between Outlook and Exchange Online during the month. Client Performance. Measures the percentage of successful RPC client/server operations between Outlook and Exchange Online that complete in two seconds or less. Mailflow Latency. Measures the percentage of local and remote mailflow transactions that are received within 20 seconds from one Exchange site to all other Exchange sites during the month. SMTP Total Messages Received. Measures the total number of messages received by the Exchange Online environment inbound from the Internet during the month. This number does not include messages filtered by other message filtering services prior to entering the Exchange Online environment. Messaging Service Availability. Measures the percentage of uptime that the Exchange Online service was accessible to end users during the month. Average Mailbox Size (MB). Measures the average size of mailboxes (in MB) for the customer as of the last day of the month. Number of SLA Impacting Outages. Provides the total number of service outages per month that impacted the Service Level Agreement (SLA). Microsoft Forefront Scan: Total Messages Purged. Measures the total number of messages purged from the Exchange Online environment during the month from antivirus scanning. Two Factor Authentication Server Availability. Percentage of successful two-factor authentications during the month. Support for WAN Acceleration Devices Office 365 for enterprises does not provide support for the use of WAN acceleration and caching devices with Exchange Online. However, Microsoft will not prevent customers from attempting to use such devices to accelerate applications, optimize bandwidth, and reduce latency. Limits Customers that deploy WAN acceleration devices must disable these devices when a support incident arises that suggests network connectivity may be the root cause. Microsoft will need such devices disabled to determine if the support incident is reproducible without the device. Support incidents that are related to the use of WAN acceleration devices will not count towards the service availability level set forth in the Exchange Online service level agreement (SLA). Exchange Online for Enterprises Service Description (Dedicated Plans) | October 2011 26 Optional Service Features The following sections describe optional features that are available with the Exchange Online service. Message Filtering The message filtering service offered by Exchange Online provides Internet email filtering through Microsoft Forefront™ Online Protection for Exchange (FOPE). This filtering solution provides enterpriseclass reliability for messaging security and management, and protects against spam and malware. By default, the antivirus features available in FOPE are not enabled. The customer can enable these features using the FOPE Administration Center. Exchange Online message filtering includes these features: Internet traffic filtering. Inbound Internet email traffic is routed through FOPE, where each message is evaluated against predefined rules. Outbound Internet email traffic routing through FOPE is an optional service configuration that is not subject to spam filtering rules. Encryption. TLS encrypts SMTP traffic in three ways: o o o Opportunistic inbound Opportunistic outbound Required outbound (optional) Safelist aggregation and recipient lookup. These two features function when Exchange Online is authoritative. Exchange Online becomes authoritative when all customer mailboxes have been migrated to the Exchange Online environment. Message quarantine. Spam filtering uses a quarantine for messages marked as spam. User notification email messages provide access to quarantined email messages. User access to the spam quarantine can also be enabled through the FOPE Administration Center. Filtering management and reporting. The FOPE Administration Center provides the customer with the ability to configure policy rules and access reports on key performance indicators of the message filtering service. Administration Center web console. Two accounts are provided for access to the FOPE Administration Center: the administrator account and quarantine account. The quarantine account can only be used to release messages from the spam quarantine. The administrator account has full access to make changes within the Administration Center. Changes made without proper training could result in significant negative impact to message transport for the entire environment. Table 4 lists Exchange Online messaging filtering features, and shows which can be customized. Table 4. Message Filtering Filtering Level Forefront Online Protection for Exchange Feature Connection filtering Description Customizable Limits Change Type DNS-based policy block list; connections are blocked. No Changes are not allowed. N/A Static list of IP addresses; connections are blocked. No Changes are not allowed. N/A Exchange Online for Enterprises Service Description (Dedicated Plans) | October 2011 27 Filtering Level Feature Description Customizable Limits Change Type Forefront Online Protection for Exchange Content filtering Proprietary content that filters email by assigning spam scores to each message. No non-delivery reports (NDRs) are delivered. No Changes are not allowed. N/A Forefront Online Protection for Exchange Recipient lookup Validates recipients in Active Directory. No Changes are not allowed. N/A Policy Level Allow list Customerprovided list of IP addresses or email addresses. Yes Additions and removals are allowed. Self-administer through the Administration Center. Policy Level Block list Customerprovided list of IP addresses, domains, or email addresses. Yes Additions and removals are allowed. Self-administer through the Administration Center. Policy Level Header Email is filtered based on values from the header. No Not offered. N/A Policy Level Message body Filtering is based on content of the message body. Yes Provided at the customer’s request. Self-administer through the Administration Center. Policy Level Subject line Filtering is based on content of the subject line. Yes Provided at the customer’s request. Self-administer through the Administration Center. Policy Level Recipient filtering Static list of email addresses that will be blocked from receiving messages, for example: (someone@organi zation.com). Yes Additions and removals are allowed. Self-administer through the Administration Center. Policy Level Sender filtering List of sender email addresses that should be allowed or rejected. Yes Additions and removals are allowed. Self-administer through the Administration Center. Exchange Online for Enterprises Service Description (Dedicated Plans) | October 2011 28 Filtering Level Feature Description Yes None Outlook Safe Sender List A per-user Allow list that permits email from individual senders to reach specific recipients by bypassing message filtering. User manages change locally through Office Outlook. The user’s spam quarantine is accessible via periodic email notification to the user. Messages stay in this quarantine for 15 days. No Changes are not allowed. N/A User Level User Level User spam quarantine Customizable Limits Change Type Customer Responsibilities Provide a list of IP email addresses to be blocked, allowed, or both via policy for initial configuration by Exchange Online. Provide a list of policy items for subject line or message body filtering, including sensitive words to be filtered for initial configuration by Exchange Online. Specify how often (in number of days) users should be notified of messages in quarantine for initial configuration by Exchange Online. Control timing and deployment of Mail Exchange (MX) record changes. Manage changes to policy settings after deployment through the FOPE Administration Center web console. Microsoft Responsibilities Determine whether the customer will use filtering services for both inbound and outbound email, and configure Forefront Online Security for Exchange to support it. Configure and run the Directory Synchronization Tool for domains that are managed by Exchange Online. Provide customer with administrative accounts to the FOPE Administration Center web console. Message Journaling Exchange Online provides the ability to journal email to a mailbox hosted by a third-party archive provide or by the customer. Customer Responsibility Create in the customer directory a contact object for the SMTP target email address to be used for journaling. Maintain proper management, redundancy, availability, performance, and functionality levels of the SMTP target to ensure successful mail acceptance at all times. Exchange Online for Enterprises Service Description (Dedicated Plans) | October 2011 29 Provide respective interoperability with Exchange Server and Exchange transport including message formats, sender/recipient information integration, and appropriate content conversion. Microsoft Responsibilities Send messages to the target location. Limits The journaling approach must be able to utilize existing network infrastructure between Office 365 and the customer environment. The outbound journal function must not prevent or put further dependencies on software upgrades in the Office 365 environment. Standard Exchange Server journaling functions are provided for selected recipients. Recipients must be members of a customer-managed distribution group to be journaled to the SMTP target of the customer’s choice. No other integration methods will be provided. Litigation Hold Exchange Online provides customers with the ability to leverage the Exchange 2010 litigation hold feature. . Litigation hold--sometimes referred to as legal hold—is commonly used in scenarios where a reasonable expectation of litigation exists and customers are required to preserve electronically stored information—including email—that is relevant to the case. Litigation hold is applied by the customer to specific mailboxes in their organization. When a user mailbox is placed on litigation hold, copies of deleted or edited email items are captured and retained in a litigation hold store for discovery and/or recovery. Items captured under litigation hold cannot be altered by the customer. Litigation hold also includes these capabilities: A customized notification banner can be created to alert users that they are under litigation hold (requires Outlook 2010). Self-service administration enables a customer administrator to add and remove users from litigation hold. Scheduled reports sent directly to a distribution group established by the customer which includes the total number of mailboxes on litigation hold, a listing of all mailboxes on litigation hold, the current size of the mailbox and the date the mailbox was configured for litigation hold. Customer Responsibility Add and remove users from litigation hold using self-service Remote PowerShell or ECP features Customize notification banner to alert users that they are under litigation hold (optional) Create and provide a distribution group to Exchange Online for use with Litigation Hold reporting Microsoft Responsibilities Configure roles for the self-service functionality Configure reporting per customer Limits Each customer is allowed a maximum of fifteen (15) percent of all mailboxes to be on litigation hold at one time. This maximum is programmatically enforced and the customer will be unable to add new users to litigation hold once the maximum is reached. Exchange Online for Enterprises Service Description (Dedicated Plans) | October 2011 30 An Exchange Online Plan 2D subscription is required for each mailbox that is placed on litigation hold. To view the customized notification banner users must be on Outlook 2010. Information Rights Management Integration Information Rights Management (IRM) allows an organization and its users to prevent information leakage by giving them the ability to control the rights that recipients are allowed to have on email messages and attachments. By utilizing Active Directory Rights Management Services (AD RMS), a customer can implement IRM to allow or restrict recipient actions such as forwarding a message to other recipients, printing a message or attachment, or extracting message or attachment content by copying and pasting. Exchange Online supports the following scenarios with customer on-premise AD RMS systems: Create IRM-protected email messages with restricted permissions using Outlook 2010. Create IRM-protected email messages with attachments using Outlook 2010. Send email messages with IRM-protected attachments using Outlook 2010 or Outlook Web App. View IRM-protected email messages and attachments using Outlook 2010. Note Because the Exchange Online service cannot view or modify any IRM-protected content, some features, including security features, may not be available for IRM-protected content (for example, virus and malware protection, search indexing, mobile access to IRM-protect content, and transport rules). Exchange Online offers customers the ability to integrate their on-premises AD RMS systems with an optional Exchange Online AD RMS service. By sharing the customer Trusted Public Domain (TPD) keys with the Exchange Online AD RMS system, the customer AD RMS systems can take advantage of Exchange 2010 Information Rights Management features. See the Identity and Provisioning Service Description for additional details on AD RMS solution for Office 365. For customers that share TPD keys the following additional features are supported: Search IRM-protected messages with multi-mailbox search. Use transport protection rules to IRM-protect messages by applying an AD RMS rights policy template to emails in transit. Use journal report decryption to save a clear-text copy of IRM-protected messages in journal reports, along with the original, IRM-protected message, so that records managers can inspect or search encrypted content. Transport decryption. For customers that no longer require an on-premises Exchange environment, the following additional features are supported: View IRM-protected email messages and attachments using Outlook Web App. Create IRM-protected messages with restricted permission using Outlook Web App. Search IRM-protected messages using Outlook Web App. View IRM-protect email messages using Windows Mobile 6.x or Windows Phone 7.x via Exchange ActiveSync. Limitations Not all features are supported in coexistence scenarios. Coexistence scenarios are specific to Exchange environments. Exchange Online for Enterprises Service Description (Dedicated Plans) | October 2011 31 Customers can set up and manage AD RMS on-premises without sharing TPD keys; however, there are limitations for this configuration. Customer Responsibility Manage AD RMS infrastructure and client integration. To take advantage of all features, the customer must annually share TPD keys with the Exchange Online service. Message Archiving For customers with advanced compliance requirements, Exchange Online provides a FISMA-accredited archiving service operated by Proofpoint. This add-on service automatically captures internal and external communications that flow through Exchange Online and then stores them in an encrypted form at a separate archiving data center operated by Proofpoint. With the Proofpoint service, messages are captured and preserved before they arrive in the inbox. Only mailboxes that are enrolled in archiving will have their data available from the archiving data center. The Proofpoint archiving service provides the ability for individual users and authorized administrators to access the archived messages. The customer creates and maintains configuration options for its archiving policies, and grants control over who can access the archive. The customer has the ability to own and maintain a distribution group of all mailboxes that are intended for archiving. Default Features When message archiving is chosen, the following features are standard and enabled by default: Administrative search. The archive administrator can run either a basic or advanced search on archived messages. Email is searchable by a customer-defined set of users. Flexible policy engine. The customer can create and update retention policies at its discretion. Each retention policy can be configured to consider criteria such as the parties involved and keywords or phrases in the content or file types attached. As each message is archived, it is evaluated against the active set of retention policies. Encryption. Email is protected through encryption when in transit and at rest in the archive. All mail or search parameters that are sent to the archive are encrypted, and results back from the archive are unencrypted when they return to Exchange Online. Export. Users who are authorized to export and have access to the archive are able to export messages to a .PST file. Online storage. Multiple copies of messages are stored online at all times for redundancy purposes. Historical user tracking. The administrator can search the archive for all users, including users who may have been deleted from the directory. Active legal hold system. With rule-based capture and management of retention hold, the archive administrator can define preservation orders, and the system can capture mail automatically based on the definition of the hold. This feature also allows delegation of access to a specific legal hold rather than to the entire archive. Customer Responsibilities Set up and maintain access permissions and perform archive administrative tasks, including search and export. Exchange Online for Enterprises Service Description (Dedicated Plans) | October 2011 32 Set up and maintain group membership for user access to archive search and export. Any significant changes in the volume of users who access the archive need to be communicated to the Exchange Online team. Set up and maintain retention policies. Maintain a DNS entry that points to the archiving web user interface. Store encryption key offsite. Limits Archiving scope is limited to the data sent and received by Exchange Online mailboxes. Archive access is not available on the Internet. Optional Features Legacy archiving import. This feature adds the ability to migrate from various legacy archiving systems. Maintaining a single archiving system helps the customer eliminate the extra time and cost of maintaining a separate legacy system. Supervision. Users can be put under "supervision," where automatic workflows require that a certain percentage of the mail of those users be reviewed. End-user access. This feature enables users to search the archive. Outbound Desktop Fax Users can send faxes via Office Outlook. Faxes are sent to a third-party carrier for transmission via a secure Internet connection. Customer Responsibility Provide and deploy customer-specific templates for outbound faxes. Limits Exchange Online outbound faxes are available only with Microsoft Office applications. Exchange Online outbound faxes do not integrate with Outlook Web App. Outbound faxes are available only with 32-bit client computers, due to current application constraints. Inbound/Outbound Fax Integration Exchange Online can integrate with the customer’s existing fax solution, for solutions that allows fax routing via SMTP. Customer Responsibility Configure the existing fax service for integration with Exchange Online. Configure Outlook clients to allow for sending of faxes. Microsoft Responsibility Provide SMTP transport. Two-Factor Authentication for Outlook Web App Typical authentication practices that require only a password to access resources may not provide the appropriate level of protection for information that is particularly sensitive or vulnerable. Two-factor Exchange Online for Enterprises Service Description (Dedicated Plans) | October 2011 33 authentication is an authentication method that applies a stronger means of identifying the user. It requires users to submit two of the following three types of identify proofs: Something known (such as a password) Something possessed (such as a smart card) Something unique about the user's appearance or person (such as a fingerprint) For an additional fee, Office 365 customers that subscribe to Exchange Online can use existing Swivel PINSafe or RSA SecurID two-factor authentication methods that they have implemented to authenticate to messaging resources that are exposed with Outlook Web App. The customer's Outlook Web App users can access Office 365 resources via two-factor authentication whenever they connect from outside of the corporate network. Users are not required to use two-factor authentication when within their corporate network. How It Works Two-factor authentication to Outlook Web App is administered through a dedicated HTTPS URL namespace. This namespace is separate from URL namespaces that are reserved for services that do not require two-factor authentication, such as Exchange Web Services and remote procedure call (RPC) over HTTP. When an Outlook Web App user accesses resources that are protected by two-factor authentication, the user is presented with the two-factor authentication challenge in addition to the standard username and password combination that is typically used to access the resource. The corporate network connection does still require the users to log on via Outlook Web App forms-based authentication, but only using standard domain credentials, not two-factor authentication. To use two-factor authentication within the Office 365 environment, the customer must provide the Swivel or RSA back-end infrastructure within its environment. Microsoft implements the components that pass the authentication requests to this back-end infrastructure. Microsoft Responsibility Provide dedicated HTTPS URL namespace for two-factor authentication. Customer Responsibilities Provide the Swivel or RSA back-end infrastructure within its environment. Provide SSL certificate to the URL that is used for two-factor authentication. Limit Two-factor authentication is provided for Outlook Web App only. Exchange Online supports Swivel version 3.4 and RSA version 7.1 Sp2. Mailbox Data Migration Exchange Online can provide a mailbox data migration service for transferring mailbox data from the customer's site to the Office 365 environment. The migration process is conducted with minimal end-user interaction, and is completed on a schedule that is jointly determined by the customer and Microsoft. This process involves the automatic migration of mailbox data from the customer email server to the Exchange Online email server. Customers have the option of choosing one migration method, or a combination of methods, to fit their requirements. Exchange Online supports mailbox data migrations when the customer’s current messaging implementation is one of the following: Exchange Online for Enterprises Service Description (Dedicated Plans) | October 2011 34 Exchange Server 2007 SP 2 or higher Lotus Domino (version 6.5.5) Customer Responsibilities Must have Outlook installed with the appropriate profile to connect systems between the customer environment and the Microsoft data center and to ensure proper message routing and directory synchronization. Distribute the client software to the end-user desktops, ensure that profile changes are made to the users’ desktops, and coordinate all desktop interdependencies. Provide network speed estimates between all customer sites and the Microsoft data center. If migrating from the Lotus Domino environment, the customer should speak with the Microsoft representative about readiness activities, partner services, or additional consultation that may be required for data migration. Microsoft Responsibilities Create new mailboxes in the appropriate Microsoft data centers, update entries on both the customer and Microsoft directories, and delete old mailboxes on the legacy customer system. Work with the customer to build a migration schedule that is optimized to reach the maximum number of mailboxes for each set of mailbox migrations. Build into the migration schedule those factors that have significant impact on the migration schedule―including mailbox size and network capacity―with the understanding that mailbox size reduction may be necessary to reach maximum migration velocity. Limits Outlook cached mode is recommended, and Outlook 2010 or Office Outlook 2007 with the latest service pack is recommended. Migrated data cannot exceed 85 percent of target mailbox. Migrated data volume has a direct relation to migration velocity. To achieve maximum migration velocity, mailbox size reduction may be required. Average mailbox size for all mailbox migrations is recommended to be in the range of 200-400 MB. Mailbox migration fees vary with the size of migrated mailboxes. The Exchange Online onboarding timeline increases significantly when customers select the mailbox data migration option. Recurring meetings are migrated to the new mailbox but often cannot be edited after migration. Meeting organizers should expect to send out new recurring meetings and instruct attendees to manually delete the old series. User Communications The Exchange Online deployment team can provide customers with service-related training guides and user communication templates. The guides and templates outline the steps required to complete the migration successfully, and provide other helpful information for the user. Customer Responsibility Customize the communication templates that are provided by Exchange Online teams. Microsoft Responsibilities Provide communication templates and user training guides. Work with the customer to create a communication strategy for the mailbox data migrations. Exchange Online for Enterprises Service Description (Dedicated Plans) | October 2011 35 BlackBerry Device Connectivity The BlackBerry Enterprise Server (BES) for Exchange Online is used to synchronize email, calendar, contacts, and tasks with BlackBerry devices. BES is available at an extra charge. Due to the requirement of co-locating the BES with Exchange Server, the Exchange Online service deploys, hosts, and supports BES in a Microsoft data center. Customer Responsibilities Procure, deploy, manage, and support client software and devices compatible with the latest version of BES software, and manage relationships with wireless carriers. Procure and maintain an up-to-date BlackBerry client access license, server license, and support agreement directly with Research In Motion (RIM) for each server being hosted. Obtain the necessary consent directly from RIM to allow Microsoft to operate all licenses on the customer’s behalf. Maintain at least two Office 365 team members as named callers on the customer’s RIM support agreement. Provide Microsoft with BES IT policy settings for initial setup. Microsoft Responsibilities Determine the number of BES servers required to support customer BlackBerry devices, and provide the customer with this information for licensing procurement. Deploy and maintain BES to provide service for BlackBerry devices. Provide at least two Office 365 team member names, phone numbers, and email addresses to the customer for the RIM support agreement. Limits Microsoft does not provide support for BlackBerry devices or handheld applications. There is a one-to-one relationship of BlackBerry devices to mailboxes. BlackBerry devices will require device security wipe and reactivation during the migration process. Blackberry Enterprise Server Express is not supported. Third-party tools or services that interface directly with or must be installed on the BES servers are not supported or allowed. Microsoft Lync® 2010 clients for BlackBerry devices are supported only for BlackBerry users with Exchange Online and Lync Online integration; support is not currently provided for Lync onpremise. Microsoft Office Communicator® clients for BlackBerry devices are not currently supported. BES service availability is not included in the Exchange Online for Enterprises Service Level Agreement for Messaging Service Availability. BlackBerry Mobile Data System Connection Service Mobile Data System Connection Service (MDS-CS) is an optional feature with BES that allows BlackBerry devices to access Internet and intranet resources via HTTP(S). The feature requires enablement and configuration on the managed BES servers, where all requests will be pushed to a single customer-hosted proxy server that can be configured to have access to both corporate intranet resources and Internet resources. Customer Responsibilities Procure, deploy, manage, and support client software and compatible devices. Manage relationship(s) with wireless carriers. Exchange Online for Enterprises Service Description (Dedicated Plans) | October 2011 36 Provide customer-hosted proxy server details to Exchange Online for configuration. Microsoft Responsibility Provide HTTP(S) browsing connectivity from the Exchange Online BES system to the customer proxy server. Limits Microsoft does not manage monitoring, logging, filtering, or security for customer-hosted proxy servers. Microsoft supports configuration for a single customer-hosted proxy server. Access to customer SharePoint and other intranet sites is available only when a customerprovided proxy server has been configured appropriately for Office 365. Management and Reporting of BlackBerry Enterprise Server The BlackBerry Administration Service (BAS) web application is provided to customers who select the BES offering. This application offers customers vital information and management capabilities. The information exposed through the BAS web application gives customers a view into BlackBerry service status and issues, and provides a collection of reports about BES user and device data. The management capabilities enable customers to perform common user administration tasks—without a need for Microsoft involvement—and apply changes directly to the BES environment in real time. When using the web application, customers are given three accounts: BES Admin, BES Senior Helpdesk, and BES Helpdesk. The customer manages who in their organization will have access to each account. The BES Admin role provides comprehensive access to functions within the web application, including the following IT policy management. Client application push functionality, which allows customers to create software configuration and assign an application to a user or group. User management functions for group and IT policy assignments. User data log access for PIN, SMS, and phone call logs through a change request. The BES Admin role may perform functions such as adding and deleting BES users, adding new users to BES policies, and exporting BES user information. Reporting about BES user details is provided on a monthly basis. The BES Senior Helpdesk role provides a subset of the BES Admin role features for use by support technicians who need to add and remove BES users or troubleshoot BlackBerry issues—including setting activation and handheld passwords. The BES Helpdesk role provides a subset of the BES Senior Helpdesk role features for use by frontline support technicians who need to troubleshoot BlackBerry issues, including setting activation and handheld passwords. Customer Responsibilities Manage who should be granted access to the BES Admin, BES Senior Helpdesk, and BES Helpdesk accounts. Distribute MSO BES Admin, MSO BES Senior Helpdesk, and MSO BES Helpdesk accounts to internal users. Request additional BAS Web Application accounts as needed by submitting a Service Request to Office 365 support teams. Periodically change the passwords for accounts. Train new BES support personnel on how to use the BAS web application after the initial handoff. Adhere to Exchange Online guidelines concerning BES user provisioning and management. Exchange Online for Enterprises Service Description (Dedicated Plans) | October 2011 37 Manage and deploy patches and other software to devices using the BAS web application. Remove inactive BES user accounts from the BES servers on a regular basis (at least monthly) based on the following criteria: o o o BES users with no managed mailbox. BES users who have had no PIN for more than 30 days. BES users who have not contacted the BES server in more than 60 days. Microsoft Responsibilities Deploy, run, and support the BAS web application. Provide one of each MSO BES Admin, MSO BES Senior Helpdesk, and MSO BES Helpdesk account to the customer at the Service Ready deployment milestone. Provide break/fix support and assistance on the use of the BAS web application. Share vendor documentation and BAS online training with the customer. Purchase the certificates needed for SSL encryption for the web application. Configure the BAS web application to enable MDS App push functionality for customer. Limits The web application is intended for service desk and IT professionals, not end users. Customized permissions within the pre-defined roles or customized reports will not be added to the web application. Exchange Online does not provide named BAS accounts for each BAS user but instead provides accounts to customers in formats such as BESAdmin01, BESAdmin02, BESHelpdesk01, and BESHelpdesk02. Hosted Voicemail Exchange Online supports hosted voicemail services based on the capabilities of Exchange Server 2010 Unified Messaging (UM). Hosted voicemail is available as a Tech Preview feature for early adopter Exchange Online customers who have deployed Microsoft Lync® Server 2010 on-premises and enabled voice services for their users. Hosted voicemail integration with other PBX phone systems is not supported at this time, but will be considered for a future release. Exchange Online voicemail has a number of benefits: Customers gain the efficiency and cost-savings that come from a centralized voicemail infrastructure and can retire legacy voicemail systems that are expensive to maintain and back up. Users have a single inbox for both email and voicemail messages and that can be accessed from Outlook, Outlook Web App, mobile devices, and a standard telephone through Outlook Voice Access. Users get a text preview of voicemail messages and personal auto-attendant capabilities via call answering rules. Limits An Exchange Online Plan 2D subscription is required for each mailbox that is enabled for hosted voice mail services. Exchange Online for Enterprises Service Description (Dedicated Plans) | October 2011 38 Planning for Service Changes and Growth Exchange Online is designed and deployed based on the number of Exchange Server mailboxes that are established during the customer's detailed discovery activities with Microsoft. Additional capacity is built into the initial planning and deployment of services based on common growth scenarios and stated customer growth. When user growth greater than 5 percent is predicted, the customer is asked to notify the Exchange Online team through the standard change request process to allow appropriate evaluation and planning of service expansion. This notification process applies to increasing the number of total mailboxes as well as expanding the scope of customer usage scenarios (such as deployment of mobile devices) or introducing new applications that run within the Exchange Online environment. In the case of a customer who is integrating a merger or acquisition into its service, several configuration and migration choices must be reviewed, in addition to pure capacity planning. Mergers and acquisitions are treated as separate projects, with full detailed discovery and onboard planning, so that all required changes can be accounted for, along with enhancing the infrastructure to meet new requirements. Customer Responsibilities Provide mailbox and messaging service usage and growth estimates. Provide advance notification of any significant user growth or messaging service usage beyond initial estimates. Microsoft Responsibilities Plan capacity based on the customer’s sustained growth rate, and add infrastructure as required. Adjust growth capacity to enable evaluation and planning for necessary service expansion. Limit Mergers and acquisitions are handled as separate projects from standard capacity planning. Exchange Online for Enterprises Service Description (Dedicated Plans) | October 2011 39