Power Tools. Mimecast Training. Student Workbook. V 1.2

Transcription

1 Power Tools Mimecast Training Student Workbook V 1.2

2 Information in this document is subject to change without notice. No part of this document may be reproduced or transmitted in any form or by any means, electronic or mechanical, for any purpose, without the express prior written permission of Mimecast Limited. A reference to Mimecast shall be deemed to include Mimecast Limited, Mimecast Services Limited, Mimecast South Africa (Pty) Limited, Mimecast Offshore Limited, Mimecast North America Inc. and Mimecast Middle East. Copyright 2013 Mimecast Limited. All rights reserved. Mimecast is a registered trademark. Unified Management, Secure Messaging Gateway, Message Archive, Stor5, Mimecast Storage Grid, Enhanced Stationery, ARMed SMTP, Always On, UEM Express, UEM Enterprise, UEM Advanced, Mimecast Protect, Mimecast Multi, Mimecast 180, Mimecast Small Business Edition, Mimecast Services for Outlook, Mimecast Synchronization Engine, Mimecast Services for BlackBerry, Unified Management for Domino, Unified Management for Groupwise, Mimecast Services for SharePoint, Mimecast Personal Portal, ZHARA and Where business banks its data are trademarks of Mimecast Limited. All other names are trademarks or registered trademarks of their respective owners. Any omission or misuse (of any kind) of service marks or trademarks should not be regarded as intent to infringe on the property of others. Mimecast disclaims all warranties, either expressed or implied, including, but not limited to, implied warranties of merchantability and fitness for particular purpose, with respect to the instructions contained within this guide. In no event shall Mimecast be liable for any damages whatsoever (including, without limitation, damages for loss of business profits, business interruption, loss of business information, or other pecuniary loss), even if Mimecast has been advised of the possibility of such damages. As some US states do not allow the exclusion or limitation of liability for consequential damages, the above limitation may not apply to you. Requests, amendments and suggestions to documentation@mimecast.com

3 Table of Contents CHAPTER 1: MIMECAST INFRASTRUCTURE DATA CENTER ARCHITECTURE MIMECAST SERVICES CHAPTER 2: ADMINISTRATION TASKS FOR CONTINUITY AUTHENTICATION METHODS LDAP AUTHENTICATION CLOUD PASSWORD AUTHENTICATION INTEGRATED AUTHENTICATION PERMISSIONS APPLICATION SETTINGS IMPORTS EXERCISE: MANAGE USER PERMISSIONS CHAPTER 3: POLICY MANAGEMENT INBOUND LOCKOUT PERMITTED / BLOCKED SENDERS POLICY SECURE RECEIPT / SECURE DELIVERY POLICIES WHAT IS DNS AUTHENTICATION? SECURE CONNECTIONS EXERCISE: IMPLEMENT SECURITY POLICIES CHAPTER 4: ADDING S TO THE ARCHIVE INGESTION JOURNALING FILE ARCHIVE CHAPTER 5: MIMECAST RETENTION ACCOUNT SETTINGS PRESERVATION POLICIES VIEWING MESSAGE RETENTION EXERCISE: RETENTION CHAPTER 6: SMART TAGS CREATING SMART TAGS ACCESSING THE SMART TAG EXERCISE: SMART TAGS CHAPTER 7: EDISCOVERY CREATING EDISCOVERY CASES MANAGING EDISCOVERY CASES EXERCISE: EDISCOVERY CHAPTER 8: RETENTION ADJUSTMENTS CHAPTER 9: LITIGATION HOLDS CREATING A LITIGATION HOLD

4 CHAPTER 10: CONTINUITY EVENTS AND SETTINGS WHAT ARE CONTINUITY EVENTS AND APPLICATION SETTINGS? CONTINUITY EVENTS APPLICATION SETTINGS CHAPTER 11: MIMECAST SERVICES FOR SHAREPOINT (MSS) USING MSS SEARCH ADVANCED MSS SEARCH CHAPTER 12: MIMECAST SYNCHRONIZATION ENGINE (MSE) BENEFITS OF EXCHANGE SERVICES BENEFITS OF FILE ARCHIVE SERVICES BENEFITS OF IM ARCHIVE SERVICES CHAPTER 13: MSE DEPLOYMENT CONSIDERATIONS PRE-REQUISITES CHAPTER 14: MSE IMPLEMENTATION INSTALLATION WIZARD SITE CONFIGURATION UTILITY BINDING MSE TO MIMECAST EXCHANGE SITES EXERCISES: VERIFY MSE IMPLEMENTATION CHAPTER 15: EXCHANGE SERVICES DASHBOARD EXERCISE: MSE DASHBOARD CHAPTER 16: TASK TYPES EXCHANGE TASKS FOLDER SYNC USER RETENTION MESSAGE RETENTION STUBBING CALENDAR SYNC CHAPTER 17: SCHEDULES EXERCISE: CREATE A SCHEDULE CHAPTER 18: EXCHANGE TASKS EXERCISE: CREATE AN EXCHANGE TASK CHAPTER 19: MONITORING MIMECAST LOGS FOLDER SYNC LONG TERM IMPLICATIONS OF MESSAGE STUBBING EXERCISES: MONITORING MSE TASKS CHAPTER 20: MIMECAST FILE ARCHIVE FILE ARCHIVE TASKS

5 HOW DOES THE MIMECAST FILE ARCHIVE WORK? VIEWING ARCHIVED FILES ACCESSING YOUR FILES MPP MSO EXERCISES: CREATE A FOLDER SYNC DEFINITION MIMEFILES IM ARCHIVE MIMECAST MOBILE SERVICES APPENDIX: KNOWLEDGE BASE AND RESOURCES KNOWLEDGE BASE TRAINING COURSES OTHER USEFUL LINKS AVAILABLE ONLINE COURSE TITLES:

6 Chapter 1: Mimecast Infrastructure KBID10456 Data Center architecture Mimecast infrastructure consists of two geographically dispersed data centers in each physical location. This provides not only load balancing of all information processing and archiving, but also provides DR coverage in the event of a natural disaster. The Mimecast architecture is made up of layers of servers based on functionality: a Processing Layer, a Scanning Layer and an Archiving Layer. For this module, we are going to concentrate on the Archiving layer. The Processing layer is the layer which makes up our customer front-end clusters. So for example, your account may reside on service37-us and 38-us; which together make up a front end cluster. The processing layer is responsible for the security and reputation checks, which are coupled with the Mimecast Mail Transfer Agent (MTA). Other activities performed at this layer include Policy application. Once reputation checks and the relevant policies have been applied, the processing layer hands the over to the scanning engines. The scanning servers run multiple technologies concerned with the scanning of s and attachments looking for spam, viruses and malware. If the passes the scanning process and no virus is detected, the message will be moved to the Storage or Archiving Layer. It is as this stage that the is archived and indexed for searching capabilities. Storage infrastructure is a key element of the Mimecast Grid. As outlined above, this is supported by triple redundancy - data is continuously replicated to primary, secondary and tertiary storage nodes at one location and then again at multiple geographic locations. This process protects data to such a degree that the Mimecast Grid is able to automatically heal and protect itself against data loss and corruption. The process is entirely proprietary and remains confidential to Mimecast. The use of continuous replication sets us apart from our competitors, most of whom only use a low level of mirroring or warm standby infrastructure - and that is a recipe for data loss in the event of an outage. Mimecast Services KBID10086 The available service features will depend on your specific Mimecast service subscription. Mimecast's current service portfolio is outlined in the table below, and shows which areas of management are included in each service. 3

7 Service Security Continuity Archiving Mimecast UEM Enterprise Mimecast UEM Express Mimecast Security Mimecast Continuity Mimecast Archive Mimecast File Archive Add-On A number of Mimecast tools are made available for you these include: Tool Mimecast Personal Portal (MPP) KBID10291 Mimecast Services for Outlook (MSO) KBID10636 Description A webmail facility, accessed through any web browser. MPP allows you to access your s from anywhere, provided you have an internet connection. You can send, receive and search your archive with ease as well as manage your mailbox and senders. An installable application that integrates seamlessly with Microsoft Outlook. MSO ensures that you have access to your Mimecast archive from Outlook, that you can always send/receive s, and provides additional mailbox control functionality. Mimecast Services for BlackBerry (MSB) KBID10301 Mimecast Mobile Mimefiles KBID10545 KBID10851 A software application which provides Archive search from your BlackBerry. With Continuity mode enabled, Mimecast ensures that your s are always sent and received, even if the BlackBerry infrastructure is unavailable. A software application that provides Archive search from your iphone and ipad. A software application that allows you to search for files or documents attached to s. These could be attachments or files that have been uploaded from your network locations or document repositories. Mimecast Services for Windows Phone (MSWP) KBID10650 Mimecast Mobile KBID10611 A software application that provides Archive search from your Windows Phone. A software application that provides Archive search from your Android phone. Mimecast Services for SharePoint (MSS) KBID10794 A built-in search facility within SharePoint that returns search results from Mimecast. 4

8 Chapter 2: Administration Tasks for Continuity In order for users to connect to Mimecast using one of the Continuity tools, two requirements must be fulfilled: KBID10597 A method of authentication must be selected Permissions must be assigned to users. Application Settings are used to enforce user application settings and control the available features. Authentication Methods Mimecast is able to authenticate user login attempts in three ways: through a Network Directory connection (LDAP), with a cloud password, and for MSO 4 users, Integrated Authentication. When users attempt to log in, Mimecast first checks the Network Directory credentials, and then checks the cloud password. If either of these two match, the user is allowed to log in. The Network Directory connection, which uses the Light-weight Directory Application Protocol (LDAP), is commonly used to authenticate users based on their Active Directory profile. This service must be configured within the Mimecast account and tested prior to use. The advantage of this secure connection is that the user can more easily remember their Network password, instead of assigning another password to them for logon attempts. Note: Consider the implications of using this method in a DR scenario. If the Network Directory is unavailable, user logon attempts may fail. Mimecast cloud passwords never expire, and are configured by the Administrator initially. The use of this password when configuring the Continuity tools ensures seamless Continuity during a DR scenario, as this password will always be available for authentication purposes. LDAP Authentication To verify if Network Directory authentication can be used using LDAP, navigate to Services Directory Sync. An Active Directory connection must be present. If a backup or DR directory server is available, ensure that this is configured as an alternate. Cloud Password Authentication To configure cloud passwords, navigate to Directories Internal Domains, and select a Domain name. Click on the address of the user, and reset the password fields. These are located above the permission fields, which are described in the next section of this guide. These can also be configured using a spreadsheet import, and can be set to Force change on logon to ensure that end users change these from the default. Integrated Authentication Integrated Windows Authentication (IWA) is performed using the Exchange Web Service (EWS), which is only available on Exchange 2007 SP1 versions and above. To leverage IWA, you must ensure you have 5

9 a properly configured public EWS endpoint. To determine if you are able to implement IWA authentication in your environment, review the requirements and steps in the knowledgebase article. IWA authentication consists of the following steps: the MSO 4 client makes an authentication request to the Mimecast Service The Mimecast Service, in return, makes a connection to your Exchange Web Service (EWS) endpoint EWS then issues a challenge, which is passed to the Mimecast Service and then back to the MSO client The MSO client responds to the challenge by communicating with the Mimecast Service, which in turn communicates with the customers EWS server, and then all the way back to MSO again Note: MSO 4 service first tries Kerberos, if that fails it will try NTLM. Only if both fail is it considered a failure of IWA as a whole, and MSO 4 then moves onto the next supported authentication mechanism. Permissions KBID10012 For each of these user tools, it is important to consider the permissions that users will require in order to make use of the services. By ensuring that the permissions are configured in advance, it is possible to provide an easy switch over to these tools for users. Note: Global overrides, configured in Account Settings as detailed below, will apply to all internal users. Account Settings: Apply Global permissions for all users Internal Domains: Apply permissions to individual users. 6

10 Application Settings KBID10180 The Application Settings definition includes options for Mimecast user services, which control the app behavior and level of access. A default definition is created for each Mimecast account, and provides access to various Mimecast applications for all internal Mimecast users. This definition also specifies the authentication method, update method and capabilities that users will have access to. The default definition cannot be edited, but Administrators can create a new definition if they wish to customize any of these settings. The settings are specific to the groups configured, which means that different definitions and settings can be created for different groups. Note: An override can be applied on an individual user basis for specific Application Settings permissions. If in place, the override will prevent the Application Settings from taking effect. A Default Application Settings Definition is created for every Mimecast account. This definition enables access for all internal users to use Mimecast applications, and cannot be edited, but Administrators can create a new definition if they wish to customize any of the settings. The settings are specific to the Groups configured, which means that different definitions and settings can be created for different Groups. Note: In order for the Application Settings to be effective, an appropriate Message Actions Policy must be in place. This Policy is created by default with each Mimecast account. Once the new definition is created, the new settings are applied to the users in the selected Group. The default definition will only apply to the users not specified in a Group. Note: Group members can be modified at a later stage. For example, new individual users or even entire domains can be added to an existing Group that is referenced in an Application Settings definition. 7

11 Imports User individual Permissions and Mobile service license allocation can be configured individually, as discussed in the previous section, or alternatively a bulk spreadsheet Import can be used to affect multiple user accounts simultaneously. Imports can also be used to reset Mimecast Cloud Passwords, which may be required for authentication if the Network Controller is not available to authenticate user connections to Mimecast. Note: Spreadsheet imports must be prepared in Microsoft Excel (.xls) format. KBID10125 Exercise: Manage User Permissions KBID10683 Verify the Authentication method on your account o Navigate to Services Directory Sync o Verify the Last Sync and status of the sync Verify user Permissions o Navigate to Account Settings o Verify the Global Permissions o Navigate to Directories Internal Domains o Select the Domain name, and select a user address o Verify the Individual Permissions Bulk Permission Update o Navigate to Directories Internal Domains o Select the Domain name o Use the Bulk Permission Update menu to select the users to be affected o Set the required permissions, and click the Apply Bulk Permission Update button Review the Client Applications in Use o Navigate to Services Applications o Click on the Registered Applications Menu o Click on the View by Platform toolbar menu drop down o Select MSO, iphone etc. to view a list of users making us of the various services 8

12 Chapter 3: Policy Management KBID10583 By default, your Mimecast Account is configured with a standard set of Policies which are configured to provide optimal security and mail flow control. Some of these Policies include providing details where inbound s should be delivered, which attachments should be stripped from s, and what spam scanning settings should be applied to the content of s. Over and above this list, there are many other Policies that can be configured to control the way Mimecast processes and delivers s. As a result, you may periodically need to create new Policies or amend existing Policies. It is important to understand how policies are applied, and the affect they will have on the way Mimecast processes s. Some of the common queries regarding policy creation, and application tend to focus around these policy types: Inbound Lockout Permitted / Blocked Senders Secure Receipt / Secure Delivery Inbound Lockout KBID10332 The Inbound Lockout policy is designed to block unwanted inbound spoofed s, i.e. an inbound originating from the internet, but displaying the internal domain name; and directed to the internal end users. Mimecast recommends that customers configure an Inbound Lockout policy which will block any spoofed attempts. This policy can be created to ensure that traffic originating from the internet, but appearing to come from an internal domain, is not allowed inbound. Prior to adding any Inbound lockout policies, is it important to consider any legitimate spoofed traffic that should be allowed. This could include s generated from a website where the sender is info@internaldomain.com, or a payroll system that generates s from and to the end user, using their internal address. In this instance, a bypass policy can be created to allow s from certain IP addresses through, even though they may appear as typical spoofed s. All other spoofed s can be configured to be blocked and therefore rejected. Note: If a user has added their own address or one of the company internal domains to their Permitted senders list, this policy will be overridden by the lockout policy, as it is applied first. Permitted / Blocked Senders Policy KBID10475 Permitted and Blocked Senders policies allow you to control who is able to inbound to your organization (and in some instances outbound). If moving from another service, you can bring your Permit and Block lists with you. Mimecast allows import functionality for more complex lists, or these entries can simply be copied and pasted into the pre-configured groups which already exist in policies. When your Mimecast account is initially created, a Permitted and a Blocked policy is created which references an empty local profile group. To ensure specific addresses or domains are blocked or permitted, you can either create additional policies, or alternatively add addresses or domains to the existing groups. 9

13 End users are also able to control their own Personal permit or block policies: Enable the digest to be sent out to all end users. The Digest provides access to release s to their Inbox, as well as permit or block all future s from the actual sender By accessing Mimecast Personal Portal (MPP) and selecting the Managed Senders link. addresses or domains can then be added to their own personal permit or block list; or existing entries can be deleted Note: Administrators can also amend these Policies for their users from within the Administration console, under the Gateway Managed Senders menu. Secure Receipt / Secure Delivery Policies KBID10515 Transport Layer Security (TLS) security technology is designed to protect confidentiality and data integrity by encrypting messages between servers. This reduces the risk of eavesdropping, interception, and alteration. This graphical representation shows an outbound being sent securely through an end-to-end negotiated encrypted tunnel between the sender s mail server and Mimecast. Company A Secure receipt Secure delivery Company B There may be instances where you are required to send certain s via secure delivery or TLS. By default Mimecast will deliver all s using SMTP, however policies can be used to ensure this traffic is sent via TLS. There are basically two main options when configuring TLS: Deliver using TLS where possible Enforce TLS When using the TLS policies Secure Receipt and Secure Delivery, it is important to understand that the encryption policies are split between the traffic from the sender to Mimecast (Secure Receipt) and the traffic from Mimecast to the recipient (Secure Delivery). This applies to both inbound and outbound s. What is DNS Authentication? KBID1067 This definition and the associated Policy help administrators to control the types of authentication checks that are performed when Mimecast receives an . SPF, DKIM, and DMARC are open standards for authentication, used to determine whether a message's sender and/or contents were forged. Each of these works by defining extra DNS records for the sending domain: 10

14 Sender Policy Framework (SPF) validates the connecting IP address by looking up the DNS record for the domain in the envelope MAIL FROM or HELO/EHLO. It can tell you whether the IP connecting to Mimecast is permitted to send mail for that domain DomainKeys Identified Mail (DKIM) validates the contents of the message body and headers by creating a cryptographic hash (or signature), and adding it as a new header to the message. It confirms that the message's content was sent from a specific domain by matching the signature to the DNS records by verifying the signature using the DNS record published by the sending domain Domain-based Message Authentication, Reporting and Conformance (DMARC) connects the domain verified by SPF or DKIM to the domain in the FROM header of the message. DMARC also provides other features, which are not relevant to this article. Mail Transfer Agents (MTAs) can verify SPF, DKIM, or DMARC for inbound s if the sender publishes DNS entries for them in their domain records. Secure Connections KBID10670 Connections to and from Mimecast can also be secured in a number of ways. These options are explored in further detail within the Mimecast Security training module, and a summary of the options can be seen in the table below: Connection Type SMTP (TLS) POPS LDAPS Applies to Inbound/Outbound mail; SMTP Journaling POP3 Journaling Active Directory Connections Exercise: Implement Security Policies Create an Inbound Lockout exclusion policy based on Source IP address o Log into the Mimecast Administration Console o Navigate to the Gateway Policy Editor (Gateway Policies) o Select Inbound Lockout from the available list o Create a new Policy o Specify Everyone as the sender ( From and your internal address as the recipient ( To) o Enter the IP addresses in the Source IP address box o Ensure that the Policy Override checkbox is selected Create a policy to attempt to deliver TLS where possible for outbound s between Mimecast and domain abc.com (i.e. the traffic will be delivered through normal SMTP from your environment to Mimecast, but encrypted where possible from Mimecast to the recipient domain) o Log into the Mimecast Administration Console o Navigate to the Gateway Policy Editor (Gateway Policies) o Select Secure Delivery from the available list o Create a new Policy o Select the drop down option Secure SMTP where possible o Specify Internal as the sender and Domain (abc.com) as the recipient 11

15 Chapter 4: Adding s to the Archive When Mimecast is implemented for your organization, inbound s are routed through the Mimecast data centers to your environment, and similarly, outbound s are routed from your environment, through Mimecast, to the external recipients. As a result, all your inbound and outbound s are present in the Mimecast Archive. Data Source Method used to add to the Archive External Archived as a result of being processed both outbound and inbound (if only requiring Archiving services, these s can also be journaled and not processed) Internal Archived if using a Journal connector which can be configured to use POP3 or SMTP Historical Added to your Archive using a process called Ingestion Note: Some Mimecast products do not require routing for Archiving, and s are uploaded through a Journal connector instead (described below). Ingestion KBID10328 Mimecast Data Ingestion Services (MDIS) is a professional data archival service that allows customers to add historical data to their Mimecast Archive. By default, Mimecast will archive all s it processes, however no prior to migrating to Mimecast will be available for Archive searches. By utilizing MDIS, all ingested data is fully indexed, compressed and encrypted, and available for searches within the Mimecast Archive. Journaling KBID10235 Journaling is the process that allows Mimecast to retrieve internal s from our customer's environment, in order to provide a full archive of both internal and external s. Mimecast can archive journal messages via either SMTP or POP3. By configuring SMTP journaling, all internal s are captured from your Server, and then archived by pushing these s to Mimecast using the SMTP protocol. For more information on configuring Journaling for your mail server, view our Knowledge Base. File Archive Mimecast provides the functionality to add files to your archive, which can then be accessed by Administrators and users (with sufficient permissions). Files will be archived based on the Account Retention period specified in the Account Settings page. Mimecast File Archive can be configured to include the following types of files: User Folder Archive - user's home directories or My Documents folders Shared Folder Archive - common or shared data directories SharePoint Archive - specified SharePoint document libraries, list items and list item attachments Box Archiving - files uploaded into a Mimecast folder created in user's Box account Dropbox Archiving - files uploaded into a Mimecast folder created in user's Dropbox account Lync IM Archiving instant messages shared on Microsoft Lync 12

16 Chapter 5: Mimecast Retention KBID10012 Mimecast controls overall retention of s using the Maximum Retention Days setting as defined in your Account Settings. Account Settings Account Settings contain information about your Mimecast account, as well as some configurable settings. Archive retention period, licensed users and product bundle purchased are some of the elements available from this view, and delimit the parameters of the account. The maximum Retention setting is determined based on your Mimecast purchase order and is configured by Mimecast support during the implementation process. This setting controls the overall length of time that and file data is retained in your archive. Preservation Policies KBID10189 Content Preservation Policies enable you to decrease the retention period of particular messages to a value less than your Maximum Account Retention. Message content that matches a Content Preservation Policy will be purged from the Archive upon reaching the Preservation time specified in the Policy. Note: This Policy only affects the content of the , such as body and attachments. Metadata Preservation Policies allow you to limit the life of message metadata to a value less than your Account Retention. Metadata (which includes the header) is the associated information present within an message. Date and Time stamps, mail server information, From and To addresses, subject and the message-id all form part of the Metadata of the . Mimecast also retains additional Metadata information, such as the Policies applied to the message, delivery and rejection details, etc. Note: Preservation Policies cannot be configured with Everyone to Everyone as the FROM and TO variables. These policies are designed to be used to reduce the retention period of s for a subset of users. Viewing Message Retention KBID10469 Message Retention is included within the metadata for each in the Mimecast Archive. This means that Administrators are able to open any in the Archive, and view the Retention Information for that specific . This can be used to determine: How long the will remain in the archive for Whether or not the has been assigned to any policies that affect the retention of the e.g. Smart Tag or Folder Based Retention Policies Note: More information on Retention Adjustments is covered later in this module. 13

17 Exercise: Retention KBID10675 Confirm your Account Retention o Navigate to the Account menu select Settings o Review the number of retention days in the Maximum Retention (Days) field View Retention information for specific s in the Archive o Navigate to the Archive menu select Search o Search for a specific , or click the Search button to display the last 30 day s s o Click on one of the results o Click the View menu button, and select View Message Retention o Review the information listed in the Retention Values section: o Current Purge Date o Purge Based On o Retention Adjustment (Date) o Litigation Hold o Original Purge Date 14

18 Chapter 6: Smart Tags KBID10216 Smart Tags allow an individual or group to view the contents of messages that they are not the sender or recipient of. Once permissions to a Smart Tag have been granted, these s can be viewed when logging on to the Mimecast Personal Portal (MPP), and can be searched through from Mimecast Services for Outlook (MSO4) and Mimecast Mobile Applications. s can be assigned to Smart Tags in a number of ways: Smart Tag Policy - based on the route of traffic Content Examination Policy - based on words/phrases found in s ediscovery case multiple searches can be assigned to one ediscovery case. Using cases also allows for historic and new s to be included in the Smart Folder. This is the only method to capture historical s. Users are able to access the content of the (including file attachments) as well as forward the to additional recipients. Permissions to access Smart Tags can only be assigned by Administrators who are assigned to an appropriate Role. Note: Users are not able to modify or delete any of the s in the Smart Tags. Creating Smart Tags A four step process is followed when creating Smart Tags. Step Name Description Knowledge Base 1 Group Create a Group which contains the addresses of the users that will access the Smart Tag KBID Smart Tag Create the Smart Tag folder 3 Permissions Assign the permissions to the Smart Tag for the Group created. Administrators must be assigned to the correct Role in order to assign Smart Tag permissions. 4 Assign s to Smart Tags Create the mail flow Policy (either a Smart Tag Assignment Policy or a Content Examination Policy), use ediscovery. KBID

19 Accessing the Smart Tag Users with permissions can access the Smart Tag and its contents through one of the end user tools: Tool Description Knowledge Base MPP A webmail facility for users to perform Archive searches, and to send/receive s, amongst other features KBID10291 MSO 4 A Windows service that integrates seamlessly with Outlook to provide Continuity, Security and Archive services to users KBID10636 Mimefiles An ipad application that provides a view of files in the user s personal Archive. KBID10851 Note: By navigating to the Message Retention view for an in the Archive, you can view if an has been assigned to a Smart Tag. Administrators can view a list of all Smart Tags and the s that have been assigned by navigating to Archive Smart Tags. Unless you have content viewing rights for the Archive, you will not be able to view the content of individual s. 16

20 Exercise: Smart Tags KBID10875 Create a Group Navigate to Directories Groups Create a new folder, and add an address to the folder by clicking on the Build drop down menu o Note: This address should be one that you have credentials for. This will allow you to test the Smart Folder policy created in exercises below. Create a Smart Tag Navigate to Archive Smart Tags Create a new folder Assign Permissions to a Smart Tag Note: This step requires an appropriate Administrator Role assignment. o Select the Smart Tag created in step 4 above o Click the Permissions menu, and select Group Access o Use the Lookup button to locate and select the Group created in step 2 above Create a Smart Tag Policy o Navigate to Gateway Policies Smart Tag Assignment o Create a new Policy o In the Policy Options section, select the Smart Tag created in step 4 above o Configure the From and To addresses appropriately. o Note: Once the Policy is saved, s that match the From and To variables in this Policy will be tagged to display in the Smart Tag folder. Any users with appropriate permissions to access the Smart Tag will also be able to access the contents of the s in the Smart Tag folder. Click the Save and Exit button to create the Policy o Add s to the Smart Tag Send test s that will match the Policy To and From variables, as configured in step 11 above o Confirm that the s have been added to the Smart Tag o Administrator Console Navigate to Archive Smart Tags Select the Smart Tag folder configured in the Policy in step 10 above The test s sent in step 14 above should display in the Smart Tag MPP/MSO 4/Mimefiles Using one of the user tools, log in as the user address specified in the Group in step 2 above Access the Smart Tag folder to display the test s from step 13 above. Note: It is recommended that the Smart Tag Policy, the Smart Tag and the Group be removed once the exercise has been completed. 17

21 Chapter 7: ediscovery KBID10097 ediscovery cases are similar to containers and allow Administrators to group multiple Archive Searches together in a single case, which can then be used for additional activities such as Retention Adjustments or Litigation Holds. The available search options include mailbox searches as well as detailed Archive searches. ediscovery cases are required for use with: Retention Adjustments - allow Administrators to adjust the retention of s in the Archive Litigation Hold - provides the ability to hold s in the Archive and exclude them from any retention or purge requests Smart Tag - allows an individual or group to view the contents of messages that they are not the sender or recipient of. By using ediscovery cases linked to Smart Tag, both historical as well as future s will be available for view Note: Smart Tag assignment using Content Examination or mail flow based Policies only includes future matches, but not historical ones. Creating ediscovery Cases Firstly, the case itself must be created by navigating to Archive Cases. Note: ediscovery cases cannot be deleted once they are created, but can be moved to folders. Once the case has been created, search results can be assigned to the case in one of the following ways, accessible from the Build Discovery Case menu: Quick Basic Search - search within a specific user s mailbox Advanced Search - this provides the same criteria as an Archive Search Add Saved Search - allows a previously saved search to be added to the ediscovery case Link to Smart Tag - assigns an ediscovery case to an existing Smart folder. Use the Perpetual Link to ensure that future s are also included. 18

22 Managing ediscovery Cases Once searches have been saved to a case, they are displayed as shown in the image below: ediscovery cases can have a status of either Editable or Locked. A case will be locked once it has been assigned to a Litigation Hold, Retention Adjustment or Smart Tag. When locked, no new searches can be added, and existing searches cannot be amended. If the case status is Editable, a Manage Saved Searches option is available. This provides a list of all the searches assigned to the case giving additional information such as who created the search, whether it was saved, the time and date of the search and the basic search parameters. Right-clicking on the search allows the Administrator to amend the search criteria, unlink or delete the saved search: As long as a case is editable, you can remove a saved search from an ediscovery Case (unlink Saved Search), however you cannot delete an ediscovery Case once it has been created. A Saved Searches Summary is also provided to show a list of all those searches assigned to the case. Note: A log of the searches performed for the Case is accessible from the Logs menu. Exercise: ediscovery KBID10876 Note: Once an ediscovery Case has been created, it cannot be deleted. It is possible to move the case to a folder in order to keep the cases organized. Create a Case Navigate to Archive Cases Create a new Discovery case by clicking on the New Discovery Case button Add a Description and Notes, then save the Case Add Searches to a Case Open the Case Click the Build Discovery Case menu button, and select Quick Basic Search Provide a Search Description, and text to search for Use the Lookup button to select the mailbox to search through Use the From and To date buttons to set the date parameters, or leave as Eternal to include all historical and future s Click the Search button to verify the search results Click the Go Back button, then click the Save and Exit button to return to the case Verify that the search has been added to the case. Click the Save and Exit button to save the case. 19

23 Chapter 8: Retention Adjustments KBID10209 A Retention Adjustment allows Administrators to modify the expiry date for s in the Archive. When an is initially archived, its retention is based on the Maximum Retention setting in the Account Settings page. Administrators may need to change the amount of time the is retained, which can be modified using an Adjustment. The Adjustment can be configured to change the retention of s matching the ediscovery case, to either purge immediately or to purge s after a certain number of days. (This will also affect future s.) For security purposes, Administrators require permissions to create and approve the Retention Adjustment. Two Administrators are required - one to create a Retention Adjustment, and a second to approve the Adjustment. Elevated permissions are required to request and approve Retention Adjustments. Note: s that are purged from the Archive cannot be retrieved. A Retention Adjustment can only be applied to s contained within an ediscovery case. An Administrator would first need to create the ediscovery case, add the associated searches to the case, and then create the Retention Adjustment to apply to the case. Two options are available for the Adjustment Type. Reset Message Lifespan (based on sent date): All messages processed by Mimecast have a set lifespan according to your Mimecast Account Maximum Retention. You can reduce the lifespan of messages as required, by entering the number of days in the Days Retention field. This is based on the sent date of the . Message Purge Request (Immediate Removal): This option allows you to instantly purge messages from the Archive. Once a message has been purged, it cannot be retrieved. As the purge is immediate, the Days Retention field is not available when this option is selected. Only one ediscovery case can be selected for each Retention Adjustment Request, and all the s within the ediscovery case will be affected. Once the ediscovery case has been selected, it will be locked, which means that no further searches can be added to the case. Note: Retention Information for each message can be accessed in the Archive. 20

24 Chapter 9: Litigation Holds KBID10148 Litigation Holds allow Administrators to preserve s in the Mimecast Archive, ensuring that they are not affected by Retention Adjustments, a Folder Based Retention (FBR) task or a Preservation Policy. Messages are identified using an ediscovery case and then placed into a Litigation Hold. The date selected for the hold will mean that all s included will not be purged from Mimecast until the Litigation Hold expires. If your company has regular purge cycle procedures for Mimecast, or if users have the FBR policies in place, it may be required to prevent s from being purged during these cycles. For example, if a Purge cycle takes place every three months, and some s are required for a litigation battle, the s can be marked with a Litigation Hold, and they will not be purged until the Hold has expired. Creating a Litigation Hold KBID10239 Creating a Hold is a two-step process. Firstly, an ediscovery case must be created), which contains the search criteria for s that are to be held. This ensures that future s matching these search terms will also be included in the case. Secondly, a Litigation Hold must be created. Note: All the s referenced by the searches contained in the ediscovery case will be affected. Only one ediscovery Case can be assigned to each Litigation Hold. Once the litigation hold has been saved, the ediscovery case is locked and cannot be amended. A Litigation Hold is marked as Active until the Hold date is reached, after which is expires and the retention policies will once again apply. Until the expiry date is reached, the date can still be amended. To view the status of the Litigation Hold job, view the article on the Storage Utilization feature. Each message in the Archive will also display Retention information (access the Message Retention View), such as Litigation Holds. 21

25 Chapter 10: Continuity Events and Settings KBID10364 What are Continuity Events and Application Settings? A Continuity Event is a definition created by an Administrator, which signals that a DR event has taken place and that mobile devices and applications should use Mimecast for Continuity. Application Settings are used to enforce MSO settings. Continuity Events Before a Continuity Event can be created, a Group needs to be in place that contains the addresses for the Continuity Event to apply to. The Group is created within the Directories Groups menu. The Continuity Event is created within the Services Continuity menu. Ensure that Mobile or Outlook Continuity is checked, and that the Event Start date is set within the last 5 days. The applications will enter Continuity mode when they next Poll Mimecast, and the Continuity Event is discovered. The Poll interval for mobile is configured with Account Settings. Application Settings KBID10180 The definition is used to control the settings of MSO, and is based on user groups. The configuration options vary between MSO 3.x and MSO 4.x settings. 22

26 Chapter 11: Mimecast Services for SharePoint (MSS) Microsoft SharePoint provides you with a central location to store files, and to collaborate with other users. Most SharePoint environments include a search facility that enables you to search through files on SharePoint and other locations. MSS is an application that can be installed within the SharePoint environment, and provides you with: The ability to return Mimecast archive search results from a SharePoint search Perform Advanced archive searches (if configured by your Administrator) Displays other user's photos and Lync status on archive search results (if configured by your Administrator) Using these features, it is possible to search for files and compare the results to recent communications that include the same files, or a different version of the file. Using MSS Search KBID10806 MSS is configured by your Administrator, and is integrated seamlessly within your SharePoint site. Use the steps below to perform a standard search. Note: These steps show a standard SharePoint installation, which may differ from the site that you have access to. 1. Navigate to your SharePoint site 2. Locate your Search field. This field may be visible immediately on the home page, on a separate page, or on the top right side of your SharePoint screen. If you are unable to locate the Search functionality, please contact your SharePoint Administrator 3. Add your search text in the field, and press the Enter key to begin the search (or click the magnifying glass icon) Note: An Advanced search is accessible through the Mimecast Archive link above the search field, and will be discussed later in this article. 4. The Search results are returned. Note: Some of the features displayed in the image below may not be available. Please consult your SharePoint Administrator for more information on available features. 23

27 Note: Depending on your configuration, the SharePoint search results are displayed in the center of the screen (potentially including documents and other resources), and the Mimecast Archive Results are displayed on the right-side of the screen. By default, 5 search results are displayed at a time - use the View More Results link to access other search results. 5. Click on one of the links to access the document or resource. If the subject line is clicked from the Mimecast search results, the content is displayed: Note: If configured, the Microsoft Lync status is also displayed, along with the available user photo. 24

28 6. Click on the user name to view that user's personal SharePoint site (if available), and click on the ' ' link below the photo to generate a new blank to that user. If an attachment is present, it can be opened or saved. Close the window to return to the Search results. Advanced MSS Search If configured, an Advanced search is accessible through the Mimecast Archive link above the search field, and if clicked, displays the following fields: The Advanced search screen allows users to specify more search parameters, which help to reduce the number of search results returned. Use the appropriate fields to restrict the search to: Section Text Sent Date Description Allows the user to search for a word, words or an exact phrase within an Allows the user to search for s to or from a particular person or directly between that person and the user Allows the user to specify the dates or the timespan that will be used to search for s Docs Allows the user to search for a word or words within the name or body of an attachment and to specify the type of document (e.g. Spread sheets) that is returned in the results. Once the parameters have been specified, click the Search button to display the search results. Use the Next link to navigate to the next page of results (if applicable). By default, 10 search results are displayed on each page. Note: When more than one section is completed, s must satisfy all criteria to be returned in the search, e.g. Text = Mimecast, Docs text = MSS Docs type = Presentations searches for all s that have the word Mimecast in the message and at least one attached presentation containing the word MSS. 25

29 Chapter 12: Mimecast Synchronization Engine (MSE) Mimecast Synchronization Engine (MSE) is a Mimecast proprietary product which integrates additional services with the customer's server environment. MSE allows Administrators to communicate data securely from the server environment to Mimecast, in order to access additional mailbox management and file archive functionality. Note: Mimecast also provides cloud-to-cloud archive solutions (e.g. Dropbox, Box) which do not require the installation of MSE. Once MSE is installed and configured, Administrators are able to utilize the various features which improve the end user experience, reduce storage load in your Exchange environment, and control the life cycle of and files. Note: Contact support@mimecast.com to obtain the MSE installation files. The available features are described below: Exchange Features: KBID10322 Folder Sync, or Mailbox Message Synchronization (MMS): Replicates user Exchange folder structures to Mimecast, so Outlook sub-folders are visible in the Mimecast Personal Portal (MPP) and Mimecast Services for Outlook (MSO) Message Content Stubbing (MCS): Removes specific elements from Exchange, and replaces them with a stub to retrieve the data from Mimecast User Retention, or Folder Based Retention (FBR): Allow users and Administrators to effect reasonable data destruction Policies from Outlook, and manage the life cycle of s in Exchange and in the Mimecast Archive Calendar Sync (CAL): A read-only view of Exchange Calendar items, displayed in the Mimecast Personal Portal (MPP) File Archive Features: Shared and User folder Archiving: By deploying MSE on network servers with access to file folders, it is possible to upload the files within the folders to Mimecast for long term archiving. SharePoint folder archiving: If an instance of MSE is installed on a SharePoint farm, files from the SharePoint file libraries can be uploaded to Mimecast for long term archiving. Note: In order to access Mimecast File Archive functionality, an optimized version of MSE needs to be installed on your environment, and the relevant add-on service is required. IM Archive Features: Archiving of all the messages shared on the Microsoft Lync platform. 26

30 Benefits of Exchange Services Mimecast provides a number of features that can greatly enhance the end user Continuity experience, for those unavoidable occasions when the corporate Exchange server or files servers are not available, or users cannot access the corporate network. Exchange Folders: Exchange mailbox folders play a large part in the way that end users organize and find important s and attachments. Folder Sync provides the ability to replicate s in the same folder structure that end users are familiar with, to Mimecast. If using Folder Sync in your environment, Exchange Folders Live View is available via MSO 3 and MPP interfaces. This provides end users with a view of the messages stored within their Mimecast Archive, in the same familiar folder structure used in their Exchange mailbox. Using this Live View, they can find, view, reply and forward s, as if they were using their standard Exchange mailbox. Calendars: Exchange Calendars is an extensively utilized feature of Microsoft Outlook, and allows end users to track important meetings and activities. Using Calendar Sync, end users logging onto MPP have read-only access to this data in the event of an Exchange outage. Mailbox management is one of the many challenges facing Exchange Administrators. Maintaining your Exchange database storage and performance, while ensuring end users have access to the data they need, can be a daunting task. By creating retention policies in the corporate Exchange environment, Administrators can plan storage requirements and ensure Exchange performance does not degrade over time. Folder Sync: If Folder Sync is implemented in your environment, end users accessing their folders from MSO 3 or MPP using the Exchange Folders Full View option, will see all folders and messages contained in those folders that Mimecast has replicated for the mailbox. This view does not rely on the currently existing in the Exchange Mailbox; and also includes any folder structure that has been extracted by the Ingestion process and then uploaded to Mimecast. This allows end users to find s in a folder that has since been removed from Exchange. Stubbing: Stubbing can assist Administrators with managing storage requirements, by removing content or attachments from the Exchange server and replacing them with a stub. Stubbing provides various options should a match be found: Delete the message, stub the attachment or stub the full message. User Retention: Allows users to effect reasonable data destruction Policies from within Outlook, as well as allowing Administrators to manage the life cycle of s in Exchange and in the Mimecast Archive. Using Folder Based Retention (FBR), Administrators can control retention in Exchange and in the Mimecast Archive to match Company policies. Mimecast Managed Folders can also be implemented, which provides users the ability to declare s for deletion from Outlook. Benefits of File Archive Services Adding the files from your network and cloud storage locations provides users with a single archive that can be searched using any of the Mimecast user applications. In this way, instant ediscovery is possible for both s and file data. By providing an online copy of files and documents, users can access these even if they cannot get to their home or shared drive. If a file is mistakenly deleted, the user can retrieve this file from the Archive. Benefits of IM Archive Services IM Archive assists the business compliance requirements to add business related IM conversations to the Mimecast archive. 27

31 Chapter 13: MSE Deployment Considerations Mimecast Synchronization Engine (MSE) is only available based on your organization s Mimecast Service, which is detailed in the table below. To benefit from its features, software also needs to be installed in your environment which then communicates the relevant metadata to Mimecast, based on MSE tasks configured in the Mimecast Administration Console. Secure UEM Security Archive Gateway Continuity Express UEM Enterprise MSE Add-on MSE Add-on MSE Add-on File Archive Add-on - File Archive Add-on It is essential to plan your MSE deployment. This includes determining the features that you wish to implement as well as planning where the software will be installed. Mimecast Support is available to assist with the deployment. Mimecast also recommends that initially the tasks are run with test groups to assess the impact on your environment. Prior to deployment, consider the following: If multiple Exchange sites are present, which sites should the software be installed on? On which servers will the software be installed? Have the pre-requisites been attended to? What features are going to be used? What users will these features be applied to? What effect will running these tasks have on your network bandwidth? What services are running at present, and what will the task load effect be on the server? What services (MPP and MSO) do end users require in order to access these features? If using SharePoint Archiving, MSE needs to be installed on a SharePoint server As with any 3rd party software that accesses the server environment, MSE has a number of prerequisites in terms of hardware, software, and user account permissions that need to be met prior to installation. This will ensure that the service runs as intended. Pre-Requisites Microsoft Exchange Version Exchange 2003 Exchange 2007 Exchange 2010 / 2013 Exchange and Office 365 Hybrid environments Knowledge Base Article KBID10462 KBID10460 KBID10461 KBID

32 Chapter 14: MSE Implementation To get MSE installed and running in your environment, certain steps are required. The software needs to be installed, the site configuration tool should be used to provide specific details regarding the site, and then the site needs to bind with Mimecast. Installation Wizard KBID10458 MSE relies on software to be installed in your environment using an Installation Wizard, which provides the Administrator with step by step configuration screens. Download the software, and copy it to the environment that MSE will be installed on. Once the software is installed, a Site Configuration Utility is used to bind your MSE installation to Mimecast. KBID10459 Site Configuration Utility To transmit updates regarding the metadata of s or files from your internal servers to Mimecast, MSE communicates securely with your Mimecast Account. Once the MSE software has been installed, this is configured using the MSE Site Configuration Utility. MSE Site Configuration provides various tabs where certain information is required to bind MSE with your Mimecast Account. This process ensures that the communication can take place securely using valid credentials for your Account. The utility is launched automatically once the installation is complete. It can also be launched from the Start menu of your server. This utility consists of six tabs: Tab Description Service Contains information regarding the actual MSE service e.g. region, status, company name Site Shows information about the server MSE is installed on e.g. server name, display name and site code Accounts This is the account used to run the MSE service, which should exist on the local server as well as on Mimecast Directories Select your own install directories for data, log and temporary files Connection This should be completed if using a proxy server Version Contains information regarding the version of MSE installed Note: The site code is generated automatically when the Site is bound to your Mimecast service. 29

33 Binding MSE to Mimecast Once the configuration tool settings have been completed, the installation can be set to bind to Mimecast by selecting the Play button: The installer will now register the details with your Mimecast Service and upon successful completion, the NT Service field will display as Started. Exchange Sites KBID10107 An Exchange Site is the location where MSE is installed in the customer s environment. Each instance where MSE is installed and configured to communicate with a server is listed in the Exchange Site widget in the Exchange Services Dashboard: From the Exchange Service Sites view, various tasks can be performed: Pause and resume the service Upgrade the current MSE version installed View the logs for the MSE service 30

34 Exercises: Verify MSE Implementation KBID10707 View the existing Exchange Sites for your account Log in to the Administration Console Navigate to Services Exchange Services The first widget in the Dashboard is the Exchange Site widget. View the number of Exchange Sites there are in each status group Click on the View All link to view an unfiltered list of all Exchange Sites Click the View menu to access different filtered lists of Exchange Sites. Review the properties of an Exchange Site Open an Exchange site from the list Confirm the status of the Exchange site Confirm the date that the site was last modified Review the Administrative options available in the task toolbar. 31

35 Chapter 15: Exchange Services Dashboard KBID10635 All MSE related options are presented in a dashboard called Exchange Services. The dashboard provides a single page to access all MSE sites and settings. Administrators are able to perform the following tasks: View existing Exchange Sites, Exchange Definitions, Schedules and Exchange Tasks Create new Exchange Definitions, Exchange Tasks and Schedules View a dynamic log of all recent Exchange Task activity Access the relevant MSE related Knowledge Base articles and Release Notes Download the latest MSE Installer package To access the MSE dashboard, navigate to Services Exchange Services. The dashboard consists of a toolbar menu, and widgets which contain information about existing settings as well as a log of MSE task activity: Note: Detailed information regarding working with Exchange Tasks will be discussed later in this manual. Exercise: MSE Dashboard KBID10708 Navigate to the Exchange Services page and review the widgets and logs Review the MSE Dashboard Log in to the Administration Console Navigate to Services Exchange Services Confirm the available information in the following widgets: Exchange Tasks Recent Task Activity Note the various task toolbar menu options to create and edit Task Definitions, Schedules and Exchange Tasks. 32

36 Chapter 16: Task Types Exchange Task Definitions consist of the following task types: Folder Sync, User Retention, Stubbing and Calendar Sync. If File Archive services are available, additional tasks are available for User Folder Archive, Shared Folder Archive, and SharePoint Archive. Using definitions, Administrators can configure what aspects of s should be replicated, stubbed or purged. Once the definitions have been created, these are assigned to a specific user group and schedule to define when these tasks should run. Exchange Tasks Note: For Exchange Tasks, it is important to note that these tasks only communicate the metadata of a message. Therefore they can only affect s which already exist in the Mimecast archive. Definition Type Description Knowledge Base Folder Sync / Mailbox Metadata Enables users to view their Exchange Folder structure from within MSO and MPP. End users can then access archived messages in the same location as their Exchange Inbox, even Synchronization during a mail server outage, or if data has been removed from (MMS) the Exchange server. KBID10066 User Retention / Folder Based Retention (FBR) Message Content Stubbing (MCS) Calendar Sync (CAL) User Initiated Stubbing Folder Sync User Retention allows Administrators to control retention in Exchange and in the Mimecast Archive to match company policies. Mimecast Managed Folders can also be implemented, which provides users the ability to declare s for deletion. Used to remove message attachments, message body; or the deletion of the entire message from the local Exchange environment. This removed data is replaced with a stub, containing the message metadata and a pointer to the message in the Mimecast Archive. To use the stub, the end user will need to access MSO or via MPP Provides a read-only view of Exchange calendars from within MPP. This is particularly important when the company Exchange server is not available, or if they cannot access the corporate network for any reason. Allows MSO users to select which messages should be stubbed by MSE. This functionality requires MSE or later. KBID10089 KBID10070 KBID10290 KBID10070 Folder Sync replicates user s folders metadata from Exchange to Mimecast. This results in end users being able to view their s in the same folder structure as their mailbox, while accessing both MPP and MSO. When creating a Folder Sync definition, by default the Inbox, Sent Items and Deleted Items folders (and subfolders) are replicated. These can also be configured to be excluded. Sync Exclusions can be added if there is a specific time of the day when the folder replication task should not be performed, i.e. during an Exchange Server backup. The initial (full) replication of a user s mailbox folder structure is a time intensive activity. It is worth noting that during the initial Folder Sync task run, each mailbox will need to be fully replicated. Therefore, it is crucial to ensure that this initial replication task is planned, i.e. stagger the folder replication using groups, instead of selecting all mailboxes in the company. On successive folder sync tasks, only the differences will be replicated. 33

37 The Exchange Folders generated by the results of the Folder Sync task view has two options in MPP: Live View: This will display a replica of the Exchange Mailbox as of the last time a Folder Replication task processed that mailbox. This view is ideal for DR scenarios. Full View: This will display all folders, and messages contained in those folders, that Mimecast has recorded for the mailbox, regardless of its current visibility in the Exchange Mailbox; as well as any folder structure that has been extracted by the Ingestion process and then uploaded. This view is ideal for finding an in a folder that has been removed from Exchange. User Retention KBID10174 User Retention definitions should be created to give Administrators the ability to control the deletion of messages from Exchange as well as the Mimecast Administration console. Folder Based Retention functionality includes: Giving users the ability to select messages for deletion from Outlook and drop them into Mimecast Managed folders. These folders are configured in the Mimecast Administration console, and "pushed" into Exchange (and therefore the end users mailbox) using MSE. Allowing Administrations to manage Exchange Inbox, Sent Items, Junk Mail and Deleted Items remotely, by setting retention policies for each (with an option to include or exclude subfolders within each folder) Allowing Administrators to manage the lifespan of messages on a time-based lifespan, from Exchange to the Mimecast Archive; until they are finally purged from the Archive permanently. Note: If the message exists for multiple users, it can only be completely removed using a Retention Adjustment policy. Allowing Administrators/users to retain messages within the Mimecast Archive, for the time period as defined in the global Mimecast Account Retention policy. Note: Folder Based Retention can only be used to shorten the lifespan of an . It cannot be used to extend the global retention period assigned to each . 34

38 Message Retention The retention of all messages is controlled based on a message retention lifespan. When configuring Retention Definitions, Administrators need to select the stage of the life cycle of the , and total number of days associated with this stage. An Exchange delete action (Delete from Exchange) must also be configured for all definitions, even if this value is set so no action is required on the actual Exchange Server. Lifespan Stages Exchange Delete Policy Expire View Policy Description Hard delete: Permanently deletes the from Exchange Soft delete: Deletes the from Exchange, however this is still recoverable from the Exchange dumpster (this requires additional Exchange Server configuration) Move to deleted items: Moves the to the Deleted Items folder Take no action: Allows the Administrator to move on to the next stage of the s lifecycle, without affecting it s retention period on the Exchange server The User can no longer see the in their Archive Search, however it is still available for search by the Administrator Permanently purged from Mimecast. i.e. cannot be accessed Purge from Archive Policy Note: When defining retention periods, it is important to remember that the number of days for the retention definition is set by the highest stage. For example, if you have Delete from Exchange at 30 days, Hide from Archive Search at 60 days and Purge from Archive at 90 days, it will take a total of 90 days for the message to be permanently purged from the Mimecast Archive. The message will exist for 30 days at stage 1, 30 days at stage 2 and then be purged after a further 30 days, giving a total lifespan of 90 days. 35

39 Stubbing Message Stubbing enables Administrators to control the size of mailboxes on the corporate Exchange server, without impacting the original location of managed . The end user can use the stub from Outlook to retrieve the message (as long as MSO has been installed) or search for the message in MPP. By using stubbing, data can be removed from the Exchange mailbox, but to the user, the /attachment still appears to still be present in their mailbox. The stubbing process runs through a series of steps to first evaluate the local mailbox for stubbing candidates (as per the configured task), confirm if these exist in the Mimecast Archive, and only then is the item stubbed. It is important to note that if both of these criteria are not met, the message will not be stubbed. The stubbing definition has multiple options that can be configured. Stubbing can be set to apply to s over a certain size, s with attachments, older messages, as well as based on properties such as whether the is flagged or the sensitivity level: Calendar Sync Mimecast Calendar Sync provides a read-only view of Outlook calendars from within MPP. This is particularly important when the company Exchange server is not available, or if users cannot access the corporate network for any reason. To view this data in MPP, a Calendar Sync definition should be created to define what calendars should be replicated. Cal Sync can include the default calendar only, or all other linked calendars. 36

40 Chapter 17: Schedules KBID10067 Schedule Definitions are required to determine when and how often a MSE task should run. They provide maximum flexibility and management to the MSE tasks, as multiple schedule definitions can be created and assigned to tasks and user groups. Exchange task definitions can be configured to run at different times using the schedules so that they are not all running at the same time. Mimecast recommends staggering schedules, as running too many tasks simultaneously may place unnecessary load on the Exchange Server. For example, Folder Sync can be set to take place twice each day, but not on weekends. Message Stubbing can take place each week on a Saturday, and User Retention once every three days in the evening. Schedules provide various options: Schedule Options Once off Daily Weekly Monthly Details This schedule will only run once on the date and time entered. This option is often used with initial Folder Sync tasks Task can either be set to run once a day at a certain time, or multiple times at regular intervals Weekly Settings allows individual days to be selected, and then the Daily Settings option provides the type (once or at regular intervals) and time for the schedule to run This can be configured to run on either a Set Date per month (e.g. the 24th) or a Set Day (e.g. the third Thurs). Daily Settings option provides the type and time for the schedule to run Exercise: Create a Schedule KBID10710 Create a Schedule Definition o Log in to the Administration Console o Navigate to Services Exchange Services o Select Exchange Definitions Schedules from the task toolbar, and select the New Schedule option o Enter a description into the Description field, e.g. Run every 10 minutes o From the Schedule Type, select Daily o Click on the Date Range, which will display a calendar control. Leave the Start date as today's date, but click on Eternal for the To date o In the Schedule Type, select Many from the drop-down o Leave the Start Time and End Time as is - this covers the full day o Change the Interval (minutes) field to 10 o Click Save and Exit o Delete the schedule definition by clicking on the schedule, and selecting the Remove Schedule button. Note: If you would like to activate this task in your live environment, do not remove the Schedule, and complete the Exchange Tasks exercise detailed in this guide. 37

41 Chapter 18: Exchange Tasks KBID10064 Exchange Tasks are required to apply MSE task definitions to specific groups of users at specific time schedules. Exchange Tasks reference a Directory Group or Organizational Unit, which must be setup up in Active Directory prior to being linked to. Exchange Task definitions and Schedules can either be created prior to creating the Exchange Task, or as part of the configuration: Note: MSE tasks will not run until the Exchange Task is created and applied to a valid Directory group of users or OU. Exercise: Create an Exchange Task KBID10711 Create a new Exchange Task o Create a Folder Sync Definition and Schedule, as detailed in the previous exercises in this guide o Create an Active Directory Distribution List or Security Group, and add your individual address to the Group o Log into the Mimecast Administration Console o Navigate to Services Exchange Services o Click on the Tasks button associated with Folder Sync in the Exchange Tasks widget, OR Click on the New Exchange Task button in the task toolbar o Click on New Task Definition o Select the MSE Site drop-down menu, and select the relevant site (where MSE is installed) from the list o Select the Schedules drop-down menu, and select the pre-prepared Schedule o Select the Task Type drop-down menu, and select Folder Replication o Select the appropriate definition from the Folder Replication Definition drop-down list o Select the AD Group to apply the task to, by clicking the Lookup button next to the Group DN field o Click the Save and Exit button to implement the task. 38

42 Chapter 19: Monitoring KBID10064 Administrators are able to monitor their Exchange Sites as well as Exchange Tasks using the logs provided in the Administration Console. Detailed service and task logs are also available on the server where MSE is installed. Mimecast Logs Mimecast provides various logs for the MSE installations and task activity: Log Type Details Exchange Site Condensed logs which show the execution time for the MSE service since it started Logs up, and the last time the execution report was run. This helps identify potential site problems Task Summary Detailed logs for each Exchange Task. By clicking on a specific log report, further Logs information is available on the execution of the task. Recent Task Accessible from Exchange Services, this log provides a list of the last ten Exchange Activity Logs tasks that have been executed. By accessing a task in the list, the Task Summary logs can be viewed Server Logs Within the installation directory there is a log folder, which has server and task specific logs. These can be used in conjunction with Mimecast Support when troubleshooting site and task queries For certain tasks, it is important to be aware of some of the functionality and behaviour. Folder Sync Folder Sync has the following limitations when it comes to the Exchange Folders view. Folder Sync works with a saved state, in that it stores data files locally on the MSE server. This is required in order to facilitate the differential sync s. The Exchange Folders Full View is linked to the Task ID that processed the mailbox, which means that the following must stay constant: The mailbox must always be processed by the same Exchange Task The DN of the profile group used in the Exchange Task, must stay the same; i.e. the group cannot be moved or renamed in your Active Directory Structure The MSE server hosting the Exchange task must remain the same The user must remain in the same Active Directory group as when the task was first processed 39

43 Long Term Implications of Message Stubbing While Stubbing has useful benefits, there are also some long term implications that Microsoft warns it s consumers about; and Mimecast aligns itself with these concerns. One of the most obvious benefits of Message Stubbing is the reduced Exchange storage requirements in the customer s corporate environment. It is however, important to also be aware of some of the longer term potential side effects caused by the use of stubs: Search problems: If you retain months (and years) of stub files, several hundred thousand messages could be processed in this way. The probability of successfully locating a specific message with an Outlook search is greatly reduced when you no longer have a significant portion of the message body available. This may result in users requiring multiple Outlook searches to find a desired message. Exchange performance: If folders contain a large number of messages, even ones just consisting of stubs, Outlook slows down considerably. This is due to the fact that Outlook must perform several operations against the Exchange server to retrieve the contents of a folder, and this is based on the number of items and not the size of the items. For more information please see: Microsoft now recommends that third-party archiving solutions such as Mimecast be configured to remove content completely from the mailbox without retaining stub files in the mailbox. To align with this recommendation, Mimecast offers a "Delete" option to the Message Stubbing Definition. Exercises: Monitoring MSE Tasks KBID10712 Review the Exchange Service Site logs: o Navigate to Services Exchange Services o Click on the View All link in the top right corner of the Exchange Service Site widget o Select one of the Active Exchange Sites o Click on the Logs drop down menu option in the task toolbar o Select the Site Summary Logs option o If logs are available in the list, click on one of the logs to view more detail o Information is provided about how long the MSE service has been started Access the Task Summary logs o Navigate to Services Exchange Services o Click on a listed Task in the Recent Task Activity log o Click on the Logs drop down menu option in the task toolbar o Select the Task Summary Logs option o A list of all the logs for each task are displayed o Click on one of the task logs, and view the detail provided. 40

44 Chapter 20: Mimecast File Archive As an add-on to Unified Management (UEM) services, Mimecast File Archive allows Administrators to archive files within the Mimecast Archive. File Archiving captures and stores files from a variety of sources including Document Libraries, Home Drives, Network Shares, Microsoft SharePoint as well as Dropbox and Box. File Archiving provides the following functionality: Access network files from the same repository that users access their personal archive Retrieve files that may have been deleted, without Administrator intervention Access files when users cannot connect to the company file server, or if the company file server is down File Archive Tasks Definition Type Description Knowledge Base User Folder Archive Allows Administrators to archive user's home directories or My Documents folders into the Mimecast Archive. Users are then able to access their files when logged into Mimecast Personal Portal (MPP), Mimecast Services for Outlook (MSO 4) and Mimefiles for ipad. KBID10775 Shared Folder Archive SharePoint Archive Used to archive common or shared data from your environment into the Mimecast Archive. Administrators and users (with sufficient permissions) are then able to access these files. Provides functionality to archive specified files from the SharePoint repository to Mimecast's Archive. File archiving requires a specially optimized version of Mimecast Synchronization Engine (MSE) to be installed in your environment, which can be requested from support@mimecast.com. Note: Box.net and Dropbox Archiving do not require MSE to be installed. How does the Mimecast File Archive work? KBID10777 KBID10778 Using an MSE task definition and schedule, the Administrator controls which files are archived with Mimecast. User permissions to the files are also determined by the Administrator. For the initial folder archive, all files (except for those listed as excluded extensions) will be archived. This results in the first task run being the most resource intensive. Subsequent archive jobs will only archive any differences to those existing files, or any new files. The MSE application pushes the files to Mimecast, where they are then converted to s, and as such added to your archive. Note: Box.net and Dropbox Archiving do not make use of MSE and therefore do not require a task definition or Exchange Task. Instead these services are configured when users log into MPP. These jobs run once a day. The User Folder Archive process uses the address network_shared_folder@yourdomain.com to send the files to the archive. For Shared and SharePoint Folder Archive, the address should be specified when configuring the task definition. Depending on the type of folder archiving, the subject of the will be: "the file name" archived from User\Shared\SharePoint Folder. 41

45 Box.net and Dropbox Archiving requires the user to authenticate and authorize Mimecast access to these services. This process is initiated from MPP. Mimecast then creates a folder in the user's Box or Dropbox account called Mimecast, which users can copy files into. The address dropbox_archiving@yourdomain.com is used for Dropbox, while boxnet_archiving@yourdomain.com is used for Box.net. The subject of the will be: "the file name" archived from Box/Dropbox. Mimecast will archive and index these files as it would other attachments. Note: Mimecast is only able to archive files under 300Mb. The archive jobs run every two hours. Viewing Archived Files Administrator View: When the Exchange Task definition is configured, a folder is created in the Smart Tag folder structure. Within this folder, subfolders will be added. For User Folder Archiving, a folder called User Files Archive is created and the address of the user will be listed as a subfolder; for Shared and SharePoint Archiving a folder called Shared Files Archive is created, and the Name field (of the Task definition) is listed as a subfolder. For Box and Dropbox Archiving, folders called Box Archive and Dropbox Archive respectively are added, and subfolders are created as per the user's address. Note: The Box or Dropbox smart tag sub-folder is always listed as the user's address, and is not dependent on the account name. To view the folders and perform searches across the archived files, navigate to Archive Smart Tags: Files Archive Box and Dropbox Archiving The Administrator's Role and permissions will determine if they have access to view the files. Administrators with access to the Smart Tags menu will be able to see the archived s, but only those Administrators with the protected permission Manage Smart Tags, can view the content of these file attachments. By default, end users can access their files if User Folder Archiving and Box or Dropbox Archiving is enabled. If Administrators would like end users to access the files within Shared and SharePoint Archived folders, they will need to assign these users permissions to the relevant Smart Tags. Note: Smart Tags cannot be renamed or deleted if associated with a File Archiving definition or Exchange Task. For more information on working with Smart Tags, view the full article. End User View: Users are able to view the files they have access to when logged into either Mimecast Personal Portal (MPP) or Mimecast Services for Outlook (MSO 4). When File Archiving is enabled, 42

46 folders are created within the Smart Tag menu option. End user tools are covered in detail in the Mimecast User Services training course. Accessing your Files The archived files can accessed when logged into either Mimecast Personal Portal (MPP), Mimecast Services for Outlook (MSO 4) or Mimefiles (accessible using an ipad). MPP KBID10293 All archived files are displayed in folders listed under the MPP Smart Tags menu option. If using Box.net or Dropbox sync, folders called Box Archive and Dropbox Archive are created with the user address listed as a sub-folder. A folder called Shared File Archives is created for User Folder Archiving which is displayed as the address, and Shared Folder and SharePoint Folder Archives are listed as named by the Administrator. A page opens in the right-hand pane which shows all the files that have been archived. The files are sent as attachments to the archive, using a generic address. Use the search filter at the top of the page to search for specific files: Click on the relevant which allows users to download and view the attachment: Note: Mimecast does not overwrite different versions of the same file. Therefore for a file which has changed, the most recent copy in your Smart Tag should be selected. 43

47 MSO 4 KBID10647 Once authenticated with MSO 4, navigate to the Mimecast tab, and click on the Search button in the Archive Search section. The Search box opens and consists of three tabs: Searches, Editor and Results. One of the menu options in the Searches Tab is Tags: All configured file archives are listed under the Tags tab. Click on the relevant Smart Tag which then displays a couple of options - to show all files, click the Run icon, or click Export to save all results to your Outlook mail folders. By clicking Run, you are then able to perform actions such as Save the , or download the attachment. To search for specific files, navigate to an Advanced Archive Search, and select the relevant Smart Tag from the drop down: Enter your search terms in the docs section of the Archive Search Editor, and click on the Search button: 44

48 Exercises: Create a Folder Sync Definition KBID10709 Create a Folder Sync definition o Log in to the Administration Console o Navigate to Services Exchange Services o Select Exchange Definitions Folder Sync from the task toolbar OR click on the Definitions button next to Folder Sync in the Exchange Task widget o Click on the New Folder Replication button o Enter a description into the Description field o Leave the Exclude/Include options unchecked o Click Save in the task toolbar. Create Time based Exclusion/s for your Folder Sync task o Click on the Manage Full Sync Exclusion Times button for the Folder Sync definition you have created o Click on the New Replication Exclusions button o Select a Day and From/To times you do not want the Folder Sync task to run (e.g. when your Exchange Server is being backed up) o Click Save and Exit to save the exclusion time. Your exclusion times are now listed. o Click Go Back to return to your Folder Sync Properties, and Go Back again to see a list of the configured Folder Sync definitions o Right click on the task definition and select Remove Definition. Note: If you would like to activate this task in your live environment, do not remove the definition, and complete the Schedule and Exchange Tasks exercises detailed in this guide. 45

49 Mimefiles Mimefiles is an application (app) for Apple ipad devices that syncs files and attachments from messages within user s personal Archive. This includes messages that users have sent/received, as well as messages in Smart Tags that they have access to. Additional metadata connected to the file/attachment is also synced, including: sender, recipients, and the details of all messages containing the file. Once the app has been configured, a set of comprehensive filters is displayed on the left side of the screen that can be used to narrow down the list of files displayed in the right-hand pane. Alternatively, the user can search for a file name using the field at the top of the right-hand pane. As search text is typed in the search field, the listed results automatically update, and the results are paginated in blocks of 100. The total number of files found in the search is displayed in the top toolbar. 100 results are displayed at a time and to display more, simply scroll down and tap on the Load more... text. Note: All file information is physically stored on the device, however the file content is not stored locally unless it is marked as a Favourite. The filters in the left-hand pane allow the user to narrow down the list of files in the right-hand pane. Use the filters in conjunction with the search option, e.g. a domain filter can be used to search for a specific domain (domain.com), and then the filtered list can be searched for a file name. Multiple filters can be applied simultaneously to further reduce search results. Tap the image icon (e.g. opened in a new page. ) on the left side of one of the line items to open the file. The file is 46

50 Selecting an item in the list will display the metadata information in the lower panel. This includes details of messages from the archive that the file has been attached to, including the message body. A file may have been attached to one or more messages, and users can tap the envelope icon to view the content of the specific message. Tapping the star icon will tag the file as a Favourite. This file is then made available offline by storing the contents on your ipad. The icon is shaded once a file has been tagged as a Favourite, and can be tapped again to un-tag the file as a Favourite. Favourites are accessed using the My Folders filter. Files can be organized using folders. Tapping the folder icon will prompt the user to tag the file to be available in an existing folder, or to create a new folder. Folders can be accessed using the My Folders filter. IM Archive Mimecast Synchronization Engine (MSE) can be configured to archive historical Instant Message (IM) conversations within Microsoft Lync. Note: IM Archive must be enabled for the organization's Mimecast account in order to utilize the available functionality. Once the MSE site has been configured, an IM Archive Definition, Schedule and Task must be created to begin the archive process. Navigate to the Services IM Archive menu: 47